@oxygen-agent/cli 1.1003.12 → 1.1010.1

package/node_modules/@oxygen/shared/dist/stripe-subscription-kind.js

@@ -0,0 +1,44 @@
+/**
+ * Which Stripe subscriptions are NOT an OXYGEN plan.
+ *
+ * OXYGEN runs three recurring rails on the same Stripe customer, and only one of
+ * them is a plan: the PLAN subscription (born from a Checkout Session),
+ * EMAIL INFRASTRUCTURE (`infra-subscription.ts`) and SENDING SEATS
+ * (`seat-subscription.ts`). The two rails are separate on purpose — a workspace
+ * with no plan at all must be able to hold managed inboxes and buy a sending
+ * seat — so a rail event is not a smaller version of a plan event, it is a
+ * different subject entirely, and plan-shaped handling of one is always wrong.
+ *
+ * THE WITNESS IS `metadata.oxygen_kind`. Both rails stamp it at
+ * `subscriptions.create` (the only two such call sites in the repo), and a plan
+ * subscription never carries it: a plan is born from a Checkout Session whose
+ * `subscription_data.metadata` carries organization_id/clerk_org_id and no
+ * `oxygen_kind`. (The third `oxygen_kind` in the codebase, `credit_topup`, rides
+ * a one-off `mode: "payment"` Checkout Session and never produces a
+ * subscription at all.) So the key's PRESENCE is a positive witness of "not a
+ * plan".
+ *
+ * PRESENCE, NOT A VALUE LIST, deliberately. Every previous gate matched the one
+ * value `"email_infra"`, which is why the seat rail — shipped later — walked
+ * straight into the plan handlers: adding a rail silently opted it INTO plan
+ * treatment, the wrong default for a safety gate. Testing presence means the
+ * next rail needs no edit here. This is the same reasoning `orphan-reconcile.ts`
+ * measured in production on 2026-09-06, where all 24 of the 24 daily
+ * `billing.subscription_health.unknown_plan_price` error lines were the same 4
+ * live sending-seat subscriptions x 6 cron runs.
+ *
+ * DELIBERATELY NARROW. This answers "did the subscription declare itself a
+ * non-plan rail", never "does it carry a recognised plan price". The catalog
+ * question stays with `tierFromPriceId` / `recognizedStripePlanItems`, and
+ * callers that need both keep asking both — `orphan-reconcile.ts` reclassifies
+ * only the zero-recognised-item half for exactly that reason.
+ */
+/** The declared non-plan rail (`email_infra`, `sending_seats`, …), or null for a plan. */
+export function nonPlanSubscriptionKind(metadata) {
+    const kind = metadata?.oxygen_kind;
+    return typeof kind === "string" && kind.length > 0 ? kind : null;
+}
+/** True when the subscription declared itself one of OXYGEN's non-plan rails. */
+export function isNonPlanSubscriptionKind(metadata) {
+    return nonPlanSubscriptionKind(metadata) !== null;
+}

package/node_modules/@oxygen/shared/dist/table-limits.d.ts

@@ -1,4 +1,7 @@
 export declare const MAX_TABLE_ACTION_RUN_ROWS = 500000;
+/** Only runs whose resolved steps are all provider-free formulas may use these ceilings. */
+export declare const MAX_FORMULA_ACTION_RUN_ROWS = 1000000;
+export declare const MAX_FORMULA_ACTION_RUN_ITEMS = 5000000;
 export declare const MAX_WORKSPACE_ROW_DELETE_ROWS = 50000;
 /**
  * Platform ceiling for a table action run's `max_concurrency` (T-27).

package/node_modules/@oxygen/shared/dist/table-limits.js

@@ -1,6 +1,9 @@
 // Shared request/action ceilings used by tenant-db enforcement and every
 // surface that resolves a symbolic row selection before invoking it.
 export const MAX_TABLE_ACTION_RUN_ROWS = 500_000;
+/** Only runs whose resolved steps are all provider-free formulas may use these ceilings. */
+export const MAX_FORMULA_ACTION_RUN_ROWS = 1_000_000;
+export const MAX_FORMULA_ACTION_RUN_ITEMS = 5_000_000;
 export const MAX_WORKSPACE_ROW_DELETE_ROWS = 50_000;
 /**
  * Platform ceiling for a table action run's `max_concurrency` (T-27).

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.d.ts

@@ -0,0 +1,94 @@
+import { DiagLogLevel, type DiagLogger } from "@opentelemetry/api";
+/**
+ * Makes a failing OTLP trace/metric export visible in LOGS.
+ *
+ * The SDK exporters report a failed export only through their result callback,
+ * and the processors hand that to `diag`, which has no logger unless one is
+ * installed — so a broken collector path (SigNoz over the private network) and a
+ * healthy one look identical from the sending process. This wraps an exporter so
+ * a failed export becomes one throttled `telemetry.export_failed` line and the
+ * first success afterwards one `telemetry.export_recovered` line, both through
+ * `log()` and therefore through whichever log sinks the process has.
+ *
+ * No recursion: `log()` records go to the LOG sinks, never to a trace or metric
+ * exporter, so a failing trace/metric lane cannot feed itself.
+ *
+ * Never throws, never changes what the SDK sees: the inner result is passed to
+ * the SDK callback untouched, every other exporter method is forwarded, and a
+ * synchronous throw from the inner exporter is recorded and rethrown exactly as
+ * it would have been without the wrapper.
+ *
+ * Nothing from the error's text is logged. OTLP errors carry receiver response
+ * bodies (`OTLPExporterError.data`) and transport errors can carry URLs; the
+ * failure is reduced to an HTTP status and a fixed code (see
+ * `classifyTelemetryExportError`), and the endpoint to origin + path.
+ *
+ * Structural types, not `@opentelemetry/core`/`sdk-metrics` imports: this
+ * package depends on neither, and the shapes used here (`{ code, error }`, the
+ * `ResourceMetrics` tree) are the SDK's stable public contract.
+ */
+export type TelemetryExportSignal = "traces" | "metrics";
+export type TelemetryExportSurface = "web" | "worker";
+type ExportResultLike = {
+    code: number;
+    error?: Error | undefined;
+};
+type ObservableExporter = {
+    export(items: unknown, resultCallback: (result: ExportResultLike) => void): void;
+    shutdown(): Promise<void>;
+};
+export type TelemetryExportObserverOptions = {
+    signal: TelemetryExportSignal;
+    /** The exporter's full URL; only origin + path is ever logged. */
+    endpoint: string;
+    surface: TelemetryExportSurface;
+    /** At most one `telemetry.export_failed` line per window. Default 60 s. */
+    windowMs?: number | undefined;
+    now?: (() => number) | undefined;
+};
+/** Origin + path only: never query strings, fragments or URL credentials. */
+export declare function telemetryEndpointForLog(endpoint: string): string;
+/**
+ * Reduces an OTLP export error to `{ status?, error_code }`. `status` is the
+ * HTTP status an `OTLPExporterError` carries in `code` for a non-retryable
+ * response; a retryable one (429/502/503/504) that exhausted its retries carries
+ * none, hence `http_retryable`. The message is matched against the exporter's
+ * own fixed strings and never copied.
+ */
+export declare function classifyTelemetryExportError(error: unknown): {
+    status?: number;
+    error_code: string;
+};
+export declare function observeTelemetryExporter<E extends ObservableExporter>(inner: E, options: TelemetryExportObserverOptions): E;
+export type TelemetryDropDiagLoggerOptions = {
+    surface: TelemetryExportSurface;
+    /** An existing diagnostics logger that still receives every call unchanged. */
+    next?: DiagLogger | undefined;
+    windowMs?: number | undefined;
+    now?: (() => number) | undefined;
+};
+/**
+ * A `diag` logger that recognises exactly one message: the BatchSpanProcessor's
+ * `Dropped N spans because maxQueueSize reached`, its only report of queue-full
+ * drops. Those become a throttled `telemetry.export_dropped` line carrying the
+ * count; every other diag call is ignored, because SDK diagnostics can carry
+ * receiver responses and exported payloads (the OTLP delegate logs the items it
+ * is about to send at debug). Nothing but the parsed count leaves this function.
+ *
+ * The count cannot name which BatchSpanProcessor dropped: diag is process-wide,
+ * so when a process also runs the Axiom processor, a drop line covers both.
+ *
+ * `next` keeps an operator-enabled diagnostics logger working: it receives every
+ * call as before, and this logger only adds the drop count.
+ */
+export declare function createTelemetryDropDiagLogger(options: TelemetryDropDiagLoggerOptions): DiagLogger;
+/**
+ * Installs `createTelemetryDropDiagLogger` as the global diag logger, once per
+ * process. Returns false when it was already installed. Callers install it only
+ * when an OTLP collector endpoint is configured, so a process without one keeps
+ * its diag configuration exactly as it was.
+ */
+export declare function installTelemetryDropDiagLogger(options: TelemetryDropDiagLoggerOptions & {
+    logLevel?: DiagLogLevel | undefined;
+}): boolean;
+export {};

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.js

@@ -0,0 +1,298 @@
+import { diag, DiagLogLevel } from "@opentelemetry/api";
+import { log } from "./log.js";
+// @opentelemetry/core ExportResultCode.SUCCESS / FAILED.
+const EXPORT_RESULT_SUCCESS = 0;
+const DEFAULT_WINDOW_MS = 60_000;
+// Methods the SDK may call on an exporter besides `export`. Forwarded only when
+// the inner exporter has them, so a reader that probes for an optional method
+// (PeriodicExportingMetricReader reads selectAggregationTemporality) sees
+// exactly what it would have seen on the unwrapped exporter.
+const FORWARDED_METHODS = [
+    "forceFlush",
+    "selectAggregationTemporality",
+    "selectAggregation",
+];
+/** Origin + path only: never query strings, fragments or URL credentials. */
+export function telemetryEndpointForLog(endpoint) {
+    try {
+        const url = new URL(endpoint);
+        return `${url.origin}${url.pathname}`;
+    }
+    catch {
+        return "invalid_url";
+    }
+}
+const SYSTEM_ERROR_CODES = {
+    ETIMEDOUT: "timeout",
+    ESOCKETTIMEDOUT: "timeout",
+    ECONNREFUSED: "connection_refused",
+    ECONNRESET: "connection_reset",
+    EPIPE: "connection_reset",
+    ENOTFOUND: "dns_failed",
+    EAI_AGAIN: "dns_failed",
+    EHOSTUNREACH: "host_unreachable",
+    ENETUNREACH: "host_unreachable",
+};
+/**
+ * Reduces an OTLP export error to `{ status?, error_code }`. `status` is the
+ * HTTP status an `OTLPExporterError` carries in `code` for a non-retryable
+ * response; a retryable one (429/502/503/504) that exhausted its retries carries
+ * none, hence `http_retryable`. The message is matched against the exporter's
+ * own fixed strings and never copied.
+ */
+export function classifyTelemetryExportError(error) {
+    if (!error || typeof error !== "object")
+        return { error_code: "unknown" };
+    const candidate = error;
+    const code = candidate.code;
+    if (typeof code === "number" && Number.isInteger(code) && code >= 100 && code <= 599) {
+        return { status: code, error_code: code >= 500 ? "http_5xx" : `http_${code}` };
+    }
+    const systemCode = typeof code === "string"
+        ? code
+        : typeof candidate.cause?.code === "string"
+            ? candidate.cause.code
+            : undefined;
+    if (systemCode)
+        return { error_code: SYSTEM_ERROR_CODES[systemCode] ?? "transport_failed" };
+    const message = typeof candidate.message === "string" ? candidate.message : "";
+    if (candidate.name === "TimeoutError" || /timed out|timeout/i.test(message))
+        return { error_code: "timeout" };
+    if (/concurren(?:t|cy) (?:export )?limit/i.test(message))
+        return { error_code: "concurrency_limit" };
+    if (/retryable status/i.test(message))
+        return { error_code: "http_retryable" };
+    if (/exceeded size limit/i.test(message))
+        return { error_code: "response_too_large" };
+    return { error_code: "transport_failed" };
+}
+function countItems(signal, items) {
+    if (signal === "traces")
+        return Array.isArray(items) ? items.length : 0;
+    // Metric data points (= live series under cumulative temporality).
+    let points = 0;
+    const scopeMetrics = items?.scopeMetrics;
+    if (!Array.isArray(scopeMetrics))
+        return 0;
+    for (const scope of scopeMetrics) {
+        const metrics = scope?.metrics;
+        if (!Array.isArray(metrics))
+            continue;
+        for (const metric of metrics) {
+            const dataPoints = metric?.dataPoints;
+            if (Array.isArray(dataPoints))
+                points += dataPoints.length;
+        }
+    }
+    return points;
+}
+export function observeTelemetryExporter(inner, options) {
+    const endpoint = telemetryEndpointForLog(options.endpoint);
+    const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
+    const now = options.now ?? Date.now;
+    const { signal, surface } = options;
+    let consecutiveFailures = 0;
+    let outageStartedAt = 0;
+    let outageDropped = 0;
+    // Only an outage that produced an export_failed line gets a recovery line, so
+    // a flapping endpoint cannot bypass the failure throttle through recoveries.
+    let outageReported = false;
+    let lastFailureLogAt = Number.NEGATIVE_INFINITY;
+    // Accumulated since the last emitted export_failed line, reported on the next.
+    let suppressedFailures = 0;
+    let pendingDropped = 0;
+    const recordFailure = (error, dropped) => {
+        try {
+            const at = now();
+            if (consecutiveFailures === 0) {
+                outageStartedAt = at;
+                outageDropped = 0;
+                outageReported = false;
+            }
+            consecutiveFailures += 1;
+            outageDropped += dropped;
+            pendingDropped += dropped;
+            if (at - lastFailureLogAt < windowMs) {
+                suppressedFailures += 1;
+                return;
+            }
+            lastFailureLogAt = at;
+            outageReported = true;
+            const { status, error_code } = classifyTelemetryExportError(error);
+            log("warn", "telemetry.export_failed", {
+                signal,
+                endpoint,
+                ...(status === undefined ? {} : { status }),
+                error_code,
+                dropped: pendingDropped,
+                consecutive_failures: consecutiveFailures,
+                suppressed_failures: suppressedFailures,
+                surface,
+            });
+            pendingDropped = 0;
+            suppressedFailures = 0;
+        }
+        catch {
+            // Observation must never change export semantics.
+        }
+    };
+    const recordSuccess = () => {
+        try {
+            if (consecutiveFailures === 0)
+                return;
+            if (outageReported) {
+                log("info", "telemetry.export_recovered", {
+                    signal,
+                    endpoint,
+                    failures: consecutiveFailures,
+                    dropped: outageDropped,
+                    outage_ms: Math.max(0, now() - outageStartedAt),
+                    surface,
+                });
+                // Every suppressed failure since the last line belonged to this outage,
+                // and the recovery line has just accounted for it.
+                pendingDropped = 0;
+                suppressedFailures = 0;
+            }
+            consecutiveFailures = 0;
+        }
+        catch {
+            // Observation must never change export semantics.
+        }
+    };
+    const observed = {
+        export(items, resultCallback) {
+            let dropped = 0;
+            try {
+                dropped = countItems(signal, items);
+            }
+            catch {
+                // Counting is best-effort; never let it block the export itself.
+            }
+            try {
+                inner.export(items, (result) => {
+                    if (result?.code === EXPORT_RESULT_SUCCESS)
+                        recordSuccess();
+                    else
+                        recordFailure(result?.error, dropped);
+                    resultCallback(result);
+                });
+            }
+            catch (error) {
+                recordFailure(error, dropped);
+                throw error;
+            }
+        },
+        shutdown() {
+            return inner.shutdown();
+        },
+    };
+    for (const method of FORWARDED_METHODS) {
+        const fn = inner[method];
+        if (typeof fn === "function")
+            observed[method] = fn.bind(inner);
+    }
+    return observed;
+}
+const DROPPED_SPANS_MESSAGE = /^Dropped (\d+) spans because maxQueueSize reached$/;
+/**
+ * A `diag` logger that recognises exactly one message: the BatchSpanProcessor's
+ * `Dropped N spans because maxQueueSize reached`, its only report of queue-full
+ * drops. Those become a throttled `telemetry.export_dropped` line carrying the
+ * count; every other diag call is ignored, because SDK diagnostics can carry
+ * receiver responses and exported payloads (the OTLP delegate logs the items it
+ * is about to send at debug). Nothing but the parsed count leaves this function.
+ *
+ * The count cannot name which BatchSpanProcessor dropped: diag is process-wide,
+ * so when a process also runs the Axiom processor, a drop line covers both.
+ *
+ * `next` keeps an operator-enabled diagnostics logger working: it receives every
+ * call as before, and this logger only adds the drop count.
+ */
+export function createTelemetryDropDiagLogger(options) {
+    const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
+    const now = options.now ?? Date.now;
+    const { next, surface } = options;
+    let pending = 0;
+    let lastEmitAt = Number.NEGATIVE_INFINITY;
+    let timer = null;
+    let emitting = false;
+    const emit = () => {
+        if (pending === 0 || emitting)
+            return;
+        emitting = true;
+        try {
+            lastEmitAt = now();
+            const dropped = pending;
+            pending = 0;
+            log("warn", "telemetry.export_dropped", { signal: "traces", dropped, reason: "queue_full", surface });
+        }
+        finally {
+            emitting = false;
+        }
+    };
+    const record = (dropped) => {
+        pending += dropped;
+        const remaining = windowMs - (now() - lastEmitAt);
+        if (remaining <= 0) {
+            emit();
+            return;
+        }
+        // The BatchSpanProcessor reports a drop run only once it ends, so a
+        // suppressed count could otherwise wait forever for another drop to carry it.
+        if (timer)
+            return;
+        timer = setTimeout(() => {
+            timer = null;
+            try {
+                emit();
+            }
+            catch {
+                // Telemetry about telemetry never throws.
+            }
+        }, remaining);
+        timer.unref?.();
+    };
+    const forward = (level) => (message, ...args) => {
+        if (level === "warn") {
+            try {
+                const match = typeof message === "string" ? DROPPED_SPANS_MESSAGE.exec(message) : null;
+                const dropped = match ? Number(match[1]) : 0;
+                if (Number.isSafeInteger(dropped) && dropped > 0)
+                    record(dropped);
+            }
+            catch {
+                // Telemetry about telemetry never throws.
+            }
+        }
+        next?.[level](message, ...args);
+    };
+    return {
+        error: forward("error"),
+        warn: forward("warn"),
+        info: forward("info"),
+        debug: forward("debug"),
+        verbose: forward("verbose"),
+    };
+}
+// globalThis, not a module-local: Next.js bundles can load this module more
+// than once per process, and a second `diag.setLogger` would replace the first
+// (and, without suppressOverrideMessage, log an override warning).
+const DIAG_BRIDGE_SLOT = Symbol.for("oxygen.telemetry.diag_drop_bridge");
+/**
+ * Installs `createTelemetryDropDiagLogger` as the global diag logger, once per
+ * process. Returns false when it was already installed. Callers install it only
+ * when an OTLP collector endpoint is configured, so a process without one keeps
+ * its diag configuration exactly as it was.
+ */
+export function installTelemetryDropDiagLogger(options) {
+    const carrier = globalThis;
+    if (carrier[DIAG_BRIDGE_SLOT])
+        return false;
+    carrier[DIAG_BRIDGE_SLOT] = true;
+    diag.setLogger(createTelemetryDropDiagLogger(options), {
+        logLevel: options.logLevel ?? DiagLogLevel.WARN,
+        suppressOverrideMessage: true,
+    });
+    return true;
+}

package/node_modules/@oxygen/shared/dist/telemetry.d.ts

@@ -3,6 +3,17 @@ export type WithTelemetrySpanOptions = {
     isTransient?: (error: unknown) => boolean;
 };
 export declare function withTelemetrySpan<T>(tracerName: string, name: string, attributes: TelemetryAttributes | undefined, fn: () => Promise<T>, options?: WithTelemetrySpanOptions): Promise<T>;
+/**
+ * The active global span's trace id: the join key into SigNoz/Axiom traces.
+ * Null when no valid span is active (a BullMQ job outside any span, a test).
+ */
+export declare function activeTelemetryTraceId(): string | null;
+/**
+ * Run `fn` inside a new span only when no span is active, so work that already
+ * sits under a request/cycle span keeps that trace and uncorrelated background
+ * work (BullMQ jobs) still gets one trace id to cross-link from Langfuse.
+ */
+export declare function withTelemetrySpanIfNone<T>(tracerName: string, name: string, attributes: TelemetryAttributes | undefined, fn: () => Promise<T>): Promise<T>;
 export declare function setActiveTelemetryAttributes(attributes: TelemetryAttributes): void;
 export declare function markActiveTelemetryError(message: string, attributes?: TelemetryAttributes): void;
 export declare function recordTelemetryCounter(name: string, value?: number, attributes?: TelemetryAttributes): void;

package/node_modules/@oxygen/shared/dist/telemetry.js

@@ -1,4 +1,4 @@
-import { SpanStatusCode, metrics, trace, } from "@opentelemetry/api";
+import { SpanStatusCode, isSpanContextValid, metrics, trace, } from "@opentelemetry/api";
 import { deployEnvTelemetryEnvironment, deployPlatformAttribute } from "./deploy-env.js";
 import { errorId } from "./log.js";
 import { normalizeTelemetryAttributes } from "./redaction.js";
@@ -39,6 +39,24 @@ export async function withTelemetrySpan(tracerName, name, attributes, fn, option
         }
     });
 }
+/**
+ * The active global span's trace id: the join key into SigNoz/Axiom traces.
+ * Null when no valid span is active (a BullMQ job outside any span, a test).
+ */
+export function activeTelemetryTraceId() {
+    const spanContext = trace.getActiveSpan()?.spanContext();
+    return spanContext && isSpanContextValid(spanContext) ? spanContext.traceId : null;
+}
+/**
+ * Run `fn` inside a new span only when no span is active, so work that already
+ * sits under a request/cycle span keeps that trace and uncorrelated background
+ * work (BullMQ jobs) still gets one trace id to cross-link from Langfuse.
+ */
+export async function withTelemetrySpanIfNone(tracerName, name, attributes, fn) {
+    if (activeTelemetryTraceId())
+        return await fn();
+    return await withTelemetrySpan(tracerName, name, attributes, fn);
+}
 export function setActiveTelemetryAttributes(attributes) {
     const span = trace.getActiveSpan();
     if (!span)

package/node_modules/@oxygen/shared/dist/ugc.d.ts

@@ -1,5 +1,20 @@
 /** UGC is a Publishing capability. These are projections, never a second Posts store. */
 export type UgcApprovalMode = "creator" | "delegated";
+/** Per calendar week or month, or `total`: N posts over the program's lifetime. */
+export type UgcPostingTargetPeriod = "week" | "month" | "total";
+export type UgcPostingTarget = {
+    count: number;
+    period: UgcPostingTargetPeriod;
+};
+export declare const UGC_POSTING_TARGET_MAX = 100;
+export declare const UGC_POSTING_TARGET_PERIODS: readonly ["week", "month", "total"];
+/** The operator-written creator brief is short by design (Philipp, 2026-09-23). */
+export declare const UGC_PROGRAM_BRIEF_MAX_CHARS = 1200;
+/** The program's target as its API shape, or null when none is set. */
+export declare function ugcPostingTarget(program: {
+    postingTargetCount?: number | null | undefined;
+    postingTargetPeriod?: UgcPostingTargetPeriod | null | undefined;
+}): UgcPostingTarget | null;
 export type UgcProgram = {
     id: string;
     name: string;
@@ -10,20 +25,17 @@ export type UgcProgram = {
     peerEngagementEnabled?: boolean;
     peerEngagementVersion?: number;
     peerEngagementEffectiveAt?: Date | null;
+    /** The product's icon, found from its site at create; null for older programs. */
+    iconUrl?: string | null;
+    /** Short operator-written creator brief; drafts are grounded in it. */
+    brief?: string | null;
+    /** Posts each creator is expected to publish per period; both null when unset. */
+    postingTargetCount?: number | null;
+    postingTargetPeriod?: UgcPostingTargetPeriod | null;
     status: "active" | "archived";
     createdAt: Date;
     updatedAt: Date;
 };
-export type UgcBrief = {
-    id: string;
-    programId: string;
-    title: string;
-    prompt: string;
-    questions: string[];
-    cycle: string | null;
-    createdAt: Date;
-    updatedAt: Date;
-};
 export type UgcPostProjection = {
     /** Public author identity from the exact participation, never a private profile corpus. */
     authorLinkedinUrl?: string;
@@ -84,7 +96,6 @@ export type UgcPostLink = {
     masterOrgId: string;
     brandApprovalRequired: boolean;
     sourcePostId: string;
-    briefId: string | null;
     attribution: Record<string, unknown>;
     projection: UgcPostProjection;
     sourceRevision: string;

package/node_modules/@oxygen/shared/dist/ugc.js

@@ -1,2 +1,12 @@
+export const UGC_POSTING_TARGET_MAX = 100;
+export const UGC_POSTING_TARGET_PERIODS = ["week", "month", "total"];
+/** The operator-written creator brief is short by design (Philipp, 2026-09-23). */
+export const UGC_PROGRAM_BRIEF_MAX_CHARS = 1200;
+/** The program's target as its API shape, or null when none is set. */
+export function ugcPostingTarget(program) {
+    return program.postingTargetCount && program.postingTargetPeriod
+        ? { count: program.postingTargetCount, period: program.postingTargetPeriod }
+        : null;
+}
 export const UGC_MONTHLY_CREATOR_CREDITS = 10_000;
 export const UGC_SPONSORED_LINKEDIN_SEATS = 1;

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -0,0 +1 @@
+export declare const OXYGEN_BUILD_VERSION = "1.1010.1";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -0,0 +1,2 @@
+// GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
+export const OXYGEN_BUILD_VERSION = "1.1010.1";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,6 +1,13 @@
+import { OXYGEN_BUILD_VERSION } from "./version.generated.js";
 // Release metadata is a string API: a new version must not change the exported
 // declaration type and invalidate every dependent package's compiler state.
-export const OXYGEN_VERSION = "1.1003.12";
+//
+// The value is DERIVED, never pinned per commit: the repo-root `VERSION` file
+// holds the series (`1.<minor>`) and the patch is the distance from the commit
+// that last touched it. scripts/ci/version-stamp.mjs writes
+// ./version.generated.ts (gitignored) at build, test and publish time. Change
+// the series by editing VERSION; there is nothing to bump here.
+export const OXYGEN_VERSION = OXYGEN_BUILD_VERSION;
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/node_modules/@oxygen/shared/dist/workspace-event-catalog.js

@@ -3,7 +3,6 @@ import { CRM_SIGNAL_WORKFLOW_EVENT_DEFINITIONS, CRM_WORKFLOW_EVENT_SOURCE, } fro
 import { SEQUENCE_CONTACT_ACTIVITY_EVENT, SEQUENCE_CRM_EVENT_DEFINITIONS, SEQUENCE_WORKFLOW_EVENT_SOURCE, } from "./sequence-crm-events.js";
 import { SEQUENCE_ENROLLMENT_TERMINAL_EVENT, SEQUENCE_TERMINAL_EVENT_SOURCE, SEQUENCE_TERMINAL_STATUSES, } from "./sequence-terminal-events.js";
 import { NOTETAKER_MEETING_COMPLETED_EVENT, NOTETAKER_MEETING_COMPLETED_PAYLOAD_FIELDS, NOTETAKER_WORKFLOW_EVENT_SOURCE, } from "./notetaker-events.js";
-import { PLAIN_SUPPORT_MESSAGE_RECEIVED_EVENT, PLAIN_SUPPORT_MESSAGE_RECEIVED_PAYLOAD_FIELDS, PLAIN_SUPPORT_WORKFLOW_EVENT_SOURCE, } from "./plain-support-events.js";
 export const WORKSPACE_EVENT_PRODUCER_READINESS_REQUIREMENTS = [
     "always",
     "notetaker_enabled",
@@ -107,15 +106,6 @@ export const WORKSPACE_EVENT_PRODUCERS = [
         readiness: "notetaker_enabled",
         payloadFields: NOTETAKER_MEETING_COMPLETED_PAYLOAD_FIELDS,
     },
-    {
-        id: "plain_support.message_received",
-        source: PLAIN_SUPPORT_WORKFLOW_EVENT_SOURCE,
-        event: PLAIN_SUPPORT_MESSAGE_RECEIVED_EVENT,
-        delivery: "direct_durable_write",
-        idempotency: "The verified Plain event id deduplicates metadata-only support delivery.",
-        readiness: "always",
-        payloadFields: PLAIN_SUPPORT_MESSAGE_RECEIVED_PAYLOAD_FIELDS,
-    },
 ];
 const workspaceEventProducersById = new Map(WORKSPACE_EVENT_PRODUCERS.map((producer) => [producer.id, producer]));
 export function getWorkspaceEventProducer(producerId) {
@@ -224,18 +214,6 @@ const crmSignalEntries = CRM_SIGNAL_WORKFLOW_EVENT_DEFINITIONS.map((definition)
     description: definition.description,
     payloadFields: definition.payloadFields,
 }));
-const plainSupportEntries = [
-    {
-        id: "plain_support.message_received",
-        producerId: "plain_support.message_received",
-        source: PLAIN_SUPPORT_WORKFLOW_EVENT_SOURCE,
-        event: PLAIN_SUPPORT_MESSAGE_RECEIVED_EVENT,
-        group: "Support · Plain",
-        label: "Customer message received",
-        description: "A customer sent a Chat, email, Slack, Microsoft Teams, or Discord message into a canonical Plain Thread. The event contains routing metadata only; customer content remains in Plain.",
-        payloadFields: PLAIN_SUPPORT_MESSAGE_RECEIVED_PAYLOAD_FIELDS,
-    },
-];
 const notetakerEntries = [
     {
         id: "notetaker.meeting_completed",
@@ -257,6 +235,5 @@ export const WORKSPACE_EVENT_CATALOG = [
     ...sequenceTerminalEntries,
     ...crmActivityEntries,
     ...crmSignalEntries,
-    ...plainSupportEntries,
     ...notetakerEntries,
 ];