@oxygen-agent/cli 1.691.5 → 1.696.0

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.691.5
+Version: 1.696.0

package/dist/command-manifest.js

@@ -46,6 +46,13 @@ const MUTATING_VERBS = new Set([
     "unbind", "unsubscribe", "update", "upload", "upsert", "use", "warm-send", "warmup",
     "withdraw", "write",
 ]);
+// `--approved` usually identifies a paid or externally mutating execution
+// mode, but a small number of destructive local operations are explicitly
+// zero-credit. Keep those exceptions exact so discovery never invents spend.
+const ZERO_CREDIT_APPROVAL_COMMANDS = new Set(["mailboxes delete"]);
+// These commands preview when the execution approval is omitted even though
+// their gate is named `--approved` rather than `--live`.
+const APPROVAL_PREVIEW_COMMANDS = new Set(["mailboxes delete"]);
 export function buildCommandManifest(program, binaryName) {
     const commands = [];
     for (const child of program.commands) {
@@ -172,8 +179,9 @@ function toManifestEntry(command, path) {
     const flagStrings = options.map((option) => option.flags);
     const leafVerb = path[path.length - 1] ?? "";
     const verbPrefix = leafVerb.split("-")[0] ?? leafVerb;
+    const commandName = path.join(" ");
     return {
-        name: path.join(" "),
+        name: commandName,
         group: path[0] ?? "",
         description: command.description(),
         arguments: command.registeredArguments.map((argument) => ({
@@ -186,20 +194,22 @@ function toManifestEntry(command, path) {
             description: option.description,
             required: option.mandatory,
         })),
-        spends_credits: flagStrings.some((flags) => flags.includes("--approved") ||
-            flags.includes("--max-credits") ||
-            // Copilot's explicit session inference-budget approval flag.
-            flags.includes("--budget-credits")) ||
-            // `copilot send` bills managed inference (5x actual model cost) inside the
-            // session budget approved at `copilot start`, and `copilot approve`
-            // dispatches the gated paid/external capability and requeues the paused
-            // turn (waking the worker for more 5x-billed inference) — no per-command
-            // cap flag exists for either, so the flag heuristic alone would misreport
-            // them as free.
-            (path[0] === "copilot" &&
-                (leafVerb === "send" || leafVerb === "approve")),
+        spends_credits: !ZERO_CREDIT_APPROVAL_COMMANDS.has(commandName) &&
+            (flagStrings.some((flags) => flags.includes("--approved") ||
+                flags.includes("--max-credits") ||
+                // Copilot's explicit session inference-budget approval flag.
+                flags.includes("--budget-credits")) ||
+                // `copilot send` bills managed inference (5x actual model cost) inside the
+                // session budget approved at `copilot start`, and `copilot approve`
+                // dispatches the gated paid/external capability and requeues the paused
+                // turn (waking the worker for more 5x-billed inference) — no per-command
+                // cap flag exists for either, so the flag heuristic alone would misreport
+                // them as free.
+                (path[0] === "copilot" &&
+                    (leafVerb === "send" || leafVerb === "approve"))),
         mutates: MUTATING_VERBS.has(leafVerb) || MUTATING_VERBS.has(verbPrefix),
-        preview_by_default: flagStrings.some((flags) => flags.includes("--live")),
+        preview_by_default: flagStrings.some((flags) => flags.includes("--live")) ||
+            APPROVAL_PREVIEW_COMMANDS.has(commandName),
         json_supported: flagStrings.some((flags) => flags.includes("--json")),
         hidden: isHiddenCommand(command),
     };

package/dist/index.js

@@ -627,7 +627,7 @@ function writeWorkflowActionTail(record) {
 // Bulk `workflows enable | disable | delete` return a per-item results[] plus
 // summary counts. In human (non --json) output there is no JSON dump, so render
 // one readable line per item and a summary-count line to stdout. `okVerb` is the
-// past-tense success verb (enabled / disabled / archived / purged).
+// past-tense success verb (enabled / disabled / deleted).
 function writeBulkWorkflowResults(data, okVerb) {
     if (!data || typeof data !== "object" || Array.isArray(data))
         return;
@@ -656,7 +656,7 @@ function writeBulkWorkflowResults(data, okVerb) {
         }
     }
     const counts = [];
-    for (const key of ["archived", "purged", "enabled", "disabled", "skipped", "failed"]) {
+    for (const key of ["deleted", "enabled", "disabled", "skipped", "failed", "archived", "purged"]) {
         const value = record[key];
         if (typeof value === "number")
             counts.push(`${value} ${key}`);
@@ -808,7 +808,7 @@ function writeMaxCreditsHint(error) {
             // command does not take. The server message is the signal: it spells out
             // "(CLI: --yes)" on those gates.
             if (error.message.includes("--yes")) {
-                process.stderr.write("hint: inspect the preview, then re-run with --yes to approve the permanent purge\n");
+                process.stderr.write("hint: inspect the preview, then re-run with --yes to approve the permanent deletion\n");
                 return;
             }
             const estimated = readDetailsNumber(error.details, "estimated_credits");
@@ -11499,15 +11499,16 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })))
         .addCommand(new Command("hubspot-sync")
-        .description("Map actual sequencer events to contact datetime fields in the connected HubSpot portal. Reuses native or provider-managed authorization and only requests known-missing property access if a preview needs new fields.")
+        .description("Project sequence activity, native email/LinkedIn timeline entries, and reply outcomes into the connected HubSpot portal. One workspace setting manages the event and classified-reply workflows across every sequence.")
         .addCommand(new Command("show")
-        .description("Show the connected portal and fetch its writable contact datetime fields, supported sequencer events, current mappings, and enabled state.")
+        .description("Show the connected portal, live contact schema, activity/status configuration, component health, and enabled state.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("sequences hubspot-sync show", options, () => requestOxygen("/api/cli/sequencer/hubspot-sync"));
     }))
         .addCommand(new Command("configure")
-        .description("Preview or save event → HubSpot property mappings. Existing fields need no new grant; creating missing properties requires --approved and HubSpot property-creation access.")
+        .description("Preview or save the workspace-wide HubSpot projection. Existing fields need no new grant; creating missing properties requires --approved and HubSpot property-creation access.")
+        .option("--config-file <path>", "Full or partial JSON configuration: mappings, timeline_events, LinkedIn identity property, lead-status property, sequence/reply status mappings, and opt-out status.")
         .option("--mappings-file <path>", "JSON object mapping every sequencer event key to a HubSpot contact datetime-property internal name; use an empty string to disable an event.")
         .option("--armed", "Enable future event delivery.")
         .option("--disarmed", "Disable future event delivery.")
@@ -11519,6 +11520,13 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             if (options.armed === options.disarmed) {
                 throw new Error("Pass exactly one of --armed or --disarmed.");
             }
+            const configPath = readOption(options.configFile);
+            const configValue = configPath
+                ? readJsonFileValue(resolve(configPath), "--config-file")
+                : undefined;
+            if (configValue !== undefined && !isRecord(configValue)) {
+                throw new Error("--config-file must contain a JSON object.");
+            }
             const mappingsPath = readOption(options.mappingsFile);
             const mappings = mappingsPath
                 ? readJsonFileValue(resolve(mappingsPath), "--mappings-file")
@@ -11526,16 +11534,93 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             if (mappings !== undefined && !isRecord(mappings)) {
                 throw new Error("--mappings-file must contain a JSON object.");
             }
+            const config = {
+                ...(configValue ?? {}),
+                ...(mappings
+                    ? {
+                        mappings: {
+                            ...(isRecord(configValue?.mappings)
+                                ? configValue.mappings
+                                : {}),
+                            ...mappings,
+                        },
+                    }
+                    : {}),
+            };
             return requestOxygen("/api/cli/sequencer/hubspot-sync", {
                 method: "POST",
                 body: {
                     armed: options.armed === true,
                     mode: options.live ? "live" : "dry_run",
-                    ...(mappings ? { config: { mappings } } : {}),
+                    ...(Object.keys(config).length > 0 ? { config } : {}),
                     ...(options.approved ? { approved: true } : {}),
                 },
             });
         });
+    })))
+        .addCommand(new Command("hubspot-list-import")
+        .description("Discover saved HubSpot contact lists and configure one bounded DNC-first automatic import into an Oxygen Sequence. Draft and paused recipients stay pending until launch or resume.")
+        .addCommand(new Command("lists")
+        .description("List saved HubSpot contact segments available for a Sequence import. This is one no-bill provider read and changes no members, DNC entries, rows, workflows, or enrollments.")
+        .argument("<sequence>", "Sequence id or slug.")
+        .option("--query <text>", "Optional case-insensitive words to match in the HubSpot list name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleAsyncAction("sequences hubspot-list-import lists", options, () => {
+            const params = new URLSearchParams({ sequence });
+            const query = readOption(options.query);
+            if (query)
+                params.set("query", query);
+            return requestOxygen(`/api/cli/sequencer/hubspot-list-import?${params.toString()}`);
+        });
+    }))
+        .addCommand(new Command("configure")
+        .description("Preview or start a scheduled HubSpot-list import. Preview first; then pass its reviewed fingerprint with --live --approved. The complete DNC list is applied before leads are read or enrolled.")
+        .argument("<sequence>", "Sequence id or slug.")
+        .requiredOption("--lead-list <id>", "Exact HubSpot ILS contact-list id whose current members should be imported.")
+        .requiredOption("--dnc-list <id>", "Different exact HubSpot ILS contact-list id synchronized additively into Oxygen DNC first.")
+        .option("--cron <expression>", "Standing cron cadence. Defaults to every 15 minutes.")
+        .option("--timezone <iana>", "IANA timezone. Defaults to UTC.")
+        .option("--max-records-per-list <n>", "Hard complete-snapshot cap per list (1-5000).", "5000")
+        .option("--max-credits <n>", "Hard credit ceiling per delivery.", "10")
+        .option("--include-contacted", "Allow leads already contacted by another active Sequence (default excludes them).")
+        .option("--reviewed-fingerprint <hash>", "Fingerprint returned by the exact dry-run preview; required for live activation.")
+        .option("--idempotency-key <key>", "Optional idempotency key for the immediate first durable run.")
+        .option("--live", "Create/bind the Table if needed, arm the Workflow, and enqueue the first cycle.")
+        .option("--approved", "Approve the reviewed recurring HubSpot reads, additive DNC writes, Table upserts, and Sequence enrollment.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleAsyncAction("sequences hubspot-list-import configure", options, () => {
+            const maxRecords = readPositiveInt(options.maxRecordsPerList);
+            const maxCredits = readPositiveNumber(options.maxCredits);
+            if (maxRecords === undefined || maxRecords > 5000) {
+                throw new Error("--max-records-per-list must be between 1 and 5000.");
+            }
+            if (maxCredits === undefined) {
+                throw new Error("--max-credits must be a positive number.");
+            }
+            const reviewedFingerprint = readOption(options.reviewedFingerprint);
+            if (options.live && !reviewedFingerprint) {
+                throw new Error("Live activation requires --reviewed-fingerprint from the exact dry-run preview.");
+            }
+            return requestOxygen("/api/cli/sequencer/hubspot-list-import", {
+                method: "POST",
+                body: {
+                    sequence,
+                    lead_list_id: options.leadList,
+                    dnc_list_id: options.dncList,
+                    mode: options.live ? "live" : "dry_run",
+                    max_records_per_list: maxRecords,
+                    max_credits: maxCredits,
+                    exclude_contacted: options.includeContacted !== true,
+                    ...(readOption(options.cron) ? { cron: readOption(options.cron) } : {}),
+                    ...(readOption(options.timezone) ? { timezone: readOption(options.timezone) } : {}),
+                    ...(options.approved ? { approved: true } : {}),
+                    ...(reviewedFingerprint ? { reviewed_fingerprint: reviewedFingerprint } : {}),
+                    ...(readOption(options.idempotencyKey) ? { idempotency_key: readOption(options.idempotencyKey) } : {}),
+                },
+            });
+        });
     })))
         .addCommand(new Command("analytics")
         .description("Show organization-level sequencer analytics, per-sequence funnels, and native email attribution under analytics.emailAttribution: byMailbox, byDomain, and explicit unattributed facts. Provider-owned campaigns appear only after their telemetry is normalized into Oxygen's native Sequence ledgers. Also reports whether the reply → CRM automation is armed, with a link to the workflow.")
@@ -12704,6 +12789,35 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (mailbox, options) => {
         await handleAsyncAction("mailboxes get", options, () => requestOxygen(`/api/cli/mailboxes/${encodeURIComponent(mailbox)}`));
+    }))
+        .addCommand(new Command("delete")
+        .description("Preview or approve removal of exact mailboxes from Oxygen at 0 credits. Deletion immediately removes them from sending but never deletes the underlying Google Workspace or Microsoft 365 accounts. It preserves conversation/message/delivery history and stops the 1,000-credit mailbox commitment for future renewals; the current period is not refunded. Listed active/paused sequences keep their status but lose these senders and are not automatically paused. Managed mailboxes and live warmup/monitoring add-ons fail closed with their exact address-scoped teardown steps.")
+        .requiredOption("--mailboxes <list>", "Comma-separated mailbox ids or addresses (maximum 500).")
+        .option("--approved", "Execute the fresh preview. Requires --plan-hash and --confirmation.")
+        .option("--plan-hash <hash>", "Fresh preview plan_hash.")
+        .option("--confirmation <phrase>", "Exact confirmation_phrase returned by the fresh preview.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("mailboxes delete", options, () => {
+            const mailboxes = readCsvOption(options.mailboxes);
+            if (mailboxes.length === 0) {
+                throw new Error("--mailboxes must contain at least one mailbox id or address.");
+            }
+            const planHash = readOption(options.planHash);
+            const confirmation = readOption(options.confirmation);
+            if (options.approved === true && (!planHash || !confirmation)) {
+                throw new Error("--approved requires --plan-hash and --confirmation from a fresh deletion preview.");
+            }
+            return requestOxygen("/api/cli/mailboxes/delete", {
+                method: "POST",
+                body: {
+                    mailboxes,
+                    ...(options.approved === true ? { approved: true } : {}),
+                    ...(planHash ? { plan_hash: planHash } : {}),
+                    ...(confirmation ? { confirmation } : {}),
+                },
+            });
+        });
     }))
         .addCommand(new Command("health")
         .description("Fleet email-health: the sending pool rolled up by external deliverability reputation (healthy/degraded/critical/unknown), per-mailbox scores, connected health providers, and DIRECTIONAL recommendations. Pure read — 0 credits; never pauses a mailbox.")
@@ -12746,7 +12860,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         "Credential file contract:",
         '  JSON: {"mailboxes":[{"email_address":"ada@send-acme.com","provider":"google","app_password":"<Google mailbox app password>"}]}',
         "  Only Google app passwords enter the encrypted seven-day transfer vault. Microsoft rows remain identity-only. Generic SMTP passwords and OAuth/MFA/delegation secrets are rejected.",
-        "  Validation: add --validate-only to parse the complete real file and return safe aggregate counts without authentication, a network request, or a workspace write. Any parse, shape, provider, platform, tenant, secret-policy, or duplicate-conflict error rejects the entire file before the first mailbox write and names mailboxes[index]; validation-only never writes. A later import infrastructure failure may interrupt the upsert; re-run the same file because import is idempotent by address.",
+        "  Validation: add --validate-only to parse the complete real file and return safe aggregate counts plus the provider-specific exact-account OAuth review plan without authentication, a network request, or a workspace write. The plan groups only supplied addresses into reviews of at most 10; it never discovers a domain, and the later online preview may skip existing grants. Any parse, shape, provider, platform, tenant, secret-policy, or duplicate-conflict error rejects the entire file before the first mailbox write and names mailboxes[index]; validation-only never writes. A later import infrastructure failure may interrupt the upsert; re-run the same file because import is idempotent by address.",
         "  Docs: https://oxygen-agent.com/docs/providers/mailbox-compatibility",
         "  Skill: oxygen-email-infra (`oxygen skills install --skill oxygen-email-infra`).",
         "",
@@ -13896,15 +14010,13 @@ Run completion:
         });
     }))
         .addCommand(new Command("list")
-        .description("List workflow automations. Archived workflows are hidden unless you pass --include-archived.")
-        .option("--include-archived", "Also list archived workflows, which are hidden by default.")
+        .description("List workflow automations.")
+        .addOption(new Option("--include-archived", "Deprecated no-op retained for compatibility.").hideHelp())
         .option("--tag <tag>", "Only workflows carrying this workspace tag (see `oxygen tags list`).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("workflows list", options, async () => {
             const params = new URLSearchParams();
-            if (options.includeArchived)
-                params.set("include_archived", "true");
             const tag = readOption(options.tag);
             if (tag)
                 params.set("tag", tag);
@@ -14371,10 +14483,11 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
         }
     }))
         .addCommand(new Command("delete")
-        .description("Archive (or, with --purge, permanently delete) one or more workflow automations. Archiving hides the workflow from `workflows list`, disarms its trigger, and is reversible with `workflows enable`/`disable` — see archived workflows again with `workflows list --include-archived`. --purge cannot be undone.")
+        .description("Preview or permanently delete one or more workflow automations. Deletion disarms the workflow and removes its definition, revisions, triggers, and workflow-scoped budget policies; historical run and usage records remain inspectable. Run without --yes to preview, then repeat with --yes to approve.")
         .argument("<workflows...>", "One or more workflow ids, slugs, or names.")
-        .option("--purge", "Permanently remove the workflow instead of archiving it. Run history pages for this workflow become unreachable; this cannot be undone.")
-        .option("--reason <text>", "Why you are deleting it. Recorded on the workflow and shown to the workspace.")
+        .addOption(new Option("--purge", "Deprecated no-op retained for compatibility.").hideHelp())
+        .option("--yes", "Approve the previewed permanent deletion.")
+        .option("--reason <text>", "Why you are deleting it. Attached to the deletion request.")
         .option("--json", "Print a JSON envelope.")
         .action(async (workflows, options) => {
         try {
@@ -14383,7 +14496,7 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
                 method: "POST",
                 body: {
                     ...(single ? { workflow: workflows[0] } : { workflows }),
-                    ...(options.purge ? { purge: true } : {}),
+                    ...(options.yes ? { approved: true } : {}),
                     ...(readOption(options.reason) ? { reason: readOption(options.reason) } : {}),
                 },
             });
@@ -14394,11 +14507,11 @@ Full trigger schema: oxygen workflows schema --subject trigger --json
             if (single) {
                 const workflow = isRecord(data.workflow) ? data.workflow : null;
                 const slug = workflow && typeof workflow.slug === "string" ? workflow.slug : workflows[0];
-                process.stdout.write(`${data.purged === true ? "purged" : "archived"} ${slug}\n`);
+                process.stdout.write(`deleted ${slug}\n`);
                 writeWorkflowActionTail(data);
             }
             else {
-                writeBulkWorkflowResults(data, options.purge ? "purged" : "archived");
+                writeBulkWorkflowResults(data, "deleted");
             }
         }
         catch (error) {

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -512,6 +512,12 @@ function normalizeIntent(query) {
     return query.toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
 }
 function explicitCapabilityIntent(query) {
+    if (isMailboxDeleteIntent(query)) {
+        return ROUTE_BY_ID.get("sending-infrastructure") ?? null;
+    }
+    if (isMailboxOnboardingIntent(query)) {
+        return ROUTE_BY_ID.get("sending-infrastructure") ?? null;
+    }
     if (isHostedWorkflowIntent(query))
         return ROUTE_BY_PRIMITIVE.get("workflows") ?? null;
     if (isOwnedPostCommentIntent(query))
@@ -603,6 +609,36 @@ function highestScoringRoute(query) {
     return best?.card ?? null;
 }
 function recommendationsFor(card, query) {
+    if (card.id === "sending-infrastructure" && isMailboxDeleteIntent(query)) {
+        return {
+            tools: [
+                "oxygen_mailboxes_delete",
+                "oxygen_mailboxes_compatibility",
+                "oxygen_mailboxes_list",
+            ],
+            commands: [
+                "mailboxes delete",
+                "mailboxes compatibility",
+                "mailboxes list",
+            ],
+        };
+    }
+    if (card.id === "sending-infrastructure" && isMailboxOnboardingIntent(query)) {
+        return {
+            tools: [
+                "oxygen_mailboxes_compatibility",
+                "oxygen_mailboxes_import",
+                "oxygen_mailboxes_connect_oauth",
+                "oxygen_mailboxes_oauth_health",
+            ],
+            commands: [
+                "mailboxes compatibility",
+                "mailboxes import",
+                "mailboxes connect-oauth",
+                "mailboxes oauth-health",
+            ],
+        };
+    }
     if (card.primitive === "posts" && isOwnedPostCommentIntent(query)) {
         return {
             tools: ["oxygen_publishing_comments", "oxygen_publishing_analytics"],
@@ -782,6 +818,18 @@ function recommendationsFor(card, query) {
     }
     return { tools: [...card.gatewayTools], commands: [...card.gatewayCommands] };
 }
+function isMailboxOnboardingIntent(query) {
+    const operation = /\b(import|migrat\w*|onboard|register|upload|bring|connect existing|add existing)\b/.test(query);
+    const mailboxScope = /\b(mailbox(?:es)?|inbox(?:es)?|sender accounts?|email accounts?|sending pool)\b/.test(query);
+    return operation && mailboxScope;
+}
+function isMailboxDeleteIntent(query) {
+    const mailboxScope = /\b(mailbox(?:es)?|inbox(?:es)?|sender accounts?|email accounts?)\b/.test(query);
+    const removal = /\b(delete|remove)\b/.test(query)
+        || /\bdisconnect\b.{0,24}\b(mailbox(?:es)?|inbox(?:es)?|sender accounts?|email accounts?)\b/.test(query);
+    const scopedDetach = /\b(remove|disconnect)\b.{0,48}\b(mailbox(?:es)?|inbox(?:es)?|sender accounts?|email accounts?)\b.{0,24}\b(?:from|in|on)\b.{0,24}\b(sequence|campaign|cadence|sender profile)\b/.test(query);
+    return mailboxScope && removal && !scopedDetach;
+}
 function isNetNewLinkedInInitiation(query) {
     const mentionsLinkedIn = /\blinkedin\b|\bdm\b/.test(query);
     const startsConversation = /\b(send|message|dm|contact|reach out|initiate|start)\b/.test(query)

package/node_modules/@oxygen/shared/dist/crm-reply-events.d.ts

@@ -29,7 +29,7 @@ export declare const CRM_SIGNAL_WORKFLOW_EVENT_DEFINITIONS: readonly [{
     readonly label: "Reply classified";
     readonly group: "Replies";
     readonly description: "An inbound email, LinkedIn, or WhatsApp reply received a CRM classification.";
-    readonly payloadFields: readonly ["channel", "status", "email", "linkedin_url", "external_id", "conversation_id", "conversation_url", "counterpart_name", "message", "sequence_id", "enrollment_id", "primary_source"];
+    readonly payloadFields: readonly ["channel", "status", "email", "linkedin_url", "external_id", "conversation_id", "conversation_url", "counterpart_name", "message", "subject", "last_message_text", "occurred_at", "opt_out", "sequence_id", "enrollment_id", "primary_source"];
 }, {
     readonly event: "signup";
     readonly label: "Signup received";

package/node_modules/@oxygen/shared/dist/crm-reply-events.js

@@ -40,6 +40,10 @@ export const CRM_SIGNAL_WORKFLOW_EVENT_DEFINITIONS = [
             "conversation_url",
             "counterpart_name",
             "message",
+            "subject",
+            "last_message_text",
+            "occurred_at",
+            "opt_out",
             "sequence_id",
             "enrollment_id",
             "primary_source",

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -40,6 +40,7 @@ export * from "./networks.js";
 export * from "./recipes.js";
 export * from "./sequence-template.js";
 export * from "./sequence-crm-events.js";
+export * from "./sequence-hubspot-sync.js";
 export * from "./sequence-terminal-events.js";
 export * from "./call-outcomes.js";
 export * from "./dial-guardrail-overrides.js";

package/node_modules/@oxygen/shared/dist/index.js

@@ -40,6 +40,7 @@ export * from "./networks.js";
 export * from "./recipes.js";
 export * from "./sequence-template.js";
 export * from "./sequence-crm-events.js";
+export * from "./sequence-hubspot-sync.js";
 export * from "./sequence-terminal-events.js";
 export * from "./call-outcomes.js";
 export * from "./dial-guardrail-overrides.js";

package/node_modules/@oxygen/shared/dist/mailbox-import.d.ts

@@ -21,6 +21,7 @@ export type MailboxImportValidationSummary = {
     infrastructure_platforms: Record<string, number>;
     credential_rows: number;
     identity_only_rows: number;
+    oauth_review_plan: MailboxOAuthReviewPlan;
     limits: {
         max_rows: number;
         max_file_bytes: number;
@@ -31,8 +32,26 @@ export type MailboxImportValidationSummary = {
     credits_used: 0;
     next_action: string;
 };
+export type MailboxOAuthProviderReviewPlan = {
+    mailboxes: number;
+    batches: number;
+    batch_sizes: number[];
+};
+export type MailboxOAuthReviewPlan = {
+    authorization: "exact_account_oauth";
+    scope: "validated_addresses";
+    directory_discovery: false;
+    existing_grants_checked: false;
+    batch_size: number;
+    total_batches: number;
+    providers: {
+        google: MailboxOAuthProviderReviewPlan;
+        microsoft: MailboxOAuthProviderReviewPlan;
+    };
+};
 export declare const MAILBOX_IMPORT_FILE_MAX_BYTES: number;
 export declare const MAILBOX_IMPORT_ROW_LIMIT = 500;
+export declare const MAILBOX_OAUTH_REVIEW_BATCH_SIZE = 10;
 /**
  * Infer the bounded mailbox-import format without node:path so browser and CLI
  * preflight use the same extension contract.
@@ -55,4 +74,11 @@ export declare function summarizeMailboxImportValidation(mailboxes: readonly Nor
     source: MailboxImportValidationSource;
     sourceProvider: string | null;
 }): MailboxImportValidationSummary;
+/**
+ * Build the deterministic, provider-specific review queue for exact-account
+ * OAuth. This is safe during local file validation: it uses only normalized
+ * provider counts, performs no directory discovery, and does not claim to know
+ * whether a workspace already holds a usable grant for an address.
+ */
+export declare function planMailboxOAuthReviews(mailboxes: readonly Pick<NormalizedMailboxImportRow, "provider">[]): MailboxOAuthReviewPlan;
 export declare function normalizeMailboxImportVendor(raw: string | null | undefined, from: string | null | undefined): string | null;

package/node_modules/@oxygen/shared/dist/mailbox-import.js

@@ -1,6 +1,7 @@
 import { OxygenError } from "./cli-result.js";
 export const MAILBOX_IMPORT_FILE_MAX_BYTES = 5 * 1024 * 1024;
 export const MAILBOX_IMPORT_ROW_LIMIT = 500;
+export const MAILBOX_OAUTH_REVIEW_BATCH_SIZE = 10;
 const MAILBOX_EMAIL_HEADERS = new Set([
     "address",
     "email",
@@ -194,6 +195,7 @@ export function summarizeMailboxImportValidation(mailboxes, input) {
         infrastructure_platforms: infrastructurePlatforms,
         credential_rows: credentialRows,
         identity_only_rows: mailboxes.length - credentialRows,
+        oauth_review_plan: planMailboxOAuthReviews(mailboxes),
         limits: {
             max_rows: MAILBOX_IMPORT_ROW_LIMIT,
             max_file_bytes: MAILBOX_IMPORT_FILE_MAX_BYTES,
@@ -205,6 +207,40 @@ export function summarizeMailboxImportValidation(mailboxes, input) {
         next_action: "Submit this reviewed file to register the mailboxes.",
     };
 }
+/**
+ * Build the deterministic, provider-specific review queue for exact-account
+ * OAuth. This is safe during local file validation: it uses only normalized
+ * provider counts, performs no directory discovery, and does not claim to know
+ * whether a workspace already holds a usable grant for an address.
+ */
+export function planMailboxOAuthReviews(mailboxes) {
+    const counts = { google: 0, microsoft: 0 };
+    for (const mailbox of mailboxes)
+        counts[mailbox.provider] += 1;
+    const google = planProviderOAuthReviews(counts.google);
+    const microsoft = planProviderOAuthReviews(counts.microsoft);
+    return {
+        authorization: "exact_account_oauth",
+        scope: "validated_addresses",
+        directory_discovery: false,
+        existing_grants_checked: false,
+        batch_size: MAILBOX_OAUTH_REVIEW_BATCH_SIZE,
+        total_batches: google.batches + microsoft.batches,
+        providers: { google, microsoft },
+    };
+}
+function planProviderOAuthReviews(mailboxes) {
+    const fullBatches = Math.floor(mailboxes / MAILBOX_OAUTH_REVIEW_BATCH_SIZE);
+    const remainder = mailboxes % MAILBOX_OAUTH_REVIEW_BATCH_SIZE;
+    const batchSizes = Array.from({ length: fullBatches }, () => MAILBOX_OAUTH_REVIEW_BATCH_SIZE);
+    if (remainder > 0)
+        batchSizes.push(remainder);
+    return {
+        mailboxes,
+        batches: batchSizes.length,
+        batch_sizes: batchSizes,
+    };
+}
 export function normalizeMailboxImportVendor(raw, from) {
     if (from === "hypertide") {
         if (raw && raw.trim().toLowerCase() !== "hypertide") {

package/node_modules/@oxygen/shared/dist/sequence-hubspot-sync.d.ts

@@ -0,0 +1,62 @@
+import { type SequenceCrmEventKey } from "./sequence-crm-events.js";
+/**
+ * The HubSpot destination is one product setting backed by two ordinary
+ * Workflows. Sequence activity and classified replies have different durable
+ * event sources, so forcing both through one trigger would either lose reply
+ * content or create a second, provider-specific event bus.
+ */
+export declare const SEQUENCE_HUBSPOT_REPLY_SYNC_TEMPLATE_ID = "sequencer-hubspot-reply-sync";
+/** Existing HubSpot's standard LinkedIn field wins; Oxygen creates its own only as a fallback. */
+export declare const HUBSPOT_LINKEDIN_IDENTITY_PROPERTY_CANDIDATES: readonly ["hs_linkedin_url", "oxygen_linkedin_url"];
+export declare const HUBSPOT_DEFAULT_LEAD_STATUS_PROPERTY = "hs_lead_status";
+/**
+ * Native HubSpot timeline coverage. Reply activities are owned by the
+ * classified-reply Workflow so the activity bridge never creates a contentless
+ * duplicate before classification finishes.
+ */
+export declare const DEFAULT_HUBSPOT_SEQUENCE_TIMELINE_EVENTS: readonly ["email_sent", "email_reply_received", "email_bounced", "linkedin_message_sent", "linkedin_inmail_sent", "linkedin_reply_received"];
+/** Events for which the HubSpot adapter has a first-class activity object. */
+export declare const HUBSPOT_SEQUENCE_TIMELINE_EVENT_KEYS: readonly ["email_sent", "email_reply_received", "email_bounced", "linkedin_message_sent", "linkedin_inmail_sent", "linkedin_reply_received"];
+export declare const HUBSPOT_CLASSIFIED_REPLY_TIMELINE_EVENTS: Set<"email_sent" | "meeting_booked" | "email_bounced" | "linkedin_profile_visited" | "linkedin_connection_sent" | "linkedin_connection_accepted" | "linkedin_message_sent" | "linkedin_inmail_sent" | "linkedin_reply_received" | "linkedin_followed" | "linkedin_post_liked" | "linkedin_post_commented" | "linkedin_connection_withdrawn" | "email_campaign_enrolled" | "email_campaign_moved" | "email_campaign_stopped" | "email_opened" | "email_clicked" | "email_reply_received" | "email_unsubscribed" | "email_spam_complaint" | "whatsapp_message_sent" | "whatsapp_reply_received" | "call_task_created" | "call_connected" | "call_no_answer" | "call_voicemail" | "crm_task_created">;
+export type HubSpotSequenceSyncConfig = {
+    /** Optional latest-occurrence snapshots on HubSpot contact properties. */
+    mappings: Record<SequenceCrmEventKey, string>;
+    /** Writable string property used when a recipient has no email identity. */
+    linkedin_identity_property: string;
+    /** Canonical events projected as native HubSpot Email/Communication activities. */
+    timeline_events: SequenceCrmEventKey[];
+    /** Writable HubSpot enumeration property receiving mapped lead-status values. */
+    lead_status_property: string;
+    /** Deterministic activity outcome (for example a bounce) -> HubSpot option value. */
+    sequence_event_status_mappings: Partial<Record<SequenceCrmEventKey, string>>;
+    /** Classified Oxygen reply status -> HubSpot option value. */
+    reply_status_mappings: Record<string, string>;
+    /** HubSpot option value that wins when the reply carries opt_out=true. */
+    opt_out_status: string;
+};
+export declare const HUBSPOT_SEQUENCE_SYNC_CONFIG_KEYS: readonly ["mappings", "linkedin_identity_property", "timeline_events", "lead_status_property", "sequence_event_status_mappings", "reply_status_mappings", "opt_out_status"];
+/**
+ * Portal labels are discovery hints only. Runtime revisions persist the actual
+ * portal option values returned by HubSpot, which may be localized or custom.
+ */
+export declare const HUBSPOT_SEQUENCE_STATUS_LABEL_RECOMMENDATIONS: {
+    readonly sequenceEvents: {
+        readonly email_bounced: readonly ["Bounced", "Bounce"];
+    };
+    readonly replyStatuses: {
+        readonly interested: readonly ["Interested"];
+        readonly positive_reply: readonly ["Interested"];
+        readonly bounced: readonly ["Bounced", "Bounce"];
+        readonly do_not_contact_again: readonly ["Do Not Contact Again", "Do not contact"];
+        readonly left_company: readonly ["Left Company"];
+    };
+    readonly optOut: readonly ["Do Not Contact Again", "Do not contact"];
+};
+/** Fresh mutable defaults for validation/building; callers may safely merge into them. */
+export declare function defaultHubSpotSequenceSyncConfig(): HubSpotSequenceSyncConfig;
+/**
+ * Apply a partial operator patch without erasing sibling event/status entries.
+ * Arrays and scalar selections replace; keyed maps merge. Validation remains
+ * the Workflow template's responsibility after the merge.
+ */
+export declare function mergeHubSpotSequenceSyncConfigInput(current: Record<string, unknown> | null | undefined, patch: Record<string, unknown> | null | undefined): Record<string, unknown>;

package/node_modules/@oxygen/shared/dist/sequence-hubspot-sync.js

@@ -0,0 +1,100 @@
+import { DEFAULT_SEQUENCE_HUBSPOT_EVENT_MAPPINGS, SEQUENCE_HUBSPOT_LINKEDIN_IDENTITY_PROPERTY, } from "./sequence-crm-events.js";
+/**
+ * The HubSpot destination is one product setting backed by two ordinary
+ * Workflows. Sequence activity and classified replies have different durable
+ * event sources, so forcing both through one trigger would either lose reply
+ * content or create a second, provider-specific event bus.
+ */
+export const SEQUENCE_HUBSPOT_REPLY_SYNC_TEMPLATE_ID = "sequencer-hubspot-reply-sync";
+/** Existing HubSpot's standard LinkedIn field wins; Oxygen creates its own only as a fallback. */
+export const HUBSPOT_LINKEDIN_IDENTITY_PROPERTY_CANDIDATES = [
+    "hs_linkedin_url",
+    SEQUENCE_HUBSPOT_LINKEDIN_IDENTITY_PROPERTY,
+];
+export const HUBSPOT_DEFAULT_LEAD_STATUS_PROPERTY = "hs_lead_status";
+/**
+ * Native HubSpot timeline coverage. Reply activities are owned by the
+ * classified-reply Workflow so the activity bridge never creates a contentless
+ * duplicate before classification finishes.
+ */
+export const DEFAULT_HUBSPOT_SEQUENCE_TIMELINE_EVENTS = [
+    "email_sent",
+    "email_reply_received",
+    "email_bounced",
+    "linkedin_message_sent",
+    "linkedin_inmail_sent",
+    "linkedin_reply_received",
+];
+/** Events for which the HubSpot adapter has a first-class activity object. */
+export const HUBSPOT_SEQUENCE_TIMELINE_EVENT_KEYS = DEFAULT_HUBSPOT_SEQUENCE_TIMELINE_EVENTS;
+export const HUBSPOT_CLASSIFIED_REPLY_TIMELINE_EVENTS = new Set([
+    "email_reply_received",
+    "linkedin_reply_received",
+]);
+const HUBSPOT_SEQUENCE_SYNC_MAP_KEYS = [
+    "mappings",
+    "sequence_event_status_mappings",
+    "reply_status_mappings",
+];
+function recordValue(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+export const HUBSPOT_SEQUENCE_SYNC_CONFIG_KEYS = [
+    "mappings",
+    "linkedin_identity_property",
+    "timeline_events",
+    "lead_status_property",
+    "sequence_event_status_mappings",
+    "reply_status_mappings",
+    "opt_out_status",
+];
+/**
+ * Portal labels are discovery hints only. Runtime revisions persist the actual
+ * portal option values returned by HubSpot, which may be localized or custom.
+ */
+export const HUBSPOT_SEQUENCE_STATUS_LABEL_RECOMMENDATIONS = {
+    sequenceEvents: {
+        email_bounced: ["Bounced", "Bounce"],
+    },
+    replyStatuses: {
+        interested: ["Interested"],
+        positive_reply: ["Interested"],
+        bounced: ["Bounced", "Bounce"],
+        do_not_contact_again: ["Do Not Contact Again", "Do not contact"],
+        left_company: ["Left Company"],
+    },
+    optOut: ["Do Not Contact Again", "Do not contact"],
+};
+/** Fresh mutable defaults for validation/building; callers may safely merge into them. */
+export function defaultHubSpotSequenceSyncConfig() {
+    return {
+        mappings: { ...DEFAULT_SEQUENCE_HUBSPOT_EVENT_MAPPINGS },
+        linkedin_identity_property: SEQUENCE_HUBSPOT_LINKEDIN_IDENTITY_PROPERTY,
+        timeline_events: [...DEFAULT_HUBSPOT_SEQUENCE_TIMELINE_EVENTS],
+        lead_status_property: "",
+        sequence_event_status_mappings: {},
+        reply_status_mappings: {},
+        opt_out_status: "",
+    };
+}
+/**
+ * Apply a partial operator patch without erasing sibling event/status entries.
+ * Arrays and scalar selections replace; keyed maps merge. Validation remains
+ * the Workflow template's responsibility after the merge.
+ */
+export function mergeHubSpotSequenceSyncConfigInput(current, patch) {
+    const base = current ?? {};
+    const next = patch ?? {};
+    const merged = { ...base, ...next };
+    for (const key of HUBSPOT_SEQUENCE_SYNC_MAP_KEYS) {
+        if (Object.prototype.hasOwnProperty.call(next, key)) {
+            merged[key] = {
+                ...recordValue(base[key]),
+                ...recordValue(next[key]),
+            };
+        }
+    }
+    return merged;
+}

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const OXYGEN_VERSION = "1.691.5";
+export declare const OXYGEN_VERSION = "1.696.0";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.691.5";
+export const OXYGEN_VERSION = "1.696.0";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/node_modules/@oxygen/shared/dist/workspace-event-catalog.js

@@ -11,6 +11,13 @@ const sequenceActivityFields = [
     "email",
     "linkedin_url",
     "lead_name",
+    "channel",
+    "direction",
+    "subject",
+    "body",
+    "body_html",
+    "action_kind",
+    "provider_message_id",
 ];
 const sequenceTerminalFields = [
     "occurred_at",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.691.5",
+  "version": "1.696.0",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",