@oxygen-agent/cli 1.982.3 → 1.1003.12

package/node_modules/@oxygen/cli-ugc/dist/field-parser.d.ts

@@ -0,0 +1,7 @@
+export type Field = {
+    name: string;
+    kind: string;
+    description: string;
+    required: boolean;
+};
+export declare function parseField(value: unknown, field: Field): unknown;

package/node_modules/@oxygen/cli-ugc/dist/field-parser.js

@@ -0,0 +1,25 @@
+export function parseField(value, field) {
+    if (field.kind === "array" || field.kind === "object") {
+        const parsed = JSON.parse(String(value));
+        if (field.kind === "array"
+            ? !Array.isArray(parsed) ||
+                !parsed.every((item) => typeof item === "string")
+            : !parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error(`${field.name} must be a JSON ${field.kind === "array" ? "array of strings" : "object"}.`);
+        return parsed;
+    }
+    if (field.kind === "number") {
+        const parsed = Number(value);
+        if (!Number.isFinite(parsed) || parsed < 0)
+            throw new Error(`${field.name} must be a nonnegative finite number.`);
+        return parsed;
+    }
+    if (field.kind === "boolean") {
+        if (value === true || value === "true")
+            return true;
+        if (value === false || value === "false")
+            return false;
+        throw new Error(`${field.name} must be true or false.`);
+    }
+    return value;
+}

package/node_modules/@oxygen/cli-ugc/dist/index.d.ts

@@ -0,0 +1,14 @@
+import type { Command } from "commander";
+/** The CLI owns authentication, transport, output and error presentation. */
+export interface UgcCommandDependencies {
+    request: (path: string, options?: {
+        method: "POST";
+        body: Record<string, unknown>;
+        idempotencyKey?: string;
+    }) => Promise<unknown>;
+    handle: (command: string, options: {
+        json?: boolean;
+    }, action: () => Promise<unknown>) => Promise<void>;
+}
+/** Register the existing UGC command tree without performing requests. */
+export declare function registerUgcCommands(program: Command, dependencies: UgcCommandDependencies): void;

package/node_modules/@oxygen/cli-ugc/dist/index.js

@@ -0,0 +1,5 @@
+import { registerUgcCommands as registerCommands } from "./commands.js";
+/** Register the existing UGC command tree without performing requests. */
+export function registerUgcCommands(program, dependencies) {
+    registerCommands(program, dependencies);
+}

package/node_modules/@oxygen/cli-ugc/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@oxygen/cli-ugc",
+  "version": "0.0.0",
+  "private": false,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {}
+}

package/node_modules/@oxygen/formula/dist/coerce.d.ts

@@ -3,6 +3,16 @@
  * imported from a host package) so the engine stays dependency-free and
  * browser-safe; tenant-db re-exports it from its own `coerce.ts` so the
  * existing internal import path keeps working.
+ *
+ * Do NOT replace this with `export { isRecord } from "@oxygen/shared"`. This
+ * file is value-re-exported by ./index.ts, so that edge drags the whole
+ * @oxygen/shared root barrel into every browser bundle that touches the formula
+ * engine — packages/workflows/src/graph/browser-safety.test.ts fails on exactly
+ * that ("packages/formula/src/coerce.ts imports @oxygen/shared"). @oxygen/shared
+ * does export a `./type-guards` leaf, but importing it would still make this
+ * browser-safe package depend on @oxygen/shared, which the same guard forbids
+ * (packages/formula declares no @oxygen/* dependency at all); the duplicate body
+ * is deliberate.
  */
 /** Loose record check: any non-array object (class instances included). */
 export declare function isRecord(value: unknown): value is Record<string, unknown>;

package/node_modules/@oxygen/formula/dist/coerce.js

@@ -3,6 +3,16 @@
  * imported from a host package) so the engine stays dependency-free and
  * browser-safe; tenant-db re-exports it from its own `coerce.ts` so the
  * existing internal import path keeps working.
+ *
+ * Do NOT replace this with `export { isRecord } from "@oxygen/shared"`. This
+ * file is value-re-exported by ./index.ts, so that edge drags the whole
+ * @oxygen/shared root barrel into every browser bundle that touches the formula
+ * engine — packages/workflows/src/graph/browser-safety.test.ts fails on exactly
+ * that ("packages/formula/src/coerce.ts imports @oxygen/shared"). @oxygen/shared
+ * does export a `./type-guards` leaf, but importing it would still make this
+ * browser-safe package depend on @oxygen/shared, which the same guard forbids
+ * (packages/formula declares no @oxygen/* dependency at all); the duplicate body
+ * is deliberate.
  */
 /** Loose record check: any non-array object (class instances included). */
 export function isRecord(value) {

package/node_modules/@oxygen/formula/dist/expression.js

@@ -435,6 +435,13 @@ function readStringLiteral(expression, start, quote) {
         expression,
     });
 }
+/**
+ * Only the escapes the language actually defines are decoded. Everything else
+ * is preserved verbatim, backslash included, because a formula string literal
+ * is the only way to write a regex pattern: collapsing an unknown escape to the
+ * bare character silently turned `"\\s+"` into `s+`, so `regex_replace(x, "\\s+", "_")`
+ * matched a literal "s" and the pattern looked broken with nothing to debug.
+ */
 function decodeEscapedCharacter(char) {
     switch (char) {
         case "n":
@@ -443,8 +450,14 @@ function decodeEscapedCharacter(char) {
             return "\r";
         case "t":
             return "\t";
+        case "\\":
+            return "\\";
+        case "\"":
+            return "\"";
+        case "'":
+            return "'";
         default:
-            return char;
+            return `\\${char}`;
     }
 }
 function readNumberLiteral(expression, start) {

package/node_modules/@oxygen/formula/dist/formula-functions.js

@@ -1,6 +1,9 @@
 import { OxygenError } from "@oxygen/shared/cli-result";
 import { walkJsonPath } from "@oxygen/shared/json-path";
+import { resolveLinkedInCountry } from "@oxygen/shared/linkedin-countries";
+import { md5Hex, sha256Hex } from "./hash.js";
 import { normalizeDomain, normalizeEmail, normalizeLinkedinUrl, } from "./value-normalizers.js";
+import { classifyEmailType, cleanJobTitle, normalizeCompanyName, splitDelimitedList, } from "./value-cleaners.js";
 // Pattern LENGTH is not a safety bound and never was -- catastrophic backtracking
 // is a function of pattern SHAPE, and `(a+)+$` hangs at 6 characters, so 256 already
 // permitted an unbounded hang while rejecting harmless long literals. The real bound
@@ -129,7 +132,8 @@ function compileFormulaRegex(pattern, functionName, flags) {
         return new RegExp(pattern, flags);
     }
     catch (error) {
-        throw formulaExpressionError("Invalid regular-expression pattern.", {
+        throw formulaExpressionError("Invalid regular-expression pattern. Patterns use JavaScript RegExp syntax without flags:"
+            + " inline modifiers such as (?i) are not supported — apply lower() to the input or spell out both cases.", {
             function: functionName,
             pattern,
             parse_error: error instanceof Error ? error.message : String(error),
@@ -576,6 +580,56 @@ const SPECS = [
         examples: [{ expression: "title_case(\"acme CORP\")", result: "Acme Corp" }],
         evaluate: (args) => asText(args[0]).replace(/([A-Za-z])([A-Za-z]*)/g, (_match, first, rest) => first.toUpperCase() + rest.toLowerCase()),
     }),
+    spec({
+        name: "sha256",
+        category: "string",
+        signature: "sha256(text)",
+        description: "Hex-encoded SHA-256 digest of the text (UTF-8). Computed in-process, so it costs no credits. Blank input returns null.",
+        minArgs: 1,
+        maxArgs: 1,
+        examples: [{ expression: "sha256(\"abc\")", result: "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad" }],
+        evaluate: (args) => blankToNull(args[0], (input) => sha256Hex(asText(input))),
+    }),
+    spec({
+        name: "md5",
+        category: "string",
+        signature: "md5(text)",
+        description: "Hex-encoded MD5 digest of the text (UTF-8). Computed in-process, so it costs no credits. Blank input returns null. MD5 exists here for ad-platform audience matching, never for anything security-bearing.",
+        minArgs: 1,
+        maxArgs: 1,
+        examples: [{ expression: "md5(\"abc\")", result: "900150983cd24fb0d6963f7d28e17f72" }],
+        evaluate: (args) => blankToNull(args[0], (input) => md5Hex(asText(input))),
+    }),
+    spec({
+        name: "email_hash",
+        category: "string",
+        signature: "email_hash(email, algorithm?)",
+        description: "Normalizes an email address and returns its hex digest — the hashed identifier ad platforms take for custom audiences. Algorithm is \"sha256\" (default) or \"md5\"; blank input returns null.",
+        minArgs: 1,
+        maxArgs: 2,
+        examples: [{ expression: "email_hash(\"  Ada@Example.COM \")", result: "b5fc85e55755f9e0d030a10ab4429b6b2944855f9a0d60077fe832becbc41d72" }],
+        evaluate: (args) => {
+            // The algorithm is checked before the blank check on purpose: an unknown
+            // algorithm is an authoring mistake, not row data, so it must fail on
+            // every row rather than only on the rows that carry an address.
+            const algorithm = args.length > 1 && !isBlankFormulaValue(args[1])
+                ? asText(args[1]).trim().toLowerCase()
+                : "sha256";
+            if (algorithm !== "sha256" && algorithm !== "md5") {
+                throw formulaExpressionError("email_hash supports the \"sha256\" and \"md5\" algorithms only.", {
+                    function: "email_hash",
+                    algorithm: args[1],
+                });
+            }
+            return blankToNull(args[0], (input) => {
+                // Trim + lowercase and nothing else. Meta, Google, and LinkedIn all
+                // specify exactly that normalization, so stripping dots or plus-tags
+                // here would hash an address the platform never matches.
+                const normalized = normalizeEmail(asText(input));
+                return algorithm === "md5" ? md5Hex(normalized) : sha256Hex(normalized);
+            });
+        },
+    }),
     spec({
         name: "pad_start",
         category: "string",
@@ -638,6 +692,46 @@ const SPECS = [
             return asText(args[0]).includes(asText(args[1]));
         },
     }),
+    spec({
+        name: "normalize_company_name",
+        category: "string",
+        signature: "normalize_company_name(text, mode?)",
+        description: "Canonical company name: legal suffixes removed (Inc, Ltd, GmbH, Pty Ltd, sp. z o.o., …, repeatedly), stray punctuation and quotes trimmed, whitespace collapsed, \"&\" and apostrophes kept. Casing is the author’s unless the whole name is upper-case, which is title-cased. mode \"short\" (default \"display\") also drops a tagline after \" - \", \" | \", \":\", \" / \" or \"(\" and keeps at most the first three words, for use in a first sentence. Blank input returns null.",
+        minArgs: 1,
+        maxArgs: 2,
+        examples: [
+            { expression: "normalize_company_name(\"Acme, Inc.\")", result: "Acme" },
+            { expression: "normalize_company_name(\"ACME CORP.\")", result: "Acme" },
+            { expression: "normalize_company_name(\"Northwind Traders LLC - Logistics\", \"short\")", result: "Northwind Traders" },
+        ],
+        evaluate: (args) => {
+            if (isBlankFormulaValue(args[0]))
+                return null;
+            const mode = isBlankFormulaValue(args[1]) ? "display" : asText(args[1]).trim().toLowerCase();
+            if (mode !== "display" && mode !== "short") {
+                throw formulaExpressionError("Unsupported company-name mode.", {
+                    function: "normalize_company_name",
+                    mode: args[1],
+                    supported: ["display", "short"],
+                });
+            }
+            return normalizeCompanyName(asText(args[0]), mode);
+        },
+    }),
+    spec({
+        name: "clean_job_title",
+        category: "string",
+        signature: "clean_job_title(text)",
+        description: "Strips emoji, symbol runs, hashtags, parentheticals and hiring slogans (\"we’re hiring\", \"open to work\", \"looking for\", \"dm me\", …) from a scraped headline, then keeps only the first clause when it is joined by \" | \", \" • \", \" · \", \" — \", \" – \" or \" :: \". A bare \"-\", \",\", \"/\" or \"&\" never cuts, so \"Account Executive - EMEA\" and \"Director of Importing/Exporting\" survive whole. All-caps titles are title-cased; any other casing is the author’s. Blank or noise-only input returns null.",
+        minArgs: 1,
+        maxArgs: 1,
+        examples: [
+            { expression: "clean_job_title(\"VP of Sales 🚀 | We’re hiring!\")", result: "VP of Sales" },
+            { expression: "clean_job_title(\"Head of Growth (ex-Google)\")", result: "Head of Growth" },
+            { expression: "clean_job_title(\"Sr. Director, Demand Generation — Hiring SDRs!\")", result: "Sr. Director, Demand Generation" },
+        ],
+        evaluate: (args) => (isBlankFormulaValue(args[0]) ? null : cleanJobTitle(asText(args[0]))),
+    }),
     // --- number ----------------------------------------------------------------
     spec({
         name: "number",
@@ -901,6 +995,19 @@ const SPECS = [
             }
         }),
     }),
+    spec({
+        name: "linkedin_country",
+        category: "url_email",
+        signature: "linkedin_country(code_or_name)",
+        description: "Canonical LinkedIn country name for an ISO alpha-2 code, a country name, or a known alias. Returns blank for anything unrecognized, so a select column never stores a value outside its own option list.",
+        minArgs: 1,
+        maxArgs: 1,
+        examples: [
+            { expression: "linkedin_country(\"US\")", result: "United States" },
+            { expression: "linkedin_country(\"Congo - Kinshasa\")", result: "Congo (DRC)" },
+        ],
+        evaluate: (args) => blankToNull(args[0], (input) => resolveLinkedInCountry(asText(input))),
+    }),
     spec({
         name: "normalize_linkedin_url",
         category: "url_email",
@@ -911,6 +1018,21 @@ const SPECS = [
         examples: [{ expression: "normalize_linkedin_url(\"https://linkedin.com/in/Ada/\")", result: "https://linkedin.com/in/ada" }],
         evaluate: (args) => blankToNull(args[0], (input) => normalizeLinkedinUrl(asText(input))),
     }),
+    spec({
+        name: "email_type",
+        category: "url_email",
+        signature: "email_type(email)",
+        description: "Classifies an address as \"disposable\", \"role\", \"personal\" (a consumer mailbox provider) or \"work\", from OXYGEN’s built-in domain and shared-inbox lists, in that precedence. Subdomains count as their parent domain and a +tag is ignored. Blank or syntactically invalid input returns null. When a fixed list is not enough, the paid bounceban.check verifier adds live username/domain typing and syntax validity for catch-all and SEG domains.",
+        minArgs: 1,
+        maxArgs: 1,
+        examples: [
+            { expression: "email_type(\"jane@gmail.com\")", result: "personal" },
+            { expression: "email_type(\"info@stripe.com\")", result: "role" },
+            { expression: "email_type(\"alice@mailinator.com\")", result: "disposable" },
+            { expression: "email_type(\"mark@acme.com\")", result: "work" },
+        ],
+        evaluate: (args) => (isBlankFormulaValue(args[0]) ? null : classifyEmailType(asText(args[0]))),
+    }),
     // --- array -----------------------------------------------------------------
     spec({
         name: "first",
@@ -989,6 +1111,19 @@ const SPECS = [
             return result;
         },
     }),
+    spec({
+        name: "to_json_list",
+        category: "array",
+        signature: "to_json_list(text, separator?)",
+        description: "Turns one messy cell into a clean array: every part trimmed, blanks dropped, duplicates removed in first-seen order. Without a separator the delimiter is auto-detected (newline, then \";\", then \"|\", then \",\"; otherwise a single item). An existing array or a JSON-encoded array string is cleaned in place. Blank input returns an empty array. Use split() when you want the raw parts, including blanks and duplicates.",
+        minArgs: 1,
+        maxArgs: 2,
+        examples: [
+            { expression: "to_json_list(\"fintech, payments,saas\")", result: ["fintech", "payments", "saas"] },
+            { expression: "to_json_list(\"growth;plg\")", result: ["growth", "plg"] },
+        ],
+        evaluate: (args) => splitDelimitedList(args[0], isBlankFormulaValue(args[1]) ? null : asText(args[1])),
+    }),
     // --- json ------------------------------------------------------------------
     spec({
         name: "path",

package/node_modules/@oxygen/formula/dist/hash.d.ts

@@ -0,0 +1,19 @@
+/**
+ * SHA-256 and MD5, hand-rolled and dependency-free.
+ *
+ * WHY HAND-ROLLED: this package is bundled into the browser (formula editor
+ * previews, the visual workflow editor) and its tsconfig sets `types: []` on
+ * purpose, so `node:crypto` is not importable here; `crypto.subtle.digest` is
+ * async and formula evaluation is synchronous per row, so a Promise cannot be
+ * returned to a cell either. Both digests are therefore computed inline —
+ * the textbook algorithms (FIPS 180-4 / RFC 1321), UTF-8 in, lowercase hex out.
+ *
+ * NOT FOR SECRETS. These exist because the ad platforms (Meta, Google,
+ * LinkedIn) specify exactly SHA-256 or MD5 over a trimmed, lowercased address
+ * for customer-match audience uploads. Do not reach for them for anything that
+ * needs a password hash, a MAC, or collision resistance.
+ */
+/** Hex-encoded SHA-256 of the UTF-8 encoding of `input`. */
+export declare function sha256Hex(input: string): string;
+/** Hex-encoded MD5 of the UTF-8 encoding of `input`. */
+export declare function md5Hex(input: string): string;

package/node_modules/@oxygen/formula/dist/hash.js

@@ -0,0 +1,199 @@
+/**
+ * SHA-256 and MD5, hand-rolled and dependency-free.
+ *
+ * WHY HAND-ROLLED: this package is bundled into the browser (formula editor
+ * previews, the visual workflow editor) and its tsconfig sets `types: []` on
+ * purpose, so `node:crypto` is not importable here; `crypto.subtle.digest` is
+ * async and formula evaluation is synchronous per row, so a Promise cannot be
+ * returned to a cell either. Both digests are therefore computed inline —
+ * the textbook algorithms (FIPS 180-4 / RFC 1321), UTF-8 in, lowercase hex out.
+ *
+ * NOT FOR SECRETS. These exist because the ad platforms (Meta, Google,
+ * LinkedIn) specify exactly SHA-256 or MD5 over a trimmed, lowercased address
+ * for customer-match audience uploads. Do not reach for them for anything that
+ * needs a password hash, a MAC, or collision resistance.
+ */
+// `noUncheckedIndexedAccess` types every element read as possibly undefined.
+// Every index below is provably in range (fixed-size constant tables and a
+// 64-word schedule), so the reads go through these accessors rather than
+// scattering assertions through the rounds.
+function wordAt(words, index) {
+    return words[index];
+}
+function shiftAt(shifts, index) {
+    return shifts[index];
+}
+function rotateRight(value, bits) {
+    return ((value >>> bits) | (value << (32 - bits))) >>> 0;
+}
+function rotateLeft(value, bits) {
+    return ((value << bits) | (value >>> (32 - bits))) >>> 0;
+}
+function hex32BigEndian(value) {
+    return (value >>> 0).toString(16).padStart(8, "0");
+}
+function hex32LittleEndian(value) {
+    let out = "";
+    for (let byte = 0; byte < 4; byte += 1) {
+        out += ((value >>> (byte * 8)) & 0xff).toString(16).padStart(2, "0");
+    }
+    return out;
+}
+/**
+ * Merkle-Damgård padding shared by both digests: append 0x80, zero-fill to a
+ * 64-byte boundary, then write the message length in bits into the last eight
+ * bytes (big-endian for SHA-256, little-endian for MD5).
+ */
+function padMessage(bytes, littleEndianLength) {
+    const paddedLength = (((bytes.length + 8) >> 6) + 1) << 6;
+    const padded = new Uint8Array(paddedLength);
+    padded.set(bytes);
+    padded[bytes.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    const bitLength = bytes.length * 8;
+    const low = bitLength >>> 0;
+    const high = Math.floor(bitLength / 0x1_0000_0000);
+    if (littleEndianLength) {
+        view.setUint32(paddedLength - 8, low, true);
+        view.setUint32(paddedLength - 4, high, true);
+    }
+    else {
+        view.setUint32(paddedLength - 8, high, false);
+        view.setUint32(paddedLength - 4, low, false);
+    }
+    return view;
+}
+function utf8Bytes(input) {
+    return new TextEncoder().encode(input);
+}
+const SHA256_K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/** Hex-encoded SHA-256 of the UTF-8 encoding of `input`. */
+export function sha256Hex(input) {
+    const view = padMessage(utf8Bytes(input), false);
+    const state = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+        0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const schedule = new Uint32Array(64);
+    for (let offset = 0; offset < view.byteLength; offset += 64) {
+        for (let i = 0; i < 16; i += 1) {
+            schedule[i] = view.getUint32(offset + i * 4, false);
+        }
+        for (let i = 16; i < 64; i += 1) {
+            const previous = wordAt(schedule, i - 15);
+            const recent = wordAt(schedule, i - 2);
+            const s0 = rotateRight(previous, 7) ^ rotateRight(previous, 18) ^ (previous >>> 3);
+            const s1 = rotateRight(recent, 17) ^ rotateRight(recent, 19) ^ (recent >>> 10);
+            schedule[i] = (wordAt(schedule, i - 16) + s0 + wordAt(schedule, i - 7) + s1) >>> 0;
+        }
+        let a = wordAt(state, 0);
+        let b = wordAt(state, 1);
+        let c = wordAt(state, 2);
+        let d = wordAt(state, 3);
+        let e = wordAt(state, 4);
+        let f = wordAt(state, 5);
+        let g = wordAt(state, 6);
+        let h = wordAt(state, 7);
+        for (let i = 0; i < 64; i += 1) {
+            const s1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25);
+            const choice = (e & f) ^ (~e & g);
+            const temp1 = (h + s1 + choice + wordAt(SHA256_K, i) + wordAt(schedule, i)) >>> 0;
+            const s0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22);
+            const majority = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (s0 + majority) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        state[0] = (wordAt(state, 0) + a) >>> 0;
+        state[1] = (wordAt(state, 1) + b) >>> 0;
+        state[2] = (wordAt(state, 2) + c) >>> 0;
+        state[3] = (wordAt(state, 3) + d) >>> 0;
+        state[4] = (wordAt(state, 4) + e) >>> 0;
+        state[5] = (wordAt(state, 5) + f) >>> 0;
+        state[6] = (wordAt(state, 6) + g) >>> 0;
+        state[7] = (wordAt(state, 7) + h) >>> 0;
+    }
+    let digest = "";
+    for (let i = 0; i < 8; i += 1)
+        digest += hex32BigEndian(wordAt(state, i));
+    return digest;
+}
+const MD5_K = new Uint32Array([
+    0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,
+    0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,
+    0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,
+    0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,
+    0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,
+    0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,
+    0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,
+    0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,
+]);
+const MD5_SHIFTS = [
+    7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
+    5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
+    4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
+    6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,
+];
+/** Hex-encoded MD5 of the UTF-8 encoding of `input`. */
+export function md5Hex(input) {
+    const view = padMessage(utf8Bytes(input), true);
+    const state = new Uint32Array([0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476]);
+    const block = new Uint32Array(16);
+    for (let offset = 0; offset < view.byteLength; offset += 64) {
+        for (let i = 0; i < 16; i += 1) {
+            block[i] = view.getUint32(offset + i * 4, true);
+        }
+        let a = wordAt(state, 0);
+        let b = wordAt(state, 1);
+        let c = wordAt(state, 2);
+        let d = wordAt(state, 3);
+        for (let i = 0; i < 64; i += 1) {
+            let mixed;
+            let wordIndex;
+            if (i < 16) {
+                mixed = (b & c) | (~b & d);
+                wordIndex = i;
+            }
+            else if (i < 32) {
+                mixed = (d & b) | (~d & c);
+                wordIndex = (5 * i + 1) % 16;
+            }
+            else if (i < 48) {
+                mixed = b ^ c ^ d;
+                wordIndex = (3 * i + 5) % 16;
+            }
+            else {
+                mixed = c ^ (b | ~d);
+                wordIndex = (7 * i) % 16;
+            }
+            const rotated = rotateLeft((mixed + a + wordAt(MD5_K, i) + wordAt(block, wordIndex)) >>> 0, shiftAt(MD5_SHIFTS, i));
+            a = d;
+            d = c;
+            c = b;
+            b = (b + rotated) >>> 0;
+        }
+        state[0] = (wordAt(state, 0) + a) >>> 0;
+        state[1] = (wordAt(state, 1) + b) >>> 0;
+        state[2] = (wordAt(state, 2) + c) >>> 0;
+        state[3] = (wordAt(state, 3) + d) >>> 0;
+    }
+    let digest = "";
+    for (let i = 0; i < 4; i += 1)
+        digest += hex32LittleEndian(wordAt(state, i));
+    return digest;
+}

package/node_modules/@oxygen/formula/dist/index.d.ts

@@ -14,4 +14,5 @@ export { isRecord } from "./coerce.js";
 export * from "./evaluate.js";
 export * from "./expression.js";
 export * from "./formula-functions.js";
+export * from "./value-cleaners.js";
 export * from "./value-normalizers.js";

package/node_modules/@oxygen/formula/dist/index.js

@@ -14,4 +14,5 @@ export { isRecord } from "./coerce.js";
 export * from "./evaluate.js";
 export * from "./expression.js";
 export * from "./formula-functions.js";
+export * from "./value-cleaners.js";
 export * from "./value-normalizers.js";

package/node_modules/@oxygen/formula/dist/value-cleaners.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Deterministic value cleaners for dirty GTM strings — company names, job
+ * titles, delimited lists, and email-address classification.
+ *
+ * Pure string functions with no I/O, no tenant context, and no dependencies,
+ * so the exact semantics that clean a cell in the worker also run in the
+ * browser (formula editor previews). Every list below is a fixed, auditable
+ * data set: nothing here calls a provider, spends a credit, or guesses with a
+ * model. When a deterministic list is not enough, the paid verifier columns
+ * are the upgrade — these helpers are the free first pass.
+ */
+/** True when every cased letter in the text is upper-case (digits/punctuation ignored). */
+export declare function isAllCaps(value: string): boolean;
+/** Capitalizes the first letter of every word and lowercases the rest (Unicode-aware). */
+export declare function titleCaseWords(value: string): string;
+/**
+ * Legal/corporate suffixes, stored as punctuation-free lower-case keys so
+ * "L.L.C.", "llc", and "LLC," all reduce to `llc`. Multi-word suffixes are
+ * joined ("pty ltd" → `ptyltd`) and matched against the trailing 1–3 tokens.
+ */
+export declare const COMPANY_LEGAL_SUFFIX_KEYS: ReadonlySet<string>;
+export type CompanyNameMode = "display" | "short";
+/**
+ * Canonical company name: legal suffixes removed, stray punctuation and quotes
+ * trimmed, whitespace collapsed. Casing is the author's unless the whole name
+ * shouts ("ACME CORP." → "Acme"), because "hubspot" is how that company writes
+ * itself. `short` additionally cuts a tagline after a separator and keeps at
+ * most three words — the form that fits in an email's first sentence.
+ *
+ * Blank input returns null.
+ */
+export declare function normalizeCompanyName(value: unknown, mode?: CompanyNameMode): string | null;
+/**
+ * Recruiting and self-promotion phrases that ride along in a scraped headline.
+ * Longest first so "we're hiring" is consumed before the bare "hiring".
+ */
+export declare const JOB_TITLE_SLOGANS: readonly string[];
+/**
+ * Canonical job title: emoji, hashtags, parentheticals, and hiring slogans
+ * removed, then only the first clause of a separator-joined headline kept.
+ * All-caps titles are title-cased; every other casing is the author's.
+ *
+ * Blank input, or input that was nothing but noise, returns null.
+ */
+export declare function cleanJobTitle(value: unknown): string | null;
+/**
+ * Turns one messy cell into a clean array: trimmed, blank-free, de-duplicated
+ * in first-seen order. An existing array or a JSON-encoded array is cleaned in
+ * place; a string is split on the given separator, or on the first delimiter
+ * actually present (newline, `;`, `|`, `,`) when none is given.
+ *
+ * Blank input returns an empty array.
+ */
+export declare function splitDelimitedList(value: unknown, separator?: string | null): string[];
+/**
+ * Consumer mailbox providers — a person, not a company domain. Re-exported from
+ * `@oxygen/shared/freemail-domains`, which is now the ONE list; this module used to
+ * carry its own 101-entry copy and was the best-maintained of eight divergent forks.
+ * Its entries survive as the bulk of the shared broad tier.
+ */
+export declare const FREE_MAIL_DOMAINS: ReadonlySet<string>;
+/** Throwaway inbox providers — never worth a send, never worth a credit. */
+export declare const DISPOSABLE_EMAIL_DOMAINS: ReadonlySet<string>;
+/** Shared-inbox local parts — a department, not a person. */
+export declare const ROLE_EMAIL_LOCAL_PARTS: ReadonlySet<string>;
+export type EmailType = "disposable" | "role" | "personal" | "work";
+/**
+ * Classifies an email address from OXYGEN's built-in lists, in precedence
+ * order: a throwaway domain wins, then a shared-inbox local part, then a
+ * consumer mailbox provider, and anything left is a company address.
+ *
+ * Blank or syntactically invalid input returns null.
+ */
+export declare function classifyEmailType(value: unknown): EmailType | null;