@oxygen-agent/cli 1.677.10 → 1.681.2

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.677.10
+Version: 1.681.2

package/dist/index.js

@@ -11,7 +11,8 @@ import { applyOxygenHelp } from "./help.js";
 import { buildCommandManifest, getCommandManifestEntry, searchCommandManifest, suggestCommandNames, } from "./command-manifest.js";
 import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { TAG_COLORS } from "@oxygen/shared/select-options";
-import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, } from "@oxygen/shared/file-import";
+import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, parseXlsxWorkbookBuffer, } from "@oxygen/shared/file-import";
+import { MAILBOX_IMPORT_FILE_MAX_BYTES as SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES, MAILBOX_IMPORT_ROW_LIMIT as SHARED_MAILBOX_IMPORT_ROW_LIMIT, normalizeMailboxImportFile as normalizeSharedMailboxImportFile, normalizeMailboxImportVendor as normalizeSharedMailboxImportVendor, normalizeMailboxWorkbookRows, parseMailboxImportText, summarizeMailboxImportValidation as summarizeSharedMailboxImportValidation, } from "@oxygen/shared/mailbox-import";
 import { assertRecipeBundleSafe, assertWorkflowGraphManifest, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowGraphManifest, isWorkflowManifest, } from "@oxygen/workflows";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
 import { createBrowserLoginSession, createRelayLoginSession, openBrowser } from "./browser-login.js";
@@ -894,413 +895,26 @@ function readJsonFileValue(path, inputName) {
  * shortcut) so the server applies the encrypted transfer-vault contract.
  */
 function normalizeMailboxImportFile(value, mode) {
-    if (!Array.isArray(value) || value.length === 0) {
-        throw new OxygenError("invalid_request", "--file must contain a non-empty mailboxes array.", { exitCode: 1 });
+    try {
+        return normalizeSharedMailboxImportFile(value, mode);
     }
-    const rows = value.map((entry, index) => {
-        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-            throw new OxygenError("invalid_request", `mailboxes[${index}] must be an object.`, { exitCode: 1 });
+    catch (error) {
+        if (error instanceof OxygenError &&
+            error.message ===
+                "This identity-only import contains a password. Choose a secure credential import for a compatible Google app-password export.") {
+            throw new OxygenError("invalid_request", "Mailbox credentials require --from credentials --vendor <source> (or --from hypertide for a Hypertide export); keep --validate-only for a no-network preflight. An identity import never accepts or forwards passwords.", { exitCode: 1 });
         }
-        return normalizeMailboxExportRow(entry, index, mode);
-    });
-    return dedupeMailboxImportRows(rows);
+        throw error;
+    }
 }
 function summarizeMailboxImportValidation(mailboxes, input) {
-    const providers = { google: 0, microsoft: 0 };
-    const infrastructurePlatforms = {};
-    let credentialRows = 0;
-    for (const mailbox of mailboxes) {
-        if (mailbox.provider === "google")
-            providers.google += 1;
-        if (mailbox.provider === "microsoft")
-            providers.microsoft += 1;
-        if (typeof mailbox.infrastructure_platform === "string") {
-            const platform = mailbox.infrastructure_platform;
-            infrastructurePlatforms[platform] =
-                (infrastructurePlatforms[platform] ?? 0) + 1;
-        }
-        if (typeof mailbox.app_password === "string")
-            credentialRows += 1;
-    }
     return {
-        valid: true,
-        source: input.source,
-        ...(input.sourceProvider
-            ? { source_provider: input.sourceProvider }
-            : {}),
-        rows: mailboxes.length,
-        providers,
-        infrastructure_platforms: infrastructurePlatforms,
-        credential_rows: credentialRows,
-        identity_only_rows: mailboxes.length - credentialRows,
-        limits: {
-            max_rows: MAILBOX_IMPORT_ROW_LIMIT,
-            max_file_bytes: MAILBOX_IMPORT_FILE_MAX_BYTES,
-        },
-        mutation: false,
-        network_request: false,
-        provider_call: false,
-        credits_used: 0,
+        ...summarizeSharedMailboxImportValidation(mailboxes, input),
         next_action: "Re-run the same command without --validate-only to register these mailboxes.",
     };
 }
-const MAILBOX_EMAIL_HEADERS = new Set([
-    "address",
-    "email",
-    "emailaddress",
-    "fromemail",
-    "mailbox",
-    "mailboxaddress",
-    "mailboxemail",
-]);
-const MAILBOX_PROVIDER_HEADERS = new Set([
-    "emailprovider",
-    "esp",
-    "mailboxprovider",
-    "platform",
-    "provider",
-    "serviceprovider",
-    "type",
-]);
-const MAILBOX_PASSWORD_HEADERS = new Set([
-    "apppassword",
-    "applicationpassword",
-    "googleapppassword",
-    "imappassword",
-    "mailboxpassword",
-    "password",
-    "smtppassword",
-]);
-const MAILBOX_WORKSPACE_HEADERS = new Set([
-    "externalaccountid",
-    "mailboxid",
-    "mailboxuid",
-    "sourceaccountid",
-    "sourcemailboxid",
-    "uid",
-    "workspaceexternalid",
-]);
-const MAILBOX_PLATFORM_HEADERS = new Set([
-    "infrastructure",
-    "infrastructureplatform",
-    "infraplatform",
-]);
-const MAILBOX_TENANT_HEADERS = new Set([
-    "azuretenantid",
-    "entratenantid",
-    "microsofttenantid",
-    "tenantid",
-]);
-const MAILBOX_NON_TRANSFERABLE_SECRET_HEADERS = new Set([
-    "accesstoken",
-    "applicationsecret",
-    "authenticatorsecret",
-    "authorization",
-    "authorizationcode",
-    "bearertoken",
-    "clientsecret",
-    "clientprivatekey",
-    "delegationkey",
-    "idtoken",
-    "mfacode",
-    "mfasecret",
-    "oauthaccesstoken",
-    "oauthcode",
-    "oauthrefreshtoken",
-    "oauthtoken",
-    "onetimepassword",
-    "otp",
-    "otpsecret",
-    "privatekey",
-    "refreshtoken",
-    "serviceaccountkey",
-    "serviceaccountjson",
-    "serviceaccountprivatekey",
-    "totp",
-    "totpsecret",
-]);
-const MAILBOX_IMPORT_FILE_MAX_BYTES = 5 * 1024 * 1024;
-const MAILBOX_IMPORT_ROW_LIMIT = 500;
-/**
- * Normalize common mailbox-vendor export labels locally, then send only
- * Oxygen's canonical fields. Passwords are accepted only in credential mode
- * and only become Google app passwords; Microsoft passwords are dropped because
- * one Outlook OAuth consent per mailbox is its only warmup path. OAuth grants,
- * MFA/TOTP seeds, and delegation keys are rejected in every mode. Host columns
- * may prove the provider but never cross the request boundary.
- */
-function normalizeMailboxExportRow(row, index, mode) {
-    const byHeader = new Map();
-    for (const [header, value] of Object.entries(row)) {
-        const normalizedHeader = normalizeMailboxExportHeader(header);
-        const existing = byHeader.get(normalizedHeader);
-        if (existing !== undefined &&
-            String(existing).trim() !== String(value ?? "").trim()) {
-            throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting columns that normalize to ${normalizedHeader}.`, { exitCode: 1 });
-        }
-        byHeader.set(normalizedHeader, value);
-    }
-    const email = readUniqueMailboxExportString(byHeader, MAILBOX_EMAIL_HEADERS, index, "email_address", (value) => value.trim().toLowerCase()) ?? readEmailShapedMailboxUsername(byHeader);
-    const providerValues = readMailboxExportStrings(byHeader, MAILBOX_PROVIDER_HEADERS);
-    const provider = normalizeMailboxProvider(providerValues, byHeader, index);
-    if (!email ||
-        email.length > 320 ||
-        !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}].email_address must be a valid address of at most 320 characters.`, { exitCode: 1 });
-    }
-    if (!provider) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}].provider could not be inferred. Oxygen imports Google Workspace and Microsoft 365/Entra identities; generic SMTP credentials are not transferable yet.`, { exitCode: 1 });
-    }
-    if (hasMailboxExportValue(byHeader, MAILBOX_NON_TRANSFERABLE_SECRET_HEADERS) ||
-        hasNonTransferableMailboxAuthLikeValue(byHeader)) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}] contains OAuth, MFA/TOTP, client-secret, or delegation material. Those credentials are never transferable; import the mailbox identity and complete the provider's administrator consent flow.`, { exitCode: 1 });
-    }
-    const passwords = readMailboxExportStrings(byHeader, MAILBOX_PASSWORD_HEADERS);
-    const distinctPasswords = [...new Set(passwords)];
-    if (distinctPasswords.some((password) => password.length > 1024)) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}].app_password must be at most 1024 characters.`, { exitCode: 1 });
-    }
-    if (mode === "identity" && distinctPasswords.length > 0) {
-        throw new OxygenError("invalid_request", "Mailbox credentials require --from credentials --vendor <source> (or --from hypertide for a Hypertide export); keep --validate-only for a no-network preflight. An identity import never accepts or forwards passwords.", { exitCode: 1 });
-    }
-    if (provider !== "microsoft" && distinctPasswords.length > 1) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting SMTP/IMAP/app-password values.`, { exitCode: 1 });
-    }
-    if (mode === "credential" &&
-        provider === "google" &&
-        distinctPasswords.length === 0) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}] needs a Google app password for credential import. OAuth tokens and an ordinary account password are not portable.`, { exitCode: 1 });
-    }
-    const workspaceExternalId = readUniqueMailboxExportString(byHeader, MAILBOX_WORKSPACE_HEADERS, index, "workspace_external_id", (value) => value.trim());
-    if (workspaceExternalId && workspaceExternalId.length > 512) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}].workspace_external_id must be at most 512 characters.`, { exitCode: 1 });
-    }
-    const tenantId = readUniqueMailboxExportString(byHeader, MAILBOX_TENANT_HEADERS, index, "tenant_id", (value) => value.trim().toLowerCase());
-    if (tenantId && provider !== "microsoft") {
-        throw new OxygenError("invalid_request", `mailboxes[${index}].tenant_id applies only to Microsoft mailboxes.`, { exitCode: 1 });
-    }
-    if (tenantId &&
-        !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(tenantId.trim())) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}].tenant_id must be a Microsoft Entra tenant GUID.`, { exitCode: 1 });
-    }
-    const infrastructurePlatformRaw = readUniqueMailboxExportString(byHeader, MAILBOX_PLATFORM_HEADERS, index, "infrastructure_platform", (value) => normalizeMailboxExportHeader(value)) ??
-        (providerValues.some((value) => ["azure", "entra", "microsoftazure"].includes(normalizeMailboxExportHeader(value)))
-            ? "microsoft_azure"
-            : null);
-    const infrastructurePlatform = normalizeMailboxInfrastructurePlatform(infrastructurePlatformRaw, provider, index);
-    return {
-        email_address: email.trim().toLowerCase(),
-        provider,
-        ...(workspaceExternalId !== null
-            ? { workspace_external_id: workspaceExternalId.trim() }
-            : {}),
-        ...(infrastructurePlatformRaw
-            ? { infrastructure_platform: infrastructurePlatform }
-            : {}),
-        ...(tenantId ? { tenant_id: tenantId.trim().toLowerCase() } : {}),
-        ...(mode === "credential" &&
-            provider === "google" &&
-            distinctPasswords[0] !== undefined
-            ? { app_password: distinctPasswords[0] }
-            : {}),
-    };
-}
-function normalizeMailboxExportHeader(value) {
-    return value
-        .replace(/^\uFEFF/, "")
-        .normalize("NFKC")
-        .trim()
-        .toLowerCase()
-        .replace(/[^a-z0-9]/g, "");
-}
-function readMailboxExportString(byHeader, headers) {
-    for (const header of headers) {
-        const value = byHeader.get(header);
-        if (typeof value === "string" && value.length > 0)
-            return value;
-    }
-    return null;
-}
-function readUniqueMailboxExportString(byHeader, headers, index, field, normalize) {
-    const values = readMailboxExportStrings(byHeader, headers);
-    if (values.length === 0)
-        return null;
-    const normalized = [...new Set(values.map(normalize))];
-    if (normalized.length > 1) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting ${field} aliases.`, { exitCode: 1 });
-    }
-    return normalized[0] ?? null;
-}
-function readMailboxExportStrings(byHeader, headers) {
-    const values = [];
-    for (const header of headers) {
-        const value = byHeader.get(header);
-        if (typeof value === "string" && value.length > 0)
-            values.push(value);
-    }
-    return values;
-}
-function hasMailboxExportValue(byHeader, headers) {
-    for (const header of headers) {
-        const value = byHeader.get(header);
-        if (value !== undefined && value !== null && String(value).trim()) {
-            return true;
-        }
-    }
-    return false;
-}
-function hasNonTransferableMailboxAuthLikeValue(byHeader) {
-    for (const [header, value] of byHeader) {
-        if (/(?:token|secret|privatekey|totp|passcode|authorization)/.test(header) &&
-            value !== undefined &&
-            value !== null &&
-            String(value).trim()) {
-            return true;
-        }
-    }
-    return false;
-}
-function readEmailShapedMailboxUsername(byHeader) {
-    for (const header of ["username", "imapusername", "smtpusername"]) {
-        const value = byHeader.get(header);
-        if (typeof value === "string" && value.includes("@"))
-            return value.trim().toLowerCase();
-    }
-    return null;
-}
-function normalizeMailboxProvider(providerValues, byHeader, index) {
-    const explicit = providerValues.map((value) => {
-        const normalized = normalizeMailboxExportHeader(value);
-        if (["google", "googleworkspace", "gmail", "gsuite"].includes(normalized)) {
-            return "google";
-        }
-        if ([
-            "azure",
-            "entra",
-            "m365",
-            "microsoft",
-            "microsoft365",
-            "microsoftazure",
-            "ms365",
-            "o365",
-            "office365",
-            "outlook",
-        ].includes(normalized)) {
-            return "microsoft";
-        }
-        throw new OxygenError("invalid_request", `mailboxes[${index}].provider is unsupported; expected Google/Gmail/Workspace or Microsoft/Outlook/Office 365/Entra.`, { exitCode: 1 });
-    });
-    const explicitKinds = [...new Set(explicit)];
-    if (explicitKinds.length > 1) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting provider aliases.`, { exitCode: 1 });
-    }
-    const hostValues = [
-        byHeader.get("imaphost"),
-        byHeader.get("imaphostname"),
-        byHeader.get("imapserver"),
-        byHeader.get("smtphost"),
-        byHeader.get("smtphostname"),
-        byHeader.get("smtpserver"),
-    ].filter((value) => typeof value === "string" && Boolean(value.trim()));
-    const hostKinds = hostValues.map((value) => {
-        const hostname = normalizeMailboxHost(value);
-        if (hostname === "smtp.gmail.com" || hostname === "imap.gmail.com") {
-            return "google";
-        }
-        if (hostname === "smtp.office365.com" ||
-            hostname === "outlook.office365.com") {
-            return "microsoft";
-        }
-        throw new OxygenError("invalid_request", `mailboxes[${index}] contains a non-standard SMTP/IMAP host. Oxygen imports Google Workspace and Microsoft 365/Entra identities; generic SMTP credential transport is not supported.`, { exitCode: 1 });
-    });
-    const inferredKinds = [...new Set(hostKinds)];
-    if (inferredKinds.length > 1) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting Google and Microsoft mail hosts.`, { exitCode: 1 });
-    }
-    const explicitKind = explicitKinds[0];
-    const inferredKind = inferredKinds[0];
-    if (explicitKind && inferredKind && explicitKind !== inferredKind) {
-        throw new OxygenError("invalid_request", `mailboxes[${index}] has conflicting provider and SMTP/IMAP host evidence.`, { exitCode: 1 });
-    }
-    return explicitKind ?? inferredKind ?? null;
-}
-function normalizeMailboxHost(value) {
-    const withoutScheme = value
-        .trim()
-        .toLowerCase()
-        .replace(/^[a-z]+:\/\//, "");
-    return withoutScheme.split(/[/:]/, 1)[0] ?? "";
-}
-function normalizeMailboxInfrastructurePlatform(raw, provider, index) {
-    if (!raw) {
-        return provider === "google" ? "google_workspace" : "microsoft_365";
-    }
-    const normalized = normalizeMailboxExportHeader(raw);
-    if (["google", "googleworkspace", "gmail", "gsuite", "workspace"].includes(normalized)) {
-        if (provider !== "google") {
-            throw mailboxPlatformConflict(index, provider);
-        }
-        return "google_workspace";
-    }
-    if (["azure", "entra", "microsoftazure"].includes(normalized)) {
-        if (provider !== "microsoft") {
-            throw mailboxPlatformConflict(index, provider);
-        }
-        return "microsoft_azure";
-    }
-    if ([
-        "m365",
-        "microsoft",
-        "microsoft365",
-        "ms365",
-        "o365",
-        "office365",
-        "outlook",
-    ].includes(normalized)) {
-        if (provider !== "microsoft") {
-            throw mailboxPlatformConflict(index, provider);
-        }
-        return "microsoft_365";
-    }
-    throw new OxygenError("invalid_request", `mailboxes[${index}].infrastructure_platform is unsupported; expected Google Workspace, Microsoft 365, Azure, or Entra.`, { exitCode: 1 });
-}
-function mailboxPlatformConflict(index, provider) {
-    return new OxygenError("invalid_request", `mailboxes[${index}].infrastructure_platform conflicts with provider=${provider}.`, { exitCode: 1 });
-}
-function dedupeMailboxImportRows(rows) {
-    const unique = new Map();
-    for (const row of rows) {
-        const address = String(row.email_address).toLowerCase();
-        const existing = unique.get(address);
-        if (!existing) {
-            unique.set(address, row);
-            continue;
-        }
-        if (JSON.stringify(existing) !== JSON.stringify(row)) {
-            throw new OxygenError("invalid_request", `Duplicate mailbox ${address} has conflicting provider, platform, tenant, external id, or credential fields.`, { exitCode: 1 });
-        }
-    }
-    return [...unique.values()];
-}
 function normalizeMailboxImportVendor(raw, from) {
-    if (from === "hypertide") {
-        if (raw && raw.trim().toLowerCase() !== "hypertide") {
-            throw new OxygenError("invalid_request", "--from hypertide is fixed to --vendor hypertide.", { exitCode: 1 });
-        }
-        return null;
-    }
-    if (from === "credentials" && !raw) {
-        throw new OxygenError("invalid_request", "--vendor <source> is required with --from credentials so the imported mailbox keeps its provenance.", { exitCode: 1 });
-    }
-    if (!raw)
-        return null;
-    const normalized = raw.trim().toLowerCase();
-    if (normalized.length < 1 ||
-        normalized.length > 64 ||
-        !/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/.test(normalized)) {
-        throw new OxygenError("invalid_request", "--vendor must be 1-64 lowercase letters, digits, dots, underscores, or hyphens.", { exitCode: 1 });
-    }
-    return normalized;
+    return normalizeSharedMailboxImportVendor(raw, from);
 }
 async function readMailboxImportFile(path) {
     let buffer;
@@ -1310,42 +924,24 @@ async function readMailboxImportFile(path) {
     catch {
         throw new OxygenError("mailbox_import_file_unreadable", `Couldn't read --file '${basename(path)}'. Check that the path exists and is readable. CSV/JSON/JSONL/XLSX identity files are accepted; credential exports require --from credentials (or --from hypertide). See https://oxygen-agent.com/docs/providers/mailbox-compatibility.`, { exitCode: 1 });
     }
-    if (buffer.byteLength > MAILBOX_IMPORT_FILE_MAX_BYTES) {
-        throw new OxygenError("invalid_request", `Mailbox import files must be ${MAILBOX_IMPORT_FILE_MAX_BYTES / 1024 / 1024} MB or smaller.`, { exitCode: 1 });
+    if (buffer.byteLength > SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES) {
+        throw new OxygenError("invalid_request", `Mailbox import files must be ${SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES / 1024 / 1024} MB or smaller.`, { exitCode: 1 });
     }
     const format = inferRowsFileFormat(path);
     let rows;
-    if (format === "json") {
-        let parsed;
+    if (format === "xlsx") {
         try {
-            parsed = JSON.parse(buffer.toString("utf8"));
+            rows = normalizeMailboxWorkbookRows(await parseXlsxWorkbookBuffer(buffer));
         }
         catch {
-            throw new OxygenError("invalid_json", "--file must contain valid JSON. File contents are omitted from this error because mailbox imports may contain credentials.", { exitCode: 1 });
-        }
-        if (Array.isArray(parsed)) {
-            rows = parsed;
-        }
-        else if (parsed &&
-            typeof parsed === "object" &&
-            !Array.isArray(parsed) &&
-            Array.isArray(parsed.mailboxes)) {
-            rows = parsed.mailboxes;
-        }
-        else {
-            throw new OxygenError("invalid_request", "--file JSON must contain a mailbox array or { mailboxes: [...] }.", { exitCode: 1 });
+            throw new OxygenError("invalid_mailbox_import_file", `Couldn't parse the ${format.toUpperCase()} mailbox file. File contents are omitted from this error because mailbox imports may contain credentials.`, { exitCode: 1 });
         }
     }
     else {
-        try {
-            rows = await parseRowsFileBuffer(buffer, format);
-        }
-        catch {
-            throw new OxygenError("invalid_mailbox_import_file", `Couldn't parse the ${format.toUpperCase()} mailbox file. File contents are omitted from this error because mailbox imports may contain credentials.`, { exitCode: 1 });
-        }
+        rows = parseMailboxImportText(buffer.toString("utf8"), format);
     }
-    if (rows.length > MAILBOX_IMPORT_ROW_LIMIT) {
-        throw new OxygenError("invalid_request", `Mailbox imports are limited to ${MAILBOX_IMPORT_ROW_LIMIT} rows per request.`, { exitCode: 1 });
+    if (rows.length > SHARED_MAILBOX_IMPORT_ROW_LIMIT) {
+        throw new OxygenError("invalid_request", `Mailbox imports are limited to ${SHARED_MAILBOX_IMPORT_ROW_LIMIT} rows per request.`, { exitCode: 1 });
     }
     return rows;
 }
@@ -13169,7 +12765,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                         : from === "credentials"
                             ? "credential_file"
                             : "identity_file",
-                    sourceProvider,
+                    sourceProvider: from === "hypertide" ? "hypertide" : sourceProvider,
                 });
             }
             return requestOxygen("/api/cli/mailboxes", {

package/node_modules/@oxygen/shared/dist/file-import.d.ts

@@ -1,3 +1,4 @@
+import { type Row } from "read-excel-file/node";
 import { type ImportColumnDataType } from "./column-types.js";
 export type RowsFileFormat = "json" | "jsonl" | "csv" | "xlsx";
 export type ImportTableColumn = {
@@ -16,6 +17,10 @@ export declare function normalizeRowsFormat(value: string | undefined, fallback:
 export declare function parseRowsFileBuffer(buffer: Buffer, format: RowsFileFormat, options?: {
     sheet?: string;
 }): Promise<Record<string, unknown>[]>;
+/** Read raw workbook cells for consumers with stricter, domain-specific headers. */
+export declare function parseXlsxWorkbookBuffer(buffer: Buffer, options?: {
+    sheet?: string;
+}): Promise<Row[]>;
 export declare function iterateRowsFileBufferBatches(buffer: Buffer, format: RowsFileFormat, options?: {
     sheet?: string;
     batchSize?: number;

package/node_modules/@oxygen/shared/dist/file-import.js

@@ -32,6 +32,21 @@ export async function parseRowsFileBuffer(buffer, format, options = {}) {
         return await parseXlsxRows(buffer, options);
     return parseRowsText(buffer.toString("utf8"), format);
 }
+/** Read raw workbook cells for consumers with stricter, domain-specific headers. */
+export async function parseXlsxWorkbookBuffer(buffer, options = {}) {
+    try {
+        return await readXlsxFile(buffer, options.sheet ? { sheet: options.sheet } : {});
+    }
+    catch (error) {
+        throw new OxygenError("invalid_rows", "XLSX sheet was not found.", {
+            details: {
+                sheet: options.sheet ?? null,
+                reason: error instanceof Error ? error.message : String(error),
+            },
+            exitCode: 1,
+        });
+    }
+}
 export async function* iterateRowsFileBufferBatches(buffer, format, options = {}) {
     const batchSize = normalizeBatchSize(options.batchSize);
     if (format === "csv") {
@@ -127,19 +142,7 @@ export function normalizeImportColumnKey(value) {
     return toSnakeIdentifier(value, "column");
 }
 async function parseXlsxRows(buffer, options) {
-    let rows;
-    try {
-        rows = await readXlsxFile(buffer, options.sheet ? { sheet: options.sheet } : {});
-    }
-    catch (error) {
-        throw new OxygenError("invalid_rows", "XLSX sheet was not found.", {
-            details: {
-                sheet: options.sheet ?? null,
-                reason: error instanceof Error ? error.message : String(error),
-            },
-            exitCode: 1,
-        });
-    }
+    const rows = await parseXlsxWorkbookBuffer(buffer, options);
     const [header, ...body] = rows;
     if (!header || header.length === 0)
         return [];

package/node_modules/@oxygen/shared/dist/mailbox-import.d.ts

@@ -0,0 +1,58 @@
+export type MailboxImportMode = "identity" | "credential";
+export type MailboxImportFileFormat = "json" | "jsonl" | "csv" | "xlsx";
+export type MailboxImportValidationSource = "identity_file" | "credential_file" | "hypertide_file";
+export type NormalizedMailboxImportRow = {
+    email_address: string;
+    provider: "google" | "microsoft";
+    workspace_external_id?: string;
+    infrastructure_platform?: "google_workspace" | "microsoft_365" | "microsoft_azure";
+    tenant_id?: string;
+    app_password?: string;
+};
+export type MailboxImportValidationSummary = {
+    valid: true;
+    source: MailboxImportValidationSource;
+    source_provider?: string;
+    rows: number;
+    providers: {
+        google: number;
+        microsoft: number;
+    };
+    infrastructure_platforms: Record<string, number>;
+    credential_rows: number;
+    identity_only_rows: number;
+    limits: {
+        max_rows: number;
+        max_file_bytes: number;
+    };
+    mutation: false;
+    network_request: false;
+    provider_call: false;
+    credits_used: 0;
+    next_action: string;
+};
+export declare const MAILBOX_IMPORT_FILE_MAX_BYTES: number;
+export declare const MAILBOX_IMPORT_ROW_LIMIT = 500;
+/**
+ * Infer the bounded mailbox-import format without node:path so browser and CLI
+ * preflight use the same extension contract.
+ */
+export declare function inferMailboxImportFileFormat(name: string): MailboxImportFileFormat;
+/**
+ * Parse credential-sensitive text without ever echoing file contents. JSON may
+ * be either a bare array or the common `{ mailboxes: [...] }` export wrapper.
+ */
+export declare function parseMailboxImportText(text: string, format: Exclude<MailboxImportFileFormat, "xlsx">): unknown[];
+/** Convert read-excel-file's browser rows to the same object rows as CSV. */
+export declare function normalizeMailboxWorkbookRows(rows: readonly (readonly unknown[])[]): unknown[];
+/**
+ * Whitelist mailbox fields before a local file crosses the network. The same
+ * function runs in the CLI and first-party web app, so accepted aliases and
+ * non-transferable-secret rejection cannot drift by surface.
+ */
+export declare function normalizeMailboxImportFile(value: unknown, mode: MailboxImportMode): NormalizedMailboxImportRow[];
+export declare function summarizeMailboxImportValidation(mailboxes: readonly NormalizedMailboxImportRow[], input: {
+    source: MailboxImportValidationSource;
+    sourceProvider: string | null;
+}): MailboxImportValidationSummary;
+export declare function normalizeMailboxImportVendor(raw: string | null | undefined, from: string | null | undefined): string | null;

package/node_modules/@oxygen/shared/dist/mailbox-import.js

@@ -0,0 +1,556 @@
+import { OxygenError } from "./cli-result.js";
+export const MAILBOX_IMPORT_FILE_MAX_BYTES = 5 * 1024 * 1024;
+export const MAILBOX_IMPORT_ROW_LIMIT = 500;
+const MAILBOX_EMAIL_HEADERS = new Set([
+    "address",
+    "email",
+    "emailaddress",
+    "fromemail",
+    "mailbox",
+    "mailboxaddress",
+    "mailboxemail",
+]);
+const MAILBOX_PROVIDER_HEADERS = new Set([
+    "emailprovider",
+    "esp",
+    "mailboxprovider",
+    "platform",
+    "provider",
+    "serviceprovider",
+    "type",
+]);
+const MAILBOX_PASSWORD_HEADERS = new Set([
+    "apppassword",
+    "applicationpassword",
+    "googleapppassword",
+    "imappassword",
+    "mailboxpassword",
+    "password",
+    "smtppassword",
+]);
+const MAILBOX_WORKSPACE_HEADERS = new Set([
+    "externalaccountid",
+    "mailboxid",
+    "mailboxuid",
+    "sourceaccountid",
+    "sourcemailboxid",
+    "uid",
+    "workspaceexternalid",
+]);
+const MAILBOX_PLATFORM_HEADERS = new Set([
+    "infrastructure",
+    "infrastructureplatform",
+    "infraplatform",
+]);
+const MAILBOX_TENANT_HEADERS = new Set([
+    "azuretenantid",
+    "entratenantid",
+    "microsofttenantid",
+    "tenantid",
+]);
+const MAILBOX_NON_TRANSFERABLE_SECRET_HEADERS = new Set([
+    "accesstoken",
+    "applicationsecret",
+    "authenticatorsecret",
+    "authorization",
+    "authorizationcode",
+    "bearertoken",
+    "clientsecret",
+    "clientprivatekey",
+    "delegationkey",
+    "idtoken",
+    "mfacode",
+    "mfasecret",
+    "oauthaccesstoken",
+    "oauthcode",
+    "oauthrefreshtoken",
+    "oauthtoken",
+    "onetimepassword",
+    "otp",
+    "otpsecret",
+    "privatekey",
+    "refreshtoken",
+    "serviceaccountkey",
+    "serviceaccountjson",
+    "serviceaccountprivatekey",
+    "totp",
+    "totpsecret",
+]);
+/**
+ * Infer the bounded mailbox-import format without node:path so browser and CLI
+ * preflight use the same extension contract.
+ */
+export function inferMailboxImportFileFormat(name) {
+    const path = name.split(/[?#]/, 1)[0] ?? name;
+    const extension = path.slice(path.lastIndexOf(".")).toLowerCase();
+    if (extension === ".jsonl" || extension === ".ndjson")
+        return "jsonl";
+    if (extension === ".csv")
+        return "csv";
+    if (extension === ".xlsx" || extension === ".xlsm")
+        return "xlsx";
+    return "json";
+}
+/**
+ * Parse credential-sensitive text without ever echoing file contents. JSON may
+ * be either a bare array or the common `{ mailboxes: [...] }` export wrapper.
+ */
+export function parseMailboxImportText(text, format) {
+    if (format === "csv")
+        return parseMailboxCsvRows(text);
+    if (format === "jsonl") {
+        return text
+            .split(/\r?\n/)
+            .map((line, index) => ({ line: line.trim(), lineNumber: index + 1 }))
+            .filter(({ line }) => Boolean(line))
+            .map(({ line, lineNumber }) => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                throw new OxygenError("invalid_jsonl", `Mailbox import contains invalid JSON on line ${lineNumber}. File contents are omitted because they may contain credentials.`, { exitCode: 1 });
+            }
+        });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new OxygenError("invalid_json", "Mailbox import must contain valid JSON. File contents are omitted because they may contain credentials.", { exitCode: 1 });
+    }
+    if (Array.isArray(parsed))
+        return parsed;
+    if (parsed &&
+        typeof parsed === "object" &&
+        !Array.isArray(parsed) &&
+        Array.isArray(parsed.mailboxes)) {
+        return parsed.mailboxes;
+    }
+    throw new OxygenError("invalid_request", "Mailbox import JSON must contain an array or { mailboxes: [...] }.", { exitCode: 1 });
+}
+/** Convert read-excel-file's browser rows to the same object rows as CSV. */
+export function normalizeMailboxWorkbookRows(rows) {
+    const [header, ...body] = rows;
+    if (!header || header.length === 0)
+        return [];
+    const labels = header
+        .map((cell, index) => ({
+        index,
+        label: cell === null || cell === undefined ? "" : String(cell).trim(),
+    }));
+    assertUniqueMailboxCsvHeaders(labels.map(({ label }) => label));
+    for (const [index, row] of body.entries()) {
+        if (row.length > header.length) {
+            throw new OxygenError("invalid_csv", `Workbook row ${index + 2} contains values beyond the named headers.`, { exitCode: 1 });
+        }
+    }
+    return body
+        .filter((row) => row.some((cell) => cell !== null && cell !== undefined && String(cell).trim()))
+        .map((row) => Object.fromEntries(labels.map(({ index, label }) => [
+        label,
+        normalizeMailboxWorkbookCell(row[index]),
+    ])));
+}
+/**
+ * Whitelist mailbox fields before a local file crosses the network. The same
+ * function runs in the CLI and first-party web app, so accepted aliases and
+ * non-transferable-secret rejection cannot drift by surface.
+ */
+export function normalizeMailboxImportFile(value, mode) {
+    if (!Array.isArray(value) || value.length === 0) {
+        throw new OxygenError("invalid_request", "The file must contain a non-empty mailboxes array.", { exitCode: 1 });
+    }
+    if (value.length > MAILBOX_IMPORT_ROW_LIMIT) {
+        throw new OxygenError("invalid_request", `Mailbox imports are limited to ${MAILBOX_IMPORT_ROW_LIMIT} rows per request.`, { exitCode: 1 });
+    }
+    const rows = value.map((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+            throw new OxygenError("invalid_request", `mailboxes[${index}] must be an object.`, { exitCode: 1 });
+        }
+        return normalizeMailboxExportRow(entry, index, mode);
+    });
+    return dedupeMailboxImportRows(rows);
+}
+export function summarizeMailboxImportValidation(mailboxes, input) {
+    const providers = { google: 0, microsoft: 0 };
+    const infrastructurePlatforms = {};
+    let credentialRows = 0;
+    for (const mailbox of mailboxes) {
+        providers[mailbox.provider] += 1;
+        if (mailbox.infrastructure_platform) {
+            infrastructurePlatforms[mailbox.infrastructure_platform] =
+                (infrastructurePlatforms[mailbox.infrastructure_platform] ?? 0) + 1;
+        }
+        if (mailbox.app_password)
+            credentialRows += 1;
+    }
+    return {
+        valid: true,
+        source: input.source,
+        ...(input.sourceProvider ? { source_provider: input.sourceProvider } : {}),
+        rows: mailboxes.length,
+        providers,
+        infrastructure_platforms: infrastructurePlatforms,
+        credential_rows: credentialRows,
+        identity_only_rows: mailboxes.length - credentialRows,
+        limits: {
+            max_rows: MAILBOX_IMPORT_ROW_LIMIT,
+            max_file_bytes: MAILBOX_IMPORT_FILE_MAX_BYTES,
+        },
+        mutation: false,
+        network_request: false,
+        provider_call: false,
+        credits_used: 0,
+        next_action: "Submit this reviewed file to register the mailboxes.",
+    };
+}
+export function normalizeMailboxImportVendor(raw, from) {
+    if (from === "hypertide") {
+        if (raw && raw.trim().toLowerCase() !== "hypertide") {
+            throw new OxygenError("invalid_request", "Hypertide import provenance is fixed to hypertide.", { exitCode: 1 });
+        }
+        return null;
+    }
+    if (from === "credentials" && !raw) {
+        throw new OxygenError("invalid_request", "Name the provider that exported these credentials so each mailbox keeps its provenance.", { exitCode: 1 });
+    }
+    if (!raw)
+        return null;
+    const normalized = raw.trim().toLowerCase();
+    if (normalized.length < 1 ||
+        normalized.length > 64 ||
+        !/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/.test(normalized)) {
+        throw new OxygenError("invalid_request", "Provider name must be 1-64 lowercase letters, digits, dots, underscores, or hyphens.", { exitCode: 1 });
+    }
+    return normalized;
+}
+function normalizeMailboxExportRow(row, index, mode) {
+    const byHeader = new Map();
+    for (const [header, value] of Object.entries(row)) {
+        const normalizedHeader = normalizeMailboxExportHeader(header);
+        const existing = byHeader.get(normalizedHeader);
+        if (existing !== undefined &&
+            String(existing).trim() !== String(value ?? "").trim()) {
+            throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting columns that normalize to ${normalizedHeader}.`, { exitCode: 1 });
+        }
+        byHeader.set(normalizedHeader, value);
+    }
+    const email = readUniqueMailboxExportString(byHeader, MAILBOX_EMAIL_HEADERS, index, "email_address", (value) => value.trim().toLowerCase()) ?? readEmailShapedMailboxUsername(byHeader);
+    const providerValues = readMailboxExportStrings(byHeader, MAILBOX_PROVIDER_HEADERS);
+    const provider = normalizeMailboxProvider(providerValues, byHeader, index);
+    if (!email ||
+        email.length > 320 ||
+        !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}].email_address must be a valid address of at most 320 characters.`, { exitCode: 1 });
+    }
+    if (!provider) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}].provider could not be inferred. Oxygen imports Google Workspace and Microsoft 365/Entra identities; generic SMTP credentials are not transferable yet.`, { exitCode: 1 });
+    }
+    if (hasMailboxExportValue(byHeader, MAILBOX_NON_TRANSFERABLE_SECRET_HEADERS) ||
+        hasNonTransferableMailboxAuthLikeValue(byHeader)) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}] contains OAuth, MFA/TOTP, client-secret, or delegation material. Those credentials are never transferable; import the mailbox identity and complete the provider consent flow.`, { exitCode: 1 });
+    }
+    const passwords = readMailboxExportStrings(byHeader, MAILBOX_PASSWORD_HEADERS);
+    const distinctPasswords = [...new Set(passwords)];
+    if (distinctPasswords.some((password) => password.length > 1024)) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}].app_password must be at most 1024 characters.`, { exitCode: 1 });
+    }
+    if (mode === "identity" && distinctPasswords.length > 0) {
+        throw new OxygenError("invalid_request", "This identity-only import contains a password. Choose a secure credential import for a compatible Google app-password export.", { exitCode: 1 });
+    }
+    if (provider !== "microsoft" && distinctPasswords.length > 1) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting SMTP/IMAP/app-password values.`, { exitCode: 1 });
+    }
+    if (mode === "credential" &&
+        provider === "google" &&
+        distinctPasswords.length === 0) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}] needs a Google app password for credential import. OAuth tokens and an ordinary account password are not portable.`, { exitCode: 1 });
+    }
+    const workspaceExternalId = readUniqueMailboxExportString(byHeader, MAILBOX_WORKSPACE_HEADERS, index, "workspace_external_id", (value) => value.trim());
+    if (workspaceExternalId && workspaceExternalId.length > 512) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}].workspace_external_id must be at most 512 characters.`, { exitCode: 1 });
+    }
+    const tenantId = readUniqueMailboxExportString(byHeader, MAILBOX_TENANT_HEADERS, index, "tenant_id", (value) => value.trim().toLowerCase());
+    if (tenantId && provider !== "microsoft") {
+        throw new OxygenError("invalid_request", `mailboxes[${index}].tenant_id applies only to Microsoft mailboxes.`, { exitCode: 1 });
+    }
+    if (tenantId &&
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(tenantId)) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}].tenant_id must be a Microsoft Entra tenant GUID.`, { exitCode: 1 });
+    }
+    const infrastructurePlatformRaw = readUniqueMailboxExportString(byHeader, MAILBOX_PLATFORM_HEADERS, index, "infrastructure_platform", normalizeMailboxExportHeader) ??
+        (providerValues.some((value) => ["azure", "entra", "microsoftazure"].includes(normalizeMailboxExportHeader(value)))
+            ? "microsoft_azure"
+            : null);
+    const infrastructurePlatform = normalizeMailboxInfrastructurePlatform(infrastructurePlatformRaw, provider, index);
+    return {
+        email_address: email.trim().toLowerCase(),
+        provider,
+        ...(workspaceExternalId !== null
+            ? { workspace_external_id: workspaceExternalId.trim() }
+            : {}),
+        ...(infrastructurePlatformRaw
+            ? { infrastructure_platform: infrastructurePlatform }
+            : {}),
+        ...(tenantId ? { tenant_id: tenantId.trim().toLowerCase() } : {}),
+        ...(mode === "credential" &&
+            provider === "google" &&
+            distinctPasswords[0] !== undefined
+            ? { app_password: distinctPasswords[0] }
+            : {}),
+    };
+}
+function normalizeMailboxExportHeader(value) {
+    return value
+        .replace(/^\uFEFF/, "")
+        .normalize("NFKC")
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]/g, "");
+}
+function readUniqueMailboxExportString(byHeader, headers, index, field, normalize) {
+    const values = readMailboxExportStrings(byHeader, headers);
+    if (values.length === 0)
+        return null;
+    const normalized = [...new Set(values.map(normalize))];
+    if (normalized.length > 1) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting ${field} aliases.`, { exitCode: 1 });
+    }
+    return normalized[0] ?? null;
+}
+function readMailboxExportStrings(byHeader, headers) {
+    const values = [];
+    for (const header of headers) {
+        const value = byHeader.get(header);
+        if (typeof value === "string" && value.length > 0)
+            values.push(value);
+    }
+    return values;
+}
+function hasMailboxExportValue(byHeader, headers) {
+    for (const header of headers) {
+        const value = byHeader.get(header);
+        if (value !== undefined && value !== null && String(value).trim())
+            return true;
+    }
+    return false;
+}
+function hasNonTransferableMailboxAuthLikeValue(byHeader) {
+    for (const [header, value] of byHeader) {
+        if (/(?:token|secret|privatekey|totp|passcode|authorization)/.test(header) &&
+            value !== undefined &&
+            value !== null &&
+            String(value).trim()) {
+            return true;
+        }
+    }
+    return false;
+}
+function readEmailShapedMailboxUsername(byHeader) {
+    for (const header of ["username", "imapusername", "smtpusername"]) {
+        const value = byHeader.get(header);
+        if (typeof value === "string" && value.includes("@")) {
+            return value.trim().toLowerCase();
+        }
+    }
+    return null;
+}
+function normalizeMailboxProvider(providerValues, byHeader, index) {
+    const explicit = providerValues.map((value) => {
+        const normalized = normalizeMailboxExportHeader(value);
+        if (["google", "googleworkspace", "gmail", "gsuite"].includes(normalized)) {
+            return "google";
+        }
+        if ([
+            "azure",
+            "entra",
+            "m365",
+            "microsoft",
+            "microsoft365",
+            "microsoftazure",
+            "ms365",
+            "o365",
+            "office365",
+            "outlook",
+        ].includes(normalized)) {
+            return "microsoft";
+        }
+        throw new OxygenError("invalid_request", `mailboxes[${index}].provider is unsupported; expected Google/Gmail/Workspace or Microsoft/Outlook/Office 365/Entra.`, { exitCode: 1 });
+    });
+    const explicitKinds = [...new Set(explicit)];
+    if (explicitKinds.length > 1) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting provider aliases.`, { exitCode: 1 });
+    }
+    const hostValues = [
+        byHeader.get("imaphost"),
+        byHeader.get("imaphostname"),
+        byHeader.get("imapserver"),
+        byHeader.get("smtphost"),
+        byHeader.get("smtphostname"),
+        byHeader.get("smtpserver"),
+    ].filter((value) => typeof value === "string" && Boolean(value.trim()));
+    const hostKinds = hostValues.map((value) => {
+        const hostname = normalizeMailboxHost(value);
+        if (hostname === "smtp.gmail.com" || hostname === "imap.gmail.com") {
+            return "google";
+        }
+        if (hostname === "smtp.office365.com" ||
+            hostname === "outlook.office365.com") {
+            return "microsoft";
+        }
+        throw new OxygenError("invalid_request", `mailboxes[${index}] contains a non-standard SMTP/IMAP host. Oxygen imports Google Workspace and Microsoft 365/Entra identities; generic SMTP credential transport is not supported.`, { exitCode: 1 });
+    });
+    const inferredKinds = [...new Set(hostKinds)];
+    if (inferredKinds.length > 1) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}] contains conflicting Google and Microsoft mail hosts.`, { exitCode: 1 });
+    }
+    const explicitKind = explicitKinds[0];
+    const inferredKind = inferredKinds[0];
+    if (explicitKind && inferredKind && explicitKind !== inferredKind) {
+        throw new OxygenError("invalid_request", `mailboxes[${index}] has conflicting provider and SMTP/IMAP host evidence.`, { exitCode: 1 });
+    }
+    return explicitKind ?? inferredKind ?? null;
+}
+function normalizeMailboxHost(value) {
+    const withoutScheme = value
+        .trim()
+        .toLowerCase()
+        .replace(/^[a-z]+:\/\//, "");
+    return withoutScheme.split(/[/:]/, 1)[0] ?? "";
+}
+function normalizeMailboxInfrastructurePlatform(raw, provider, index) {
+    if (!raw)
+        return provider === "google" ? "google_workspace" : "microsoft_365";
+    const normalized = normalizeMailboxExportHeader(raw);
+    if (["google", "googleworkspace", "gmail", "gsuite", "workspace"].includes(normalized)) {
+        if (provider !== "google")
+            throw mailboxPlatformConflict(index, provider);
+        return "google_workspace";
+    }
+    if (["azure", "entra", "microsoftazure"].includes(normalized)) {
+        if (provider !== "microsoft")
+            throw mailboxPlatformConflict(index, provider);
+        return "microsoft_azure";
+    }
+    if ([
+        "m365",
+        "microsoft",
+        "microsoft365",
+        "ms365",
+        "o365",
+        "office365",
+        "outlook",
+    ].includes(normalized)) {
+        if (provider !== "microsoft")
+            throw mailboxPlatformConflict(index, provider);
+        return "microsoft_365";
+    }
+    throw new OxygenError("invalid_request", `mailboxes[${index}].infrastructure_platform is unsupported; expected Google Workspace, Microsoft 365, Azure, or Entra.`, { exitCode: 1 });
+}
+function mailboxPlatformConflict(index, provider) {
+    return new OxygenError("invalid_request", `mailboxes[${index}].infrastructure_platform conflicts with provider=${provider}.`, { exitCode: 1 });
+}
+function dedupeMailboxImportRows(rows) {
+    const unique = new Map();
+    for (const row of rows) {
+        const address = row.email_address.toLowerCase();
+        const existing = unique.get(address);
+        if (!existing) {
+            unique.set(address, row);
+            continue;
+        }
+        if (JSON.stringify(existing) !== JSON.stringify(row)) {
+            throw new OxygenError("invalid_request", `Duplicate mailbox ${address} has conflicting provider, platform, tenant, external id, or credential fields.`, { exitCode: 1 });
+        }
+    }
+    return [...unique.values()];
+}
+function parseMailboxCsvRows(text) {
+    const records = parseMailboxCsvRecords(text);
+    const [header, ...rows] = records;
+    if (!header || header.length === 0)
+        return [];
+    assertUniqueMailboxCsvHeaders(header);
+    for (const [index, row] of rows.entries()) {
+        if (row.length > header.length) {
+            throw new OxygenError("invalid_csv", `CSV row ${index + 2} contains more fields than the header.`, { exitCode: 1 });
+        }
+    }
+    return rows
+        .filter((row) => row.some((cell) => cell.trim()))
+        .map((row) => Object.fromEntries(header.map((key, index) => [
+        key,
+        row[index] === undefined || row[index] === "" ? null : row[index],
+    ])));
+}
+function parseMailboxCsvRecords(text) {
+    const records = [];
+    let record = [];
+    let field = "";
+    let inQuotes = false;
+    for (let index = 0; index < text.length; index += 1) {
+        const char = text[index];
+        const next = text[index + 1];
+        if (inQuotes) {
+            if (char === '"' && next === '"') {
+                field += '"';
+                index += 1;
+            }
+            else if (char === '"') {
+                inQuotes = false;
+            }
+            else {
+                field += char;
+            }
+            continue;
+        }
+        if (char === '"')
+            inQuotes = true;
+        else if (char === ",") {
+            record.push(field);
+            field = "";
+        }
+        else if (char === "\n") {
+            record.push(field);
+            records.push(record);
+            record = [];
+            field = "";
+        }
+        else if (char !== "\r") {
+            field += char;
+        }
+    }
+    if (inQuotes) {
+        throw new OxygenError("invalid_csv", "CSV contains an unterminated quoted field.", {
+            exitCode: 1,
+        });
+    }
+    if (field || record.length > 0) {
+        record.push(field);
+        records.push(record);
+    }
+    return records;
+}
+function assertUniqueMailboxCsvHeaders(header) {
+    const seen = new Set();
+    for (const value of header) {
+        const normalized = value.normalize("NFKC").trim().toLowerCase();
+        if (!normalized || seen.has(normalized)) {
+            throw new OxygenError("invalid_csv", "CSV/XLSX headers must be non-empty and unique (case-insensitive).", { exitCode: 1 });
+        }
+        seen.add(normalized);
+    }
+}
+function normalizeMailboxWorkbookCell(value) {
+    if (value === undefined || value === null || value === "")
+        return null;
+    if (typeof value === "string" ||
+        typeof value === "number" ||
+        typeof value === "boolean") {
+        return value;
+    }
+    if (value instanceof Date)
+        return value.toISOString();
+    return String(value);
+}

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const OXYGEN_VERSION = "1.677.10";
+export declare const OXYGEN_VERSION = "1.681.2";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.677.10";
+export const OXYGEN_VERSION = "1.681.2";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/node_modules/@oxygen/shared/package.json

@@ -21,6 +21,11 @@
       "import": "./dist/file-import.js",
       "default": "./dist/file-import.js"
     },
+    "./mailbox-import": {
+      "types": "./dist/mailbox-import.d.ts",
+      "import": "./dist/mailbox-import.js",
+      "default": "./dist/mailbox-import.js"
+    },
     "./linkedin-url": {
       "types": "./dist/linkedin-url.d.ts",
       "import": "./dist/linkedin-url.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.677.10",
+  "version": "1.681.2",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",