@oxygen-agent/cli 1.987.20 → 1.1010.1

package/node_modules/@oxygen/shared/dist/product-analytics-events.d.ts

@@ -42,7 +42,6 @@ export declare const PRODUCT_EVENTS: {
     readonly FIRST_PLAY_STARTED: "first_play_started";
     readonly FIRST_PLAY_STEP_COMPLETED: "first_play_step_completed";
     readonly FIRST_PLAY_COMPLETED: "first_play_completed";
-    readonly FIRST_PLAY_SKIPPED: "first_play_skipped";
     /**
      * Usage — what was ASKED for. `mcp_tool_called` used to sit here as the
      * second highest-volume event; it was REPLACED (not joined) by the reserved
@@ -70,13 +69,33 @@ export declare const PRODUCT_EVENTS: {
     readonly TABLE_INGESTION_RUN_SETTLED: "table_ingestion_run_settled";
     readonly AGENT_RUN_SETTLED: "agent_run_settled";
     readonly SEQUENCE_ENROLLMENT_SETTLED: "sequence_enrollment_settled";
+    /**
+     * A Workspace Copilot turn reached completed / failed / cancelled. The
+     * Copilot is a Control surface, not a primitive, but its turns are durable
+     * worker runs like the others and it had no outcome event at all. Counts,
+     * credits and ids only — never the user message or the assistant text.
+     */
+    readonly COPILOT_TURN_SETTLED: "copilot_turn_settled";
     /** Revenue lifecycle. */
+    /**
+     * A Stripe Checkout was opened for a first subscription. `source` says which
+     * surface opened it (a paywall, the sidebar Upgrade row, Billing) and
+     * `blocked_capability` which wall, so signup → wall → checkout →
+     * `subscription_activated` is one funnel instead of a gap between pageviews.
+     */
+    readonly CHECKOUT_STARTED: "checkout_started";
     readonly TRIAL_STARTED: "trial_started";
     readonly SUBSCRIPTION_ACTIVATED: "subscription_activated";
     readonly SUBSCRIPTION_CHURNED: "subscription_churned";
     readonly TRIAL_CANCEL_SCHEDULED: "trial_cancel_scheduled";
     readonly TRIAL_CANCEL_RESUMED: "trial_cancel_resumed";
     readonly TRIAL_ENDED_UNCONVERTED: "trial_ended_unconverted";
+    /**
+     * A paid credit top-up was granted (the Stripe Checkout fulfilment, after the
+     * ledger grant committed). `uuid` derives from the checkout session, so the
+     * webhook, the success redirect and every redelivery collapse to one event.
+     */
+    readonly CREDITS_PURCHASED: "credits_purchased";
     /**
      * Marketing site. The public hero lookup on oxygen-agent.com: an ANONYMOUS
      * visitor types their website and OXYGEN spends its own credits profiling it.
@@ -101,6 +120,21 @@ export declare const PRODUCT_EVENTS: {
     readonly HERO_LOOKUP_SUBMITTED: "hero_lookup_submitted";
     readonly HERO_LOOKUP_RENDERED: "hero_lookup_rendered";
     readonly HERO_SIGNUP_CLICKED: "hero_signup_clicked";
+    /**
+     * Web navigation timing, measured in the browser from the click on an
+     * internal link (capture phase, before Next's own handler) to: the first
+     * visible feedback, the URL commit, and the destination's own readiness
+     * seam (`lib/analytics/navigation-readiness.ts`). Properties are route
+     * TEMPLATES (ids collapsed), a duration and enums — never a raw path, a
+     * query string or page content. PostHog owns these because they answer
+     * "how does the product feel per route per release", which is a usage
+     * question joinable to the funnel; a navigation that never became usable
+     * is a defect and is ALSO beaconed to Axiom as a client error.
+     */
+    readonly WEB_NAVIGATION_FEEDBACK: "web_navigation_feedback";
+    readonly WEB_NAVIGATION_MEANINGFUL: "web_navigation_meaningful";
+    readonly WEB_NAVIGATION_USABLE: "web_navigation_usable";
+    readonly WEB_NAVIGATION_USABLE_TIMEOUT: "web_navigation_usable_timeout";
     /** Pipeline heartbeat: proves ingestion is alive when the product is quiet. */
     readonly POSTHOG_CANARY: "posthog_canary";
 };
@@ -112,5 +146,5 @@ export declare const PRODUCT_EVENT_NAMES: readonly ProductEventName[];
  * emitter cannot be handed a lifecycle event that only the control plane has
  * the facts for.
  */
-export declare const WORKER_RUN_OUTCOME_EVENTS: readonly ["workflow_run_settled", "table_action_run_settled", "table_ingestion_run_settled", "agent_run_settled", "sequence_enrollment_settled"];
+export declare const WORKER_RUN_OUTCOME_EVENTS: readonly ["workflow_run_settled", "table_action_run_settled", "table_ingestion_run_settled", "agent_run_settled", "sequence_enrollment_settled", "copilot_turn_settled"];
 export type WorkerRunOutcomeEventName = (typeof WORKER_RUN_OUTCOME_EVENTS)[number];

package/node_modules/@oxygen/shared/dist/product-analytics-events.js

@@ -42,7 +42,6 @@ export const PRODUCT_EVENTS = {
     FIRST_PLAY_STARTED: "first_play_started",
     FIRST_PLAY_STEP_COMPLETED: "first_play_step_completed",
     FIRST_PLAY_COMPLETED: "first_play_completed",
-    FIRST_PLAY_SKIPPED: "first_play_skipped",
     /**
      * Usage — what was ASKED for. `mcp_tool_called` used to sit here as the
      * second highest-volume event; it was REPLACED (not joined) by the reserved
@@ -70,13 +69,33 @@ export const PRODUCT_EVENTS = {
     TABLE_INGESTION_RUN_SETTLED: "table_ingestion_run_settled",
     AGENT_RUN_SETTLED: "agent_run_settled",
     SEQUENCE_ENROLLMENT_SETTLED: "sequence_enrollment_settled",
+    /**
+     * A Workspace Copilot turn reached completed / failed / cancelled. The
+     * Copilot is a Control surface, not a primitive, but its turns are durable
+     * worker runs like the others and it had no outcome event at all. Counts,
+     * credits and ids only — never the user message or the assistant text.
+     */
+    COPILOT_TURN_SETTLED: "copilot_turn_settled",
     /** Revenue lifecycle. */
+    /**
+     * A Stripe Checkout was opened for a first subscription. `source` says which
+     * surface opened it (a paywall, the sidebar Upgrade row, Billing) and
+     * `blocked_capability` which wall, so signup → wall → checkout →
+     * `subscription_activated` is one funnel instead of a gap between pageviews.
+     */
+    CHECKOUT_STARTED: "checkout_started",
     TRIAL_STARTED: "trial_started",
     SUBSCRIPTION_ACTIVATED: "subscription_activated",
     SUBSCRIPTION_CHURNED: "subscription_churned",
     TRIAL_CANCEL_SCHEDULED: "trial_cancel_scheduled",
     TRIAL_CANCEL_RESUMED: "trial_cancel_resumed",
     TRIAL_ENDED_UNCONVERTED: "trial_ended_unconverted",
+    /**
+     * A paid credit top-up was granted (the Stripe Checkout fulfilment, after the
+     * ledger grant committed). `uuid` derives from the checkout session, so the
+     * webhook, the success redirect and every redelivery collapse to one event.
+     */
+    CREDITS_PURCHASED: "credits_purchased",
     /**
      * Marketing site. The public hero lookup on oxygen-agent.com: an ANONYMOUS
      * visitor types their website and OXYGEN spends its own credits profiling it.
@@ -101,6 +120,21 @@ export const PRODUCT_EVENTS = {
     HERO_LOOKUP_SUBMITTED: "hero_lookup_submitted",
     HERO_LOOKUP_RENDERED: "hero_lookup_rendered",
     HERO_SIGNUP_CLICKED: "hero_signup_clicked",
+    /**
+     * Web navigation timing, measured in the browser from the click on an
+     * internal link (capture phase, before Next's own handler) to: the first
+     * visible feedback, the URL commit, and the destination's own readiness
+     * seam (`lib/analytics/navigation-readiness.ts`). Properties are route
+     * TEMPLATES (ids collapsed), a duration and enums — never a raw path, a
+     * query string or page content. PostHog owns these because they answer
+     * "how does the product feel per route per release", which is a usage
+     * question joinable to the funnel; a navigation that never became usable
+     * is a defect and is ALSO beaconed to Axiom as a client error.
+     */
+    WEB_NAVIGATION_FEEDBACK: "web_navigation_feedback",
+    WEB_NAVIGATION_MEANINGFUL: "web_navigation_meaningful",
+    WEB_NAVIGATION_USABLE: "web_navigation_usable",
+    WEB_NAVIGATION_USABLE_TIMEOUT: "web_navigation_usable_timeout",
     /** Pipeline heartbeat: proves ingestion is alive when the product is quiet. */
     POSTHOG_CANARY: "posthog_canary",
 };
@@ -117,4 +151,5 @@ export const WORKER_RUN_OUTCOME_EVENTS = Object.freeze([
     PRODUCT_EVENTS.TABLE_INGESTION_RUN_SETTLED,
     PRODUCT_EVENTS.AGENT_RUN_SETTLED,
     PRODUCT_EVENTS.SEQUENCE_ENROLLMENT_SETTLED,
+    PRODUCT_EVENTS.COPILOT_TURN_SETTLED,
 ]);

package/node_modules/@oxygen/shared/dist/rate-window.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Fixed-window bucketing arithmetic shared by every rate/spend limiter.
+ */
+/** The start of the fixed `windowSeconds` window containing `now`. */
+export declare function startOfWindow(now: Date, windowSeconds: number): Date;

package/node_modules/@oxygen/shared/dist/rate-window.js

@@ -0,0 +1,8 @@
+/**
+ * Fixed-window bucketing arithmetic shared by every rate/spend limiter.
+ */
+/** The start of the fixed `windowSeconds` window containing `now`. */
+export function startOfWindow(now, windowSeconds) {
+    const windowMs = windowSeconds * 1000;
+    return new Date(Math.floor(now.getTime() / windowMs) * windowMs);
+}

package/node_modules/@oxygen/shared/dist/redaction.js

@@ -1,5 +1,8 @@
 const SECRET_KEY_PATTERN = /(api[_-]?key|x[_-]?key|authorization|bearer|cookie|password|secret|token|ciphertext|connection[_-]?string|connection[_-]?uri|database[_-]?url|dsn)/i;
-const OMITTED_KEY_PATTERN = /^(body|payload|prompt|prompts|raw_prompt|raw_prompts|row|rows|input|inputs|output|outputs|request|response|provider_payload|provider_response|customer_data)$/i;
+// `content_preview` is raw model output (ai-column-runner's invalid_ai_output
+// details); web routes log `error_details` on a 4xx, and model text belongs in
+// Langfuse only (ADR 0014), never in operational logs.
+const OMITTED_KEY_PATTERN = /^(body|payload|prompt|prompts|raw_prompt|raw_prompts|row|rows|input|inputs|output|outputs|request|response|provider_payload|provider_response|customer_data|content_preview)$/i;
 // OXY-125: keyed redaction (SECRET_KEY_PATTERN) only catches whole fields named
 // like a secret. Credentials also leak as *substrings* of otherwise-ordinary
 // fields — most commonly an Authorization header dumped into error_message /

package/node_modules/@oxygen/shared/dist/research-output-contract.js

@@ -1,3 +1,4 @@
+import { isRecord as isObject } from "./type-guards.js";
 const MAX_RESEARCH_SECTIONS = 20;
 const OUTPUT_SECTIONS_MARKER = /\b(?:return|provide|include|produce|output)\b.{0,80}\b(?:labeled|named|required|requested)?\s*(?:output\s+)?sections?\s*:/i;
 const LABELED_SECTION = /^(?:[-*+]\s+|\d+[.)]\s+)?([A-Za-z][A-Za-z0-9_. /&()'’+\-]{1,79})\s*:\s*.*$/;
@@ -253,6 +254,3 @@ function hasExactMembers(value, expected) {
         && value.length === expected.length
         && expected.every((member) => value.includes(member));
 }
-function isObject(value) {
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}

package/node_modules/@oxygen/shared/dist/scraper-lane-credential.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Which key a LinkedIn scraper lane runs on (Philipp, 2026-09-25). Every lane
+ * defaults to OXYGEN's managed credits; a workspace may instead run it on its own
+ * account with the lane's vendor, which OXYGEN then never bills. The vendor is a
+ * property of the lane, so a caller picks only the mode.
+ *
+ * Browser-safe on purpose: the New table lanes render the menu from this list.
+ */
+export declare const SCRAPER_LANE_CREDENTIAL_MODES: readonly ["managed", "user_api_key"];
+export type ScraperLaneCredentialMode = (typeof SCRAPER_LANE_CREDENTIAL_MODES)[number];
+export type ScraperLane = "linkedin_posts" | "linkedin_post_engagers" | "linkedin_company_followers";
+/** The integration that stores each lane's customer key, and its display name. */
+export declare const SCRAPER_LANE_KEY_VENDOR: Readonly<Record<ScraperLane, {
+    integrationId: "up2data" | "scrapeli";
+    name: string;
+}>>;
+/** Absent means managed; anything outside the two modes is null, for the caller to refuse. */
+export declare function readScraperLaneCredentialMode(value: unknown): ScraperLaneCredentialMode | null;

package/node_modules/@oxygen/shared/dist/scraper-lane-credential.js

@@ -0,0 +1,23 @@
+/**
+ * Which key a LinkedIn scraper lane runs on (Philipp, 2026-09-25). Every lane
+ * defaults to OXYGEN's managed credits; a workspace may instead run it on its own
+ * account with the lane's vendor, which OXYGEN then never bills. The vendor is a
+ * property of the lane, so a caller picks only the mode.
+ *
+ * Browser-safe on purpose: the New table lanes render the menu from this list.
+ */
+export const SCRAPER_LANE_CREDENTIAL_MODES = ["managed", "user_api_key"];
+/** The integration that stores each lane's customer key, and its display name. */
+export const SCRAPER_LANE_KEY_VENDOR = {
+    linkedin_posts: { integrationId: "up2data", name: "Up2Data" },
+    linkedin_post_engagers: { integrationId: "up2data", name: "Up2Data" },
+    linkedin_company_followers: { integrationId: "scrapeli", name: "ScrapeLi" },
+};
+/** Absent means managed; anything outside the two modes is null, for the caller to refuse. */
+export function readScraperLaneCredentialMode(value) {
+    if (value === undefined || value === null || value === "")
+        return "managed";
+    return SCRAPER_LANE_CREDENTIAL_MODES.includes(value)
+        ? value
+        : null;
+}

package/node_modules/@oxygen/shared/dist/search-vocab.js

@@ -1,11 +1,10 @@
 // Shared search-planner vocabulary + stateless text helpers.
 //
 // Single source of truth for the constraint vocabulary and pure text helpers
-// consumed by BOTH the legacy web search planners
-// (apps/web/src/lib/company-search-plan.ts, people-search-plan.ts) and the
-// @oxygen/routing classifier/compiler (via packages/routing/src/vocab.ts,
-// which layers its named tuning deltas on top of these bases). Keeping one copy
-// here is what stops the two surfaces from silently drifting (OXY-414).
+// consumed by the web search planners (apps/web/src/lib/company-search-plan.ts,
+// people-search-plan.ts). Any other search classifier or compiler layers its
+// tuning deltas on top of these bases rather than re-listing vocabulary, so the
+// surfaces cannot silently drift (OXY-414).
 //
 // Everything here is a pure function or a static table: no Date.now, no
 // randomness, no I/O — safe to import from any layer.

package/node_modules/@oxygen/shared/dist/select-options.js

@@ -75,7 +75,12 @@ export const IMAGE_COLUMN_SEMANTIC = "image";
 export function isImageColumnSemantic(semanticType) {
     return semanticType === "image" || semanticType === "avatar" || semanticType === "photo";
 }
-const MAX_OPTIONS = 200;
+// A sanity ceiling, not a correctness one: it stops a malformed write from
+// turning one column into an unbounded list. Raised from 200 to 300 for the
+// CRM's country column, whose vocabulary is the 250-entry LinkedIn country set
+// (see @oxygen/shared/linkedin-countries) — at 200 the tail of the alphabet was
+// silently truncated away, which reads as "Oxygen has never heard of Vietnam".
+const MAX_OPTIONS = 300;
 // Normalize a raw options array (from a column `definition.options`, CLI/MCP, or
 // the editor) into canonical SelectOptions: dedupe by value, default colors,
 // canonical 0..n ordering. Accepts strings or {value,label,color,order} objects.

package/node_modules/@oxygen/shared/dist/sequence-failures.js

@@ -1,5 +1,6 @@
 import { redactCustomerFacingDetails, redactCustomerFacingError, } from "./error-redaction.js";
 import { isProviderFundingErrorCode, isProviderRateLimitErrorCode, } from "./provider-funding-errors.js";
+import { asRecordOrNull as asRecord } from "./type-guards.js";
 export const SEQUENCE_FAILURE_SCHEMA_VERSION = 1;
 export const SEQUENCE_FAILURE_RETRY_AFTER_MAX_MS = 24 * 60 * 60 * 1000;
 export const SEQUENCE_FAILURE_CLASSES = [
@@ -318,8 +319,3 @@ function firstBoolean(records, keys) {
     }
     return null;
 }
-function asRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : null;
-}

package/node_modules/@oxygen/shared/dist/sequences.d.ts

@@ -1176,4 +1176,27 @@ export declare function secondsUntilSendWindowEnd(window: SequenceSendWindow, no
  * describes this window's sends.
  */
 export declare function secondsSinceSendWindowStart(window: SequenceSendWindow, now: Date, timezone?: string): number | null;
+/**
+ * The next instant at which `isWithinSendWindow` becomes true, or null when the
+ * window is already open, never opens, or cannot be evaluated.
+ *
+ * This is what a deferral should wait for. Before it existed, the two
+ * native-email send-window gates deferred a flat +30 minutes, so every pending
+ * action was re-claimed, re-planned and re-written twice an hour for as long as
+ * the window stayed shut — ~128 times each across a closed weekend, which is
+ * where 24,261 of one fortnight's deferral log lines came from.
+ *
+ * Null on exactly the cases its three siblings decline: an unresolvable
+ * timezone, a malformed `start`/`end`, and a zero-width window. The caller keeps
+ * its own fallback delay for those, so a bad window can never park an action
+ * forever — the same fail-open posture isWithinSendWindow takes.
+ *
+ * Computed by stepping to the next allowed local `start` and then correcting
+ * against the real clock, because minutes-of-day arithmetic alone is wrong
+ * across a DST boundary (the offset moves between `now` and the candidate). The
+ * correction re-reads the candidate's local time and closes the gap; the result
+ * is only returned once isWithinSendWindow itself agrees, so this function can
+ * never hand back an instant the gate would reject.
+ */
+export declare function nextSendWindowOpenAt(window: SequenceSendWindow, now: Date, timezone?: string): Date | null;
 export {};

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -1,5 +1,7 @@
 import { OxygenError } from "./cli-result.js";
 import { hashVariantKey, renderTemplate, spintaxSyntaxIssues, templateColumnKeys, } from "./sequence-template.js";
+import { isRecord } from "./type-guards.js";
+import { LINKEDIN_INVITE_NOTE_LIMIT } from "./linkedin-sequences.js";
 /**
  * Multichannel sequence DSL — the shared contract validated identically by CLI,
  * MCP, API, and web. A sequence is an ordered list of steps applied to each
@@ -996,7 +998,10 @@ export const SEQUENCE_CRM_IDENTITY_KINDS = [
 export const SEQUENCE_CONNECTION_BRANCH_CONDITIONS = ["connection_accepted", "already_connected", "open_profile"];
 const MAX_SEQUENCE_STEPS = 50;
 const MAX_TEMPLATE_LENGTH = 8_000;
-const MAX_NOTE_LENGTH = 300;
+// The Premium ceiling, and only an authoring hint: the limit that actually
+// binds is the SENDER's, which is lower on a Basic account and is enforced
+// against the RENDERED note at dispatch. See LINKEDIN_INVITE_NOTE_LIMIT_BASIC.
+const MAX_NOTE_LENGTH = LINKEDIN_INVITE_NOTE_LIMIT;
 const MAX_CRM_TASK_PROPERTIES = 100;
 const MAX_CRM_TASK_ASSOCIATIONS = 20;
 const MAX_CRM_RECORD_MAPPINGS = 10;
@@ -2563,6 +2568,36 @@ function hhmmToMinutes(value) {
     return hours * 60 + minutes;
 }
 const ISO_WEEKDAY = { Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6, Sun: 7 };
+/**
+ * Does this window admit `isoWeekday`? Shared by every gate so they cannot
+ * disagree about what a day list means.
+ *
+ * `days` is contractually ISO numbers (normalizeWeekdays rejects anything else),
+ * but `settings.email_send_window` is stored without passing through it, and
+ * production holds windows whose days are `["mon","tue",...]`. A raw
+ * `days.includes(1)` is false for every day of the week, so such a window is
+ * never open and its Sequence can never send — a silent, permanent stall that
+ * also contradicts this module's fail-open posture for a malformed window.
+ * Names are therefore accepted, and a list with no recognisable entry at all is
+ * treated as absent (every day), which is exactly what normalizeWeekdays
+ * produces for the same input.
+ */
+function sendWindowAllowsWeekday(days, isoWeekday) {
+    let recognised = 0;
+    for (const entry of days) {
+        const day = typeof entry === "number"
+            ? entry
+            : typeof entry === "string"
+                ? ISO_WEEKDAY[`${entry.trim().slice(0, 1).toUpperCase()}${entry.trim().slice(1, 3).toLowerCase()}`] ?? Number(entry)
+                : Number.NaN;
+        if (!Number.isInteger(day) || day < 1 || day > 7)
+            continue;
+        recognised += 1;
+        if (day === isoWeekday)
+            return true;
+    }
+    return recognised === 0;
+}
 /**
  * Resolve which IANA timezone a send window evaluates in for a given lead row.
  * "recipient" mode reads the lead's tz from `recipient_timezone_column`, falling
@@ -2593,7 +2628,7 @@ export function isWithinSendWindow(window, now, timezone) {
     const endM = hhmmToMinutes(window.end);
     if (startM === null || endM === null)
         return true; // malformed window → fail open
-    if (window.days && window.days.length > 0 && !window.days.includes(parts.isoWeekday))
+    if (window.days && window.days.length > 0 && !sendWindowAllowsWeekday(window.days, parts.isoWeekday))
         return false;
     if (startM === endM)
         return false; // empty window
@@ -2654,6 +2689,84 @@ export function secondsSinceSendWindowStart(window, now, timezone) {
         : minutes + 24 * 60 - startM; // wrapped past midnight: opened yesterday evening
     return elapsedMinutes >= 0 ? elapsedMinutes * 60 : null;
 }
+/**
+ * How far ahead nextSendWindowOpenAt will look for an opening. A window with a
+ * `days` list opens at least weekly, so 8 days covers every configurable gap
+ * with a day of slack; anything that finds nothing inside it is a window that
+ * never opens (zero-width, or a malformed tz that fails the parts read).
+ */
+const SEND_WINDOW_LOOKAHEAD_DAYS = 8;
+/**
+ * The next instant at which `isWithinSendWindow` becomes true, or null when the
+ * window is already open, never opens, or cannot be evaluated.
+ *
+ * This is what a deferral should wait for. Before it existed, the two
+ * native-email send-window gates deferred a flat +30 minutes, so every pending
+ * action was re-claimed, re-planned and re-written twice an hour for as long as
+ * the window stayed shut — ~128 times each across a closed weekend, which is
+ * where 24,261 of one fortnight's deferral log lines came from.
+ *
+ * Null on exactly the cases its three siblings decline: an unresolvable
+ * timezone, a malformed `start`/`end`, and a zero-width window. The caller keeps
+ * its own fallback delay for those, so a bad window can never park an action
+ * forever — the same fail-open posture isWithinSendWindow takes.
+ *
+ * Computed by stepping to the next allowed local `start` and then correcting
+ * against the real clock, because minutes-of-day arithmetic alone is wrong
+ * across a DST boundary (the offset moves between `now` and the candidate). The
+ * correction re-reads the candidate's local time and closes the gap; the result
+ * is only returned once isWithinSendWindow itself agrees, so this function can
+ * never hand back an instant the gate would reject.
+ */
+export function nextSendWindowOpenAt(window, now, timezone) {
+    const tz = timezone?.trim() ? timezone.trim() : window.timezone;
+    const parts = tzParts(now, tz) ?? tzParts(now, window.timezone) ?? tzParts(now, "UTC");
+    if (!parts)
+        return null;
+    const startM = hhmmToMinutes(window.start);
+    const endM = hhmmToMinutes(window.end);
+    if (startM === null || endM === null || startM === endM)
+        return null;
+    if (isWithinSendWindow(window, now, timezone))
+        return null;
+    const dayAllowed = (isoWeekday) => !window.days || window.days.length === 0 || sendWindowAllowsWeekday(window.days, isoWeekday);
+    const minutes = parts.hour * 60 + parts.minute;
+    // Days to skip before the window's local `start` is both in the future and on
+    // an allowed weekday. 0 means "later today".
+    let dayOffset = minutes < startM && dayAllowed(parts.isoWeekday) ? 0 : 1;
+    while (dayOffset <= SEND_WINDOW_LOOKAHEAD_DAYS && !dayAllowed(((parts.isoWeekday - 1 + dayOffset) % 7) + 1)) {
+        dayOffset += 1;
+    }
+    if (dayOffset > SEND_WINDOW_LOOKAHEAD_DAYS)
+        return null;
+    let candidate = new Date(now.getTime() + ((dayOffset * 24 * 60) + startM - minutes) * 60_000);
+    // DST correction: the offset that applied at `now` may not apply at the
+    // candidate, so the naive arithmetic can land an hour early or late. Re-read
+    // the candidate's own local time and close the gap. Two rounds are enough for
+    // any real transition (the second only runs if the first lands on the shifted
+    // side of the boundary); a zone with no transition converges on the first.
+    for (let round = 0; round < 2; round += 1) {
+        const at = tzParts(candidate, tz);
+        if (!at)
+            break;
+        const drift = (at.hour * 60 + at.minute) - startM;
+        if (drift === 0)
+            break;
+        // Choose the nearer direction so a ±23h reading across midnight (the window
+        // opens just after a backward transition) corrects by minutes, not a day.
+        const shift = drift > 12 * 60 ? drift - 24 * 60 : drift < -12 * 60 ? drift + 24 * 60 : drift;
+        candidate = new Date(candidate.getTime() - shift * 60_000);
+    }
+    // A local `start` can be skipped entirely by a forward DST jump, and a
+    // corrected candidate can land a minute on the wrong side. Walk forward to the
+    // first minute the gate actually accepts rather than trusting the arithmetic.
+    for (let nudge = 0; nudge <= 120; nudge += 1) {
+        const at = new Date(candidate.getTime() + nudge * 60_000);
+        if (at.getTime() > now.getTime() && isWithinSendWindow(window, at, timezone))
+            return at;
+    }
+    return null;
+}
 function tzParts(now, tz) {
     try {
         const formatted = new Intl.DateTimeFormat("en-US", {
@@ -2852,6 +2965,3 @@ function normalizeWeekdays(value, path, issues) {
     }
     return out.length > 0 ? out.sort((a, b) => a - b) : undefined;
 }
-function isRecord(value) {
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}

package/node_modules/@oxygen/shared/dist/signup-lead-payload.d.ts

@@ -0,0 +1,80 @@
+export type JsonRecord = Record<string, unknown>;
+export type SignupLeadWebhookSource = "clerk" | "onboarding" | "backfill" | "stripe";
+export type CustomerLifecycleEvent = "signup"
+/** Creator research completed by the onboarding bootstrap; produced by @oxygen/control-db, never by Clerk. */
+ | "signup_research" | "trial_created" | "paid" | "churned";
+export type SignupLeadWebhookInput = {
+    eventId?: string | null | undefined;
+    providerEventId?: string | null | undefined;
+    type: string;
+    source: SignupLeadWebhookSource;
+    lifecycleEvent?: CustomerLifecycleEvent | null | undefined;
+    occurredAt?: Date | string | number | null | undefined;
+    user?: {
+        clerkUserId?: string | null;
+        email?: string | null;
+        firstName?: string | null;
+        lastName?: string | null;
+        createdAt?: Date | string | number | null | undefined;
+        /** A profile URL the provider already knows for this person; the consent-recorded creator URL still wins at enqueue. */
+        linkedinUrl?: string | null;
+    };
+    organization?: {
+        clerkOrgId?: string | null;
+        name?: string | null;
+        slug?: string | null;
+        domain?: string | null;
+        createdAt?: Date | string | number | null | undefined;
+        /**
+         * Clerk user id of the organization's creator (Clerk `organization.created_by`).
+         * Downstream qualification only treats the exact creator as an acquisition
+         * lead; invited members get onboarding but no founder outreach.
+         */
+        createdBy?: string | null;
+    };
+    membership?: {
+        role?: string | null;
+    };
+    stripe?: {
+        customerId?: string | null;
+        subscriptionId?: string | null;
+        invoiceId?: string | null;
+        priceId?: string | null;
+        tier?: string | null;
+        status?: string | null;
+        trialStart?: Date | string | number | null | undefined;
+        trialEnd?: Date | string | number | null | undefined;
+        periodStart?: Date | string | number | null | undefined;
+        periodEnd?: Date | string | number | null | undefined;
+        amountPaid?: number | null;
+        currency?: string | null;
+        billingReason?: string | null;
+    };
+    metadata?: JsonRecord;
+    /** Allow-listed research evidence (`person_facts` / `company_facts`) when the producer already holds it. */
+    qualificationEvidence?: JsonRecord;
+    /** Research intent or status attached to the fact (`expected`, `scope`, `run_id`, ...). */
+    research?: JsonRecord;
+    rawEvent?: JsonRecord;
+};
+export type SignupLeadWebhookPayload = JsonRecord & {
+    id: string;
+    event_id: string;
+    event: string;
+    type: string;
+    occurred_at: string;
+    source: SignupLeadWebhookSource;
+    event_type: string;
+    provider_event_id: string;
+};
+export type WorkEmailClassification = {
+    domain: string | null;
+    isGenericMailbox: boolean;
+};
+/**
+ * Classifies an email address into a (likely) company work-email domain.
+ * Consumer/generic mailboxes return `{ domain: null, isGenericMailbox: true }`.
+ */
+export declare function classifyWorkEmail(email: string | null | undefined): WorkEmailClassification;
+export declare function isGenericMailboxDomain(domain: string | null | undefined): boolean;
+export declare function buildSignupLeadWebhookPayload(input: SignupLeadWebhookInput): SignupLeadWebhookPayload;