@oxygen-agent/cli 1.365.3 → 1.575.19

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -1,5 +1,5 @@
 import { OxygenError } from "./cli-result.js";
-import { hashVariantKey, renderTemplate, templateColumnKeys, } from "./sequence-template.js";
+import { hashVariantKey, renderTemplate, spintaxSyntaxIssues, templateColumnKeys, } from "./sequence-template.js";
 /**
  * Multichannel sequence DSL — the shared contract validated identically by CLI,
  * MCP, API, and web. A sequence is an ordered list of steps applied to each
@@ -28,7 +28,7 @@ import { hashVariantKey, renderTemplate, templateColumnKeys, } from "./sequence-
  * and inbox rotation while Oxygen owns the cross-channel timeline + reply
  * suppression.
  */
-export const SEQUENCE_CHANNELS = ["linkedin", "email", "whatsapp"];
+export const SEQUENCE_CHANNELS = ["linkedin", "email", "whatsapp", "call", "crm"];
 /**
  * Signals an enrollment accumulates from provider webhooks. wait_for_signal gates
  * and signal-branch conditions read these. linkedin_connected also advances the
@@ -53,6 +53,15 @@ export const SEQUENCE_SIGNALS = [
     // like email_bounced. branch / wait_for_signal consume both like any other signal.
     "meeting_booked",
     "email_unsubscribed",
+    // Call outcomes, recorded when a rep dispositions a call_task. Unlike a reply,
+    // NONE of these is terminal: "no answer" is the common case and the sequence is
+    // expected to continue (email follow-up, retry later), so a branch can route on
+    // them and later steps still run. call_connected covers every disposition where
+    // a live conversation happened, including negative ones — the enrollment should
+    // take the "we spoke to them" arm whether the answer was yes or no.
+    "call_connected",
+    "call_no_answer",
+    "call_voicemail",
     // External GTM signals — recorded onto an enrollment by an Oxygen monitor,
     // enrichment column, or the published `sequences signal` callable (NOT a
     // provider webhook). branch / wait_for_signal consume these identically to
@@ -80,6 +89,33 @@ export const SEQUENCE_NATIVE_UNTRACKED_SIGNALS = ["email_opened", "email_clicked
 function isNativeUntrackedSignal(value) {
     return SEQUENCE_NATIVE_UNTRACKED_SIGNALS.includes(value);
 }
+/**
+ * Signals that ALWAYS terminalize the enrollment the moment they fire, so no
+ * later step can ever observe them. A reply on any channel unconditionally stops
+ * the replying lead's enrollment (`status: 'replied'`, reason `lead_replied` —
+ * see the LinkedIn / WhatsApp / email inbound paths), and the one-click
+ * List-Unsubscribe webhook stops it too (`unsubscribed_one_click`).
+ *
+ * They are still RECORDED on the enrollment (analytics, the timeline, and the
+ * reply-rate rollups all read them), but a branch or wait_for_signal gated on one
+ * is dead code: the enrollment is already terminal when the signal lands, so the
+ * gate always times out / always takes the `else` arm. The builder therefore does
+ * not offer them as branch or gate conditions — reply-stop is built in.
+ */
+export const SEQUENCE_TERMINAL_SIGNALS = [
+    "linkedin_replied",
+    "whatsapp_replied",
+    "email_replied",
+    "email_unsubscribed",
+];
+export function isTerminalSequenceSignal(value) {
+    return SEQUENCE_TERMINAL_SIGNALS.includes(value);
+}
+/**
+ * The signals a branch / wait_for_signal condition can meaningfully read — every
+ * signal except the terminal ones above. This is what authoring surfaces offer.
+ */
+export const SEQUENCE_BRANCHABLE_SIGNALS = SEQUENCE_SIGNALS.filter((signal) => !isTerminalSequenceSignal(signal));
 /** External GTM signals (the non-engagement subset of SEQUENCE_SIGNALS). */
 export const SEQUENCE_EXTERNAL_SIGNALS = [
     "company_hiring",
@@ -106,8 +142,12 @@ export const SEQUENCE_EMAIL_COLUMN_KEYS = ["email", "email_address", "work_email
  * complaint loop (the address a bounce/opt-out suppresses), so they can't drift.
  * Returns the trimmed raw value (callers normalize/lowercase as needed) or null.
  */
-export function recipientEmailFromRow(rowValues) {
-    for (const key of SEQUENCE_EMAIL_COLUMN_KEYS) {
+export function recipientEmailFromRow(rowValues, emailColumnKey) {
+    // An explicit per-sequence email column (settings.email_column_key) wins so a
+    // non-English / non-standard header (e.g. "E-Mail") resolves; the built-in
+    // English keys stay as fallbacks when no column is mapped.
+    const keys = emailColumnKey ? [emailColumnKey, ...SEQUENCE_EMAIL_COLUMN_KEYS] : [...SEQUENCE_EMAIL_COLUMN_KEYS];
+    for (const key of keys) {
         const value = rowValues?.[key];
         if (typeof value === "string" && value.includes("@"))
             return value.trim();
@@ -119,14 +159,19 @@ export function recipientEmailFromRow(rowValues) {
  * Deliverability lore: a send lands better when the SENDING mailbox and the
  * RECIPIENT sit on the same provider (Google→Google, Microsoft→Microsoft), so at
  * mailbox-pick the dispatcher can bias rotation toward a same-ESP mailbox.
- *   - "off"    — no ESP bias (default); rotation is pure LRU / domain-spread.
- *   - "prefer" — pick a same-ESP mailbox when one is available, else fall back to
- *     any sendable mailbox (never blocks a send).
+ *   - "off"    — no ESP bias; rotation is pure LRU / domain-spread.
+ *   - "prefer" — (DEFAULT) pick a same-ESP mailbox when one is available, else
+ *     fall back to any sendable mailbox (never blocks a send). On by default
+ *     because it only ever improves deliverability and cannot starve sends.
  *   - "strict" — require a same-ESP mailbox; when none is available the action is
  *     DEFERRED with a visible skipped_reason rather than sent cross-provider.
+ *     Power-user setting, reachable via CLI/MCP; the web "Provider Matching"
+ *     checkbox toggles off↔prefer only.
  */
 export const ESP_MATCHING_MODES = ["off", "prefer", "strict"];
-export const DEFAULT_ESP_MATCHING_MODE = "off";
+// Provider Matching is ON by default (prefer): a same-provider send lands better,
+// and prefer never blocks — an absent setting biases mailbox pick without risk.
+export const DEFAULT_ESP_MATCHING_MODE = "prefer";
 export function isEspMatchingMode(value) {
     return typeof value === "string" && ESP_MATCHING_MODES.includes(value);
 }
@@ -145,14 +190,111 @@ export function validateEspMatchingSetting(value) {
     }
 }
 /**
- * The email-provider FAMILY a recipient (or sending mailbox) routes through. Kept
- * intentionally aligned with EMAIL_MAILBOX_PROVIDERS in tenant-db so a mailbox's
- * `provider` and an inferred recipient ESP compare directly.
+ * The MATCHABLE email-provider a recipient routes through — the narrow set ESP
+ * matching can act on. Kept intentionally aligned with EMAIL_MAILBOX_PROVIDERS in
+ * tenant-db so a mailbox's `provider` and a resolved recipient ESP compare
+ * directly: we can only bias rotation toward a provider we can actually SEND
+ * from, and the pool is Google/Microsoft only.
+ *
+ * This is deliberately NARROWER than RECIPIENT_ESP_FAMILIES (what we DISPLAY).
+ * A domain behind Proofpoint has family "proofpoint" but may still be matchable
+ * as "microsoft" — see resolveEspFamily.
  */
 export const RECIPIENT_ESPS = ["google", "microsoft"];
-/** Consumer domains that deterministically route to Google / Microsoft mail. */
-const GOOGLE_CONSUMER_DOMAINS = new Set(["gmail.com", "googlemail.com"]);
-const MICROSOFT_CONSUMER_DOMAINS = new Set(["outlook.com", "hotmail.com", "live.com", "msn.com"]);
+/**
+ * The DISPLAY taxonomy: the mail-infrastructure family a recipient domain sits
+ * on. Wider than RecipientEsp because "everything that isn't Google or Microsoft"
+ * is not one thing — a list that is 23% Proofpoint is a very different
+ * deliverability problem from one that is 23% self-hosted, and collapsing both to
+ * null (today's behavior) hides that. Split into three groups:
+ *
+ *   - MAILBOX providers (google, microsoft) — imply a matchable ESP.
+ *   - GATEWAY vendors (proofpoint, mimecast, ...) — security filters that sit IN
+ *     FRONT of a mailbox provider. Their MX tells you the filter, NOT where the
+ *     mailbox lives; the SPF fallback is what sees behind them.
+ *   - OTHER mailbox hosts (zoho, yahoo, fastmail, ...) and self_hosted — real
+ *     destinations we simply cannot send as, so never matchable.
+ */
+export const RECIPIENT_ESP_FAMILIES = [
+    "google",
+    "microsoft",
+    "proofpoint",
+    "mimecast",
+    "barracuda",
+    "cisco",
+    "zscaler",
+    "trendmicro",
+    "sophos",
+    "zoho",
+    "yahoo",
+    "apple",
+    "proton",
+    "fastmail",
+    "gmx",
+    "amazon",
+    "self_hosted",
+];
+export function isRecipientEspFamily(value) {
+    return typeof value === "string" && RECIPIENT_ESP_FAMILIES.includes(value);
+}
+/**
+ * Families that are inbound SECURITY GATEWAYS rather than mailbox hosts. Seeing
+ * one in MX means the real mailbox provider is hidden behind it, so the resolver
+ * must fall through to the SPF signal instead of concluding "not Google/Microsoft".
+ * This is the single most important distinction in this file: treating a
+ * Proofpoint MX as "no known ESP" is how a Microsoft-hosted list silently loses
+ * ESP matching.
+ */
+const GATEWAY_FAMILIES = new Set([
+    "proofpoint",
+    "mimecast",
+    "barracuda",
+    "cisco",
+    "zscaler",
+    "trendmicro",
+    "sophos",
+]);
+export function isEspGatewayFamily(family) {
+    return family !== null && family !== undefined && GATEWAY_FAMILIES.has(family);
+}
+/**
+ * The matchable ESP a display family implies, or null when the family is a
+ * gateway (unknown until SPF) or a provider we cannot send as. The ONLY place
+ * family → esp is decided, so display and matching can't drift.
+ */
+export function matchableEspFromFamily(family) {
+    if (family === "google" || family === "microsoft")
+        return family;
+    return null;
+}
+/**
+ * Consumer/freemail domains that resolve deterministically from the domain string
+ * with NO network call. Only google/microsoft are matchable; the rest are display
+ * families (a list heavy on these is a list-quality signal worth surfacing).
+ */
+const CONSUMER_DOMAIN_FAMILIES = new Map([
+    ["gmail.com", "google"],
+    ["googlemail.com", "google"],
+    ["outlook.com", "microsoft"],
+    ["hotmail.com", "microsoft"],
+    ["live.com", "microsoft"],
+    ["msn.com", "microsoft"],
+    ["yahoo.com", "yahoo"],
+    ["yahoo.co.uk", "yahoo"],
+    ["ymail.com", "yahoo"],
+    ["aol.com", "yahoo"],
+    ["icloud.com", "apple"],
+    ["me.com", "apple"],
+    ["mac.com", "apple"],
+    ["proton.me", "proton"],
+    ["protonmail.com", "proton"],
+    ["pm.me", "proton"],
+    ["fastmail.com", "fastmail"],
+    ["zoho.com", "zoho"],
+    ["gmx.com", "gmx"],
+    ["gmx.de", "gmx"],
+    ["web.de", "gmx"],
+]);
 /**
  * Normalize a recipient domain: lowercase, trim, drop a trailing FQDN dot, and if
  * a full address is passed take the part after the last '@'. Returns "" for junk.
@@ -167,32 +309,57 @@ function normalizeRecipientDomain(domain) {
     return d.replace(/\.+$/, "");
 }
 /**
- * Infer a recipient's ESP from its email domain, DETERMINISTICALLY, for the
- * well-known consumer domains (gmail/googlemail → google; outlook/hotmail/live/
- * msn → microsoft). Returns null for any other domain — the caller then resolves
- * the ESP via a cached MX lookup (custom domains fronted by Google Workspace /
- * Microsoft 365 aren't decidable from the domain string alone). Pure and
- * side-effect-free so it's the single source of truth for the deterministic map.
+ * Does `host` sit at or under `suffix`? Requires a DOT boundary, so "google.com"
+ * matches "aspmx.l.google.com" and itself but NOT "notgoogle.com" — a bare
+ * endsWith() would map an unrelated lookalike domain onto a real ESP family and,
+ * under strict matching, route a send at the wrong pool.
  */
-export function inferRecipientEsp(domain) {
-    const d = normalizeRecipientDomain(domain);
-    if (!d)
-        return null;
-    if (GOOGLE_CONSUMER_DOMAINS.has(d))
-        return "google";
-    if (MICROSOFT_CONSUMER_DOMAINS.has(d))
-        return "microsoft";
-    return null;
+function hostMatchesSuffix(host, suffix) {
+    return host === suffix || host.endsWith(`.${suffix}`);
 }
 /**
- * Map a domain's resolved MX exchange hostnames to an ESP family, for the MX-cache
- * path (custom domains on Google Workspace / Microsoft 365). Google MX hosts end
- * in `google.com` / `googlemail.com` (e.g. aspmx.l.google.com); Microsoft 365 MX
- * hosts end in `outlook.com` / `protection.outlook.com` (e.g.
- * acme-com.mail.protection.outlook.com). Returns null when no host matches either
- * family. Pure so both the resolver and its tests share one mapping.
+ * MX exchange-host suffix → display family, most specific first. Every entry is
+ * the vendor's own mail-routing domain (what shows up in a real MX answer):
+ * Google Workspace publishes aspmx.l.google.com, Microsoft 365 publishes
+ * <tenant>.mail.protection.outlook.com, Proofpoint pphosted.com, and so on.
  */
-export function espFromMxHosts(hosts) {
+const MX_FAMILY_SUFFIXES = [
+    ["protection.outlook.com", "microsoft"],
+    ["outlook.com", "microsoft"],
+    ["google.com", "google"],
+    ["googlemail.com", "google"],
+    ["pphosted.com", "proofpoint"],
+    ["ppe-hosted.com", "proofpoint"],
+    ["mimecast.com", "mimecast"],
+    ["mimecast.co.za", "mimecast"],
+    ["mimecast-offshore.com", "mimecast"],
+    ["barracudanetworks.com", "barracuda"],
+    ["barracuda.com", "barracuda"],
+    ["iphmx.com", "cisco"],
+    ["cisco.com", "cisco"],
+    ["zscaler.net", "zscaler"],
+    ["zscalerthree.net", "zscaler"],
+    ["trendmicro.com", "trendmicro"],
+    ["trendmicro.eu", "trendmicro"],
+    ["sophos.com", "sophos"],
+    ["zoho.com", "zoho"],
+    ["zoho.eu", "zoho"],
+    ["yahoodns.net", "yahoo"],
+    ["icloud.com", "apple"],
+    ["protonmail.ch", "proton"],
+    ["proton.me", "proton"],
+    ["messagingengine.com", "fastmail"],
+    ["gmx.net", "gmx"],
+    ["amazonaws.com", "amazon"],
+    ["awsapps.com", "amazon"],
+];
+/**
+ * Map a domain's resolved MX exchange hostnames to a DISPLAY family. Returns null
+ * when no host matches any known vendor — the caller records that as
+ * "self_hosted" only once it is sure the lookup itself succeeded (an empty/failed
+ * answer is "unknown", which is a different fact).
+ */
+export function familyFromMxHosts(hosts) {
     if (!Array.isArray(hosts))
         return null;
     for (const raw of hosts) {
@@ -201,13 +368,92 @@ export function espFromMxHosts(hosts) {
         const host = raw.trim().toLowerCase().replace(/\.+$/, "");
         if (!host)
             continue;
-        if (host.endsWith("google.com") || host.endsWith("googlemail.com"))
-            return "google";
-        if (host.endsWith("outlook.com") || host.endsWith("protection.outlook.com"))
-            return "microsoft";
+        for (const [suffix, family] of MX_FAMILY_SUFFIXES) {
+            if (hostMatchesSuffix(host, suffix))
+                return family;
+        }
     }
     return null;
 }
+/**
+ * SPF `include:` targets that identify the ESP a domain SENDS through — the
+ * signal that sees behind an inbound security gateway. An org filtering inbound
+ * mail through Proofpoint still relays its own outbound via Microsoft 365, and
+ * says so in SPF, so this recovers a matchable ESP that MX alone cannot.
+ */
+const SPF_INCLUDE_ESPS = [
+    ["spf.protection.outlook.com", "microsoft"],
+    ["spf.protection.office365.us", "microsoft"],
+    ["_spf.google.com", "google"],
+    ["_spf.googlemail.com", "google"],
+    ["aspmx.googlemail.com", "google"],
+];
+/**
+ * Resolve the matchable ESP from a domain's TXT records by reading its SPF
+ * mechanisms. Scans every `v=spf1` record's include:/redirect= targets.
+ *
+ * AMBIGUITY IS NOT GUESSED: a domain mid-migration (or running Workspace
+ * alongside an Office tenant) can include BOTH vendors. Returning either one
+ * would be a coin flip that strict matching then acts on, so a both-match
+ * degrades to null ("unknown") and the caller falls back / defers honestly.
+ */
+export function espFromSpfRecords(records) {
+    if (!Array.isArray(records))
+        return null;
+    const found = new Set();
+    for (const raw of records) {
+        if (typeof raw !== "string")
+            continue;
+        const record = raw.trim().toLowerCase().replace(/^"|"$/g, "");
+        if (!record.startsWith("v=spf1"))
+            continue;
+        for (const term of record.split(/\s+/)) {
+            const target = term.startsWith("include:")
+                ? term.slice("include:".length)
+                : term.startsWith("redirect=")
+                    ? term.slice("redirect=".length)
+                    : null;
+            if (!target)
+                continue;
+            const host = target.replace(/\.+$/, "");
+            for (const [suffix, esp] of SPF_INCLUDE_ESPS) {
+                if (hostMatchesSuffix(host, suffix))
+                    found.add(esp);
+            }
+        }
+    }
+    return found.size === 1 ? [...found][0] : null;
+}
+/**
+ * Infer a recipient's DISPLAY family from its domain string alone,
+ * DETERMINISTICALLY, for the well-known consumer/freemail domains. Returns null
+ * for any other domain — the caller then resolves via the cached MX (+ SPF)
+ * lookup, because a custom domain fronted by Workspace / M365 / a gateway is not
+ * decidable from the string. Pure: the single source of truth for the map.
+ */
+export function inferRecipientEspFamily(domain) {
+    const d = normalizeRecipientDomain(domain);
+    if (!d)
+        return null;
+    return CONSUMER_DOMAIN_FAMILIES.get(d) ?? null;
+}
+/**
+ * Infer a recipient's MATCHABLE ESP from its domain string. Narrow by design:
+ * only the Google/Microsoft consumer domains resolve here, everything else
+ * (including yahoo/proton/icloud, which are real but unsendable-as) is null.
+ * Unchanged contract — the dispatcher's fast path still calls this.
+ */
+export function inferRecipientEsp(domain) {
+    return matchableEspFromFamily(inferRecipientEspFamily(domain));
+}
+/**
+ * Back-compat narrow view of familyFromMxHosts: MX hosts → matchable ESP. Now
+ * derived from the family table so the two can't drift, and gateway MX hosts
+ * correctly yield null here (they need the SPF signal to become matchable).
+ */
+export function espFromMxHosts(hosts) {
+    return matchableEspFromFamily(familyFromMxHosts(hosts));
+}
 /**
  * row_values keys an enrollment's phone number may live under, in
  * send-precedence order, for WhatsApp sends. The enroll path resolves the FIRST
@@ -252,6 +498,66 @@ export function whatsAppAttendeeIdFromRow(rowValues, phoneColumnKey) {
     }
     return null;
 }
+/**
+ * Normalize a raw phone number to strict E.164 (`+` then 2-15 digits, no leading
+ * zero) for the CALL channel. Deliberately stricter than
+ * whatsAppAttendeeIdForPhone, which accepts any 7-15 bare digits: on WhatsApp a
+ * bad guess fails an API call, but on the phone it rings a real stranger.
+ *
+ * Rules — anything ambiguous returns null rather than guessing:
+ *   - already "+…"                      -> strip separators, validate, keep.
+ *   - 10 bare digits                    -> NANP national number, prefix "+1".
+ *   - 11 bare digits starting with "1"  -> NANP with country code, prefix "+".
+ *   - anything else                     -> null.
+ *
+ * SCOPE: bare (non-"+") input is completed ONLY for the NANP, where the national
+ * number is always exactly 10 digits. Every other country has a variable national
+ * length (UK 10, Germany 6-11, …), so a bare string genuinely cannot be resolved
+ * to one number — those callers must supply full E.164. That matches v1, which
+ * provisions US/Canada numbers only.
+ *
+ * When international dialing lands, replace this with libphonenumber-js rather
+ * than extending the heuristic — per-country national-number rules are a lookup
+ * table, not something to hand-roll against live prospects.
+ */
+export function callPhoneForLead(phone) {
+    const trimmed = phone.trim();
+    if (!trimmed)
+        return null;
+    const hasPlus = trimmed.startsWith("+");
+    const digits = trimmed.replace(/[^\d]/g, "");
+    if (!digits)
+        return null;
+    if (hasPlus) {
+        return /^[1-9]\d{1,14}$/.test(digits) ? `+${digits}` : null;
+    }
+    if (digits.length === 10)
+        return `+1${digits}`;
+    if (digits.length === 11 && digits.startsWith("1"))
+        return `+${digits}`;
+    // No "+" and not a NANP shape: the country code is unknowable. Returning null
+    // makes the dispatcher skip the step rather than dial a guess.
+    return null;
+}
+/**
+ * Resolve a lead's dialable E.164 number from its row_values, reusing the SAME
+ * column precedence WhatsApp uses (SEQUENCE_PHONE_COLUMN_KEYS) so the two phone
+ * channels can never disagree about which column holds the number.
+ */
+export function callPhoneFromRow(rowValues, phoneColumnKey) {
+    if (!rowValues)
+        return null;
+    const keys = phoneColumnKey ? [phoneColumnKey, ...SEQUENCE_PHONE_COLUMN_KEYS] : [...SEQUENCE_PHONE_COLUMN_KEYS];
+    for (const key of keys) {
+        const value = rowValues[key];
+        if (typeof value === "string" && value.trim()) {
+            const normalized = callPhoneForLead(value);
+            if (normalized)
+                return normalized;
+        }
+    }
+    return null;
+}
 /**
  * Base content + up to this many alternates per A/B step (base counts as
  * variant "a", so the ceiling is "a"–"z" — Instantly-class A/Z testing).
@@ -309,12 +615,29 @@ export const SEQUENCE_STEP_KINDS = [
     "email_stop",
     // whatsapp channel (native dispatch via Unipile)
     "whatsapp_message",
+    // call channel — the ONLY step whose executor is a human. It enqueues an
+    // ox_sequencer.call_tasks row and parks the enrollment on a call signal; a rep
+    // dialing and dispositioning is what resumes it. Nothing is sent, nothing is
+    // metered, and no provider is touched at plan time.
+    "call_task",
+    // CRM channel — creates an inspectable task in a connected CRM. The step
+    // contract is provider-neutral; HubSpot is the first enabled adapter.
+    "crm_task",
     // control (channel-agnostic)
     "wait",
     "wait_for_signal",
     "branch",
     "stop",
 ];
+// ---- CRM-channel steps (external writes through a connected CRM) ----
+export const SEQUENCE_CRM_TASK_PROVIDERS = ["hubspot"];
+export const SEQUENCE_CRM_IDENTITY_KINDS = [
+    "provider_id",
+    "email",
+    "domain",
+    "linkedin_url",
+    "exact",
+];
 /**
  * Conditions a connection branch routes on. Both need live LinkedIn access, so
  * the dispatcher (not the planner) resolves them over time:
@@ -327,6 +650,14 @@ export const SEQUENCE_CONNECTION_BRANCH_CONDITIONS = ["connection_accepted", "al
 const MAX_SEQUENCE_STEPS = 50;
 const MAX_TEMPLATE_LENGTH = 8_000;
 const MAX_NOTE_LENGTH = 300;
+const MAX_CRM_TASK_PROPERTIES = 100;
+const MAX_CRM_TASK_ASSOCIATIONS = 20;
+const MAX_CRM_RECORD_MAPPINGS = 10;
+const MAX_CRM_RECORD_IDENTITIES = 10;
+const MAX_CRM_RECORD_LINKS = 20;
+const MAX_CRM_MAPPING_KEY_LENGTH = 128;
+const MAX_CRM_RELATIVE_TIME_MINUTES = 525_600;
+const FORBIDDEN_CRM_MAPPING_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 /** Cap on step Cc/Bcc recipients — a handful of fixed addresses (e.g. an AE, a CRM drop), not a list. */
 const MAX_STEP_EMAIL_RECIPIENTS = 10;
 const ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
@@ -344,6 +675,64 @@ export function sequenceChannels(definition) {
     }
     return [...channels];
 }
+/**
+ * Steps that still have empty copy — the launch gate for definitions stored
+ * stored under `draft`. Empty means nothing to send, so starting would
+ * either dispatch a blank message or fail per lead at send time.
+ */
+export function sequenceStepsMissingCopy(steps) {
+    const missing = [];
+    const check = (step, field, value) => {
+        if (typeof value !== "string" || !value.trim())
+            missing.push({ stepId: step.id, kind: step.kind, field });
+    };
+    for (const step of steps) {
+        switch (step.kind) {
+            case "message":
+            case "whatsapp_message":
+                check(step, "template", step.template);
+                break;
+            case "inmail":
+                check(step, "subject_template", step.subject_template);
+                check(step, "template", step.template);
+                break;
+            case "email_send":
+                check(step, "subject_template", step.subject_template);
+                check(step, "body_template", step.body_template);
+                break;
+            case "email_reply":
+                check(step, "body_template", step.body_template);
+                break;
+            case "crm_task":
+                for (const [property, mapping] of Object.entries(step.property_mappings)) {
+                    if (mapping.source === "template") {
+                        check(step, `property_mappings.${property}.template`, mapping.template);
+                    }
+                }
+                for (const [recordRef, record] of Object.entries(step.record_mappings ?? {})) {
+                    for (const [index, identity] of record.identities.entries()) {
+                        if (identity.value.source === "template") {
+                            check(step, `record_mappings.${recordRef}.identities[${index}].value.template`, identity.value.template);
+                        }
+                    }
+                    for (const [property, mapping] of Object.entries(record.property_mappings)) {
+                        if (mapping.source === "template") {
+                            check(step, `record_mappings.${recordRef}.property_mappings.${property}.template`, mapping.template);
+                        }
+                    }
+                }
+                for (const [index, association] of (step.associations ?? []).entries()) {
+                    if (association.object_id?.source === "template") {
+                        check(step, `associations[${index}].object_id.template`, association.object_id.template);
+                    }
+                }
+                break;
+            default:
+                break;
+        }
+    }
+    return missing;
+}
 /**
  * Validate + normalize a raw sequence definition. Assigns stable ids to steps
  * that omit one (s{index}), verifies branch/gate targets resolve, and enforces
@@ -352,7 +741,7 @@ export function sequenceChannels(definition) {
  */
 export function validateSequenceDefinition(input, options = {}) {
     const issues = [];
-    const rawSteps = collectSteps(input, issues);
+    const rawSteps = collectSteps(input, options, issues);
     // Pass 1: normalize each step + assign ids.
     const normalized = [];
     const usedIds = new Set();
@@ -471,14 +860,16 @@ function collectConditionSignals(condition, out) {
     else
         collectConditionSignals(condition.not, out);
 }
-function collectSteps(input, issues) {
+function collectSteps(input, options, issues) {
     const record = isRecord(input) ? input : null;
     const steps = record?.steps;
     if (!Array.isArray(steps)) {
         issues.push({ path: "steps", message: "steps must be an array." });
         return [];
     }
-    if (steps.length === 0) {
+    // A draft may be empty: a new sequence starts blank, and deleting the last step
+    // is a normal edit. Launch is where a sequence must actually have something.
+    if (steps.length === 0 && options.draft !== true) {
         issues.push({ path: "steps", message: "A sequence needs at least one step." });
     }
     if (steps.length > MAX_SEQUENCE_STEPS) {
@@ -526,8 +917,8 @@ raw, index, options, issues) {
             };
         }
         case "message": {
-            const template = requiredTemplate(raw.template, `${path}.template`, issues);
-            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["template"], issues);
+            const template = requiredTemplate(raw.template, `${path}.template`, issues, options.draft === true);
+            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["template"], issues, options.draft === true);
             const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             const attachments = normalizeLinkedInAttachments(raw.attachments, `${path}.attachments`, issues);
             return {
@@ -538,9 +929,9 @@ raw, index, options, issues) {
             };
         }
         case "inmail": {
-            const subject = requiredTemplate(raw.subject_template, `${path}.subject_template`, issues);
-            const template = requiredTemplate(raw.template, `${path}.template`, issues);
-            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["subject_template", "template"], issues);
+            const subject = requiredTemplate(raw.subject_template, `${path}.subject_template`, issues, options.draft === true);
+            const template = requiredTemplate(raw.template, `${path}.template`, issues, options.draft === true);
+            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["subject_template", "template"], issues, options.draft === true);
             const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             return {
                 id, channel: "linkedin", kind: "inmail", subject_template: subject ?? "", template: template ?? "",
@@ -562,10 +953,10 @@ raw, index, options, issues) {
             return { id, channel: "email", kind: "email_move", subsequence_id: subsequenceId ?? "" };
         }
         case "email_send": {
-            const subject = requiredTemplate(raw.subject_template, `${path}.subject_template`, issues);
-            const body = requiredTemplate(raw.body_template, `${path}.body_template`, issues);
+            const subject = requiredTemplate(raw.subject_template, `${path}.subject_template`, issues, options.draft === true);
+            const body = requiredTemplate(raw.body_template, `${path}.body_template`, issues, options.draft === true);
             const bodyHtml = optionalTemplate(raw.body_html_template, `${path}.body_html_template`, MAX_TEMPLATE_LENGTH, issues);
-            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["subject_template", "body_template", "body_html_template"], issues);
+            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["subject_template", "body_template", "body_html_template"], issues, options.draft === true);
             const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             const cc = optionalEmailList(raw.cc, `${path}.cc`, issues);
             const bcc = optionalEmailList(raw.bcc, `${path}.bcc`, issues);
@@ -581,9 +972,9 @@ raw, index, options, issues) {
             };
         }
         case "email_reply": {
-            const body = requiredTemplate(raw.body_template, `${path}.body_template`, issues);
+            const body = requiredTemplate(raw.body_template, `${path}.body_template`, issues, options.draft === true);
             const bodyHtml = optionalTemplate(raw.body_html_template, `${path}.body_html_template`, MAX_TEMPLATE_LENGTH, issues);
-            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["body_template", "body_html_template"], issues);
+            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["body_template", "body_html_template"], issues, options.draft === true);
             const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             const cc = optionalEmailList(raw.cc, `${path}.cc`, issues);
             const bcc = optionalEmailList(raw.bcc, `${path}.bcc`, issues);
@@ -601,8 +992,8 @@ raw, index, options, issues) {
         case "email_stop":
             return { id, channel: "email", kind: "email_stop" };
         case "whatsapp_message": {
-            const template = requiredTemplate(raw.template, `${path}.template`, issues);
-            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["template"], issues);
+            const template = requiredTemplate(raw.template, `${path}.template`, issues, options.draft === true);
+            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["template"], issues, options.draft === true);
             const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             return {
                 id, channel: "whatsapp", kind: "whatsapp_message", template: template ?? "",
@@ -610,6 +1001,67 @@ raw, index, options, issues) {
                 ...(autoOptimize ? { auto_optimize: autoOptimize } : {}),
             };
         }
+        case "call_task": {
+            // `note` is talking points for the rep, never transmitted, so it is
+            // optional and unvalidated for emptiness — unlike message copy, a blank one
+            // cannot produce a bad send.
+            const note = typeof raw.note === "string" ? raw.note : undefined;
+            const priority = raw.priority === undefined || raw.priority === null
+                ? undefined
+                : positiveInt(raw.priority, `${path}.priority`, issues) ?? undefined;
+            const timeoutDays = raw.timeout_days === undefined || raw.timeout_days === null
+                ? 3
+                : positiveInt(raw.timeout_days, `${path}.timeout_days`, issues) ?? 3;
+            return {
+                id,
+                channel: "call",
+                kind: "call_task",
+                ...(note !== undefined ? { note } : {}),
+                ...(priority !== undefined ? { priority } : {}),
+                timeout_days: timeoutDays,
+                // Defaults to "continue", the opposite of wait_for_signal's "stop". A
+                // human failing to get to the queue is an operational fact, not a signal
+                // the lead is uninterested — killing the enrollment because nobody dialed
+                // would silently drop leads whenever the team gets busy.
+                on_timeout: raw.on_timeout === "stop" ? "stop" : "continue",
+            };
+        }
+        case "crm_task": {
+            const provider = typeof raw.provider === "string"
+                && SEQUENCE_CRM_TASK_PROVIDERS.includes(raw.provider)
+                ? raw.provider
+                : "hubspot";
+            if (raw.provider !== undefined
+                && (!(typeof raw.provider === "string")
+                    || !SEQUENCE_CRM_TASK_PROVIDERS.includes(raw.provider))) {
+                issues.push({
+                    path: `${path}.provider`,
+                    message: `provider must be one of: ${SEQUENCE_CRM_TASK_PROVIDERS.join(", ")}.`,
+                });
+            }
+            const connectionId = optionalString(raw.connection_id, `${path}.connection_id`, issues);
+            const propertyMappings = normalizeCrmTaskPropertyMappings(raw.property_mappings, `${path}.property_mappings`, issues, options.draft === true);
+            const recordMappings = normalizeCrmRecordMappings(raw.record_mappings, `${path}.record_mappings`, issues, options.draft === true);
+            const recordLinks = normalizeCrmRecordLinks(raw.record_links, `${path}.record_links`, recordMappings, issues);
+            const associations = normalizeCrmTaskAssociations(raw.associations, `${path}.associations`, recordMappings, issues, options.draft === true);
+            if (provider === "hubspot" && !Object.hasOwn(propertyMappings, "hs_timestamp")) {
+                issues.push({
+                    path: `${path}.property_mappings.hs_timestamp`,
+                    message: "HubSpot CRM tasks require an hs_timestamp mapping for the due date.",
+                });
+            }
+            return {
+                id,
+                channel: "crm",
+                kind: "crm_task",
+                provider,
+                ...(connectionId !== undefined ? { connection_id: connectionId } : {}),
+                property_mappings: propertyMappings,
+                ...(recordMappings ? { record_mappings: recordMappings } : {}),
+                ...(recordLinks ? { record_links: recordLinks } : {}),
+                ...(associations ? { associations } : {}),
+            };
+        }
         case "wait": {
             const days = optionalNonNegativeInt(raw.days, `${path}.days`, issues);
             const hours = optionalNonNegativeInt(raw.hours, `${path}.hours`, issues);
@@ -767,8 +1219,395 @@ function channelForKind(kind) {
         return "email";
     if (kind === "whatsapp_message")
         return "whatsapp";
+    if (kind === "call_task")
+        return "call";
+    if (kind === "crm_task")
+        return "crm";
     return "linkedin";
 }
+function normalizeCrmTaskPropertyMappings(raw, path, issues, draft, requireNonEmpty = true) {
+    if (!isRecord(raw)) {
+        issues.push({ path, message: "property_mappings must be an object keyed by CRM property internal name." });
+        return {};
+    }
+    const entries = Object.entries(raw);
+    if (requireNonEmpty && entries.length === 0) {
+        issues.push({ path, message: "property_mappings must contain at least one CRM property." });
+    }
+    if (entries.length > MAX_CRM_TASK_PROPERTIES) {
+        issues.push({ path, message: `property_mappings may contain at most ${MAX_CRM_TASK_PROPERTIES} properties.` });
+    }
+    const mappings = {};
+    for (const [rawKey, value] of entries.slice(0, MAX_CRM_TASK_PROPERTIES)) {
+        const key = rawKey.trim();
+        const keyPath = `${path}.${rawKey}`;
+        if (!key
+            || key.length > MAX_CRM_MAPPING_KEY_LENGTH
+            || !/^[A-Za-z0-9_.-]+$/.test(key)
+            || FORBIDDEN_CRM_MAPPING_KEYS.has(key)) {
+            issues.push({
+                path: keyPath,
+                message: `CRM property names must be safe keys matching [A-Za-z0-9_.-]{1,${MAX_CRM_MAPPING_KEY_LENGTH}}.`,
+            });
+            continue;
+        }
+        const mapping = normalizeCrmTaskValueMapping(value, keyPath, issues, draft);
+        if (mapping)
+            mappings[key] = mapping;
+    }
+    return mappings;
+}
+function normalizeCrmTaskValueMapping(raw, path, issues, draft) {
+    if (!isRecord(raw) || typeof raw.source !== "string") {
+        issues.push({
+            path,
+            message: "mapping must use source literal, row, template, or relative_time.",
+        });
+        return null;
+    }
+    switch (raw.source) {
+        case "literal": {
+            const value = raw.value;
+            if (typeof value !== "string"
+                && typeof value !== "number"
+                && typeof value !== "boolean") {
+                issues.push({ path: `${path}.value`, message: "literal value must be a string, number, or boolean." });
+                return null;
+            }
+            if (typeof value === "number" && !Number.isFinite(value)) {
+                issues.push({ path: `${path}.value`, message: "literal number must be finite." });
+                return null;
+            }
+            if (typeof value === "string" && value.length > MAX_TEMPLATE_LENGTH) {
+                issues.push({ path: `${path}.value`, message: `literal string may be at most ${MAX_TEMPLATE_LENGTH} characters.` });
+            }
+            return { source: "literal", value: value };
+        }
+        case "row": {
+            const key = typeof raw.key === "string" ? raw.key.trim() : "";
+            if (!key || key.length > MAX_CRM_MAPPING_KEY_LENGTH) {
+                issues.push({ path: `${path}.key`, message: `row key must be 1-${MAX_CRM_MAPPING_KEY_LENGTH} characters.` });
+            }
+            return { source: "row", key };
+        }
+        case "template": {
+            const template = requiredTemplate(raw.template, `${path}.template`, issues, draft);
+            return { source: "template", template: template ?? "" };
+        }
+        case "relative_time": {
+            const offset = optionalNonNegativeInt(raw.offset_minutes, `${path}.offset_minutes`, issues);
+            if (offset === undefined || offset > MAX_CRM_RELATIVE_TIME_MINUTES) {
+                if (raw.offset_minutes === undefined || raw.offset_minutes === null) {
+                    issues.push({
+                        path: `${path}.offset_minutes`,
+                        message: "offset_minutes is required.",
+                    });
+                }
+                else if (offset !== undefined) {
+                    issues.push({
+                        path: `${path}.offset_minutes`,
+                        message: `offset_minutes may be at most ${MAX_CRM_RELATIVE_TIME_MINUTES}.`,
+                    });
+                }
+                return null;
+            }
+            return { source: "relative_time", offset_minutes: offset };
+        }
+        default:
+            issues.push({
+                path: `${path}.source`,
+                message: "source must be one of: literal, row, template, relative_time.",
+            });
+            return null;
+    }
+}
+function normalizeCrmRecordMappings(raw, path, issues, draft) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (!isRecord(raw)) {
+        issues.push({ path, message: "record_mappings must be an object keyed by a local record reference." });
+        return undefined;
+    }
+    const entries = Object.entries(raw);
+    if (entries.length > MAX_CRM_RECORD_MAPPINGS) {
+        issues.push({ path, message: `record_mappings may contain at most ${MAX_CRM_RECORD_MAPPINGS} records.` });
+    }
+    const mappings = {};
+    for (const [rawRef, rawMapping] of entries.slice(0, MAX_CRM_RECORD_MAPPINGS)) {
+        const ref = rawRef.trim();
+        const entryPath = `${path}.${rawRef}`;
+        if (!isSafeCrmKey(ref)) {
+            issues.push({
+                path: entryPath,
+                message: `record reference must be a safe key matching [A-Za-z0-9_.-]{1,${MAX_CRM_MAPPING_KEY_LENGTH}}.`,
+            });
+            continue;
+        }
+        if (!isRecord(rawMapping)) {
+            issues.push({ path: entryPath, message: "record mapping must be an object." });
+            continue;
+        }
+        const objectType = typeof rawMapping.object_type === "string"
+            ? rawMapping.object_type.trim()
+            : "";
+        if (!isSafeCrmKey(objectType)) {
+            issues.push({
+                path: `${entryPath}.object_type`,
+                message: `object_type must match [A-Za-z0-9_.-]{1,${MAX_CRM_MAPPING_KEY_LENGTH}}.`,
+            });
+        }
+        const identities = normalizeCrmRecordIdentities(rawMapping.identities, `${entryPath}.identities`, issues, draft);
+        const propertyMappings = normalizeCrmTaskPropertyMappings(rawMapping.property_mappings ?? {}, `${entryPath}.property_mappings`, issues, draft, false);
+        const onMissing = rawMapping.on_missing === "create"
+            ? "create"
+            : "fail";
+        if (rawMapping.on_missing !== undefined
+            && rawMapping.on_missing !== null
+            && rawMapping.on_missing !== "fail"
+            && rawMapping.on_missing !== "create") {
+            issues.push({
+                path: `${entryPath}.on_missing`,
+                message: "on_missing must be fail or create.",
+            });
+        }
+        const onMatch = rawMapping.on_match === "update"
+            ? "update"
+            : "reuse";
+        if (rawMapping.on_match !== undefined
+            && rawMapping.on_match !== null
+            && rawMapping.on_match !== "reuse"
+            && rawMapping.on_match !== "update") {
+            issues.push({
+                path: `${entryPath}.on_match`,
+                message: "on_match must be reuse or update.",
+            });
+        }
+        mappings[ref] = {
+            object_type: objectType,
+            identities,
+            property_mappings: propertyMappings,
+            on_missing: onMissing,
+            on_match: onMatch,
+        };
+    }
+    return Object.keys(mappings).length > 0 ? mappings : undefined;
+}
+function normalizeCrmRecordIdentities(raw, path, issues, draft) {
+    if (!Array.isArray(raw) || raw.length === 0) {
+        issues.push({
+            path,
+            message: "identities must contain at least one exact provider_id, email, domain, linkedin_url, or exact mapping.",
+        });
+        return [];
+    }
+    if (raw.length > MAX_CRM_RECORD_IDENTITIES) {
+        issues.push({ path, message: `identities may contain at most ${MAX_CRM_RECORD_IDENTITIES} entries.` });
+    }
+    const identities = [];
+    const seen = new Set();
+    raw.slice(0, MAX_CRM_RECORD_IDENTITIES).forEach((entry, index) => {
+        const entryPath = `${path}[${index}]`;
+        if (!isRecord(entry)) {
+            issues.push({ path: entryPath, message: "identity mapping must be an object." });
+            return;
+        }
+        const kind = typeof entry.kind === "string"
+            && SEQUENCE_CRM_IDENTITY_KINDS.includes(entry.kind)
+            ? entry.kind
+            : null;
+        if (!kind) {
+            issues.push({
+                path: `${entryPath}.kind`,
+                message: `kind must be one of: ${SEQUENCE_CRM_IDENTITY_KINDS.join(", ")}.`,
+            });
+            return;
+        }
+        const property = typeof entry.property === "string" ? entry.property.trim() : "";
+        if (kind === "provider_id") {
+            if (property) {
+                issues.push({
+                    path: `${entryPath}.property`,
+                    message: "provider_id identities do not use a property.",
+                });
+            }
+        }
+        else if (!isSafeCrmKey(property)) {
+            issues.push({
+                path: `${entryPath}.property`,
+                message: `identity property must be a safe key matching [A-Za-z0-9_.-]{1,${MAX_CRM_MAPPING_KEY_LENGTH}}.`,
+            });
+        }
+        const value = normalizeCrmTaskValueMapping(entry.value, `${entryPath}.value`, issues, draft);
+        if (value?.source === "relative_time") {
+            issues.push({
+                path: `${entryPath}.value.source`,
+                message: "record identities cannot use relative_time.",
+            });
+            return;
+        }
+        const dedupeKey = `${kind}:${property.toLowerCase()}`;
+        if (seen.has(dedupeKey)) {
+            issues.push({
+                path: entryPath,
+                message: "duplicate identity kind/property mappings are not allowed.",
+            });
+            return;
+        }
+        seen.add(dedupeKey);
+        if (value) {
+            identities.push({
+                kind,
+                ...(kind !== "provider_id" ? { property } : {}),
+                value,
+            });
+        }
+    });
+    return identities;
+}
+function normalizeCrmRecordLinks(raw, path, recordMappings, issues) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (!Array.isArray(raw)) {
+        issues.push({ path, message: "record_links must be an array." });
+        return undefined;
+    }
+    if (raw.length > MAX_CRM_RECORD_LINKS) {
+        issues.push({ path, message: `record_links may contain at most ${MAX_CRM_RECORD_LINKS} links.` });
+    }
+    const links = [];
+    const seen = new Set();
+    raw.slice(0, MAX_CRM_RECORD_LINKS).forEach((entry, index) => {
+        const entryPath = `${path}[${index}]`;
+        if (!isRecord(entry)) {
+            issues.push({ path: entryPath, message: "record link must be an object." });
+            return;
+        }
+        const fromRecord = typeof entry.from_record === "string" ? entry.from_record.trim() : "";
+        const toRecord = typeof entry.to_record === "string" ? entry.to_record.trim() : "";
+        if (!recordMappings?.[fromRecord]) {
+            issues.push({ path: `${entryPath}.from_record`, message: "from_record must reference record_mappings." });
+        }
+        if (!recordMappings?.[toRecord]) {
+            issues.push({ path: `${entryPath}.to_record`, message: "to_record must reference record_mappings." });
+        }
+        if (fromRecord && fromRecord === toRecord) {
+            issues.push({ path: entryPath, message: "record link cannot point a record at itself." });
+        }
+        const dedupeKey = `${fromRecord}:${toRecord}`;
+        if (seen.has(dedupeKey)) {
+            issues.push({ path: entryPath, message: "duplicate record link." });
+            return;
+        }
+        seen.add(dedupeKey);
+        const associationTypeId = entry.association_type_id === undefined || entry.association_type_id === null
+            ? undefined
+            : positiveInt(entry.association_type_id, `${entryPath}.association_type_id`, issues);
+        const associationCategory = normalizeCrmAssociationCategory(entry.association_category, `${entryPath}.association_category`, issues);
+        if (recordMappings?.[fromRecord] && recordMappings[toRecord] && fromRecord !== toRecord) {
+            links.push({
+                from_record: fromRecord,
+                to_record: toRecord,
+                ...(associationTypeId !== undefined ? { association_type_id: associationTypeId } : {}),
+                ...(associationCategory ? { association_category: associationCategory } : {}),
+            });
+        }
+    });
+    return links.length > 0 ? links : undefined;
+}
+function normalizeCrmTaskAssociations(raw, path, recordMappings, issues, draft) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (!Array.isArray(raw)) {
+        issues.push({ path, message: "associations must be an array." });
+        return undefined;
+    }
+    if (raw.length > MAX_CRM_TASK_ASSOCIATIONS) {
+        issues.push({ path, message: `associations may contain at most ${MAX_CRM_TASK_ASSOCIATIONS} records.` });
+    }
+    const associations = [];
+    raw.slice(0, MAX_CRM_TASK_ASSOCIATIONS).forEach((entry, index) => {
+        const entryPath = `${path}[${index}]`;
+        if (!isRecord(entry)) {
+            issues.push({ path: entryPath, message: "association must be an object." });
+            return;
+        }
+        const recordRef = typeof entry.record_ref === "string" ? entry.record_ref.trim() : "";
+        const objectType = typeof entry.object_type === "string" ? entry.object_type.trim() : "";
+        const hasObjectId = entry.object_id !== undefined && entry.object_id !== null;
+        if ((recordRef ? 1 : 0) + (hasObjectId ? 1 : 0) !== 1) {
+            issues.push({
+                path: entryPath,
+                message: "association must set exactly one of record_ref or object_id.",
+            });
+        }
+        if (recordRef && !recordMappings?.[recordRef]) {
+            issues.push({
+                path: `${entryPath}.record_ref`,
+                message: "record_ref must reference record_mappings.",
+            });
+        }
+        if (!recordRef && !isSafeCrmKey(objectType)) {
+            issues.push({
+                path: `${entryPath}.object_type`,
+                message: `object_type must match [A-Za-z0-9_.-]{1,${MAX_CRM_MAPPING_KEY_LENGTH}}.`,
+            });
+        }
+        else if (objectType && !isSafeCrmKey(objectType)) {
+            issues.push({
+                path: `${entryPath}.object_type`,
+                message: `object_type must match [A-Za-z0-9_.-]{1,${MAX_CRM_MAPPING_KEY_LENGTH}}.`,
+            });
+        }
+        const objectId = hasObjectId
+            ? normalizeCrmTaskValueMapping(entry.object_id, `${entryPath}.object_id`, issues, draft)
+            : null;
+        if (objectId?.source === "relative_time") {
+            issues.push({
+                path: `${entryPath}.object_id.source`,
+                message: "association object_id must use literal, row, or template (not relative_time).",
+            });
+        }
+        const associationTypeId = entry.association_type_id === undefined || entry.association_type_id === null
+            ? undefined
+            : positiveInt(entry.association_type_id, `${entryPath}.association_type_id`, issues);
+        const associationCategory = normalizeCrmAssociationCategory(entry.association_category, `${entryPath}.association_category`, issues);
+        if (recordRef && recordMappings?.[recordRef]) {
+            associations.push({
+                record_ref: recordRef,
+                ...(objectType ? { object_type: objectType } : {}),
+                ...(associationTypeId !== undefined ? { association_type_id: associationTypeId } : {}),
+                ...(associationCategory ? { association_category: associationCategory } : {}),
+            });
+        }
+        else if (objectId && objectId.source !== "relative_time") {
+            associations.push({
+                object_type: objectType,
+                object_id: objectId,
+                ...(associationTypeId !== undefined ? { association_type_id: associationTypeId } : {}),
+                ...(associationCategory ? { association_category: associationCategory } : {}),
+            });
+        }
+    });
+    return associations.length > 0 ? associations : undefined;
+}
+function normalizeCrmAssociationCategory(raw, path, issues) {
+    if (raw === undefined || raw === null || raw === "HUBSPOT_DEFINED") {
+        return "HUBSPOT_DEFINED";
+    }
+    if (raw === "USER_DEFINED")
+        return "USER_DEFINED";
+    issues.push({
+        path,
+        message: "association_category must be HUBSPOT_DEFINED or USER_DEFINED.",
+    });
+    return undefined;
+}
+function isSafeCrmKey(value) {
+    return Boolean(value
+        && value.length <= MAX_CRM_MAPPING_KEY_LENGTH
+        && /^[A-Za-z0-9_.-]+$/.test(value)
+        && !FORBIDDEN_CRM_MAPPING_KEYS.has(value));
+}
 function normalizeId(value, index, path, issues) {
     if (value === undefined || value === null)
         return `s${index}`;
@@ -860,8 +1699,11 @@ function normalizeConditionList(raw, path, issues, depth) {
     });
     return out;
 }
-function requiredTemplate(value, path, issues) {
-    if (typeof value !== "string" || !value.trim()) {
+function requiredTemplate(value, path, issues, 
+// Drafts may hold copy the user has not written yet — see the `draft` option.
+// The field must still BE a string; only emptiness is forgiven.
+allowEmpty = false) {
+    if (typeof value !== "string" || (!value.trim() && !allowEmpty)) {
         issues.push({ path, message: "is required and must be a non-empty string." });
         return undefined;
     }
@@ -869,6 +1711,8 @@ function requiredTemplate(value, path, issues) {
         issues.push({ path, message: `must be at most ${MAX_TEMPLATE_LENGTH} characters.` });
         return undefined;
     }
+    for (const issue of spintaxSyntaxIssues(value))
+        issues.push({ path, message: issue });
     return value;
 }
 function optionalTemplate(value, path, maxLength, issues) {
@@ -882,6 +1726,8 @@ function optionalTemplate(value, path, maxLength, issues) {
         issues.push({ path, message: `must be at most ${maxLength} characters.` });
         return undefined;
     }
+    for (const issue of spintaxSyntaxIssues(value))
+        issues.push({ path, message: issue });
     return value;
 }
 /**
@@ -992,7 +1838,8 @@ export function sequenceWaitStepDelayWithJitterMs(step, enrollmentId) {
 /**
  * Render a sequence-copy template against a row's values. Delegates to the shared
  * deterministic engine (sequence-template.ts): `{{column}}` substitution plus
- * `{{column|fallback}}`, `{{RANDOM|…}}` spintax, and `{% if … %}` conditionals.
+ * `{{column|fallback}}`, `{{RANDOM|…}}` and bare `{a|b|c}` spintax (nestable), and
+ * `{% if … %}` conditionals.
  * Pass `{ seed }` to make spintax choices replayable across retries/crash-replays.
  */
 export function renderSequenceTemplate(template, values, options) {
@@ -1015,6 +1862,36 @@ export function sequenceTemplateVariables(definition) {
     for (const step of definition.steps) {
         if (step.kind === "invite")
             scan(step.note_template);
+        if (step.kind === "crm_task") {
+            for (const mapping of Object.values(step.property_mappings)) {
+                if (mapping.source === "template")
+                    scan(mapping.template);
+                if (mapping.source === "row")
+                    vars.add(mapping.key);
+            }
+            for (const record of Object.values(step.record_mappings ?? {})) {
+                for (const identity of record.identities) {
+                    if (identity.value.source === "template")
+                        scan(identity.value.template);
+                    if (identity.value.source === "row")
+                        vars.add(identity.value.key);
+                }
+                for (const mapping of Object.values(record.property_mappings)) {
+                    if (mapping.source === "template")
+                        scan(mapping.template);
+                    if (mapping.source === "row")
+                        vars.add(mapping.key);
+                }
+            }
+            for (const association of step.associations ?? []) {
+                if (!association.object_id)
+                    continue;
+                if (association.object_id.source === "template")
+                    scan(association.object_id.template);
+                if (association.object_id.source === "row")
+                    vars.add(association.object_id.key);
+            }
+        }
         // Scan base + every A/B variant's copy so a column referenced only in a
         // variant still surfaces in the start preview's variable-resolution check.
         for (const content of sequenceStepVariantContents(step)) {
@@ -1262,7 +2139,10 @@ function tzParts(now, tz) {
     }
 }
 // ===== Validation helpers for variants + send windows =====
-function normalizeVariants(raw, path, fields, issues) {
+function normalizeVariants(raw, path, fields, issues, 
+// Mirrors the base step's allowance: a variant seeded from unwritten copy is
+// empty too, and would otherwise wedge the same autosave.
+allowEmpty = false) {
     if (raw === undefined || raw === null)
         return undefined;
     if (!Array.isArray(raw)) {
@@ -1285,7 +2165,7 @@ function normalizeVariants(raw, path, fields, issues) {
             const value = entry[field];
             if (value === undefined || value === null)
                 continue;
-            const template = requiredTemplate(value, `${path}[${i}].${field}`, issues);
+            const template = requiredTemplate(value, `${path}[${i}].${field}`, issues, allowEmpty);
             if (template !== undefined)
                 variant[field] = template;
         }