@oxygen-agent/cli 1.310.2 → 1.334.3

package/node_modules/@oxygen/shared/dist/sequences.d.ts

@@ -36,7 +36,7 @@ export type SequenceChannel = (typeof SEQUENCE_CHANNELS)[number];
  * a signal — it's resolved on demand by the dispatcher via a connection branch,
  * `condition: "already_connected"`.)
  */
-export declare const SEQUENCE_SIGNALS: readonly ["linkedin_connected", "linkedin_replied", "whatsapp_replied", "email_sent", "email_opened", "email_clicked", "email_replied", "email_bounced", "company_hiring", "company_raised_funds", "job_change", "new_hire", "web_visit", "intent"];
+export declare const SEQUENCE_SIGNALS: readonly ["linkedin_connected", "linkedin_replied", "whatsapp_replied", "email_sent", "email_opened", "email_clicked", "email_replied", "email_bounced", "meeting_booked", "email_unsubscribed", "company_hiring", "company_raised_funds", "job_change", "new_hire", "web_visit", "intent"];
 export type SequenceSignal = (typeof SEQUENCE_SIGNALS)[number];
 /**
  * Email engagement signals that ONLY arrive via the Instantly webhook
@@ -177,11 +177,26 @@ export type SequenceSendWindow = {
 export declare const MAX_STEP_VARIANTS = 26;
 /**
  * Metrics a step's opt-in auto-winner (A/B auto-optimize) can decide on. `reply`
- * is the only metric today — open/click require tracking domains (a gated,
- * separate capability), so the reversible auto-winner ships on reply first.
- */
-export declare const SEQUENCE_AUTO_OPTIMIZE_METRICS: readonly ["reply"];
+ * is the recommended default — it's the strongest intent signal and is produced
+ * natively on every channel. `click` and `open` are also supported, but ONLY on a
+ * sequence with native open/click tracking enabled (a verified tracking domain +
+ * per-sequence open/click toggles): the auto-winner counts opens/clicks from the
+ * native tracking-event stream, so without tracking those metrics have no data and
+ * are rejected at validation. `open` in particular is a soft signal — Apple Mail
+ * Privacy Protection pre-fetches pixels and inflates opens — so prefer `reply`.
+ * The two tracking-dependent metrics are named in SEQUENCE_TRACKING_DEPENDENT_METRICS.
+ */
+export declare const SEQUENCE_AUTO_OPTIMIZE_METRICS: readonly ["reply", "click", "open"];
 export type SequenceAutoOptimizeMetric = (typeof SEQUENCE_AUTO_OPTIMIZE_METRICS)[number];
+/**
+ * Auto-winner metrics whose conversion counts come ONLY from native open/click
+ * tracking (the /api/t/* pixel + link routes feeding the tracking-event stream).
+ * A step configuring one of these needs the sequence to have native tracking
+ * enabled, or the winner engine sees zero conversions and never decides — the
+ * auto-optimize validator rejects it with an actionable message. Mirrors
+ * SEQUENCE_NATIVE_UNTRACKED_SIGNALS on the signal side.
+ */
+export declare const SEQUENCE_TRACKING_DEPENDENT_METRICS: readonly ["click", "open"];
 /** Default send floor per variant before the auto-winner may decide. */
 export declare const DEFAULT_AUTO_OPTIMIZE_MIN_SENDS = 100;
 /** Default conversion (reply) floor per variant before the auto-winner may decide. */
@@ -235,7 +250,7 @@ export type SequenceLinkedInMessageStep = {
     variants?: {
         template?: string;
     }[];
-    /** Opt-in reversible auto-winner over the variants (reply metric). */
+    /** Opt-in reversible auto-winner over the variants (metric: reply | click | open; reply recommended). */
     auto_optimize?: SequenceAutoOptimizeConfig;
     /** Files attached to the message (≤ a few, fetched at dispatch). */
     attachments?: SequenceLinkedInAttachment[];
@@ -251,7 +266,7 @@ export type SequenceLinkedInInMailStep = {
         subject_template?: string;
         template?: string;
     }[];
-    /** Opt-in reversible auto-winner over the variants (reply metric). */
+    /** Opt-in reversible auto-winner over the variants (metric: reply | click | open; reply recommended). */
     auto_optimize?: SequenceAutoOptimizeConfig;
 };
 export type SequenceLinkedInFollowStep = {
@@ -323,7 +338,7 @@ export type SequenceEmailSendStep = {
         body_template?: string;
         body_html_template?: string;
     }[];
-    /** Opt-in reversible auto-winner over the variants (reply metric). */
+    /** Opt-in reversible auto-winner over the variants (metric: reply | click | open; reply recommended). */
     auto_optimize?: SequenceAutoOptimizeConfig;
     /** Per-step send window (overrides the sequence-level email_send_window). */
     send_window?: SequenceSendWindow;
@@ -345,7 +360,7 @@ export type SequenceEmailReplyStep = {
         body_template?: string;
         body_html_template?: string;
     }[];
-    /** Opt-in reversible auto-winner over the variants (reply metric). */
+    /** Opt-in reversible auto-winner over the variants (metric: reply | click | open; reply recommended). */
     auto_optimize?: SequenceAutoOptimizeConfig;
     /** Per-step send window (overrides the sequence-level email_send_window). */
     send_window?: SequenceSendWindow;
@@ -366,7 +381,7 @@ export type SequenceWhatsAppMessageStep = {
     variants?: {
         template?: string;
     }[];
-    /** Opt-in reversible auto-winner over the variants (reply metric). */
+    /** Opt-in reversible auto-winner over the variants (metric: reply | click | open; reply recommended). */
     auto_optimize?: SequenceAutoOptimizeConfig;
 };
 export type SequenceWaitStep = {
@@ -447,12 +462,38 @@ export type SequenceStopStep = {
     kind: "stop";
 };
 /**
- * A boolean expression over the signals an enrollment has accumulated. A leaf
- * tests whether a signal is present (default) or absent (present:false).
+ * A boolean expression a signal-branch routes on. Two leaf kinds, plus the
+ * all/any/not combinators:
+ * - a SIGNAL leaf `{ signal, present? }` tests whether an accumulated enrollment
+ *   signal is present (default) or absent (present:false).
+ * - a DATA leaf `{ has_column, present? }` tests whether the lead's source row
+ *   carries a non-empty value in the named row_values column — present (default)
+ *   or absent (present:false). This is the LinkedIn/Lemlist "does the lead have an
+ *   email / phone / … ?" branch: route by what data you HAVE about the lead,
+ *   evaluated synchronously against the enrollment's row_values (no signal, no
+ *   wait). A value counts as present when it is a non-empty trimmed string, or any
+ *   number / boolean; null / undefined / "" / whitespace count as absent.
+ *
+ * Lemlist condition-key → Oxygen mapping (13 keys), so a Lemlist journey ports
+ * across without a lossy translation table:
+ *   hasEmailAddress      → { has_column: "email" }   (or any SEQUENCE_EMAIL_COLUMN_KEYS key)
+ *   hasLinkedinUrl       → { has_column: "<linkedin url column>" }
+ *   hasPhoneNumber       → { has_column: "phone" }    (or any SEQUENCE_PHONE_COLUMN_KEYS key)
+ *   linkedinInviteAccepted → a CONNECTION branch (condition: "connection_accepted")
+ *   opened               → { signal: "email_opened" }
+ *   clicked              → { signal: "email_clicked" }
+ *   replied              → { signal: "email_replied" } (or linkedin_replied / whatsapp_replied)
+ *   meetingBooked        → { signal: "meeting_booked" }
+ *   emailsUnsubscribed   → { signal: "email_unsubscribed" }
+ *   aircallDone          → out of scope (no Aircall integration)
+ * Negate any leaf with present:false (e.g. "no email on file" = { has_column: "email", present: false }).
  */
 export type SequenceSignalCondition = {
     signal: SequenceSignal;
     present?: boolean;
+} | {
+    has_column: string;
+    present?: boolean;
 } | {
     all: SequenceSignalCondition[];
 } | {
@@ -527,10 +568,15 @@ export declare function renderSequenceTemplate(template: string, values: Record<
  */
 export declare function sequenceTemplateVariables(definition: SequenceDefinition): string[];
 /**
- * Evaluate a condition against the set of signals an enrollment has fired.
- * Used by the dispatch planner for branch steps. Pure.
+ * Evaluate a condition against an enrollment's accumulated signals AND (optionally)
+ * its source-row values. Used by the dispatch planner for branch steps. Pure.
+ *
+ * `rowValues` is optional and backward-compatible: when omitted (undefined), a data
+ * leaf ({ has_column }) evaluates as ABSENT — present:false matches, present:true
+ * does not — so an existing signal-only caller is unaffected. Signal leaves ignore
+ * rowValues entirely.
  */
-export declare function evaluateSequenceCondition(condition: SequenceSignalCondition, firedSignals: Iterable<string>): boolean;
+export declare function evaluateSequenceCondition(condition: SequenceSignalCondition, firedSignals: Iterable<string>, rowValues?: Record<string, unknown> | null): boolean;
 /** Variant label for an index: 0 → "a" (the base step), 1 → "b", … */
 export declare function sequenceVariantLabel(index: number): string;
 type StepVariantContent = Record<string, string>;

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -45,6 +45,14 @@ export const SEQUENCE_SIGNALS = [
     "email_clicked",
     "email_replied",
     "email_bounced",
+    // Outcome + lifecycle signals that CLOSE the Lemlist parity gap (its meetingBooked
+    // / emailsUnsubscribed keys). `meeting_booked` is recorded via the published
+    // `sequences signal` callable (a monitor, CRM sync, or human marks the meeting —
+    // no provider webhook). `email_unsubscribed` is recorded AUTOMATICALLY by the
+    // public one-click List-Unsubscribe webhook, folded onto the enrollment exactly
+    // like email_bounced. branch / wait_for_signal consume both like any other signal.
+    "meeting_booked",
+    "email_unsubscribed",
     // External GTM signals — recorded onto an enrollment by an Oxygen monitor,
     // enrichment column, or the published `sequences signal` callable (NOT a
     // provider webhook). branch / wait_for_signal consume these identically to
@@ -256,10 +264,28 @@ export function whatsAppAttendeeIdFromRow(rowValues, phoneColumnKey) {
 export const MAX_STEP_VARIANTS = 26;
 /**
  * Metrics a step's opt-in auto-winner (A/B auto-optimize) can decide on. `reply`
- * is the only metric today — open/click require tracking domains (a gated,
- * separate capability), so the reversible auto-winner ships on reply first.
+ * is the recommended default — it's the strongest intent signal and is produced
+ * natively on every channel. `click` and `open` are also supported, but ONLY on a
+ * sequence with native open/click tracking enabled (a verified tracking domain +
+ * per-sequence open/click toggles): the auto-winner counts opens/clicks from the
+ * native tracking-event stream, so without tracking those metrics have no data and
+ * are rejected at validation. `open` in particular is a soft signal — Apple Mail
+ * Privacy Protection pre-fetches pixels and inflates opens — so prefer `reply`.
+ * The two tracking-dependent metrics are named in SEQUENCE_TRACKING_DEPENDENT_METRICS.
  */
-export const SEQUENCE_AUTO_OPTIMIZE_METRICS = ["reply"];
+export const SEQUENCE_AUTO_OPTIMIZE_METRICS = ["reply", "click", "open"];
+/**
+ * Auto-winner metrics whose conversion counts come ONLY from native open/click
+ * tracking (the /api/t/* pixel + link routes feeding the tracking-event stream).
+ * A step configuring one of these needs the sequence to have native tracking
+ * enabled, or the winner engine sees zero conversions and never decides — the
+ * auto-optimize validator rejects it with an actionable message. Mirrors
+ * SEQUENCE_NATIVE_UNTRACKED_SIGNALS on the signal side.
+ */
+export const SEQUENCE_TRACKING_DEPENDENT_METRICS = ["click", "open"];
+function metricNeedsNativeTracking(metric) {
+    return SEQUENCE_TRACKING_DEPENDENT_METRICS.includes(metric);
+}
 /** Default send floor per variant before the auto-winner may decide. */
 export const DEFAULT_AUTO_OPTIMIZE_MIN_SENDS = 100;
 /** Default conversion (reply) floor per variant before the auto-winner may decide. */
@@ -432,6 +458,12 @@ function reportNativeEngagementGates(steps, issues) {
 function collectConditionSignals(condition, out) {
     if ("signal" in condition)
         out.add(condition.signal);
+    // A data leaf ({ has_column }) references a row_values column, not a signal, so
+    // it contributes nothing — and must be handled BEFORE the not-fallthrough below
+    // (which would otherwise read condition.not off a data leaf). This is also why
+    // the native-untracked engagement-gate walker never trips on a has_column branch.
+    else if ("has_column" in condition)
+        return;
     else if ("all" in condition)
         condition.all.forEach((c) => collectConditionSignals(c, out));
     else if ("any" in condition)
@@ -496,7 +528,7 @@ raw, index, options, issues) {
         case "message": {
             const template = requiredTemplate(raw.template, `${path}.template`, issues);
             const variants = normalizeVariants(raw.variants, `${path}.variants`, ["template"], issues);
-            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, issues);
+            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             const attachments = normalizeLinkedInAttachments(raw.attachments, `${path}.attachments`, issues);
             return {
                 id, channel: "linkedin", kind: "message", template: template ?? "",
@@ -509,7 +541,7 @@ raw, index, options, issues) {
             const subject = requiredTemplate(raw.subject_template, `${path}.subject_template`, issues);
             const template = requiredTemplate(raw.template, `${path}.template`, issues);
             const variants = normalizeVariants(raw.variants, `${path}.variants`, ["subject_template", "template"], issues);
-            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, issues);
+            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             return {
                 id, channel: "linkedin", kind: "inmail", subject_template: subject ?? "", template: template ?? "",
                 ...(variants ? { variants: variants } : {}),
@@ -534,7 +566,7 @@ raw, index, options, issues) {
             const body = requiredTemplate(raw.body_template, `${path}.body_template`, issues);
             const bodyHtml = optionalTemplate(raw.body_html_template, `${path}.body_html_template`, MAX_TEMPLATE_LENGTH, issues);
             const variants = normalizeVariants(raw.variants, `${path}.variants`, ["subject_template", "body_template", "body_html_template"], issues);
-            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, issues);
+            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             const cc = optionalEmailList(raw.cc, `${path}.cc`, issues);
             const bcc = optionalEmailList(raw.bcc, `${path}.bcc`, issues);
             const sendWindow = normalizeSendWindow(raw.send_window, `${path}.send_window`, issues);
@@ -552,7 +584,7 @@ raw, index, options, issues) {
             const body = requiredTemplate(raw.body_template, `${path}.body_template`, issues);
             const bodyHtml = optionalTemplate(raw.body_html_template, `${path}.body_html_template`, MAX_TEMPLATE_LENGTH, issues);
             const variants = normalizeVariants(raw.variants, `${path}.variants`, ["body_template", "body_html_template"], issues);
-            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, issues);
+            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             const cc = optionalEmailList(raw.cc, `${path}.cc`, issues);
             const bcc = optionalEmailList(raw.bcc, `${path}.bcc`, issues);
             const sendWindow = normalizeSendWindow(raw.send_window, `${path}.send_window`, issues);
@@ -571,7 +603,7 @@ raw, index, options, issues) {
         case "whatsapp_message": {
             const template = requiredTemplate(raw.template, `${path}.template`, issues);
             const variants = normalizeVariants(raw.variants, `${path}.variants`, ["template"], issues);
-            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, issues);
+            const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             return {
                 id, channel: "whatsapp", kind: "whatsapp_message", template: template ?? "",
                 ...(variants ? { variants: variants } : {}),
@@ -662,13 +694,22 @@ raw, index, options, issues) {
             };
         }
         case "comment_post": {
-            // ai_prompt (AI-generated comments) is a planned follow-up; today a
-            // comment_post step needs a text_template (with {{column}} interpolation).
-            const textTemplate = requiredTemplate(raw.text_template, `${path}.text_template`, issues);
+            // A comment step needs a comment source: a text_template ({{column}}
+            // interpolation), an ai_prompt (a KG-grounded comment generated at send
+            // time), or both — in which case ai_prompt generates and text_template is
+            // the fallback when generation fails. At least one is required.
+            const textTemplate = optionalTemplate(raw.text_template, `${path}.text_template`, MAX_TEMPLATE_LENGTH, issues);
+            const aiPrompt = optionalTemplate(raw.ai_prompt, `${path}.ai_prompt`, MAX_TEMPLATE_LENGTH, issues);
+            const hasText = typeof textTemplate === "string" && textTemplate.trim().length > 0;
+            const hasPrompt = typeof aiPrompt === "string" && aiPrompt.trim().length > 0;
+            if (!hasText && !hasPrompt) {
+                issues.push({ path, message: "comment_post requires at least one of text_template or ai_prompt." });
+            }
             const recency = optionalPostRecencyDays(raw.post_recency_days, `${path}.post_recency_days`, issues);
             return {
                 id, channel: "linkedin", kind: "comment_post",
-                text_template: textTemplate ?? "",
+                ...(hasText ? { text_template: textTemplate } : {}),
+                ...(hasPrompt ? { ai_prompt: aiPrompt } : {}),
                 ...(recency !== undefined ? { post_recency_days: recency } : {}),
                 ...(raw.on_no_post === "stop" ? { on_no_post: "stop" } : {}),
             };
@@ -753,6 +794,26 @@ function normalizeTargetRef(value, path, issues) {
     }
     return value;
 }
+/** Max length of a data-leaf column key — bounded like an identifier, not template-length. */
+const MAX_CONDITION_COLUMN_KEY_LENGTH = 128;
+/**
+ * Validate + normalize a data leaf's `has_column` row_values key: a non-empty
+ * string, trimmed, at most MAX_CONDITION_COLUMN_KEY_LENGTH chars. Unlike a step id
+ * it is NOT charset-restricted — a column key can carry spaces/capitals (e.g.
+ * "Email", "Work Email"). Returns the trimmed key, or undefined with an issue.
+ */
+function normalizeConditionColumnKey(value, path, issues) {
+    if (typeof value !== "string" || !value.trim()) {
+        issues.push({ path, message: "has_column must be a non-empty string (a row_values column key)." });
+        return undefined;
+    }
+    const key = value.trim();
+    if (key.length > MAX_CONDITION_COLUMN_KEY_LENGTH) {
+        issues.push({ path, message: `has_column must be at most ${MAX_CONDITION_COLUMN_KEY_LENGTH} characters.` });
+        return undefined;
+    }
+    return key;
+}
 function normalizeCondition(raw, path, issues, depth = 0) {
     if (depth > 6) {
         issues.push({ path, message: "condition nests too deeply." });
@@ -768,6 +829,12 @@ function normalizeCondition(raw, path, issues, depth = 0) {
             return undefined;
         return { signal, present: raw.present === false ? false : true };
     }
+    if (raw.has_column !== undefined) {
+        const key = normalizeConditionColumnKey(raw.has_column, `${path}.has_column`, issues);
+        if (!key)
+            return undefined;
+        return { has_column: key, present: raw.present === false ? false : true };
+    }
     if (Array.isArray(raw.all)) {
         return { all: normalizeConditionList(raw.all, `${path}.all`, issues, depth) };
     }
@@ -778,7 +845,7 @@ function normalizeCondition(raw, path, issues, depth = 0) {
         const inner = normalizeCondition(raw.not, `${path}.not`, issues, depth + 1);
         return inner ? { not: inner } : undefined;
     }
-    issues.push({ path, message: "condition must be {signal}, {all}, {any}, or {not}." });
+    issues.push({ path, message: "condition must be {signal}, {has_column}, {all}, {any}, or {not}." });
     return undefined;
 }
 function normalizeConditionList(raw, path, issues, depth) {
@@ -958,20 +1025,49 @@ export function sequenceTemplateVariables(definition) {
     return [...vars];
 }
 /**
- * Evaluate a condition against the set of signals an enrollment has fired.
- * Used by the dispatch planner for branch steps. Pure.
+ * Evaluate a condition against an enrollment's accumulated signals AND (optionally)
+ * its source-row values. Used by the dispatch planner for branch steps. Pure.
+ *
+ * `rowValues` is optional and backward-compatible: when omitted (undefined), a data
+ * leaf ({ has_column }) evaluates as ABSENT — present:false matches, present:true
+ * does not — so an existing signal-only caller is unaffected. Signal leaves ignore
+ * rowValues entirely.
  */
-export function evaluateSequenceCondition(condition, firedSignals) {
+export function evaluateSequenceCondition(condition, firedSignals, rowValues) {
     const fired = firedSignals instanceof Set ? firedSignals : new Set(firedSignals);
     if ("signal" in condition) {
         const present = fired.has(condition.signal);
         return condition.present === false ? !present : present;
     }
+    if ("has_column" in condition) {
+        const present = rowValueIsPresent(rowValues?.[condition.has_column]);
+        return condition.present === false ? !present : present;
+    }
     if ("all" in condition)
-        return condition.all.every((c) => evaluateSequenceCondition(c, fired));
+        return condition.all.every((c) => evaluateSequenceCondition(c, fired, rowValues));
     if ("any" in condition)
-        return condition.any.some((c) => evaluateSequenceCondition(c, fired));
-    return !evaluateSequenceCondition(condition.not, fired);
+        return condition.any.some((c) => evaluateSequenceCondition(c, fired, rowValues));
+    return !evaluateSequenceCondition(condition.not, fired, rowValues);
+}
+/**
+ * Whether a lead's row_values value counts as "present" for a data-leaf branch: a
+ * non-empty trimmed string, or any number (incl. 0) / boolean (incl. false), or a
+ * non-empty array / object. null / undefined / "" / whitespace-only → absent. Pure.
+ */
+function rowValueIsPresent(value) {
+    if (value === null || value === undefined)
+        return false;
+    if (typeof value === "string")
+        return value.trim().length > 0;
+    if (typeof value === "number")
+        return !Number.isNaN(value);
+    if (typeof value === "boolean")
+        return true;
+    if (Array.isArray(value))
+        return value.length > 0;
+    if (typeof value === "object")
+        return Object.keys(value).length > 0;
+    return true;
 }
 // ===== A/B variants =====
 const VARIANT_ALPHABET = "abcdefghijklmnopqrstuvwxyz";
@@ -1209,11 +1305,16 @@ const MAX_AUTO_OPTIMIZE_MIN_CONVERSIONS = 100_000;
  * Validate + normalize a step's optional `auto_optimize` config. Only meaningful
  * on a step that actually has A/B alternates (variants.length >= 1, i.e. ≥ 2 total
  * variants) — configuring it on a single-variant step is a dead knob, so reject
- * it. `metric` must be a supported metric (reply today); the thresholds default to
- * DEFAULT_AUTO_OPTIMIZE_* and must be positive integers within sane bounds.
- * Returns undefined when absent (field omitted).
+ * it. `metric` must be a supported metric (reply | click | open); the thresholds
+ * default to DEFAULT_AUTO_OPTIMIZE_* and must be positive integers within sane
+ * bounds. The tracking-dependent metrics (click/open) are rejected unless the
+ * sequence has native open/click tracking enabled (options.nativeTrackingEnabled)
+ * — the SAME gate the open/click SIGNAL validation uses — because the winner
+ * engine counts those conversions only from the native tracking-event stream, so
+ * without tracking they would always read zero and never decide. Returns undefined
+ * when absent (field omitted).
  */
-function normalizeAutoOptimize(raw, path, variants, issues) {
+function normalizeAutoOptimize(raw, path, variants, options, issues) {
     if (raw === undefined || raw === null)
         return undefined;
     if (!isRecord(raw)) {
@@ -1229,6 +1330,16 @@ function normalizeAutoOptimize(raw, path, variants, issues) {
         issues.push({ path: `${path}.metric`, message: `metric must be one of: ${SEQUENCE_AUTO_OPTIMIZE_METRICS.join(", ")}.` });
         return undefined;
     }
+    // Tracking gate: click/open conversions come only from native open/click
+    // tracking. Reject them when the sequence has no native tracking, naming the
+    // prerequisite — reply stays available and is the recommended default.
+    if (metricNeedsNativeTracking(metric) && !options.nativeTrackingEnabled) {
+        issues.push({
+            path: `${path}.metric`,
+            message: `metric '${metric}' needs native open/click tracking, which is not enabled for this sequence — turn on a verified tracking domain and per-sequence open/click tracking (see 'oxygen domains tracking'), or use metric 'reply' (the recommended default; opens are soft signals under Apple Mail Privacy Protection).`,
+        });
+        return undefined;
+    }
     const minSends = raw.min_sends_per_variant === undefined || raw.min_sends_per_variant === null
         ? DEFAULT_AUTO_OPTIMIZE_MIN_SENDS
         : positiveInt(raw.min_sends_per_variant, `${path}.min_sends_per_variant`, issues) ?? DEFAULT_AUTO_OPTIMIZE_MIN_SENDS;

package/node_modules/@oxygen/shared/dist/sql-error.d.ts

@@ -20,6 +20,14 @@ export type SqlErrorAttribution = {
     constraint: string | null;
     /** Neon/HTTP transport status code (numeric) when the failure carries one. */
     statusCode: number | null;
+    /**
+     * pg's `detail` for deadlocks (40P01) ONLY: the waits-for lock chain
+     * ("Process A waits for ...; blocked by process B."), which names processes,
+     * transactions, and lock modes — never customer row values — and is the only
+     * way to attribute which statements deadlocked. Every other SQLSTATE keeps
+     * the blanket OXY-38 detail ban (unique-violation details embed row values).
+     */
+    deadlockDetail: string | null;
 };
 /** Log-field shape (snake_case) for merging into `errorFields(error)` payloads. */
 export declare function sqlErrorFields(error: unknown): Record<string, unknown>;
@@ -45,5 +53,22 @@ export declare function redactSqlParameters(text: string): string;
  * 40001/40P01 knowledge lives in one place. Never throws.
  */
 export declare function isRetryableConcurrencyError(error?: unknown): boolean;
+/**
+ * True when a write lost a concurrency race and is safe to re-read / retry: a
+ * serialization (40001) or deadlock (40P01) transaction abort, OR the XX000
+ * catalog race Postgres reports as "tuple concurrently updated". The SQLSTATE
+ * classifier deliberately maps the latter to `internal` (it is NOT a
+ * transaction-abort code), so `isRetryableConcurrencyError` misses it and it is
+ * matched by message here — the dual test the tenant-migration bookkeeping write
+ * and the role-grant apply both need.
+ *
+ * Both the SQLSTATE and the message are read through the `Error.cause` chain, so
+ * this stays correct when the error is a drizzle `DrizzleQueryError` — which
+ * nests the real pg error on `.cause` and replaces the top-level message with
+ * `Failed query: <sql>`. A top-level-only read (the pre-consolidation apps/web +
+ * tenant-db copies) was structurally blind to every drizzle-wrapped conflict
+ * (OXY-4148). Never throws.
+ */
+export declare function isConcurrentWriteConflictError(error?: unknown): boolean;
 /** Telemetry-attribute shape (dotted keys) for span error attribution. */
 export declare function sqlErrorTelemetryAttributes(error: unknown): Record<string, unknown>;

package/node_modules/@oxygen/shared/dist/sql-error.js

@@ -84,6 +84,7 @@ function describeSqlError(error) {
         // or transport status codes — safe to surface. We deliberately do NOT read
         // pg's `detail`, `hint`, or `where`: those embed customer row values (e.g.
         // "Key (email)=(a@b.com) already exists") and would leak data (OXY-38).
+        // Single carve-out: 40P01 deadlock detail (see readDeadlockDetail).
         return {
             pgCode: sqlstate,
             cause,
@@ -95,6 +96,7 @@ function describeSqlError(error) {
             column: readIdentifierField(error, "column"),
             constraint: readIdentifierField(error, "constraint"),
             statusCode: readStatusCode(error),
+            deadlockDetail: sqlstate === "40P01" ? readDeadlockDetail(error) : null,
         };
     }
     catch {
@@ -130,6 +132,7 @@ export function sqlErrorFields(error) {
         ...(attribution.column ? { sql_error_column: attribution.column } : {}),
         ...(attribution.constraint ? { sql_error_constraint: attribution.constraint } : {}),
         ...(attribution.statusCode !== null ? { sql_error_status: attribution.statusCode } : {}),
+        ...(attribution.deadlockDetail ? { sql_error_detail: attribution.deadlockDetail } : {}),
     };
 }
 /**
@@ -161,6 +164,32 @@ export function isRetryableConcurrencyError(error) {
     const cause = describeSqlError(error)?.cause;
     return cause === "serialization" || cause === "deadlock";
 }
+/**
+ * True when a write lost a concurrency race and is safe to re-read / retry: a
+ * serialization (40001) or deadlock (40P01) transaction abort, OR the XX000
+ * catalog race Postgres reports as "tuple concurrently updated". The SQLSTATE
+ * classifier deliberately maps the latter to `internal` (it is NOT a
+ * transaction-abort code), so `isRetryableConcurrencyError` misses it and it is
+ * matched by message here — the dual test the tenant-migration bookkeeping write
+ * and the role-grant apply both need.
+ *
+ * Both the SQLSTATE and the message are read through the `Error.cause` chain, so
+ * this stays correct when the error is a drizzle `DrizzleQueryError` — which
+ * nests the real pg error on `.cause` and replaces the top-level message with
+ * `Failed query: <sql>`. A top-level-only read (the pre-consolidation apps/web +
+ * tenant-db copies) was structurally blind to every drizzle-wrapped conflict
+ * (OXY-4148). Never throws.
+ */
+export function isConcurrentWriteConflictError(error) {
+    return isRetryableConcurrencyError(error) || causeChainMessageIncludes(error, "tuple concurrently updated");
+}
+// Walk the Error.cause chain and report whether any message in it contains the
+// needle. drizzle buries the driver's message on `.cause.message` (its own
+// top-level message is `Failed query: ...`), so a single-level `.message` read
+// misses "tuple concurrently updated" once the error is wrapped.
+function causeChainMessageIncludes(error, needle) {
+    return (readCauseChain(error, (obj) => typeof obj.message === "string" && obj.message.includes(needle) ? true : null) === true);
+}
 /** Telemetry-attribute shape (dotted keys) for span error attribution. */
 export function sqlErrorTelemetryAttributes(error) {
     const attribution = describeSqlError(error);
@@ -264,6 +293,23 @@ function readIdentifierField(error, key) {
         return typeof value === "string" && isSafeIdentifier(value) ? value : null;
     });
 }
+// pg's deadlock (40P01) detail is the waits-for lock chain: "Process 123 waits
+// for ShareLock on transaction 456; blocked by process 789." — process ids,
+// transaction ids, and lock modes only, never customer row values. That chain
+// is the only client-visible attribution of WHICH statements deadlocked, so it
+// is surfaced as the single exception to the OXY-38 detail ban. Defence in
+// depth: only accepted when the text actually matches the waits-for shape (an
+// unexpected driver payload is dropped) and capped in length.
+const DEADLOCK_DETAIL_SHAPE = /^process \d+ waits for /i;
+const DEADLOCK_DETAIL_MAX_LENGTH = 600;
+function readDeadlockDetail(error) {
+    return readCauseChain(error, (obj) => {
+        const value = obj.detail;
+        return typeof value === "string" && DEADLOCK_DETAIL_SHAPE.test(value)
+            ? value.slice(0, DEADLOCK_DETAIL_MAX_LENGTH)
+            : null;
+    });
+}
 function readSeverity(error) {
     return readCauseChain(error, (obj) => {
         const value = obj.severity;

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const OXYGEN_VERSION = "1.310.2";
+export declare const OXYGEN_VERSION = "1.334.3";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
-export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.298.0";
+export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.310.2";
+export const OXYGEN_VERSION = "1.334.3";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:
@@ -20,20 +20,22 @@ export const OXYGEN_VERSION = "1.310.2";
 // (see MANAGED_INBOX_MINIMUM_CLI_VERSION). A per-route floor fails one command
 // safely; a global floor fails the whole product. OXY-4091.
 //
-// 1.181.0: paid table action runs and background columns run require
+// 1.328.1: paid table action runs and background columns run require
 // approved=true in addition to max_credits; older CLIs cannot send the flag.
-// 1.154.0: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
+// 1.328.1: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
 // (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and
 // removed the old /api/cli/linkedin/* routes — older CLIs would 404.
 export const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 // Per-surface floor for the whitelabel/managed-inbox purchase path, enforced only
 // by /api/cli/managed-inboxes/subscribe.
 //
-// 1.298.0: whitelabel inbox subscribe moved from Oxygen credits to a USD-billed
-// Stripe subscription. Older CLIs send `zapshield` (gone), omit the registrant
-// address the registrar now requires, and read `credits_required` from a preview
-// that no longer returns it — so they would mis-render the price of a PAID order.
-// Refusing them is right; refusing them EVERYWHERE was not. This shipped as a
-// 117-minor raise of the global floor inside an unrelated feature commit and armed
-// a product-wide lockout that nothing would have caught before prod (OXY-4091).
-export const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.298.0";
+// 1.326.2: Pricing Model 2.0 (2026-07-14) moved whitelabel inbox subscribe from the
+// USD Stripe rail back to Oxygen credits: the preview now returns
+// monthly_credits/one_off_credits and the approved execute RESERVES credits instead
+// of creating a Stripe subscription. An older CLI mis-renders the price/shape of a
+// PAID order (and would misread the reserved-not-charged response), so it is refused
+// on THIS route only. The floor lags one release per OXY-4091: the 1.326.2 CLI
+// publishes from the 1.326.x prod deploy, and this floor rides the 1.330.0 release —
+// so it can never exceed npm's newest CLI. (1.298.0 was the prior credits→Stripe
+// contract move.) Do NOT raise the global OXYGEN_MINIMUM_CLI_VERSION for this.
+export const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/workflow-mcp-tools.d.ts

@@ -0,0 +1,4 @@
+export declare const WORKFLOW_MCP_TOOL_PREFIX = "oxygen_workflow_";
+export declare const MAX_MCP_TOOL_NAME_LENGTH = 64;
+export declare function workflowMcpToolName(slug: string): string;
+export declare function workflowMcpToolNameExceedsLimit(slug: string): boolean;

package/node_modules/@oxygen/shared/dist/workflow-mcp-tools.js

@@ -0,0 +1,18 @@
+// The MCP tool a workflow published via `oxygen workflows mcp enable` appears as
+// to MCP clients — the "Clay Functions" dynamic-tool pattern. The slug is used
+// verbatim (hyphens preserved). This is the single canonical name builder,
+// shared by the mcp-server selector, the CLI, and the web routes so the tool
+// name can never drift between the surface that publishes it, the surface that
+// lists it, and the surface that dispatches it.
+export const WORKFLOW_MCP_TOOL_PREFIX = "oxygen_workflow_";
+// MCP tool names are capped at 64 chars. A slug long enough to push
+// `oxygen_workflow_<slug>` past this is SKIPPED from tools/list (never truncated:
+// a truncated name would collide across distinct slugs and dispatch to the wrong
+// workflow).
+export const MAX_MCP_TOOL_NAME_LENGTH = 64;
+export function workflowMcpToolName(slug) {
+    return `${WORKFLOW_MCP_TOOL_PREFIX}${slug}`;
+}
+export function workflowMcpToolNameExceedsLimit(slug) {
+    return workflowMcpToolName(slug).length > MAX_MCP_TOOL_NAME_LENGTH;
+}