@oxygen-agent/cli 1.894.0 → 1.917.5

package/node_modules/@oxygen/shared/dist/product-briefing-rules.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The briefing contract: every behavioural rule the OXYGEN session briefing has
+ * to state, and which half of it owns that rule.
+ *
+ * WHY THIS FILE EXISTS. The briefing is one string an agent reads once per
+ * session, so its only failure mode is silent omission: nothing crashes, no
+ * type breaks, and the rule simply stops being said. That happened. Splitting
+ * the MCP `instructions` into shared doctrine plus an MCP remainder dropped
+ * sixteen rules — sender rotation, the webhook/event/wait triggers, "never
+ * sends raw provider messages", the Knowledge citation and near-duplicate
+ * discipline, `ui://`, Crustdata routing, and more — while every existing
+ * assertion stayed green, because those assertions pinned lengths, the derived
+ * roster, and a handful of literal phrases, none of which is the rule set.
+ *
+ * WHY THIS SHAPE. There is no way to derive "this prose still tells an agent to
+ * rotate senders" from code, so the rule set has to be written down. What the
+ * ledger adds over sixteen inline `toContain` calls is:
+ *
+ * - Each entry names the behaviour in `rule`, so a future editor deleting a
+ *   sentence sees what they are deleting rather than an opaque magic string.
+ * - `probes` is a disjunction: ANY match satisfies the rule. The briefing lives
+ *   under a hard character budget, so it gets compressed often; probes key on
+ *   the distinctive noun ("sender rotation") and accept alternate phrasings, so
+ *   honest rewording stays green while deletion goes red.
+ * - `home` makes the shared/MCP split testable in both directions: a doctrine
+ *   rule missing from the doctrine is red, an MCP-mechanics rule that leaks into
+ *   the surface-neutral doctrine is red, and a rule stated in both halves is red
+ *   (duplication is what the split was meant to end, and it is paid for twice in
+ *   every session's context).
+ *
+ * WHAT IT DOES NOT CATCH, stated plainly so nobody over-trusts it:
+ *
+ * - Truth. A probe proves a phrase is present, not that the surrounding
+ *   sentence is correct or still says the right thing.
+ * - Rules never entered here. New behaviour has to be added to this ledger by
+ *   hand; the file is only as complete as its last review. `MINIMUM_RULE_COUNT`
+ *   in the tests is a ratchet against quietly gutting the ledger itself, not a
+ *   proof of completeness.
+ * - Whether an agent obeys any of it at runtime. That is an eval, not a test.
+ */
+/** Which half of the composed briefing must state a rule. */
+export type BriefingHome = "doctrine" | "mcp";
+export interface BriefingRule {
+    /** Stable identifier. Rename the prose, never this. */
+    id: string;
+    /** The behaviour in plain English: what an agent loses if this goes missing. */
+    rule: string;
+    /**
+     * `doctrine` — surface-neutral product truth, equally valid for a Copilot
+     * turn, an Agent run, and an MCP session; lives in `product-doctrine.ts`.
+     * `mcp` — MCP mechanics or literal `oxygen_*` tool names; lives in the MCP
+     * server's remainder, and must stay out of the doctrine.
+     */
+    home: BriefingHome;
+    /** Accepted phrasings. Any one match satisfies the rule. */
+    probes: readonly RegExp[];
+}
+export declare const OXYGEN_BRIEFING_RULES: readonly BriefingRule[];

package/node_modules/@oxygen/shared/dist/product-briefing-rules.js

@@ -0,0 +1,291 @@
+/**
+ * The briefing contract: every behavioural rule the OXYGEN session briefing has
+ * to state, and which half of it owns that rule.
+ *
+ * WHY THIS FILE EXISTS. The briefing is one string an agent reads once per
+ * session, so its only failure mode is silent omission: nothing crashes, no
+ * type breaks, and the rule simply stops being said. That happened. Splitting
+ * the MCP `instructions` into shared doctrine plus an MCP remainder dropped
+ * sixteen rules — sender rotation, the webhook/event/wait triggers, "never
+ * sends raw provider messages", the Knowledge citation and near-duplicate
+ * discipline, `ui://`, Crustdata routing, and more — while every existing
+ * assertion stayed green, because those assertions pinned lengths, the derived
+ * roster, and a handful of literal phrases, none of which is the rule set.
+ *
+ * WHY THIS SHAPE. There is no way to derive "this prose still tells an agent to
+ * rotate senders" from code, so the rule set has to be written down. What the
+ * ledger adds over sixteen inline `toContain` calls is:
+ *
+ * - Each entry names the behaviour in `rule`, so a future editor deleting a
+ *   sentence sees what they are deleting rather than an opaque magic string.
+ * - `probes` is a disjunction: ANY match satisfies the rule. The briefing lives
+ *   under a hard character budget, so it gets compressed often; probes key on
+ *   the distinctive noun ("sender rotation") and accept alternate phrasings, so
+ *   honest rewording stays green while deletion goes red.
+ * - `home` makes the shared/MCP split testable in both directions: a doctrine
+ *   rule missing from the doctrine is red, an MCP-mechanics rule that leaks into
+ *   the surface-neutral doctrine is red, and a rule stated in both halves is red
+ *   (duplication is what the split was meant to end, and it is paid for twice in
+ *   every session's context).
+ *
+ * WHAT IT DOES NOT CATCH, stated plainly so nobody over-trusts it:
+ *
+ * - Truth. A probe proves a phrase is present, not that the surrounding
+ *   sentence is correct or still says the right thing.
+ * - Rules never entered here. New behaviour has to be added to this ledger by
+ *   hand; the file is only as complete as its last review. `MINIMUM_RULE_COUNT`
+ *   in the tests is a ratchet against quietly gutting the ledger itself, not a
+ *   proof of completeness.
+ * - Whether an agent obeys any of it at runtime. That is an eval, not a test.
+ */
+export const OXYGEN_BRIEFING_RULES = [
+    // ---- Surface-neutral product doctrine ----------------------------------
+    {
+        id: "native-primitives-only",
+        rule: "Use the hosted primitives; never rebuild one with local scripts, cron, files, or a second engine.",
+        home: "doctrine",
+        probes: [/never rebuild [^.]*scripts, cron, files/i],
+    },
+    {
+        id: "records-are-canon",
+        rule: "Records hold canonical truth; a Table row is a candidate promoted onto Records, never the canon.",
+        home: "doctrine",
+        probes: [/Tables hold [^.]*promoted onto Records/i, /Records hold canonical truth/i],
+    },
+    {
+        id: "tables-own-column-work",
+        rule: "Tables own typed rows, formulas, AI/tool columns, waterfalls, cell state, and run provenance.",
+        home: "doctrine",
+        probes: [/waterfalls/i],
+    },
+    {
+        id: "row-dependencies-stay-columns",
+        rule: "Simple row dependencies stay chained Table columns instead of becoming a Workflow.",
+        home: "doctrine",
+        probes: [/row dependencies stay chained Table columns/i, /chained Table columns/i],
+    },
+    {
+        id: "linkedin-routing-by-interaction-state",
+        rule: "Interaction state, not recipient count, routes LinkedIn work: net-new is Sequences even for one recipient and one step; an existing thread or a single direct email is Messages.",
+        home: "doctrine",
+        probes: [/Interaction state, not recipient count/i],
+    },
+    {
+        id: "sequences-own-sender-rotation",
+        rule: "Sequences own sender rotation — rotating senders is never hand-rolled outside the primitive.",
+        home: "doctrine",
+        probes: [/sender rotation/i, /rotating senders/i],
+    },
+    {
+        id: "sequences-own-suppression",
+        rule: "Sequences own suppression.",
+        home: "doctrine",
+        probes: [/suppression/i],
+    },
+    {
+        id: "sequences-own-reply-stop",
+        rule: "Sequences own reply-stop.",
+        home: "doctrine",
+        probes: [/reply-stop/i],
+    },
+    {
+        id: "workflows-own-deterministic-orchestration",
+        rule: "Deterministic orchestration belongs to hosted Workflows, not to a local runner.",
+        home: "doctrine",
+        probes: [/belongs to hosted OXYGEN Workflows/i],
+    },
+    {
+        id: "workflow-triggers-include-webhook-and-event",
+        rule: "Workflow triggers include scheduled/cron, webhook, and event delivery — not only manual calls.",
+        home: "doctrine",
+        probes: [/webhook, event/i],
+    },
+    {
+        id: "workflows-can-wait",
+        rule: "Waiting is a Workflow step, so a delay does not justify a local script.",
+        home: "doctrine",
+        probes: [/branching, waiting/i],
+    },
+    {
+        id: "workflow-files-are-authoring-inputs",
+        rule: "Local workflow files are authoring inputs only; the hosted definition is the runtime.",
+        home: "doctrine",
+        probes: [/local files are authoring inputs only/i],
+    },
+    {
+        id: "workflow-outreach-enrolls-never-raw-sends",
+        rule: "Workflow outreach enrolls into an active, bounded Sequence and never sends raw provider messages.",
+        home: "doctrine",
+        probes: [/never sends raw provider messages/i, /never a raw provider send/i],
+    },
+    {
+        id: "agents-own-adaptive-runs",
+        rule: "Adaptive goals, threads, and checkpoints belong to governed Agents, which own first-class runs and may call Workflows as child actions.",
+        home: "doctrine",
+        probes: [/governed Agents/i],
+    },
+    {
+        id: "no-competing-store",
+        rule: "Neither Workflows nor Agents is a store: a draft is Messages, a note is Records activity.",
+        home: "doctrine",
+        probes: [/a draft is Messages/i],
+    },
+    {
+        id: "messages-stored-once",
+        rule: "Messages hold conversation content, stored once across channels.",
+        home: "doctrine",
+        probes: [/conversation content, stored once/i],
+    },
+    {
+        id: "signals-only-record",
+        rule: "Signals record that something happened; acting on one is Workflows or Sequences.",
+        home: "doctrine",
+        probes: [/Signals hold durable typed events/i],
+    },
+    {
+        id: "knowledge-cite-slugs",
+        rule: "Cite the slugs of the Knowledge pages an answer rests on.",
+        home: "doctrine",
+        probes: [/cite their slugs/i, /cite the slugs/i, /by slug/i],
+    },
+    {
+        id: "knowledge-no-near-duplicates",
+        rule: "Search before minting a near-duplicate Knowledge page.",
+        home: "doctrine",
+        probes: [/near-duplicate/i],
+    },
+    {
+        id: "knowledge-file-findings-back",
+        rule: "File durable findings back into Knowledge instead of leaving them in chat memory.",
+        home: "doctrine",
+        probes: [/file durable findings/i, /file findings back/i],
+    },
+    {
+        id: "knowledge-canonical-is-gated",
+        rule: "Canonical voice and positioning changes stay proposal-gated.",
+        home: "doctrine",
+        probes: [/proposal-gated/i],
+    },
+    {
+        id: "knowledge-pinned-context-and-off-voice",
+        rule: "Pinned canonical context is auto-applied to AI copy; if it is reported missing, say so rather than write off-voice copy.",
+        home: "doctrine",
+        probes: [/Pinned canonical context/i],
+    },
+    {
+        id: "knowledge-never-off-voice",
+        rule: "Never silently produce off-voice copy when the voice context is missing.",
+        home: "doctrine",
+        probes: [/off-voice/i],
+    },
+    {
+        id: "paid-work-needs-preview-scope-ceiling",
+        rule: "Paid provider work and external writes need a preview on a small sample, exact scope, approval, and a hard ceiling.",
+        home: "doctrine",
+        probes: [/preview on a small sample/i],
+    },
+    {
+        id: "spend-authority-is-not-tool-authority",
+        rule: "Never infer spend authority from tool authority.",
+        home: "doctrine",
+        probes: [/Never infer spend authority from tool authority/i],
+    },
+    // ---- MCP mechanics and literal tool names -------------------------------
+    {
+        id: "capability-search-returns-gateways",
+        rule: "Capability search returns ownership, boundaries, spend posture, gateways, and ranked tools — read it before guessing.",
+        home: "mcp",
+        probes: [/gateways/i],
+    },
+    {
+        id: "session-starts-with-whoami",
+        rule: "A session starts at `oxygen_whoami` for user, org, and factual onboarding markers.",
+        home: "mcp",
+        probes: [/oxygen_whoami/],
+    },
+    {
+        id: "context-resolve-before-gtm-work",
+        rule: "Call `oxygen_context_resolve` before context-dependent GTM work.",
+        home: "mcp",
+        probes: [/oxygen_context_resolve/],
+    },
+    {
+        id: "onboarding-never-blocks",
+        rule: "The onboarding gate is advisory: if the user declines, continue — never block a concrete ask.",
+        home: "mcp",
+        probes: [/never block a concrete ask/i],
+    },
+    {
+        id: "toolset-pack-recovery",
+        rule: "On 'No such tool available', reconnect with the returned `?toolset=<toolset_pack>`; never load a full manifest by default.",
+        home: "mcp",
+        probes: [/\?toolset=<toolset_pack>/],
+    },
+    {
+        // Both halves of the full-profile rule are load-bearing and they were carried
+        // separately in the pre-refactor text: the restraint (not by default) and the
+        // sanctioned case (registry-spanning work). Dropping the second half leaves an
+        // agent knowing full is discouraged but never knowing when it is earned.
+        id: "toolset-full-is-for-registry-spanning-work",
+        rule: "`?toolset=full` is reserved for work spanning the registry, never the default profile.",
+        home: "mcp",
+        probes: [/for registry-spanning work/i],
+    },
+    {
+        // Distinct from `onboarding-never-blocks`: that one governs the missing-context
+        // gate, this one governs the recipe detour. The pre-refactor text stated both and
+        // the first refactor collapsed them into one, which is why each is pinned alone.
+        id: "route-a-concrete-ask-directly",
+        rule: "A concrete ask is routed directly; playbook discovery is never pushed in front of it.",
+        home: "mcp",
+        probes: [/route a concrete ask directly/i],
+    },
+    {
+        id: "knowledge-is-index-first",
+        rule: "Knowledge work is index-first through `oxygen_knowledge_index`.",
+        home: "mcp",
+        probes: [/oxygen_knowledge_index/],
+    },
+    {
+        id: "open-only-relevant-pages",
+        rule: "Open only the relevant Knowledge pages rather than pulling the whole wiki into context.",
+        home: "mcp",
+        probes: [/open(?:ing)? only (?:the )?relevant pages/i],
+    },
+    {
+        id: "linkedin-public-read-is-cookieless",
+        rule: "Public or third-party LinkedIn reads use cookieless `scraper.*`; `linkedin.*` (Unipile) is only for the connected account.",
+        home: "mcp",
+        probes: [/cookieless `scraper\.\*`/],
+    },
+    {
+        id: "crustdata-only-for-indexed-datasets",
+        rule: "Use Crustdata only for a distinct indexed or longitudinal dataset the native scraper does not provide.",
+        home: "mcp",
+        probes: [/Crustdata only for an? [^.]*dataset/i],
+    },
+    {
+        id: "no-silent-costlier-fallback",
+        rule: "Never silently fall back to a costlier provider; surface unavailability.",
+        home: "mcp",
+        probes: [/Never silently fall back to a costlier provider/i],
+    },
+    {
+        id: "surface-deep-links",
+        rule: "Surface the `web_url` deep-links responses return.",
+        home: "mcp",
+        probes: [/web_url/],
+    },
+    {
+        id: "surface-inline-widgets",
+        rule: "Surface the inline `ui://` widgets responses return.",
+        home: "mcp",
+        probes: [/ui:\/\//],
+    },
+    {
+        id: "customer-terminals-use-oxygen",
+        rule: "Customer terminals use `oxygen`; `oxygen-dev` is internal unless requested.",
+        home: "mcp",
+        probes: [/`oxygen-dev` is internal/],
+    },
+];

package/node_modules/@oxygen/shared/dist/product-doctrine.d.ts

@@ -0,0 +1,11 @@
+import { type PrimitiveRouteCard } from "./capability-discovery.js";
+/** The only route-card fields the doctrine reads, so a test can inject a roster. */
+export type DoctrinePrimitive = Pick<PrimitiveRouteCard, "layer" | "primitive">;
+/**
+ * Render the doctrine for a roster of primitives. Callers pass nothing; the
+ * parameter is the seam that lets a test prove the roster is derived by feeding
+ * a grown or shrunk route array and watching the output follow.
+ */
+export declare function renderOxygenProductDoctrine(routes?: readonly DoctrinePrimitive[]): string;
+/** The rendered doctrine for the shipped primitive roster. */
+export declare const OXYGEN_PRODUCT_DOCTRINE: string;

package/node_modules/@oxygen/shared/dist/product-doctrine.js

@@ -0,0 +1,70 @@
+import { OXYGEN_PRIMITIVE_ROUTES } from "./capability-discovery.js";
+/**
+ * The surface-neutral OXYGEN product briefing: what OXYGEN is, which primitive
+ * owns which fact, and what paid work costs in authority.
+ *
+ * It exists because the briefing used to live only in the MCP server's
+ * `instructions` string, so an external Claude Code session was told the five
+ * layers and the ownership law while our own Workspace Copilot and Agent runs —
+ * the surfaces a non-expert customer actually uses — were told neither. Anything
+ * here must be true of EVERY surface: no tool names, no connector/profile
+ * mechanics, no host quirks. Those stay with the surface that owns them.
+ *
+ * The primitive roster is DERIVED from the capability route cards rather than
+ * restated. `capability-discovery.ts` already throws at module load if its cards
+ * drift from `RECIPE_PRIMITIVES`, so deriving here inherits that check: a
+ * sixteenth primitive, or a retired one, cannot ship with the doctrine still
+ * describing the old fifteen. A hand-typed roster is exactly the copy that rots
+ * silently, which is how it rotted in the first place.
+ *
+ * Every behavioural rule this text must state is pinned in
+ * `product-briefing-rules.ts`. Compress the prose freely; dropping a rule is a
+ * product decision that belongs in that ledger, not a side effect of a refactor.
+ */
+/** Rendering order for the stack. Only layers that own a primitive get a line. */
+const LAYER_ORDER = ["Control", "Knowledge", "Data", "Action", "External"];
+/** `knowledge-graph` -> `Knowledge Graph`; the slug is the source, the label is derived. */
+function primitiveLabel(primitive) {
+    return primitive
+        .split("-")
+        .map((word) => (word ? word[0].toUpperCase() + word.slice(1) : word))
+        .join(" ");
+}
+function joinLabels(labels) {
+    if (labels.length <= 1)
+        return labels[0] ?? "";
+    if (labels.length === 2)
+        return `${labels[0]} and ${labels[1]}`;
+    return `${labels.slice(0, -1).join(", ")}, and ${labels[labels.length - 1]}`;
+}
+function rosterLines(routes) {
+    return LAYER_ORDER.flatMap((layer) => {
+        const labels = routes.filter((card) => card.layer === layer).map((card) => primitiveLabel(card.primitive));
+        return labels.length ? [`- ${layer}: ${joinLabels(labels)}.`] : [];
+    }).join("\n");
+}
+/**
+ * Render the doctrine for a roster of primitives. Callers pass nothing; the
+ * parameter is the seam that lets a test prove the roster is derived by feeding
+ * a grown or shrunk route array and watching the output follow.
+ */
+export function renderOxygenProductDoctrine(routes = OXYGEN_PRIMITIVE_ROUTES) {
+    return `OXYGEN is hosted revenue infrastructure for B2B startups; OXYGEN OS is its five-layer stack. Control surfaces (CLI, MCP, web, desktop, Copilot) call one contract, own no state; External is the platforms OXYGEN acts on. Between them, the ${routes.length} primitives, each owning its facts:
+
+${rosterLines(routes)}
+
+Use native primitives so state, approvals, costs, provenance, and runs stay hosted and inspectable; never rebuild one with scripts, cron, files, or a second engine.
+
+Ownership law — one owner per fact, no primitive re-implements another:
+
+- Records hold canonical truth; Tables hold disposable work promoted onto Records — a row is a candidate, not canon. Tables own typed rows, formulas, AI and tool columns, waterfalls, cell state, and provenance; simple row dependencies stay chained Table columns, not Workflows.
+- Interaction state, not recipient count, owns LinkedIn routing: net-new outreach is Sequences even for one recipient and one step; a reply in an existing thread or one direct email is Messages, holding conversation content, stored once. Cadence, enrollment, sender rotation, suppression, and reply-stop are Sequences.
+- Signals hold durable typed events and record only that something happened; acting on one is Workflows or Sequences; an inbound reply is both, a reaction only a Signal.
+- Deterministic scheduled, cron, webhook, event, branching, waiting, retrying, or approval-gated orchestration belongs to hosted OXYGEN Workflows: schema → lint → apply → call, and local files are authoring inputs only. Adaptive goals, persistent threads, and checkpoints belong to governed Agents, owning first-class runs and calling Workflows as child actions; neither compiles into the other nor is a store — a draft is Messages, a note Records activity, and Workflow outreach enrolls into an active, bounded Sequence and never sends raw provider messages.
+- Posts hold broadcast artifacts and engagement telemetry; Publishing owns approval-gated scheduling, dispatch, retries, and provenance; Ads owns competitor ad intelligence; Tags are the cross-primitive label vocabulary; Dashboards curates native reporting; Observability is the read lens over runs, costs, and failures, never a second engine.
+- The Knowledge Graph describes kinds of customer (ICP, personas, offers, rubrics, voice); Records holds the companies and people they describe. Durable knowledge belongs there, not chat memory: read pages, cite their slugs, search before minting a near-duplicate, file durable findings back. Canonical voice and positioning stay proposal-gated. Pinned canonical context is auto-applied to AI copy; if reported missing, say so rather than write off-voice. Recipes package motions that read it, advisory only.
+
+Paid provider work and external writes require a preview on a small sample, exact scope, approval, and a hard credit or action ceiling. Never infer spend authority from tool authority. Surface deep-links, costs, failures, retries, and approval needs, not a bare success; name missing context, never guess.`;
+}
+/** The rendered doctrine for the shipped primitive roster. */
+export const OXYGEN_PRODUCT_DOCTRINE = renderOxygenProductDoctrine();

package/node_modules/@oxygen/shared/dist/sequences.d.ts

@@ -193,20 +193,21 @@ export declare function espFromMxHosts(hosts: readonly string[] | null | undefin
 /**
  * row_values keys an enrollment's phone number may live under, in
  * send-precedence order, for WhatsApp sends. The enroll path resolves the FIRST
- * present key to a Unipile WhatsApp attendee id (E.164). Mirrors
+ * present key to a Unipile WhatsApp attendee id. Mirrors
  * SEQUENCE_EMAIL_COLUMN_KEYS so the WhatsApp send + lookup paths can't drift.
  */
 export declare const SEQUENCE_PHONE_COLUMN_KEYS: readonly ["phone", "phone_number", "mobile", "mobile_phone", "Phone"];
 /**
- * Normalize a raw phone number to the attendee id Unipile's WhatsApp
- * `chats_create` accepts (E.164 digits — no '+', spaces, or separators). Returns
- * null for an implausibly short/long number.
- *
- * NOTE (R1 — the one unconfirmed Unipile contract): the exact attendee format
- * Unipile wants to open a COLD WhatsApp chat is the single thing to confirm
- * against a live WhatsApp account. If Unipile needs a different shape (a resolved
- * attendee id, or a "<digits>@s.whatsapp.net" jid), THIS function is the only
- * seam to change — every caller routes through it.
+ * Normalize a phone-shaped value to the digits Oxygen uses as its stable local
+ * WhatsApp identity. A classic WhatsApp phone JID is accepted and reduced to its
+ * local digits; a privacy-preserving `@lid` value is not a phone and is rejected.
+ */
+export declare function whatsAppPhoneDigits(phone: string): string | null;
+/**
+ * Normalize a raw phone number to the exact recipient identifier Unipile's
+ * WhatsApp `chats_create` accepts. A real phone becomes the classic
+ * `<digits>@s.whatsapp.net` JID. Already-resolved classic or `@lid` identifiers
+ * pass through unchanged so replaying a durable action never double-suffixes it.
  */
 export declare function whatsAppAttendeeIdForPhone(phone: string): string | null;
 /**
@@ -216,10 +217,16 @@ export declare function whatsAppAttendeeIdForPhone(phone: string): string | null
  * enroll/plan path and any preview count can't drift.
  */
 export declare function whatsAppAttendeeIdFromRow(rowValues: Record<string, unknown> | null | undefined, phoneColumnKey?: string | null): string | null;
+/**
+ * Resolve the stable local phone identity from a lead row without leaking the
+ * provider-specific JID into a Table phone column. This deliberately shares the
+ * same source-key precedence as WhatsApp dispatch.
+ */
+export declare function whatsAppPhoneDigitsFromRow(rowValues: Record<string, unknown> | null | undefined, phoneColumnKey?: string | null): string | null;
 /**
  * Normalize a raw phone number to strict E.164 (`+` then 2-15 digits, no leading
  * zero) for the CALL channel. Deliberately stricter than
- * whatsAppAttendeeIdForPhone, which accepts any 7-15 bare digits: on WhatsApp a
+ * whatsAppPhoneDigits, which accepts any 7-15 bare digits: on WhatsApp a
  * bad guess fails an API call, but on the phone it rings a real stranger.
  *
  * Rules — anything ambiguous returns null rather than guessing:

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -457,27 +457,42 @@ export function espFromMxHosts(hosts) {
 /**
  * row_values keys an enrollment's phone number may live under, in
  * send-precedence order, for WhatsApp sends. The enroll path resolves the FIRST
- * present key to a Unipile WhatsApp attendee id (E.164). Mirrors
+ * present key to a Unipile WhatsApp attendee id. Mirrors
  * SEQUENCE_EMAIL_COLUMN_KEYS so the WhatsApp send + lookup paths can't drift.
  */
 export const SEQUENCE_PHONE_COLUMN_KEYS = ["phone", "phone_number", "mobile", "mobile_phone", "Phone"];
 /**
- * Normalize a raw phone number to the attendee id Unipile's WhatsApp
- * `chats_create` accepts (E.164 digits — no '+', spaces, or separators). Returns
- * null for an implausibly short/long number.
- *
- * NOTE (R1 — the one unconfirmed Unipile contract): the exact attendee format
- * Unipile wants to open a COLD WhatsApp chat is the single thing to confirm
- * against a live WhatsApp account. If Unipile needs a different shape (a resolved
- * attendee id, or a "<digits>@s.whatsapp.net" jid), THIS function is the only
- * seam to change — every caller routes through it.
+ * Normalize a phone-shaped value to the digits Oxygen uses as its stable local
+ * WhatsApp identity. A classic WhatsApp phone JID is accepted and reduced to its
+ * local digits; a privacy-preserving `@lid` value is not a phone and is rejected.
  */
-export function whatsAppAttendeeIdForPhone(phone) {
-    const digits = phone.trim().replace(/[^\d]/g, "");
+export function whatsAppPhoneDigits(phone) {
+    const trimmed = phone.trim().toLowerCase();
+    if (/^\d{7,15}@lid$/u.test(trimmed))
+        return null;
+    const classicJid = /^(\d{7,15})@s\.whatsapp\.net$/u.exec(trimmed);
+    if (classicJid?.[1])
+        return classicJid[1];
+    if (trimmed.includes("@"))
+        return null;
+    const digits = trimmed.replace(/[^\d]/g, "");
     if (digits.length < 7 || digits.length > 15)
         return null;
     return digits;
 }
+/**
+ * Normalize a raw phone number to the exact recipient identifier Unipile's
+ * WhatsApp `chats_create` accepts. A real phone becomes the classic
+ * `<digits>@s.whatsapp.net` JID. Already-resolved classic or `@lid` identifiers
+ * pass through unchanged so replaying a durable action never double-suffixes it.
+ */
+export function whatsAppAttendeeIdForPhone(phone) {
+    const trimmed = phone.trim().toLowerCase();
+    if (/^\d{7,15}@(s\.whatsapp\.net|lid)$/u.test(trimmed))
+        return trimmed;
+    const digits = whatsAppPhoneDigits(trimmed);
+    return digits ? `${digits}@s.whatsapp.net` : null;
+}
 /**
  * Resolve a lead's WhatsApp attendee id from its row_values: read the configured
  * phone column (or fall back to SEQUENCE_PHONE_COLUMN_KEYS in precedence order),
@@ -498,10 +513,29 @@ export function whatsAppAttendeeIdFromRow(rowValues, phoneColumnKey) {
     }
     return null;
 }
+/**
+ * Resolve the stable local phone identity from a lead row without leaking the
+ * provider-specific JID into a Table phone column. This deliberately shares the
+ * same source-key precedence as WhatsApp dispatch.
+ */
+export function whatsAppPhoneDigitsFromRow(rowValues, phoneColumnKey) {
+    if (!rowValues)
+        return null;
+    const keys = phoneColumnKey ? [phoneColumnKey, ...SEQUENCE_PHONE_COLUMN_KEYS] : [...SEQUENCE_PHONE_COLUMN_KEYS];
+    for (const key of keys) {
+        const value = rowValues[key];
+        if (typeof value === "string" && value.trim()) {
+            const digits = whatsAppPhoneDigits(value);
+            if (digits)
+                return digits;
+        }
+    }
+    return null;
+}
 /**
  * Normalize a raw phone number to strict E.164 (`+` then 2-15 digits, no leading
  * zero) for the CALL channel. Deliberately stricter than
- * whatsAppAttendeeIdForPhone, which accepts any 7-15 bare digits: on WhatsApp a
+ * whatsAppPhoneDigits, which accepts any 7-15 bare digits: on WhatsApp a
  * bad guess fails an API call, but on the phone it rings a real stranger.
  *
  * Rules — anything ambiguous returns null rather than guessing:

package/node_modules/@oxygen/shared/dist/user-capability-routing.js

@@ -1,4 +1,4 @@
-import { getCapabilityRouteMatch, inferCapabilityRoute, } from "./capability-discovery.js";
+import { getCapabilityRoute, getCapabilityRouteMatch, inferCapabilityRoute, } from "./capability-discovery.js";
 // Provider brands are intentionally not duplicated into the static capability
 // catalog. A short "connect <provider>" query would otherwise match Tables via
 // its relationship-oriented "connect" term. Correct that narrow ambiguity at
@@ -13,9 +13,30 @@ export function inferUserCapabilityRoute(query) {
     }
     return getCapabilityRouteMatch("connected-integrations") ?? route;
 }
+// The words that mean "this is Tables work, not a provider connection". Hand-typing
+// them drifted: the list covered table/row/column/dataset/join/relate but not csv,
+// import, enrich, waterfall, formula, lookup or score -- all of which the Tables card
+// itself claims. The measured cost was 11 queries ("connect my csv", "connect my
+// enrichment", "connect my formula") losing their Tables tools and being handed
+// oxygen_integrations_connect instead, on ALL THREE surfaces that call this wrapper.
+//
+// So derive from the card rather than restating it. `connect` is excluded because it
+// is the ambiguity itself -- it is a Tables intent term AND the verb this function
+// keys on, and leaving it in would make the guard reject every query the wrapper
+// exists to correct.
+const TABLES_INTENT_AMBIGUITY_TRIGGERS = new Set(["connect"]);
+function tablesIntentGuard() {
+    const terms = (getCapabilityRoute("tables")?.intentTerms ?? [])
+        .filter((term) => !TABLES_INTENT_AMBIGUITY_TRIGGERS.has(term))
+        .flatMap((term) => (term.includes(" ") ? [term] : [term, `${term}s`]))
+        .map((term) => term.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .sort((a, b) => b.length - a.length);
+    return new RegExp(`\\b(?:${terms.join("|")})\\b`);
+}
+const TABLES_INTENT_GUARD = tablesIntentGuard();
 function isSimpleProviderConnectionIntent(query) {
     const normalized = query.toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
-    if (/\b(table|tables|row|rows|column|columns|dataset|join|relationship|relate)\b/.test(normalized)) {
+    if (TABLES_INTENT_GUARD.test(normalized)) {
         return false;
     }
     if (/\b(integration|provider|oauth|byok|api key|connected account)\b/.test(normalized)) {

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,4 +1,4 @@
-export declare const OXYGEN_VERSION = "1.894.0";
+export declare const OXYGEN_VERSION = "1.917.5";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
 export declare const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.894.0";
+export const OXYGEN_VERSION = "1.917.5";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/node_modules/@oxygen/shared/package.json

@@ -141,6 +141,11 @@
       "import": "./dist/pricing-sheet.js",
       "default": "./dist/pricing-sheet.js"
     },
+    "./copilot-plan": {
+      "types": "./dist/copilot-plan.d.ts",
+      "import": "./dist/copilot-plan.js",
+      "default": "./dist/copilot-plan.js"
+    },
     "./copilot-journeys": {
       "types": "./dist/copilot-journeys.d.ts",
       "import": "./dist/copilot-journeys.js",
@@ -171,6 +176,11 @@
       "import": "./dist/schedule-label.js",
       "default": "./dist/schedule-label.js"
     },
+    "./product-briefing-rules": {
+      "types": "./dist/product-briefing-rules.d.ts",
+      "import": "./dist/product-briefing-rules.js",
+      "default": "./dist/product-briefing-rules.js"
+    },
     "./publishing-limits": {
       "types": "./dist/publishing-limits.d.ts",
       "import": "./dist/publishing-limits.js",