@oxygen-agent/cli 1.861.1 → 1.883.2

package/node_modules/@oxygen/shared/dist/json-path.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The one dot-path parser and walker.
+ *
+ * Before this module the repo carried a dozen near-identical implementations —
+ * tool `outputPath`, custom-HTTP output projection, formula `path()`, table-send
+ * mappings, prompt templates, SQL filters, the grid's payload reader, and more.
+ * They agreed on the happy path and disagreed on the edges, which is exactly how
+ * "the filter and the cell read different values" bugs are born.
+ *
+ * The one design constraint that made consolidation possible: **nothing here
+ * throws.** Every existing call site raises its own typed `OxygenError` on a
+ * malformed path — `invalid_output_path`, `invalid_table_send_mapping`,
+ * `formulaExpressionError`, `invalid_column_run` — and a caller must be able to
+ * keep raising exactly the error it raised before. So parse/walk failures come
+ * back as discriminated results and the call site decides what they mean.
+ *
+ * Two behaviours differ between call sites and are therefore explicit options
+ * rather than defaults:
+ *
+ * - `brackets` (`a[0]` as sugar for `a.0`) exists only in the SQL filter parser.
+ * - `parseJsonStrings` (treat a string that looks like a JSON container as its
+ *   parsed value) exists only in table-send, whose documented reason — "text
+ *   columns holding JSON (AI outputs) still resolve" — is also why structured AI
+ *   columns stored as `text` are reachable at all.
+ *
+ * Both default OFF so a migrated call site is provably unchanged.
+ *
+ * There are also two *validation timings* in the wild, and both are preserved:
+ *
+ * - **Up-front** (`parseJsonPath` + `readJsonPath`): the whole path is validated
+ *   before traversal, so `"a..b"` is rejected even against a null value.
+ * - **Lazy** (`walkJsonPath`): an empty segment is only noticed if traversal
+ *   actually reaches it, so `"a..b"` against a null value resolves to null and
+ *   never reports the malformed path.
+ *
+ * That difference is observable, so it is a choice the caller makes, not one
+ * this module makes for it.
+ */
+export type JsonPathSegment = string | number;
+export type ParseJsonPathResult = {
+    ok: true;
+    segments: string[];
+} | {
+    ok: false;
+    reason: "empty_segment";
+};
+export type WalkJsonPathResult = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    reason: "empty_segment";
+};
+export type JsonPathReadOptions = {
+    /**
+     * Parse a string that looks like a serialized JSON object/array into its
+     * container before traversing it — at the root and at every level, because a
+     * provider payload can nest a JSON string inside a real object.
+     */
+    parseJsonStrings?: boolean;
+};
+export type ParseJsonPathOptions = {
+    /** Accept `a[0]` / `a[0][1]` as sugar for `a.0` / `a.0.1`. */
+    brackets?: boolean;
+    /** What an empty segment (`"a..b"`, `"a."`) means. Default `"reject"`. */
+    emptySegment?: "skip" | "reject";
+};
+/**
+ * A string that stores a serialized JSON object/array is treated as its parsed
+ * container; anything else is returned untouched — including strings that fail
+ * to parse, which stay the string they were rather than becoming null.
+ */
+export declare function coerceJsonContainer(value: unknown): unknown;
+/**
+ * Split a dot-path into trimmed segments, validating up front.
+ *
+ * An empty or whitespace-only path is "no path" and parses to zero segments —
+ * every call site short-circuits on it before validating, and treating it as one
+ * empty segment would reject the one input they all accept. A path that has real
+ * segments AND an empty one (`"a."`, `"a..b"`) is still malformed.
+ */
+export declare function parseJsonPath(path: string, options?: ParseJsonPathOptions): ParseJsonPathResult;
+/**
+ * Walk pre-parsed segments. A missing key, an out-of-range index, or a null
+ * encountered mid-path all resolve to `null` — a path that does not lead
+ * anywhere is an absent value, never an error.
+ *
+ * Traversal is own-property only (`Object.hasOwn`), so `__proto__`,
+ * `constructor` and the rest of the prototype chain are unreachable through a
+ * path even when the path names them.
+ */
+export declare function readJsonPath(value: unknown, segments: readonly JsonPathSegment[], options?: JsonPathReadOptions): unknown;
+/**
+ * Walk a raw dot-path with LAZY validation: an empty segment is reported only if
+ * traversal reaches it. This is the shape tool `outputPath` and formula `path()`
+ * have always had, and the difference is observable — `("a..b")` against a null
+ * value resolves to null here and is rejected by `parseJsonPath`.
+ *
+ * Prefer `parseJsonPath` + `readJsonPath` for new code; this exists so the
+ * existing call sites stay byte-identical.
+ */
+export declare function walkJsonPath(value: unknown, rawPath: string, options?: JsonPathReadOptions): WalkJsonPathResult;
+/**
+ * Can this path be written as a `{{column.path}}` mention token? Segments with
+ * spaces, dots, or punctuation cannot — which is not hypothetical: a research
+ * column names its output sections after free-text prompt labels ("Funding
+ * Stage"), and those are filterable and sortable but not referenceable.
+ */
+export declare function isTemplateSafePath(path: string): boolean;

package/node_modules/@oxygen/shared/dist/json-path.js

@@ -0,0 +1,177 @@
+/**
+ * The one dot-path parser and walker.
+ *
+ * Before this module the repo carried a dozen near-identical implementations —
+ * tool `outputPath`, custom-HTTP output projection, formula `path()`, table-send
+ * mappings, prompt templates, SQL filters, the grid's payload reader, and more.
+ * They agreed on the happy path and disagreed on the edges, which is exactly how
+ * "the filter and the cell read different values" bugs are born.
+ *
+ * The one design constraint that made consolidation possible: **nothing here
+ * throws.** Every existing call site raises its own typed `OxygenError` on a
+ * malformed path — `invalid_output_path`, `invalid_table_send_mapping`,
+ * `formulaExpressionError`, `invalid_column_run` — and a caller must be able to
+ * keep raising exactly the error it raised before. So parse/walk failures come
+ * back as discriminated results and the call site decides what they mean.
+ *
+ * Two behaviours differ between call sites and are therefore explicit options
+ * rather than defaults:
+ *
+ * - `brackets` (`a[0]` as sugar for `a.0`) exists only in the SQL filter parser.
+ * - `parseJsonStrings` (treat a string that looks like a JSON container as its
+ *   parsed value) exists only in table-send, whose documented reason — "text
+ *   columns holding JSON (AI outputs) still resolve" — is also why structured AI
+ *   columns stored as `text` are reachable at all.
+ *
+ * Both default OFF so a migrated call site is provably unchanged.
+ *
+ * There are also two *validation timings* in the wild, and both are preserved:
+ *
+ * - **Up-front** (`parseJsonPath` + `readJsonPath`): the whole path is validated
+ *   before traversal, so `"a..b"` is rejected even against a null value.
+ * - **Lazy** (`walkJsonPath`): an empty segment is only noticed if traversal
+ *   actually reaches it, so `"a..b"` against a null value resolves to null and
+ *   never reports the malformed path.
+ *
+ * That difference is observable, so it is a choice the caller makes, not one
+ * this module makes for it.
+ */
+const NUMERIC_SEGMENT = /^\d+$/;
+const TEMPLATE_SAFE_PATH = /^[a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*$/;
+// A head of one-or-more non-`[` characters, optionally followed by one or more
+// `[123]` index groups. Anything else (a stray bracket, an unclosed group) is
+// left as a single literal segment rather than silently reinterpreted.
+const BRACKET_SEGMENT = /^([^[]+)((?:\[\d+\])+)?$/;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * A string that stores a serialized JSON object/array is treated as its parsed
+ * container; anything else is returned untouched — including strings that fail
+ * to parse, which stay the string they were rather than becoming null.
+ */
+export function coerceJsonContainer(value) {
+    if (typeof value !== "string")
+        return value;
+    const trimmed = value.trim();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("["))
+        return value;
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * Split a dot-path into trimmed segments, validating up front.
+ *
+ * An empty or whitespace-only path is "no path" and parses to zero segments —
+ * every call site short-circuits on it before validating, and treating it as one
+ * empty segment would reject the one input they all accept. A path that has real
+ * segments AND an empty one (`"a."`, `"a..b"`) is still malformed.
+ */
+export function parseJsonPath(path, options = {}) {
+    const emptySegment = options.emptySegment ?? "reject";
+    const segments = [];
+    if (!path.trim())
+        return { ok: true, segments };
+    for (const rawSegment of path.split(".")) {
+        const segment = rawSegment.trim();
+        if (!segment) {
+            if (emptySegment === "skip")
+                continue;
+            return { ok: false, reason: "empty_segment" };
+        }
+        if (!options.brackets) {
+            segments.push(segment);
+            continue;
+        }
+        const bracketMatch = BRACKET_SEGMENT.exec(segment);
+        if (!bracketMatch) {
+            segments.push(segment);
+            continue;
+        }
+        const head = bracketMatch[1]?.trim();
+        if (head)
+            segments.push(head);
+        for (const index of bracketMatch[2]?.match(/\d+/g) ?? [])
+            segments.push(index);
+    }
+    return { ok: true, segments };
+}
+/**
+ * Walk pre-parsed segments. A missing key, an out-of-range index, or a null
+ * encountered mid-path all resolve to `null` — a path that does not lead
+ * anywhere is an absent value, never an error.
+ *
+ * Traversal is own-property only (`Object.hasOwn`), so `__proto__`,
+ * `constructor` and the rest of the prototype chain are unreachable through a
+ * path even when the path names them.
+ */
+export function readJsonPath(value, segments, options = {}) {
+    const parseStrings = options.parseJsonStrings === true;
+    let current = parseStrings ? coerceJsonContainer(value) : value;
+    for (const segment of segments) {
+        if (current === null || current === undefined)
+            return null;
+        if (parseStrings)
+            current = coerceJsonContainer(current);
+        if (Array.isArray(current)
+            && (typeof segment === "number" || NUMERIC_SEGMENT.test(segment))) {
+            current = current[Number(segment)] ?? null;
+            continue;
+        }
+        const key = String(segment);
+        if (isRecord(current) && Object.hasOwn(current, key)) {
+            current = current[key];
+            continue;
+        }
+        return null;
+    }
+    return current ?? null;
+}
+/**
+ * Walk a raw dot-path with LAZY validation: an empty segment is reported only if
+ * traversal reaches it. This is the shape tool `outputPath` and formula `path()`
+ * have always had, and the difference is observable — `("a..b")` against a null
+ * value resolves to null here and is rejected by `parseJsonPath`.
+ *
+ * Prefer `parseJsonPath` + `readJsonPath` for new code; this exists so the
+ * existing call sites stay byte-identical.
+ */
+export function walkJsonPath(value, rawPath, options = {}) {
+    const parseStrings = options.parseJsonStrings === true;
+    const path = rawPath.trim();
+    let current = parseStrings ? coerceJsonContainer(value) : value;
+    if (!path)
+        return { ok: true, value: current ?? null };
+    for (const rawSegment of path.split(".")) {
+        const segment = rawSegment.trim();
+        if (!segment)
+            return { ok: false, reason: "empty_segment" };
+        if (current === null || current === undefined)
+            return { ok: true, value: null };
+        if (parseStrings)
+            current = coerceJsonContainer(current);
+        if (Array.isArray(current) && NUMERIC_SEGMENT.test(segment)) {
+            current = current[Number(segment)] ?? null;
+            continue;
+        }
+        if (isRecord(current) && Object.hasOwn(current, segment)) {
+            current = current[segment];
+            continue;
+        }
+        return { ok: true, value: null };
+    }
+    return { ok: true, value: current ?? null };
+}
+/**
+ * Can this path be written as a `{{column.path}}` mention token? Segments with
+ * spaces, dots, or punctuation cannot — which is not hypothetical: a research
+ * column names its output sections after free-text prompt labels ("Funding
+ * Stage"), and those are filterable and sortable but not referenceable.
+ */
+export function isTemplateSafePath(path) {
+    return TEMPLATE_SAFE_PATH.test(path);
+}

package/node_modules/@oxygen/shared/dist/log-collapse.d.ts

@@ -37,9 +37,12 @@
  * ingest batch. Query them as `['worker_fields']['occurrences']`, never flat.
  *
  * NOT a substitute for the log line: an OTel counter is not a backstop for
- * collapsed volume. `registerOTel()` on web is called with no metric readers and
- * the worker only builds one when AXIOM_METRICS_DATASET is set (it is not), so
- * every recordTelemetryCounter call in this repo is a no-op today. If a signal
+ * collapsed volume. `registerOTel()` on web is called with no metric readers
+ * (apps/web/src/instrumentation.ts:48), so a counter on the WEB surface is a
+ * no-op. The worker DOES build one — AXIOM_METRICS_DATASET is set in Doppler
+ * `oxygen-worker/prd` — so worker counters are live and re-exported every 60s,
+ * which is why their labels are allow-listed in packages/shared/src/telemetry.ts.
+ * Neither case makes a counter the right home for collapsed volume: if a signal
  * matters it stays in the LOG — which is what `occurrences`/`suppressed` are for.
  */
 /** Why a window's state was retired — carried on the closing rollup line. */

package/node_modules/@oxygen/shared/dist/log-collapse.js

@@ -37,9 +37,12 @@
  * ingest batch. Query them as `['worker_fields']['occurrences']`, never flat.
  *
  * NOT a substitute for the log line: an OTel counter is not a backstop for
- * collapsed volume. `registerOTel()` on web is called with no metric readers and
- * the worker only builds one when AXIOM_METRICS_DATASET is set (it is not), so
- * every recordTelemetryCounter call in this repo is a no-op today. If a signal
+ * collapsed volume. `registerOTel()` on web is called with no metric readers
+ * (apps/web/src/instrumentation.ts:48), so a counter on the WEB surface is a
+ * no-op. The worker DOES build one — AXIOM_METRICS_DATASET is set in Doppler
+ * `oxygen-worker/prd` — so worker counters are live and re-exported every 60s,
+ * which is why their labels are allow-listed in packages/shared/src/telemetry.ts.
+ * Neither case makes a counter the right home for collapsed volume: if a signal
  * matters it stays in the LOG — which is what `occurrences`/`suppressed` are for.
  */
 export function createLogCollapser(options) {

package/node_modules/@oxygen/shared/dist/pricing-sheet.d.ts

@@ -39,6 +39,14 @@ export declare const PRICING_SHEET_VERIFIED = "2026-07";
 export declare const PRICING_CREDITS_PER_USD = 1000;
 /** On-demand top-up price per 1,000 credits (USD); subscriptions pay $1.00. */
 export declare const TOPUP_USD_PER_1K = 1.25;
+export declare const SENDING_SEAT_USD_CENTS: {
+    readonly linkedin: 3000;
+    readonly whatsapp: 3000;
+    readonly phone_number: 1000;
+    readonly email_sender: 100;
+};
+export declare const MANAGED_INBOX_USD_CENTS = 400;
+export declare const SENDING_DOMAIN_USD_CENTS = 1250;
 export declare const SUBSCRIPTION_USD_PER_1K = 1;
 /**
  * AI column runs, honest 5× of modeled tier COGS.

package/node_modules/@oxygen/shared/dist/pricing-sheet.js

@@ -34,12 +34,18 @@
  * loadPricingBook() instead of importing this file, so a staff re-price at
  * /admin/costs takes effect without a deploy.
  */
-import { AUTOMATION_ACTION_CREDITS as SNAPSHOT_AUTOMATION_ACTION_CREDITS, CREDITS_PER_USD as SNAPSHOT_CREDITS_PER_USD, DELIVERABILITY_INCLUDED_TESTS_PER_INBOX as SNAPSHOT_DELIVERABILITY_INCLUDED_TESTS_PER_INBOX, DELIVERABILITY_SEAT_CREDITS_PER_MONTH as SNAPSHOT_DELIVERABILITY_SEAT_CREDITS_PER_MONTH, EGRESS_IP_CREDITS_PER_MONTH as SNAPSHOT_EGRESS_IP_CREDITS_PER_MONTH, ENRICHMENT_CREDITS_PER_ROW_TYPICAL as SNAPSHOT_ENRICHMENT_CREDITS_PER_ROW_TYPICAL, LINKEDIN_ACCOUNT_CREDITS_PER_MONTH as SNAPSHOT_LINKEDIN_ACCOUNT_CREDITS_PER_MONTH, LINKEDIN_ACTION_CREDITS as SNAPSHOT_LINKEDIN_ACTION_CREDITS, LINKEDIN_TYPICAL_ACTIONS_CREDITS_PER_MONTH as SNAPSHOT_LINKEDIN_TYPICAL_ACTIONS_CREDITS_PER_MONTH, MANAGED_DOMAIN_CREDITS_PER_YEAR_TYPICAL as SNAPSHOT_MANAGED_DOMAIN_CREDITS_PER_YEAR_TYPICAL, MANAGED_DOMAIN_MARKUP as SNAPSHOT_MANAGED_DOMAIN_MARKUP, MANAGED_INBOX_CREDITS_PER_MONTH as SNAPSHOT_MANAGED_INBOX_CREDITS_PER_MONTH, MANAGED_INBOX_MARKUP as SNAPSHOT_MANAGED_INBOX_MARKUP, PLACEMENT_TEST_OVERAGE_CREDITS as SNAPSHOT_PLACEMENT_TEST_OVERAGE_CREDITS, PRICE_SHEET_VERIFIED as SNAPSHOT_PRICE_SHEET_VERIFIED, SEND_CREDITS as SNAPSHOT_SEND_CREDITS, SUBSCRIPTION_USD_PER_1K as SNAPSHOT_SUBSCRIPTION_USD_PER_1K, TOPUP_USD_PER_1K as SNAPSHOT_TOPUP_USD_PER_1K, VOICE_CREDITS_PER_AMD_CALL as SNAPSHOT_VOICE_CREDITS_PER_AMD_CALL, VOICE_CREDITS_PER_MINUTE as SNAPSHOT_VOICE_CREDITS_PER_MINUTE, VOICE_MARKUP as SNAPSHOT_VOICE_MARKUP, VOICE_NUMBER_CREDITS_PER_MONTH as SNAPSHOT_VOICE_NUMBER_CREDITS_PER_MONTH, WHATSAPP_ACCOUNT_CREDITS_PER_MONTH as SNAPSHOT_WHATSAPP_ACCOUNT_CREDITS_PER_MONTH, } from "./pricing-snapshot.generated.js";
+import { AUTOMATION_ACTION_CREDITS as SNAPSHOT_AUTOMATION_ACTION_CREDITS, CREDITS_PER_USD as SNAPSHOT_CREDITS_PER_USD, DELIVERABILITY_INCLUDED_TESTS_PER_INBOX as SNAPSHOT_DELIVERABILITY_INCLUDED_TESTS_PER_INBOX, DELIVERABILITY_SEAT_CREDITS_PER_MONTH as SNAPSHOT_DELIVERABILITY_SEAT_CREDITS_PER_MONTH, EGRESS_IP_CREDITS_PER_MONTH as SNAPSHOT_EGRESS_IP_CREDITS_PER_MONTH, MANAGED_INBOX_USD_CENTS as SNAPSHOT_MANAGED_INBOX_USD_CENTS, SENDING_DOMAIN_USD_CENTS as SNAPSHOT_SENDING_DOMAIN_USD_CENTS, SENDING_SEAT_USD_CENTS as SNAPSHOT_SENDING_SEAT_USD_CENTS, ENRICHMENT_CREDITS_PER_ROW_TYPICAL as SNAPSHOT_ENRICHMENT_CREDITS_PER_ROW_TYPICAL, LINKEDIN_ACCOUNT_CREDITS_PER_MONTH as SNAPSHOT_LINKEDIN_ACCOUNT_CREDITS_PER_MONTH, LINKEDIN_ACTION_CREDITS as SNAPSHOT_LINKEDIN_ACTION_CREDITS, LINKEDIN_TYPICAL_ACTIONS_CREDITS_PER_MONTH as SNAPSHOT_LINKEDIN_TYPICAL_ACTIONS_CREDITS_PER_MONTH, MANAGED_DOMAIN_CREDITS_PER_YEAR_TYPICAL as SNAPSHOT_MANAGED_DOMAIN_CREDITS_PER_YEAR_TYPICAL, MANAGED_DOMAIN_MARKUP as SNAPSHOT_MANAGED_DOMAIN_MARKUP, MANAGED_INBOX_CREDITS_PER_MONTH as SNAPSHOT_MANAGED_INBOX_CREDITS_PER_MONTH, MANAGED_INBOX_MARKUP as SNAPSHOT_MANAGED_INBOX_MARKUP, PLACEMENT_TEST_OVERAGE_CREDITS as SNAPSHOT_PLACEMENT_TEST_OVERAGE_CREDITS, PRICE_SHEET_VERIFIED as SNAPSHOT_PRICE_SHEET_VERIFIED, SEND_CREDITS as SNAPSHOT_SEND_CREDITS, SUBSCRIPTION_USD_PER_1K as SNAPSHOT_SUBSCRIPTION_USD_PER_1K, TOPUP_USD_PER_1K as SNAPSHOT_TOPUP_USD_PER_1K, VOICE_CREDITS_PER_AMD_CALL as SNAPSHOT_VOICE_CREDITS_PER_AMD_CALL, VOICE_CREDITS_PER_MINUTE as SNAPSHOT_VOICE_CREDITS_PER_MINUTE, VOICE_MARKUP as SNAPSHOT_VOICE_MARKUP, VOICE_NUMBER_CREDITS_PER_MONTH as SNAPSHOT_VOICE_NUMBER_CREDITS_PER_MONTH, WHATSAPP_ACCOUNT_CREDITS_PER_MONTH as SNAPSHOT_WHATSAPP_ACCOUNT_CREDITS_PER_MONTH, } from "./pricing-snapshot.generated.js";
 export { creditsToUsd, usdToCredits } from "./pricing-snapshot.generated.js";
 export const PRICING_SHEET_VERIFIED = SNAPSHOT_PRICE_SHEET_VERIFIED;
 export const PRICING_CREDITS_PER_USD = SNAPSHOT_CREDITS_PER_USD;
 /** On-demand top-up price per 1,000 credits (USD); subscriptions pay $1.00. */
 export const TOPUP_USD_PER_1K = SNAPSHOT_TOPUP_USD_PER_1K;
+// Dollar-priced CAPACITY, re-exported on the client-safe subpath so the pricing
+// calculator and the marketing sections quote the same numbers the product
+// charges. These are not credits and must never be converted as if they were.
+export const SENDING_SEAT_USD_CENTS = SNAPSHOT_SENDING_SEAT_USD_CENTS;
+export const MANAGED_INBOX_USD_CENTS = SNAPSHOT_MANAGED_INBOX_USD_CENTS;
+export const SENDING_DOMAIN_USD_CENTS = SNAPSHOT_SENDING_DOMAIN_USD_CENTS;
 export const SUBSCRIPTION_USD_PER_1K = SNAPSHOT_SUBSCRIPTION_USD_PER_1K;
 /**
  * AI column runs, honest 5× of modeled tier COGS.

package/node_modules/@oxygen/shared/dist/pricing-snapshot.generated.d.ts

@@ -35,6 +35,8 @@ export declare const SENDING_SEAT_USD_CENTS: {
     readonly email_sender: 100;
 };
 export type SendingSeatKey = keyof typeof SENDING_SEAT_USD_CENTS;
+export declare const MANAGED_INBOX_USD_CENTS = 400;
+export declare const SENDING_DOMAIN_USD_CENTS = 1250;
 export declare const VOICE_NUMBER_CREDITS_PER_MONTH = 5000;
 export declare const VOICE_CREDITS_PER_MINUTE = 90;
 export declare const VOICE_CREDITS_PER_AMD_CALL = 38;

package/node_modules/@oxygen/shared/dist/pricing-snapshot.generated.js

@@ -60,6 +60,19 @@ export const SENDING_SEAT_USD_CENTS = {
     phone_number: 1_000,
     email_sender: 100,
 };
+// --- email infrastructure (USD, Stripe-billed) -------------------------------
+//
+// Sold in dollars as real Stripe products, not credits. MANAGED_INBOX is ALL-IN:
+// it already contains the sending seat and warm-up, so a customer never assembles
+// a working mailbox out of parts and can never end up holding a mailbox with no
+// seat to send from. A customer bringing their OWN mailbox pays the $1
+// email_sender seat instead.
+//
+// The domain is FLAT rather than cost x 1.25. That is only safe because the
+// below-cost guard refuses any quote whose line price falls under live vendor
+// cost, so an expensive TLD is refused rather than silently sold at a loss.
+export const MANAGED_INBOX_USD_CENTS = 400;
+export const SENDING_DOMAIN_USD_CENTS = 1_250;
 // --- voice ------------------------------------------------------------------
 export const VOICE_NUMBER_CREDITS_PER_MONTH = 5_000;
 export const VOICE_CREDITS_PER_MINUTE = 90;

package/node_modules/@oxygen/shared/dist/research-output-contract.d.ts

@@ -0,0 +1,53 @@
+export type ResearchOutputContract = {
+    version: 1;
+    sections: string[];
+    evidenceRequired: boolean;
+    derivedFrom: "prompt_labeled_sections";
+};
+/**
+ * Derive the result shape the prompt explicitly asks the research column to
+ * return. This is intentionally conservative: prose containing colons is not a
+ * contract. We only accept a contiguous list after an explicit output-sections
+ * marker, and require at least two distinct labels.
+ */
+export declare function deriveResearchOutputContract(prompt: string, options: {
+    evidenceRequired: boolean;
+}): ResearchOutputContract | null;
+export declare function buildResearchOutputSchema(contract: ResearchOutputContract | null): Record<string, unknown>;
+/**
+ * The schema of the research cell as it is actually STORED — which is not the
+ * schema the model answers in.
+ *
+ * `finalizeResearchCellValue` rewrites the model's answer on the way to the
+ * cell: `citations` (1-based indices into the evidence block) are resolved
+ * against the sources Oxygen really fetched and replaced by `sources`, and a
+ * `validation` block records whether the prompt's own section contract held.
+ * So a consumer asking "what fields does this column expose" — the reference
+ * picker, a filter, a sub-column — must read THIS shape. Deriving those from
+ * `buildResearchOutputSchema` would offer `citations`, which no cell has, and
+ * hide `sources`, which every cell does.
+ */
+export declare function buildResearchCellSchema(contract: ResearchOutputContract | null): Record<string, unknown>;
+/**
+ * Is this research column's output schema OWNED BY THE SERVER, i.e. re-derived
+ * from the prompt rather than authored by hand?
+ *
+ * Three cases mean yes, and they are not interchangeable:
+ *   - no schema at all — a column created before contracts existed, or one the
+ *     author never touched;
+ *   - exactly the legacy broad `{answer,found,confidence,citations}` shape,
+ *     which is how a pre-contract column upgrades itself at run time and on its
+ *     next edit with no data migration;
+ *   - a stored `researchOutput` marker, which says a previous normalize derived
+ *     the shape and a prompt edit must re-derive it.
+ *
+ * The normalizer and the runner both have to answer this, and they used to
+ * answer it with two hand-written copies that could drift into "the run used a
+ * different schema than the column was saved with".
+ */
+export declare function usesServerManagedResearchSchema(definition: {
+    outputSchema?: unknown;
+    researchOutput?: unknown;
+} | null | undefined): boolean;
+/** Stored columns predating the prompt-derived contract carry this broad schema. */
+export declare function isLegacyResearchOutputSchema(schema: unknown): boolean;

package/node_modules/@oxygen/shared/dist/research-output-contract.js

@@ -0,0 +1,196 @@
+const MAX_RESEARCH_SECTIONS = 20;
+const OUTPUT_SECTIONS_MARKER = /\b(?:return|provide|include|produce|output)\b.{0,80}\b(?:labeled|named|required|requested)?\s*(?:output\s+)?sections?\s*:/i;
+const LABELED_SECTION = /^(?:[-*+]\s+|\d+[.)]\s+)?([A-Za-z][A-Za-z0-9_. /&()'’+\-]{1,79})\s*:\s*.*$/;
+/**
+ * Derive the result shape the prompt explicitly asks the research column to
+ * return. This is intentionally conservative: prose containing colons is not a
+ * contract. We only accept a contiguous list after an explicit output-sections
+ * marker, and require at least two distinct labels.
+ */
+export function deriveResearchOutputContract(prompt, options) {
+    const lines = prompt.replaceAll("\r\n", "\n").split("\n");
+    const markerIndex = lines.findIndex((line) => OUTPUT_SECTIONS_MARKER.test(line));
+    if (markerIndex < 0)
+        return null;
+    const sections = [];
+    const seen = new Set();
+    let started = false;
+    for (const rawLine of lines.slice(markerIndex + 1)) {
+        const line = rawLine.trim();
+        if (!line) {
+            if (started)
+                break;
+            continue;
+        }
+        const match = LABELED_SECTION.exec(line);
+        if (!match) {
+            if (started)
+                break;
+            continue;
+        }
+        started = true;
+        const heading = match[1].trim();
+        const normalized = heading.toLocaleLowerCase("en-US");
+        if (!seen.has(normalized)) {
+            seen.add(normalized);
+            sections.push(heading);
+        }
+        if (sections.length >= MAX_RESEARCH_SECTIONS)
+            break;
+    }
+    if (sections.length < 2)
+        return null;
+    return {
+        version: 1,
+        sections,
+        evidenceRequired: options.evidenceRequired,
+        derivedFrom: "prompt_labeled_sections",
+    };
+}
+export function buildResearchOutputSchema(contract) {
+    const answer = contract
+        ? {
+            type: "object",
+            additionalProperties: false,
+            properties: Object.fromEntries(contract.sections.map((section) => [
+                section,
+                {
+                    type: ["string", "null"],
+                    description: `The requested '${section}' section, or null when the evidence does not support it.`,
+                },
+            ])),
+            required: contract.sections,
+        }
+        : {
+            type: ["string", "null"],
+            description: "The answer, or null when the evidence does not contain it.",
+        };
+    return {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            answer,
+            found: {
+                type: "boolean",
+                description: "True only when the evidence actually answers the question.",
+            },
+            confidence: {
+                type: "string",
+                enum: ["high", "medium", "low"],
+                description: "How well the evidence supports the answer.",
+            },
+            citations: {
+                type: "array",
+                items: { type: "integer" },
+                description: "1-based indices of the <web_evidence> entries the answer relies on.",
+            },
+        },
+        required: ["answer", "found", "confidence", "citations"],
+    };
+}
+/**
+ * The schema of the research cell as it is actually STORED — which is not the
+ * schema the model answers in.
+ *
+ * `finalizeResearchCellValue` rewrites the model's answer on the way to the
+ * cell: `citations` (1-based indices into the evidence block) are resolved
+ * against the sources Oxygen really fetched and replaced by `sources`, and a
+ * `validation` block records whether the prompt's own section contract held.
+ * So a consumer asking "what fields does this column expose" — the reference
+ * picker, a filter, a sub-column — must read THIS shape. Deriving those from
+ * `buildResearchOutputSchema` would offer `citations`, which no cell has, and
+ * hide `sources`, which every cell does.
+ */
+export function buildResearchCellSchema(contract) {
+    const modelSchema = buildResearchOutputSchema(contract);
+    const properties = isObject(modelSchema.properties) ? { ...modelSchema.properties } : {};
+    delete properties.citations;
+    return {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            ...properties,
+            sources: {
+                type: "array",
+                description: "The sources the answer actually grounded on, in evidence order.",
+                items: {
+                    type: "object",
+                    additionalProperties: true,
+                    properties: {
+                        title: { type: ["string", "null"], description: "Source title." },
+                        url: { type: ["string", "null"], description: "Source URL." },
+                        engine: { type: ["string", "null"], description: "Search engine that returned it." },
+                        published_date: { type: ["string", "null"], description: "Publication date, when known." },
+                    },
+                },
+            },
+            validation: {
+                type: "object",
+                additionalProperties: true,
+                description: "Whether the answer satisfied the prompt's section and evidence contract.",
+                properties: {
+                    valid: { type: "boolean", description: "True when every contract check passed." },
+                },
+            },
+        },
+        required: ["answer", "found", "confidence", "sources"],
+    };
+}
+/**
+ * Is this research column's output schema OWNED BY THE SERVER, i.e. re-derived
+ * from the prompt rather than authored by hand?
+ *
+ * Three cases mean yes, and they are not interchangeable:
+ *   - no schema at all — a column created before contracts existed, or one the
+ *     author never touched;
+ *   - exactly the legacy broad `{answer,found,confidence,citations}` shape,
+ *     which is how a pre-contract column upgrades itself at run time and on its
+ *     next edit with no data migration;
+ *   - a stored `researchOutput` marker, which says a previous normalize derived
+ *     the shape and a prompt edit must re-derive it.
+ *
+ * The normalizer and the runner both have to answer this, and they used to
+ * answer it with two hand-written copies that could drift into "the run used a
+ * different schema than the column was saved with".
+ */
+export function usesServerManagedResearchSchema(definition) {
+    if (!definition)
+        return true;
+    const schema = definition.outputSchema;
+    return schema === undefined
+        || schema === null
+        || isLegacyResearchOutputSchema(schema)
+        || isObject(definition.researchOutput);
+}
+/** Stored columns predating the prompt-derived contract carry this broad schema. */
+export function isLegacyResearchOutputSchema(schema) {
+    if (!isObject(schema))
+        return false;
+    if (schema.type !== "object" || schema.additionalProperties !== false)
+        return false;
+    const properties = isObject(schema.properties) ? schema.properties : null;
+    if (!properties || !hasExactMembers(Object.keys(properties), ["answer", "found", "confidence", "citations"])) {
+        return false;
+    }
+    if (!hasExactMembers(schema.required, ["answer", "found", "confidence", "citations"]))
+        return false;
+    if (!isObject(properties.answer) || !isObject(properties.found)
+        || !isObject(properties.confidence) || !isObject(properties.citations))
+        return false;
+    const answerType = properties.answer.type;
+    const citationItems = isObject(properties.citations.items) ? properties.citations.items : null;
+    return hasExactMembers(answerType, ["string", "null"])
+        && properties.found.type === "boolean"
+        && properties.confidence.type === "string"
+        && hasExactMembers(properties.confidence.enum, ["high", "medium", "low"])
+        && properties.citations.type === "array"
+        && citationItems?.type === "integer";
+}
+function hasExactMembers(value, expected) {
+    return Array.isArray(value)
+        && value.length === expected.length
+        && expected.every((member) => value.includes(member));
+}
+function isObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}