@oxygen-agent/cli 1.1010.644 → 1.1010.721

package/node_modules/@oxygen/shared/dist/repricing.d.ts

@@ -0,0 +1,130 @@
+export declare const REPRICING_2026_09_EFFECTIVE_AT_ENV_VAR = "OXYGEN_REPRICING_2026_09_EFFECTIVE_AT";
+/** Stable machine name of this price change, as reported on customer surfaces. */
+export declare const REPRICING_2026_09_NAME = "repricing_2026_09";
+type RepricingEnv = {
+    [key: string]: string | undefined;
+};
+export type RepricingOptions = {
+    env?: RepricingEnv;
+    /** The instant to resolve at. Defaults to the current time. */
+    now?: Date | number;
+};
+/**
+ * `unset` and `invalid` both keep every old value. `scheduled` names a future
+ * instant (old values still in force); `in_force` means the new values apply.
+ */
+export type RepricingSwitchState = {
+    status: "unset";
+    effectiveAt: null;
+} | {
+    status: "invalid";
+    effectiveAt: null;
+    raw: string;
+} | {
+    status: "scheduled";
+    effectiveAt: Date;
+} | {
+    status: "in_force";
+    effectiveAt: Date;
+};
+/** Parse the switch's raw value. `null` for unset, `undefined` for unparseable. */
+export declare function parseRepricingEffectiveAt(raw: string | undefined): Date | null | undefined;
+/** Where the switch stands at `now`. */
+export declare function readRepricingSwitch(options?: RepricingOptions): RepricingSwitchState;
+/** True once the switch names an instant that has passed. */
+export declare function isRepricingInForce(options?: RepricingOptions): boolean;
+/**
+ * A price or limit value. `null` means "no bound", and only a limit's `before`
+ * may hold it: a limit that did not exist and now does is a tightening that
+ * waits for the switch (the email per-mailbox maximum, S52).
+ */
+export type RepricedScalar = number | boolean | string | null;
+type Widen<T> = T extends null ? null : T extends number ? number : T extends boolean ? boolean : T extends string ? string : never;
+/** The value in force: `before` until the switch's instant, `after` from it on. */
+export declare function repricedValue<T extends RepricedScalar>(value: {
+    readonly before: T;
+    readonly after: T;
+}, options?: RepricingOptions): Widen<T>;
+/**
+ * One price that rises or one limit that tightens at the switch's instant.
+ * `key` is the stable machine name surfaces report (`topup.usd_cents_per_100_credits`),
+ * `slice` and `decision` point back at the specification and decision record.
+ */
+export type RepricedValue<T extends RepricedScalar = RepricedScalar> = {
+    readonly key: string;
+    readonly kind: "price" | "limit";
+    readonly slice: string;
+    readonly decision: string;
+    readonly unit: string;
+    readonly description: string;
+    readonly before: T;
+    readonly after: T;
+};
+export declare function defineRepricedValue<T extends RepricedScalar>(definition: RepricedValue<T>): RepricedValue<T>;
+/** The hard per-mailbox maximum: none before the instant, 50 a day from it. */
+export declare const EMAIL_MAILBOX_DAILY_CAP_MAXIMUM: RepricedValue<number | null>;
+/**
+ * A mailbox still on the old default of 40 a day, which nobody set by hand, sends
+ * at the new default of 25 (P-58, proposed). The column was `DEFAULT 40`, so a
+ * deliberate 40 set before `daily_cap_source` existed cannot be told apart;
+ * setting the cap again records it as the customer's own, and it is then kept.
+ */
+export declare const EMAIL_MAILBOX_OLD_DEFAULT_DAILY_CAP: RepricedValue<25 | 40>;
+/**
+ * S20: the monthly credit reservation of every connected account (decisions
+ * 2.1–2.4). Each key is the pricing-seed charge key, so the seed row carries the
+ * new price and `repricedChargeCredits` holds the old one until the instant.
+ *
+ * A `before` of 0 means the kind had no credit reservation at all: X accounts
+ * were never priced, and a phone number was paid through its $10 Stripe seat
+ * rather than in credits. Such a kind reserves nothing until the instant.
+ */
+export declare const S20_RESERVATION_PRICE_RISES: readonly RepricedValue<number>[];
+/**
+ * Every value the 2026-09 switch moves. Each dark slice appends its entries
+ * here, so `oxygen limits show` can list them once a date is set and one test
+ * proves each resolves to its old value before the instant and its new value
+ * after it.
+ */
+export declare const REPRICING_2026_09_SCHEDULE: readonly RepricedValue[];
+/** The schedule entry with this key, or undefined. */
+export declare function findRepricedValue(key: string, schedule?: readonly RepricedValue[]): RepricedValue | undefined;
+/**
+ * The credits a recurring charge costs right now, given the price stored in the
+ * pricing book (database row or seed).
+ *
+ * The seed and the S20 migration carry the NEW price, so a charge key with a
+ * scheduled rise must not reach a customer before the instant. Until then a
+ * stored price equal to the scheduled new price resolves to the old one. Any
+ * other stored price is a staff override made at /admin/costs and stands, as it
+ * always has. From the instant on the stored price stands. A key with no
+ * scheduled rise passes through unchanged. A result of 0 means "not priced yet":
+ * callers that reserve credits treat it as unpriced, never as free.
+ */
+export declare function repricedChargeCredits(chargeKey: string, storedCredits: number, options?: RepricingOptions): number;
+/** Human-readable problems with a schedule; empty when it is sound. */
+export declare function findRepricingScheduleViolations(schedule?: readonly RepricedValue[]): string[];
+export type RepricingScheduleChange = {
+    key: string;
+    kind: "price" | "limit";
+    unit: string;
+    description: string;
+    value_in_force: RepricedScalar;
+    value_before: RepricedScalar;
+    value_after: RepricedScalar;
+};
+export type RepricingScheduleDescription = {
+    name: typeof REPRICING_2026_09_NAME;
+    effective_at: string;
+    status: "scheduled" | "in_force";
+    changes: RepricingScheduleChange[];
+};
+/**
+ * What customer surfaces report about the scheduled change. `null` while the
+ * switch is unset or unparseable: nothing is announced until an operator sets a
+ * valid instant, so an inert switch changes no customer-visible output.
+ */
+export declare function describeRepricingSchedule(options?: RepricingOptions & {
+    schedule?: readonly RepricedValue[];
+}): RepricingScheduleDescription | null;
+export {};

package/node_modules/@oxygen/shared/dist/repricing.js

@@ -0,0 +1,320 @@
+// The 2026-09 repricing effective-date switch, and the one place that reads
+// `OXYGEN_REPRICING_2026_09_EFFECTIVE_AT`.
+//
+// WHY THIS EXISTS. A production release carries everything on `dev`, so no price
+// rise can be held back by "not merged yet". The 2026-09 repricing (oxygen-knowledge
+// `wiki/ops/Repricing 2026-09 Specification.md` §6.1, slice S07) ships every rise
+// and every tightened limit dark, then moves them all at one instant, 30 days
+// after customers are told. Each such value is declared once in
+// `REPRICING_2026_09_SCHEDULE` below with its old and new value, and resolves to
+// the old value before the instant and to the new value from it on.
+//
+// WHAT GOES THROUGH HERE, AND WHAT NEVER DOES.
+//
+// - A price that rises or a limit that tightens: a snapshot constant (top-up
+//   rate, automation step, BYOK fee, ...) or a plan limit. Its slice adds one
+//   `defineRepricedValue` entry and reads it with `repricedValue`.
+// - Never a decrease or a limit increase. Those ship live on release (§6.1), so
+//   holding one back would only delay a customer benefit; the schedule check
+//   below refuses a price entry whose new value is not higher.
+// - Database prices (`pricing_recurring_charges`, `pricing_scalars`) move with
+//   the T + 30 migration batch (S91b). A reader that must hold a database value
+//   until the instant passes the stored row as `after` and the pre-change value
+//   as `before`, exactly like a snapshot constant.
+//
+// UNSET MEANS NEVER, deliberately and permanently: a variable nobody set must
+// never raise a customer's price. The value is an ISO 8601 instant WITH an
+// explicit offset (`2026-11-01T00:00:00Z`); a bare date or local time would move
+// prices at a different moment on every host. An unparseable value is treated
+// exactly like an unset one and old values stay in force, because the
+// customer-safe failure of a mistyped date is "prices did not rise yet", never
+// "prices rose early". The state says `invalid` so a server caller can log it.
+//
+// ONE VALUE FOR EVERY PROCESS. The web app, the legacy worker and every BullMQ
+// role price the same work, so the variable lives in Doppler `oxygen-shared`
+// (inherited by web and worker) and in the runtime roles' common vault names
+// (`ops/selfhost/worker-queue/apply-runtime.py`). Setting it is a production
+// configuration change that needs explicit human approval (S95); rolling back
+// before the instant is unsetting it.
+//
+// Read per call rather than memoized at module load, like the cutover freeze:
+// tests drive both states, and an operator's change must not need a restart to
+// be seen consistently. Parsing one short string per call is negligible.
+//
+// No imports on purpose: `@oxygen/shared` ships inside the published CLI, and
+// "use client" components may import the schedule. A client component cannot
+// read the server's environment, though, so a page that shows a price in force
+// must resolve it on the server and pass it down.
+export const REPRICING_2026_09_EFFECTIVE_AT_ENV_VAR = "OXYGEN_REPRICING_2026_09_EFFECTIVE_AT";
+/** Stable machine name of this price change, as reported on customer surfaces. */
+export const REPRICING_2026_09_NAME = "repricing_2026_09";
+// Date and time with an explicit `Z` or `±hh:mm` offset. Seconds and up to
+// millisecond fractions are optional.
+const ISO_INSTANT_WITH_OFFSET = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d{1,3})?)?(?:Z|[+-]\d{2}:\d{2})$/;
+/** Parse the switch's raw value. `null` for unset, `undefined` for unparseable. */
+export function parseRepricingEffectiveAt(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return null;
+    if (!ISO_INSTANT_WITH_OFFSET.test(value))
+        return undefined;
+    const ms = Date.parse(value);
+    if (!Number.isFinite(ms))
+        return undefined;
+    const parsed = new Date(ms);
+    // Date.parse rolls impossible calendar dates over (2026-02-30 → 2026-03-02);
+    // an instant that does not round-trip its own date part was mistyped.
+    const offsetMatch = /([+-])(\d{2}):(\d{2})$/.exec(value);
+    const offsetMinutes = offsetMatch
+        ? (offsetMatch[1] === "-" ? -1 : 1) * (Number(offsetMatch[2]) * 60 + Number(offsetMatch[3]))
+        : 0;
+    const localDate = new Date(ms + offsetMinutes * 60_000).toISOString().slice(0, 10);
+    if (localDate !== value.slice(0, 10))
+        return undefined;
+    return parsed;
+}
+/** Where the switch stands at `now`. */
+export function readRepricingSwitch(options = {}) {
+    const env = options.env ?? process.env;
+    const raw = env[REPRICING_2026_09_EFFECTIVE_AT_ENV_VAR];
+    const effectiveAt = parseRepricingEffectiveAt(raw);
+    if (effectiveAt === null)
+        return { status: "unset", effectiveAt: null };
+    if (effectiveAt === undefined)
+        return { status: "invalid", effectiveAt: null, raw: (raw ?? "").trim() };
+    const now = options.now === undefined ? Date.now() : Number(options.now);
+    return now >= effectiveAt.getTime()
+        ? { status: "in_force", effectiveAt }
+        : { status: "scheduled", effectiveAt };
+}
+/** True once the switch names an instant that has passed. */
+export function isRepricingInForce(options = {}) {
+    return readRepricingSwitch(options).status === "in_force";
+}
+/** The value in force: `before` until the switch's instant, `after` from it on. */
+export function repricedValue(value, options = {}) {
+    return (isRepricingInForce(options) ? value.after : value.before);
+}
+export function defineRepricedValue(definition) {
+    return Object.freeze({ ...definition });
+}
+const GIB = 1024 ** 3;
+// S50 (decision L1, ratified 2026-09-26): the storage limits that TIGHTEN, per
+// plan band. Today every band has 3,000,000 rows per Table, 25,000,000 per
+// workspace and 30 GiB (warning at 20 GiB). $199 and $499 keep those values, and
+// $999 / $1,999 rise only after the capacity test at 5M and 10M rows, so only
+// free, $49 and $99 appear here. The database warning is PROPOSED P-48: two
+// thirds of the hard limit, rounded down to a whole byte.
+// `packages/shared/src/table-capacity.ts` resolves these; a test pins each
+// `after` to the ratified ladder there, so the two cannot drift.
+const STORAGE_CUTS = [
+    { band: "free", tableRows: 100_000, workspaceRows: 1_000_000, databaseBytes: 2 * GIB },
+    { band: "49", tableRows: 1_000_000, workspaceRows: 5_000_000, databaseBytes: 10 * GIB },
+    { band: "99", tableRows: 2_000_000, workspaceRows: 10_000_000, databaseBytes: 20 * GIB },
+];
+function storageCutEntries() {
+    return STORAGE_CUTS.flatMap(({ band, tableRows, workspaceRows, databaseBytes }) => {
+        const plan = band === "free" ? "the free plan" : `the $${band} plan`;
+        const entry = (field, unit, description, before, after) => defineRepricedValue({
+            key: `storage.${band}.${field}`,
+            kind: "limit",
+            slice: "S50",
+            decision: "L1",
+            unit,
+            description,
+            before,
+            after,
+        });
+        return [
+            entry("table_row_limit", "rows", `Rows per Table on ${plan}.`, 3_000_000, tableRows),
+            entry("workspace_row_limit", "rows", `Retained Table rows per workspace on ${plan}.`, 25_000_000, workspaceRows),
+            entry("workspace_database_limit_bytes", "bytes", `Workspace Table database hard limit on ${plan}.`, 30 * GIB, databaseBytes),
+            entry("workspace_database_warning_bytes", "bytes", `Workspace Table database warning on ${plan}.`, 20 * GIB, Math.floor((databaseBytes * 2) / 3)),
+        ];
+    });
+}
+// ---- S52 (L3.3): email sending per mailbox. -------------------------------
+// The new default of 25 a day is not scheduled: new mailboxes were created at
+// 18 a day, so 25 is an increase and ships live (`@oxygen/shared/sending-limits`).
+// What tightens is the new hard maximum, and the move of mailboxes still on the
+// old column default of 40.
+/** The hard per-mailbox maximum: none before the instant, 50 a day from it. */
+export const EMAIL_MAILBOX_DAILY_CAP_MAXIMUM = defineRepricedValue({
+    key: "sending.email_mailbox_daily_cap_max",
+    kind: "limit",
+    slice: "S52",
+    decision: "L3.3",
+    unit: "emails_per_mailbox_per_day",
+    description: "Most emails one mailbox may send a day. A higher cap is refused, and a mailbox set higher sends at this maximum.",
+    before: null,
+    after: 50,
+});
+/**
+ * A mailbox still on the old default of 40 a day, which nobody set by hand, sends
+ * at the new default of 25 (P-58, proposed). The column was `DEFAULT 40`, so a
+ * deliberate 40 set before `daily_cap_source` existed cannot be told apart;
+ * setting the cap again records it as the customer's own, and it is then kept.
+ */
+export const EMAIL_MAILBOX_OLD_DEFAULT_DAILY_CAP = defineRepricedValue({
+    key: "sending.email_mailbox_old_default_daily_cap",
+    kind: "limit",
+    slice: "S52",
+    decision: "L3.3 (P-58)",
+    unit: "emails_per_mailbox_per_day",
+    description: "A mailbox still on the old default of 40 a day, a cap you never set yourself, sends at the new default of 25.",
+    before: 40,
+    after: 25,
+});
+/**
+ * S20: the monthly credit reservation of every connected account (decisions
+ * 2.1–2.4). Each key is the pricing-seed charge key, so the seed row carries the
+ * new price and `repricedChargeCredits` holds the old one until the instant.
+ *
+ * A `before` of 0 means the kind had no credit reservation at all: X accounts
+ * were never priced, and a phone number was paid through its $10 Stripe seat
+ * rather than in credits. Such a kind reserves nothing until the instant.
+ */
+export const S20_RESERVATION_PRICE_RISES = [
+    defineRepricedValue({
+        key: "seat.linkedin_account",
+        kind: "price",
+        slice: "S20",
+        decision: "2.1",
+        unit: "credits_per_account_per_month",
+        description: "Monthly credit reservation for a connected LinkedIn account.",
+        before: 1_000,
+        after: 3_400,
+    }),
+    defineRepricedValue({
+        key: "seat.x_account",
+        kind: "price",
+        slice: "S20",
+        decision: "2.2",
+        unit: "credits_per_account_per_month",
+        description: "Monthly credit reservation for a connected X account.",
+        before: 0,
+        after: 1_000,
+    }),
+    defineRepricedValue({
+        key: "seat.whatsapp_account",
+        kind: "price",
+        slice: "S20",
+        decision: "2.3",
+        unit: "credits_per_number_per_month",
+        description: "Monthly credit reservation for a connected WhatsApp number.",
+        before: 1_000,
+        after: 3_000,
+    }),
+    defineRepricedValue({
+        key: "seat.phone_number",
+        kind: "price",
+        slice: "S20",
+        decision: "2.4",
+        unit: "credits_per_number_per_month",
+        description: "Monthly credit reservation for a rented phone number.",
+        before: 0,
+        after: 1_000,
+    }),
+];
+/**
+ * Every value the 2026-09 switch moves. Each dark slice appends its entries
+ * here, so `oxygen limits show` can list them once a date is set and one test
+ * proves each resolves to its old value before the instant and its new value
+ * after it.
+ */
+export const REPRICING_2026_09_SCHEDULE = [
+    ...storageCutEntries(),
+    ...S20_RESERVATION_PRICE_RISES,
+    EMAIL_MAILBOX_DAILY_CAP_MAXIMUM,
+    EMAIL_MAILBOX_OLD_DEFAULT_DAILY_CAP,
+];
+/** The schedule entry with this key, or undefined. */
+export function findRepricedValue(key, schedule = REPRICING_2026_09_SCHEDULE) {
+    return schedule.find((entry) => entry.key === key);
+}
+/**
+ * The credits a recurring charge costs right now, given the price stored in the
+ * pricing book (database row or seed).
+ *
+ * The seed and the S20 migration carry the NEW price, so a charge key with a
+ * scheduled rise must not reach a customer before the instant. Until then a
+ * stored price equal to the scheduled new price resolves to the old one. Any
+ * other stored price is a staff override made at /admin/costs and stands, as it
+ * always has. From the instant on the stored price stands. A key with no
+ * scheduled rise passes through unchanged. A result of 0 means "not priced yet":
+ * callers that reserve credits treat it as unpriced, never as free.
+ */
+export function repricedChargeCredits(chargeKey, storedCredits, options = {}) {
+    const entry = REPRICING_2026_09_SCHEDULE.find((candidate) => candidate.key === chargeKey && candidate.kind === "price" && typeof candidate.before === "number");
+    if (!entry || isRepricingInForce(options))
+        return storedCredits;
+    return storedCredits === entry.after ? entry.before : storedCredits;
+}
+const KEY_PATTERN = /^[a-z0-9_]+(?:\.[a-z0-9_]+)*$/;
+const SLICE_PATTERN = /^S\d{2}[a-z]?$/;
+/** Human-readable problems with a schedule; empty when it is sound. */
+export function findRepricingScheduleViolations(schedule = REPRICING_2026_09_SCHEDULE) {
+    const violations = [];
+    const seen = new Set();
+    for (const entry of schedule) {
+        const label = entry.key || "(empty key)";
+        if (!KEY_PATTERN.test(entry.key))
+            violations.push(`${label}: key must be dotted snake_case.`);
+        if (seen.has(entry.key))
+            violations.push(`${label}: duplicate key.`);
+        seen.add(entry.key);
+        if (!SLICE_PATTERN.test(entry.slice))
+            violations.push(`${label}: slice must name a specification slice such as S10.`);
+        if (!entry.decision.trim())
+            violations.push(`${label}: decision must name the decision-record number.`);
+        if (!entry.unit.trim() || !entry.description.trim())
+            violations.push(`${label}: unit and description are required.`);
+        if (entry.after === null) {
+            violations.push(`${label}: a value that becomes unbounded is a loosening and ships live on release.`);
+            continue;
+        }
+        if (entry.before === null) {
+            if (entry.kind !== "limit")
+                violations.push(`${label}: only a limit may be unbounded before the switch.`);
+            continue;
+        }
+        if (typeof entry.before !== typeof entry.after) {
+            violations.push(`${label}: before and after must have the same type.`);
+            continue;
+        }
+        if (entry.before === entry.after)
+            violations.push(`${label}: before and after are equal, so nothing changes.`);
+        if (entry.kind === "price"
+            && typeof entry.before === "number"
+            && typeof entry.after === "number"
+            && !(entry.after > entry.before)) {
+            violations.push(`${label}: only a price rise waits for the switch; a decrease ships live on release.`);
+        }
+    }
+    return violations;
+}
+/**
+ * What customer surfaces report about the scheduled change. `null` while the
+ * switch is unset or unparseable: nothing is announced until an operator sets a
+ * valid instant, so an inert switch changes no customer-visible output.
+ */
+export function describeRepricingSchedule(options = {}) {
+    const state = readRepricingSwitch(options);
+    if (state.status !== "scheduled" && state.status !== "in_force")
+        return null;
+    const inForce = state.status === "in_force";
+    return {
+        name: REPRICING_2026_09_NAME,
+        effective_at: state.effectiveAt.toISOString(),
+        status: state.status,
+        changes: (options.schedule ?? REPRICING_2026_09_SCHEDULE).map((entry) => ({
+            key: entry.key,
+            kind: entry.kind,
+            unit: entry.unit,
+            description: entry.description,
+            value_in_force: inForce ? entry.after : entry.before,
+            value_before: entry.before,
+            value_after: entry.after,
+        })),
+    };
+}

package/node_modules/@oxygen/shared/dist/sending-limits.d.ts

@@ -0,0 +1,32 @@
+import { type RepricingOptions } from "./repricing.js";
+/**
+ * The daily cap a new mailbox gets when nobody names one. New mailboxes were
+ * created at 18 a day before the repricing, so this is an increase and is live.
+ */
+export declare const EMAIL_MAILBOX_DEFAULT_DAILY_CAP = 25;
+/**
+ * Who set a mailbox's stored cap. `default` = OXYGEN's default at creation,
+ * `user` = a person or agent set it. A row written before the column existed
+ * has no source (null): its cap may be the old column default or a choice.
+ */
+export declare const EMAIL_MAILBOX_DAILY_CAP_SOURCES: readonly ["default", "user"];
+export type EmailMailboxDailyCapSource = (typeof EMAIL_MAILBOX_DAILY_CAP_SOURCES)[number];
+export declare function readEmailMailboxDailyCapSource(value: unknown): EmailMailboxDailyCapSource | null;
+/** The most a mailbox may be set to send a day, or null while there is no maximum. */
+export declare function emailMailboxDailyCapMaximum(options?: RepricingOptions): number | null;
+/**
+ * The configured cap in force for a stored one: every surface that reads a
+ * mailbox's cap, and the send claim, go through this.
+ *
+ * Once the switch is in force, a cap still at the old default of 40 that nobody
+ * set by hand sends at the new default, and any cap above the maximum sends at
+ * the maximum. Before it, the stored cap is returned unchanged.
+ */
+export declare function emailMailboxDailyCapInForce(input: {
+    storedCap: number;
+    source: EmailMailboxDailyCapSource | null;
+}, options?: RepricingOptions): number;
+/** A new voice number may dial this many times a day once it has warmed up. */
+export declare const VOICE_NUMBER_DEFAULT_DAILY_CAP = 100;
+/** The most a voice number may be set to dial a day. */
+export declare const VOICE_NUMBER_MAX_DAILY_CAP = 300;

package/node_modules/@oxygen/shared/dist/sending-limits.js

@@ -0,0 +1,49 @@
+// Per-channel sending limits that are the same on every plan (2026-09 repricing,
+// decision L3; specification slice S52). Limits guard, credits meter: none of
+// these is sold, and none charges for sending.
+//
+// Email per mailbox: warm-up ramp 5 / 10 / 20 (tenant-db `WARMUP_RAMP_DAILY_CAPS`),
+// then the mailbox's own daily cap, 25 by default. The hard maximum of 50 and the
+// move of mailboxes still on the old default of 40 are limit cuts, held by the
+// 2026-09 effective-date switch (`./repricing.ts`), so they are read through it.
+//
+// Voice per number: 100 dials a day by default, adjustable up to 300.
+import { EMAIL_MAILBOX_DAILY_CAP_MAXIMUM, EMAIL_MAILBOX_OLD_DEFAULT_DAILY_CAP, repricedValue, } from "./repricing.js";
+/**
+ * The daily cap a new mailbox gets when nobody names one. New mailboxes were
+ * created at 18 a day before the repricing, so this is an increase and is live.
+ */
+export const EMAIL_MAILBOX_DEFAULT_DAILY_CAP = 25;
+/**
+ * Who set a mailbox's stored cap. `default` = OXYGEN's default at creation,
+ * `user` = a person or agent set it. A row written before the column existed
+ * has no source (null): its cap may be the old column default or a choice.
+ */
+export const EMAIL_MAILBOX_DAILY_CAP_SOURCES = ["default", "user"];
+export function readEmailMailboxDailyCapSource(value) {
+    return value === "default" || value === "user" ? value : null;
+}
+/** The most a mailbox may be set to send a day, or null while there is no maximum. */
+export function emailMailboxDailyCapMaximum(options = {}) {
+    return repricedValue(EMAIL_MAILBOX_DAILY_CAP_MAXIMUM, options);
+}
+/**
+ * The configured cap in force for a stored one: every surface that reads a
+ * mailbox's cap, and the send claim, go through this.
+ *
+ * Once the switch is in force, a cap still at the old default of 40 that nobody
+ * set by hand sends at the new default, and any cap above the maximum sends at
+ * the maximum. Before it, the stored cap is returned unchanged.
+ */
+export function emailMailboxDailyCapInForce(input, options = {}) {
+    const stored = Number.isFinite(input.storedCap) ? Math.max(0, Math.floor(input.storedCap)) : 0;
+    const cap = input.source !== "user" && stored === EMAIL_MAILBOX_OLD_DEFAULT_DAILY_CAP.before
+        ? repricedValue(EMAIL_MAILBOX_OLD_DEFAULT_DAILY_CAP, options)
+        : stored;
+    const maximum = emailMailboxDailyCapMaximum(options);
+    return maximum === null ? cap : Math.min(cap, maximum);
+}
+/** A new voice number may dial this many times a day once it has warmed up. */
+export const VOICE_NUMBER_DEFAULT_DAILY_CAP = 100;
+/** The most a voice number may be set to dial a day. */
+export const VOICE_NUMBER_MAX_DAILY_CAP = 300;

package/node_modules/@oxygen/shared/dist/sequence-failures.js

@@ -172,8 +172,11 @@ function classifySequenceFailure(input) {
         .toLowerCase();
     // Ambiguous effects win every other classification. A 429-shaped code or a
     // provider name must never make a possibly-applied write safe to replay.
+    // `write[_-]?ambiguous` is the LinkedIn client's `provider_write_ambiguous`:
+    // stored rows written before that error carried `effect_outcome` would
+    // otherwise read back as a recipient hard bounce.
     if (input.effectOutcome === "unknown" ||
-        /(?:effect|outcome)[_-]?unknown|ambiguous[_-]?(?:effect|write)/i.test(codes)) {
+        /(?:effect|outcome)[_-]?unknown|ambiguous[_-]?(?:effect|write)|write[_-]?ambiguous/i.test(codes)) {
         return "effect_unknown";
     }
     if ([input.code, input.providerSubtype].some((code) => isProviderFundingErrorCode(code)))

package/node_modules/@oxygen/shared/dist/stripe-price-catalog.d.ts

@@ -17,6 +17,25 @@ export declare const PRICING_PLANS: {
 /** The six purchasable rungs with their Stripe price ids, cheapest first. */
 export declare const PURCHASABLE_PLANS: Record<OxygenPlanKey, PricingPlan>;
 export declare function getPlanPriceId(plan: PricingPlan, currency: BillingCurrency): string;
+/** How often a plan Price bills. Credits are granted monthly on both. */
+export type PlanBillingInterval = "month" | "year";
+/**
+ * The configured Price for one rung and interval, or "" when that Price is not
+ * configured (every yearly Price, until S14 creates them).
+ */
+export declare function getPurchasablePlanPriceId(planKey: OxygenPlanKey, interval: PlanBillingInterval, currency?: BillingCurrency): string;
+/**
+ * The billing interval of a recognized plan Price. "year" only for a configured
+ * yearly Oxygen Price; every other recognized Price (monthly rungs and every
+ * grandfathered or legacy plan) is "month"; an unrecognized id is null.
+ *
+ * This is the one definition the credit-grant paths read, so the Stripe webhook,
+ * the lazy grant on a balance read and the slice sweep can never disagree about
+ * whether a paid period is sliced.
+ */
+export declare function planBillingIntervalForPriceId(priceId: string | null | undefined): PlanBillingInterval | null;
+/** Every configured yearly plan Price id (empty until S14). */
+export declare function configuredAnnualPlanPriceIds(): readonly string[];
 /**
  * Resolve a Stripe price id to the plan key stored in `subscriptions.tier`.
  *
@@ -30,6 +49,11 @@ export declare function tierFromPriceId(priceId: string): string | null;
  * Complete runtime-recognized Price set grouped by the current self-serve
  * family. Catalog audit/migration code consumes this instead of maintaining a
  * second env map that can silently omit grandfathered subscriptions.
+ *
+ * The yearly Prices are deliberately NOT listed yet: the migration planner
+ * matches an outgoing Oxygen Price to its target by amount, and must learn to
+ * compare intervals (repricing slice S16) before a yearly Price may enter its
+ * source set. S14 adds them when it creates the Prices.
  */
 export declare function recognizedStripePriceIdsBySelfServeTier(): Record<SelfServePlanTier, readonly string[]>;
 export declare function formatMonthlyPrice(priceCents: number | null, currency?: BillingCurrency): string;