@oxygen-agent/cli 1.987.20 → 1.1010.1

package/node_modules/@oxygen/cli-ugc/dist/field-parser.d.ts

@@ -3,5 +3,14 @@ export type Field = {
     kind: string;
     description: string;
     required: boolean;
+    /** CLI flag name when it differs from the body key (e.g. `at` for scheduled_for). */
+    flag?: string;
 };
+/** `2/week`, `4/month`, `10/total` or `none` (clears); a count of 1–100. */
+export declare function parsePostingTarget(value: string): {
+    count: number;
+    period: "week" | "month" | "total";
+} | null;
+/** A JSON array of emails, or emails separated by commas, semicolons or whitespace. */
+export declare function parseEmailList(value: string): string[];
 export declare function parseField(value: unknown, field: Field): unknown;

package/node_modules/@oxygen/cli-ugc/dist/field-parser.js

@@ -1,4 +1,38 @@
+/** `2/week`, `4/month`, `10/total` or `none` (clears); a count of 1–100. */
+export function parsePostingTarget(value) {
+    const text = value.trim().toLowerCase();
+    if (text === "none")
+        return null;
+    const match = /^(\d{1,3})\s*\/\s*(week|month|total)$/.exec(text);
+    const count = match ? Number(match[1]) : 0;
+    if (!match || count < 1 || count > 100)
+        throw new Error("--posting-target must be <n>/month, <n>/total or <n>/week with n from 1 to 100, or none.");
+    return { count, period: match[2] };
+}
+/** A JSON array of emails, or emails separated by commas, semicolons or whitespace. */
+export function parseEmailList(value) {
+    const text = value.trim();
+    let items;
+    if (text.startsWith("[")) {
+        items = JSON.parse(text);
+        if (!Array.isArray(items) || !items.every((item) => typeof item === "string"))
+            throw new Error("--emails must be a JSON array of strings or a comma-separated list.");
+    }
+    else
+        items = text.split(/[\s,;]+/);
+    const emails = items.map((item) => item.trim()).filter(Boolean);
+    if (!emails.length)
+        throw new Error("--emails needs at least one email address.");
+    return emails;
+}
 export function parseField(value, field) {
+    if (field.kind === "posting_target")
+        return parsePostingTarget(String(value));
+    if (field.kind === "email_list")
+        return parseEmailList(String(value));
+    // Comma-separated words; an empty value is an empty list (it clears).
+    if (field.kind === "text_list")
+        return String(value).split(",").map((item) => item.trim()).filter(Boolean);
     if (field.kind === "array" || field.kind === "object") {
         const parsed = JSON.parse(String(value));
         if (field.kind === "array"

package/node_modules/@oxygen/formula/dist/coerce.d.ts

@@ -3,6 +3,16 @@
  * imported from a host package) so the engine stays dependency-free and
  * browser-safe; tenant-db re-exports it from its own `coerce.ts` so the
  * existing internal import path keeps working.
+ *
+ * Do NOT replace this with `export { isRecord } from "@oxygen/shared"`. This
+ * file is value-re-exported by ./index.ts, so that edge drags the whole
+ * @oxygen/shared root barrel into every browser bundle that touches the formula
+ * engine — packages/workflows/src/graph/browser-safety.test.ts fails on exactly
+ * that ("packages/formula/src/coerce.ts imports @oxygen/shared"). @oxygen/shared
+ * does export a `./type-guards` leaf, but importing it would still make this
+ * browser-safe package depend on @oxygen/shared, which the same guard forbids
+ * (packages/formula declares no @oxygen/* dependency at all); the duplicate body
+ * is deliberate.
  */
 /** Loose record check: any non-array object (class instances included). */
 export declare function isRecord(value: unknown): value is Record<string, unknown>;

package/node_modules/@oxygen/formula/dist/coerce.js

@@ -3,6 +3,16 @@
  * imported from a host package) so the engine stays dependency-free and
  * browser-safe; tenant-db re-exports it from its own `coerce.ts` so the
  * existing internal import path keeps working.
+ *
+ * Do NOT replace this with `export { isRecord } from "@oxygen/shared"`. This
+ * file is value-re-exported by ./index.ts, so that edge drags the whole
+ * @oxygen/shared root barrel into every browser bundle that touches the formula
+ * engine — packages/workflows/src/graph/browser-safety.test.ts fails on exactly
+ * that ("packages/formula/src/coerce.ts imports @oxygen/shared"). @oxygen/shared
+ * does export a `./type-guards` leaf, but importing it would still make this
+ * browser-safe package depend on @oxygen/shared, which the same guard forbids
+ * (packages/formula declares no @oxygen/* dependency at all); the duplicate body
+ * is deliberate.
  */
 /** Loose record check: any non-array object (class instances included). */
 export function isRecord(value) {

package/node_modules/@oxygen/formula/dist/formula-functions.js

@@ -1,5 +1,7 @@
 import { OxygenError } from "@oxygen/shared/cli-result";
 import { walkJsonPath } from "@oxygen/shared/json-path";
+import { resolveLinkedInCountry } from "@oxygen/shared/linkedin-countries";
+import { md5Hex, sha256Hex } from "./hash.js";
 import { normalizeDomain, normalizeEmail, normalizeLinkedinUrl, } from "./value-normalizers.js";
 import { classifyEmailType, cleanJobTitle, normalizeCompanyName, splitDelimitedList, } from "./value-cleaners.js";
 // Pattern LENGTH is not a safety bound and never was -- catastrophic backtracking
@@ -578,6 +580,56 @@ const SPECS = [
         examples: [{ expression: "title_case(\"acme CORP\")", result: "Acme Corp" }],
         evaluate: (args) => asText(args[0]).replace(/([A-Za-z])([A-Za-z]*)/g, (_match, first, rest) => first.toUpperCase() + rest.toLowerCase()),
     }),
+    spec({
+        name: "sha256",
+        category: "string",
+        signature: "sha256(text)",
+        description: "Hex-encoded SHA-256 digest of the text (UTF-8). Computed in-process, so it costs no credits. Blank input returns null.",
+        minArgs: 1,
+        maxArgs: 1,
+        examples: [{ expression: "sha256(\"abc\")", result: "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad" }],
+        evaluate: (args) => blankToNull(args[0], (input) => sha256Hex(asText(input))),
+    }),
+    spec({
+        name: "md5",
+        category: "string",
+        signature: "md5(text)",
+        description: "Hex-encoded MD5 digest of the text (UTF-8). Computed in-process, so it costs no credits. Blank input returns null. MD5 exists here for ad-platform audience matching, never for anything security-bearing.",
+        minArgs: 1,
+        maxArgs: 1,
+        examples: [{ expression: "md5(\"abc\")", result: "900150983cd24fb0d6963f7d28e17f72" }],
+        evaluate: (args) => blankToNull(args[0], (input) => md5Hex(asText(input))),
+    }),
+    spec({
+        name: "email_hash",
+        category: "string",
+        signature: "email_hash(email, algorithm?)",
+        description: "Normalizes an email address and returns its hex digest — the hashed identifier ad platforms take for custom audiences. Algorithm is \"sha256\" (default) or \"md5\"; blank input returns null.",
+        minArgs: 1,
+        maxArgs: 2,
+        examples: [{ expression: "email_hash(\"  Ada@Example.COM \")", result: "b5fc85e55755f9e0d030a10ab4429b6b2944855f9a0d60077fe832becbc41d72" }],
+        evaluate: (args) => {
+            // The algorithm is checked before the blank check on purpose: an unknown
+            // algorithm is an authoring mistake, not row data, so it must fail on
+            // every row rather than only on the rows that carry an address.
+            const algorithm = args.length > 1 && !isBlankFormulaValue(args[1])
+                ? asText(args[1]).trim().toLowerCase()
+                : "sha256";
+            if (algorithm !== "sha256" && algorithm !== "md5") {
+                throw formulaExpressionError("email_hash supports the \"sha256\" and \"md5\" algorithms only.", {
+                    function: "email_hash",
+                    algorithm: args[1],
+                });
+            }
+            return blankToNull(args[0], (input) => {
+                // Trim + lowercase and nothing else. Meta, Google, and LinkedIn all
+                // specify exactly that normalization, so stripping dots or plus-tags
+                // here would hash an address the platform never matches.
+                const normalized = normalizeEmail(asText(input));
+                return algorithm === "md5" ? md5Hex(normalized) : sha256Hex(normalized);
+            });
+        },
+    }),
     spec({
         name: "pad_start",
         category: "string",
@@ -943,6 +995,19 @@ const SPECS = [
             }
         }),
     }),
+    spec({
+        name: "linkedin_country",
+        category: "url_email",
+        signature: "linkedin_country(code_or_name)",
+        description: "Canonical LinkedIn country name for an ISO alpha-2 code, a country name, or a known alias. Returns blank for anything unrecognized, so a select column never stores a value outside its own option list.",
+        minArgs: 1,
+        maxArgs: 1,
+        examples: [
+            { expression: "linkedin_country(\"US\")", result: "United States" },
+            { expression: "linkedin_country(\"Congo - Kinshasa\")", result: "Congo (DRC)" },
+        ],
+        evaluate: (args) => blankToNull(args[0], (input) => resolveLinkedInCountry(asText(input))),
+    }),
     spec({
         name: "normalize_linkedin_url",
         category: "url_email",

package/node_modules/@oxygen/formula/dist/hash.d.ts

@@ -0,0 +1,19 @@
+/**
+ * SHA-256 and MD5, hand-rolled and dependency-free.
+ *
+ * WHY HAND-ROLLED: this package is bundled into the browser (formula editor
+ * previews, the visual workflow editor) and its tsconfig sets `types: []` on
+ * purpose, so `node:crypto` is not importable here; `crypto.subtle.digest` is
+ * async and formula evaluation is synchronous per row, so a Promise cannot be
+ * returned to a cell either. Both digests are therefore computed inline —
+ * the textbook algorithms (FIPS 180-4 / RFC 1321), UTF-8 in, lowercase hex out.
+ *
+ * NOT FOR SECRETS. These exist because the ad platforms (Meta, Google,
+ * LinkedIn) specify exactly SHA-256 or MD5 over a trimmed, lowercased address
+ * for customer-match audience uploads. Do not reach for them for anything that
+ * needs a password hash, a MAC, or collision resistance.
+ */
+/** Hex-encoded SHA-256 of the UTF-8 encoding of `input`. */
+export declare function sha256Hex(input: string): string;
+/** Hex-encoded MD5 of the UTF-8 encoding of `input`. */
+export declare function md5Hex(input: string): string;

package/node_modules/@oxygen/formula/dist/hash.js

@@ -0,0 +1,199 @@
+/**
+ * SHA-256 and MD5, hand-rolled and dependency-free.
+ *
+ * WHY HAND-ROLLED: this package is bundled into the browser (formula editor
+ * previews, the visual workflow editor) and its tsconfig sets `types: []` on
+ * purpose, so `node:crypto` is not importable here; `crypto.subtle.digest` is
+ * async and formula evaluation is synchronous per row, so a Promise cannot be
+ * returned to a cell either. Both digests are therefore computed inline —
+ * the textbook algorithms (FIPS 180-4 / RFC 1321), UTF-8 in, lowercase hex out.
+ *
+ * NOT FOR SECRETS. These exist because the ad platforms (Meta, Google,
+ * LinkedIn) specify exactly SHA-256 or MD5 over a trimmed, lowercased address
+ * for customer-match audience uploads. Do not reach for them for anything that
+ * needs a password hash, a MAC, or collision resistance.
+ */
+// `noUncheckedIndexedAccess` types every element read as possibly undefined.
+// Every index below is provably in range (fixed-size constant tables and a
+// 64-word schedule), so the reads go through these accessors rather than
+// scattering assertions through the rounds.
+function wordAt(words, index) {
+    return words[index];
+}
+function shiftAt(shifts, index) {
+    return shifts[index];
+}
+function rotateRight(value, bits) {
+    return ((value >>> bits) | (value << (32 - bits))) >>> 0;
+}
+function rotateLeft(value, bits) {
+    return ((value << bits) | (value >>> (32 - bits))) >>> 0;
+}
+function hex32BigEndian(value) {
+    return (value >>> 0).toString(16).padStart(8, "0");
+}
+function hex32LittleEndian(value) {
+    let out = "";
+    for (let byte = 0; byte < 4; byte += 1) {
+        out += ((value >>> (byte * 8)) & 0xff).toString(16).padStart(2, "0");
+    }
+    return out;
+}
+/**
+ * Merkle-Damgård padding shared by both digests: append 0x80, zero-fill to a
+ * 64-byte boundary, then write the message length in bits into the last eight
+ * bytes (big-endian for SHA-256, little-endian for MD5).
+ */
+function padMessage(bytes, littleEndianLength) {
+    const paddedLength = (((bytes.length + 8) >> 6) + 1) << 6;
+    const padded = new Uint8Array(paddedLength);
+    padded.set(bytes);
+    padded[bytes.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    const bitLength = bytes.length * 8;
+    const low = bitLength >>> 0;
+    const high = Math.floor(bitLength / 0x1_0000_0000);
+    if (littleEndianLength) {
+        view.setUint32(paddedLength - 8, low, true);
+        view.setUint32(paddedLength - 4, high, true);
+    }
+    else {
+        view.setUint32(paddedLength - 8, high, false);
+        view.setUint32(paddedLength - 4, low, false);
+    }
+    return view;
+}
+function utf8Bytes(input) {
+    return new TextEncoder().encode(input);
+}
+const SHA256_K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/** Hex-encoded SHA-256 of the UTF-8 encoding of `input`. */
+export function sha256Hex(input) {
+    const view = padMessage(utf8Bytes(input), false);
+    const state = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+        0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const schedule = new Uint32Array(64);
+    for (let offset = 0; offset < view.byteLength; offset += 64) {
+        for (let i = 0; i < 16; i += 1) {
+            schedule[i] = view.getUint32(offset + i * 4, false);
+        }
+        for (let i = 16; i < 64; i += 1) {
+            const previous = wordAt(schedule, i - 15);
+            const recent = wordAt(schedule, i - 2);
+            const s0 = rotateRight(previous, 7) ^ rotateRight(previous, 18) ^ (previous >>> 3);
+            const s1 = rotateRight(recent, 17) ^ rotateRight(recent, 19) ^ (recent >>> 10);
+            schedule[i] = (wordAt(schedule, i - 16) + s0 + wordAt(schedule, i - 7) + s1) >>> 0;
+        }
+        let a = wordAt(state, 0);
+        let b = wordAt(state, 1);
+        let c = wordAt(state, 2);
+        let d = wordAt(state, 3);
+        let e = wordAt(state, 4);
+        let f = wordAt(state, 5);
+        let g = wordAt(state, 6);
+        let h = wordAt(state, 7);
+        for (let i = 0; i < 64; i += 1) {
+            const s1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25);
+            const choice = (e & f) ^ (~e & g);
+            const temp1 = (h + s1 + choice + wordAt(SHA256_K, i) + wordAt(schedule, i)) >>> 0;
+            const s0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22);
+            const majority = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (s0 + majority) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        state[0] = (wordAt(state, 0) + a) >>> 0;
+        state[1] = (wordAt(state, 1) + b) >>> 0;
+        state[2] = (wordAt(state, 2) + c) >>> 0;
+        state[3] = (wordAt(state, 3) + d) >>> 0;
+        state[4] = (wordAt(state, 4) + e) >>> 0;
+        state[5] = (wordAt(state, 5) + f) >>> 0;
+        state[6] = (wordAt(state, 6) + g) >>> 0;
+        state[7] = (wordAt(state, 7) + h) >>> 0;
+    }
+    let digest = "";
+    for (let i = 0; i < 8; i += 1)
+        digest += hex32BigEndian(wordAt(state, i));
+    return digest;
+}
+const MD5_K = new Uint32Array([
+    0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,
+    0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,
+    0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,
+    0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,
+    0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,
+    0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,
+    0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,
+    0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,
+]);
+const MD5_SHIFTS = [
+    7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
+    5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
+    4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
+    6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,
+];
+/** Hex-encoded MD5 of the UTF-8 encoding of `input`. */
+export function md5Hex(input) {
+    const view = padMessage(utf8Bytes(input), true);
+    const state = new Uint32Array([0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476]);
+    const block = new Uint32Array(16);
+    for (let offset = 0; offset < view.byteLength; offset += 64) {
+        for (let i = 0; i < 16; i += 1) {
+            block[i] = view.getUint32(offset + i * 4, true);
+        }
+        let a = wordAt(state, 0);
+        let b = wordAt(state, 1);
+        let c = wordAt(state, 2);
+        let d = wordAt(state, 3);
+        for (let i = 0; i < 64; i += 1) {
+            let mixed;
+            let wordIndex;
+            if (i < 16) {
+                mixed = (b & c) | (~b & d);
+                wordIndex = i;
+            }
+            else if (i < 32) {
+                mixed = (d & b) | (~d & c);
+                wordIndex = (5 * i + 1) % 16;
+            }
+            else if (i < 48) {
+                mixed = b ^ c ^ d;
+                wordIndex = (3 * i + 5) % 16;
+            }
+            else {
+                mixed = c ^ (b | ~d);
+                wordIndex = (7 * i) % 16;
+            }
+            const rotated = rotateLeft((mixed + a + wordAt(MD5_K, i) + wordAt(block, wordIndex)) >>> 0, shiftAt(MD5_SHIFTS, i));
+            a = d;
+            d = c;
+            c = b;
+            b = (b + rotated) >>> 0;
+        }
+        state[0] = (wordAt(state, 0) + a) >>> 0;
+        state[1] = (wordAt(state, 1) + b) >>> 0;
+        state[2] = (wordAt(state, 2) + c) >>> 0;
+        state[3] = (wordAt(state, 3) + d) >>> 0;
+    }
+    let digest = "";
+    for (let i = 0; i < 4; i += 1)
+        digest += hex32LittleEndian(wordAt(state, i));
+    return digest;
+}

package/node_modules/@oxygen/formula/dist/value-cleaners.d.ts

@@ -52,7 +52,12 @@ export declare function cleanJobTitle(value: unknown): string | null;
  * Blank input returns an empty array.
  */
 export declare function splitDelimitedList(value: unknown, separator?: string | null): string[];
-/** Consumer mailbox providers — a person, not a company domain. */
+/**
+ * Consumer mailbox providers — a person, not a company domain. Re-exported from
+ * `@oxygen/shared/freemail-domains`, which is now the ONE list; this module used to
+ * carry its own 101-entry copy and was the best-maintained of eight divergent forks.
+ * Its entries survive as the bulk of the shared broad tier.
+ */
 export declare const FREE_MAIL_DOMAINS: ReadonlySet<string>;
 /** Throwaway inbox providers — never worth a send, never worth a credit. */
 export declare const DISPOSABLE_EMAIL_DOMAINS: ReadonlySet<string>;

package/node_modules/@oxygen/formula/dist/value-cleaners.js

@@ -9,6 +9,7 @@
  * model. When a deterministic list is not enough, the paid verifier columns
  * are the upgrade — these helpers are the free first pass.
  */
+import { PERSONAL_EMAIL_DOMAINS } from "@oxygen/shared/freemail-domains";
 // ---------------------------------------------------------------------------
 // Shared text helpers
 // ---------------------------------------------------------------------------
@@ -279,32 +280,15 @@ export function splitDelimitedList(value, separator) {
 // ---------------------------------------------------------------------------
 // Email classification
 // ---------------------------------------------------------------------------
-/** Consumer mailbox providers — a person, not a company domain. */
-export const FREE_MAIL_DOMAINS = new Set([
-    "gmail.com", "googlemail.com",
-    "yahoo.com", "yahoo.co.uk", "yahoo.fr", "yahoo.de", "yahoo.co.jp", "yahoo.ca",
-    "yahoo.com.au", "yahoo.es", "yahoo.it", "ymail.com", "rocketmail.com",
-    "hotmail.com", "hotmail.co.uk", "hotmail.fr", "hotmail.de", "hotmail.it", "hotmail.es",
-    "outlook.com", "outlook.fr", "outlook.de", "outlook.es", "outlook.co.uk",
-    "live.com", "live.co.uk", "live.fr", "live.de", "msn.com",
-    "aol.com", "icloud.com", "me.com", "mac.com",
-    "protonmail.com", "proton.me", "pm.me",
-    "gmx.com", "gmx.de", "gmx.net", "gmx.at", "gmx.ch",
-    "web.de", "t-online.de", "freenet.de",
-    "mail.com", "mail.ru", "yandex.ru", "yandex.com",
-    "zoho.com", "fastmail.com", "hey.com", "tutanota.com", "tuta.io",
-    "orange.fr", "wanadoo.fr", "free.fr", "laposte.net", "sfr.fr",
-    "libero.it", "virgilio.it", "seznam.cz",
-    "wp.pl", "o2.pl", "onet.pl", "interia.pl",
-    "qq.com", "163.com", "126.com", "sina.com",
-    "naver.com", "daum.net", "hanmail.net", "rediffmail.com",
-    "bigpond.com", "optusnet.com.au", "telus.net", "shaw.ca", "sympatico.ca", "rogers.com",
-    "btinternet.com", "sky.com", "talktalk.net", "virginmedia.com", "blueyonder.co.uk",
-    "comcast.net", "verizon.net", "att.net", "sbcglobal.net", "cox.net",
-    "charter.net", "earthlink.net", "bellsouth.net",
-    "ziggo.nl", "kpnmail.nl", "home.nl", "telenet.be", "skynet.be", "bluewin.ch",
-    "uol.com.br", "bol.com.br", "terra.com.br",
-]);
+/**
+ * Consumer mailbox providers — a person, not a company domain. Re-exported from
+ * `@oxygen/shared/freemail-domains`, which is now the ONE list; this module used to
+ * carry its own 101-entry copy and was the best-maintained of eight divergent forks.
+ * Its entries survive as the bulk of the shared broad tier.
+ */
+// Aliased rather than `export … from`, because this module also USES the set locally
+// (see classifyDomain below) and a re-export creates no local binding.
+export const FREE_MAIL_DOMAINS = PERSONAL_EMAIL_DOMAINS;
 /** Throwaway inbox providers — never worth a send, never worth a credit. */
 export const DISPOSABLE_EMAIL_DOMAINS = new Set([
     "mailinator.com", "guerrillamail.com", "guerrillamail.net",

package/node_modules/@oxygen/recipe-sdk/dist/index.d.ts

@@ -9,6 +9,11 @@ export type RecipeToolRunOptions = {
     connectionId?: string;
     /** Pin the credential rail instead of automatically selecting a connected key. */
     credentialMode?: "managed" | "user_api_key" | "user_oauth";
+    /**
+     * With credentialMode user_api_key on a LinkedIn rail (scraper.*) tool: run on
+     * the workspace's own Up2Data key rather than its HarvestAPI key.
+     */
+    byokKeySource?: "up2data";
 };
 export type RecipeToolApi = {
     run: <T = unknown>(toolId: string, payload?: Record<string, unknown>, options?: RecipeToolRunOptions) => Promise<T>;
@@ -113,9 +118,17 @@ export type RecipeCrmExternalRef = {
     provider_event_id?: string | null;
     confidence?: number | null;
 };
+/** Source evidence only; never registers or resolves a provider external identity. */
+export type RecipeCrmSourceProvenance = {
+    provider: string;
+    object: string;
+    external_id: string;
+    provider_account: string;
+};
 export type RecipeCrmApi = {
     assert: <T = unknown>(object: string, identity: RecipeCrmIdentity, values: Record<string, unknown> | undefined, options: {
         key: string;
+        provenance?: RecipeCrmSourceProvenance;
     }) => Promise<T>;
     assertFromProvider: <T = unknown>(object: string, identity: RecipeCrmIdentity, values: Record<string, unknown> | undefined, external: RecipeCrmExternalRef, options: {
         key: string;

package/node_modules/@oxygen/shared/dist/array-utils.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Small array helpers shared across every OXYGEN package.
+ */
+/** Split `values` into consecutive slices of at most `size` entries. */
+export declare function chunk<T>(values: T[], size: number): T[][];

package/node_modules/@oxygen/shared/dist/array-utils.js

@@ -0,0 +1,11 @@
+/**
+ * Small array helpers shared across every OXYGEN package.
+ */
+/** Split `values` into consecutive slices of at most `size` entries. */
+export function chunk(values, size) {
+    const chunks = [];
+    for (let index = 0; index < values.length; index += size) {
+        chunks.push(values.slice(index, index + size));
+    }
+    return chunks;
+}