@oxygen-agent/cli 1.1010.644 → 1.1010.721

package/node_modules/@oxygen/shared/dist/stripe-price-catalog.js

@@ -19,6 +19,24 @@ const STRIPE_PRICE_OXYGEN_IDS = {
     oxygen_999: { usd: process.env.STRIPE_PRICE_OXYGEN_999_USD ?? "" },
     oxygen_1999: { usd: process.env.STRIPE_PRICE_OXYGEN_1999_USD ?? "" },
 };
+/**
+ * The yearly Price of each rung (Repricing 2026-09, decision 1.2: pay 10 months,
+ * get 12, credits still granted monthly). A second Price on the rung's existing
+ * Product, since month and year are distinct intervals a Portal configuration
+ * accepts under one Product.
+ *
+ * DARK until the yearly Prices exist (slice S14): every env var is unset, an
+ * unset id is "", and tierFromPriceId refuses "" before any map is consulted, so
+ * no subscription resolves to a yearly interval and nothing is ever sliced.
+ */
+const STRIPE_PRICE_OXYGEN_ANNUAL_IDS = {
+    oxygen_49: { usd: process.env.STRIPE_PRICE_OXYGEN_49_ANNUAL_USD ?? "" },
+    oxygen_99: { usd: process.env.STRIPE_PRICE_OXYGEN_99_ANNUAL_USD ?? "" },
+    oxygen_199: { usd: process.env.STRIPE_PRICE_OXYGEN_199_ANNUAL_USD ?? "" },
+    oxygen_499: { usd: process.env.STRIPE_PRICE_OXYGEN_499_ANNUAL_USD ?? "" },
+    oxygen_999: { usd: process.env.STRIPE_PRICE_OXYGEN_999_ANNUAL_USD ?? "" },
+    oxygen_1999: { usd: process.env.STRIPE_PRICE_OXYGEN_1999_ANNUAL_USD ?? "" },
+};
 // Grandfathered on 2026-09-19. These three stay pointed at their LIVE prices
 // (35 Starter + 2 Pro subscriptions bill against them) rather than moving into
 // the legacy CSV lists: tierFromPriceId must keep returning "starter"/"pro"/
@@ -82,6 +100,39 @@ export function getPlanPriceId(plan, currency) {
     return (plan.priceIds[currency]
         || (currency === DEFAULT_BILLING_CURRENCY ? plan.priceId : ""));
 }
+/**
+ * The configured Price for one rung and interval, or "" when that Price is not
+ * configured (every yearly Price, until S14 creates them).
+ */
+export function getPurchasablePlanPriceId(planKey, interval, currency = DEFAULT_BILLING_CURRENCY) {
+    const ids = interval === "year"
+        ? STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey]
+        : STRIPE_PRICE_OXYGEN_IDS[planKey];
+    return ids[currency] || "";
+}
+/**
+ * The billing interval of a recognized plan Price. "year" only for a configured
+ * yearly Oxygen Price; every other recognized Price (monthly rungs and every
+ * grandfathered or legacy plan) is "month"; an unrecognized id is null.
+ *
+ * This is the one definition the credit-grant paths read, so the Stripe webhook,
+ * the lazy grant on a balance read and the slice sweep can never disagree about
+ * whether a paid period is sliced.
+ */
+export function planBillingIntervalForPriceId(priceId) {
+    if (!priceId)
+        return null;
+    for (const planKey of PURCHASABLE_PLAN_KEYS) {
+        if (Object.values(STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey]).includes(priceId)) {
+            return "year";
+        }
+    }
+    return tierFromPriceId(priceId) === null ? null : "month";
+}
+/** Every configured yearly plan Price id (empty until S14). */
+export function configuredAnnualPlanPriceIds() {
+    return uniqueNonEmptyPriceIds(PURCHASABLE_PLAN_KEYS.flatMap((planKey) => Object.values(STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey])));
+}
 /**
  * Resolve a Stripe price id to the plan key stored in `subscriptions.tier`.
  *
@@ -97,7 +148,8 @@ export function tierFromPriceId(priceId) {
     if (!priceId)
         return null;
     for (const planKey of PURCHASABLE_PLAN_KEYS) {
-        if (Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey]).includes(priceId)) {
+        if (Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey]).includes(priceId)
+            || Object.values(STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey]).includes(priceId)) {
             return planKey;
         }
     }
@@ -122,6 +174,11 @@ export function tierFromPriceId(priceId) {
  * Complete runtime-recognized Price set grouped by the current self-serve
  * family. Catalog audit/migration code consumes this instead of maintaining a
  * second env map that can silently omit grandfathered subscriptions.
+ *
+ * The yearly Prices are deliberately NOT listed yet: the migration planner
+ * matches an outgoing Oxygen Price to its target by amount, and must learn to
+ * compare intervals (repricing slice S16) before a yearly Price may enter its
+ * source set. S14 adds them when it creates the Prices.
  */
 export function recognizedStripePriceIdsBySelfServeTier() {
     const byTier = {

package/node_modules/@oxygen/shared/dist/table-capacity.d.ts

@@ -1,13 +1,42 @@
-/**
- * Plan-independent infrastructure envelope for durable Workspace Tables.
- * Plans do not sell different storage entitlements; every workspace gets the
- * same safety boundary and plans continue to differ through operation/rate and
- * credit limits.
- */
-export declare const WORKSPACE_TABLE_CAPACITY: Readonly<{
-    tableRowLimit: 3000000;
-    workspaceRowLimit: 25000000;
+import type { PlanBand } from "./plan-band.js";
+import { type RepricingOptions } from "./repricing.js";
+export type WorkspaceTableCapacityLimits = {
+    tableRowLimit: number;
+    workspaceRowLimit: number;
     workspaceDatabaseWarningBytes: number;
     workspaceDatabaseLimitBytes: number;
-}>;
+};
+/**
+ * The envelope every workspace had before storage scaled with plan size, and
+ * still the value in force for any workspace whose plan-resolved limits have not
+ * been written to its tenant yet. The tenant capacity trigger falls back to these
+ * exact numbers when its per-workspace limit columns are NULL (tenant migration
+ * `0451_workspace_capacity_plan_limits.sql`,
+ * enforced by `0452_workspace_capacity_plan_limit_enforcement.sql`); a test pins the two together.
+ */
+export declare const WORKSPACE_TABLE_CAPACITY: Readonly<WorkspaceTableCapacityLimits>;
 export declare const WORKSPACE_TABLE_DATABASE_STORAGE_SCOPE: "postgres_workspace_tables_heap_indexes_toast";
+/** Two thirds of the hard limit, rounded down (PROPOSED P-48, repricing spec § 4.1). */
+export declare function workspaceDatabaseWarningBytesFor(limitBytes: number): number;
+/**
+ * Storage by plan size, as ratified (decision L1, 2026-09-26; repricing spec
+ * § 4.1). This is the target ladder, not what is in force: see
+ * `resolveWorkspaceTableCapacity`.
+ */
+export declare const PLAN_BAND_TABLE_CAPACITY_TARGETS: Readonly<Record<PlanBand, WorkspaceTableCapacityLimits>>;
+/**
+ * Sizes above today's envelope ship only after a capacity test at 5M and 10M
+ * rows per Table (decision L1). Until that test passes these bands keep today's
+ * envelope; shipping them is removing a band from this list.
+ */
+export declare const PLAN_BANDS_AWAITING_CAPACITY_TEST: readonly PlanBand[];
+/**
+ * The storage limits in force for a plan band right now.
+ *
+ * - A limit that tightens (free, $49, $99) is a scheduled 2026-09 repricing value
+ *   (`storage.<band>.*` in `REPRICING_2026_09_SCHEDULE`): today's envelope until
+ *   the effective-date switch, the ratified ladder from it on.
+ * - A band awaiting the capacity test keeps today's envelope.
+ * - Every other band is already at its ladder value.
+ */
+export declare function resolveWorkspaceTableCapacity(band: PlanBand, options?: RepricingOptions): WorkspaceTableCapacityLimits;

package/node_modules/@oxygen/shared/dist/table-capacity.js

@@ -1,9 +1,12 @@
+import { findRepricedValue, repricedValue } from "./repricing.js";
 const GIB = 1024 ** 3;
 /**
- * Plan-independent infrastructure envelope for durable Workspace Tables.
- * Plans do not sell different storage entitlements; every workspace gets the
- * same safety boundary and plans continue to differ through operation/rate and
- * credit limits.
+ * The envelope every workspace had before storage scaled with plan size, and
+ * still the value in force for any workspace whose plan-resolved limits have not
+ * been written to its tenant yet. The tenant capacity trigger falls back to these
+ * exact numbers when its per-workspace limit columns are NULL (tenant migration
+ * `0451_workspace_capacity_plan_limits.sql`,
+ * enforced by `0452_workspace_capacity_plan_limit_enforcement.sql`); a test pins the two together.
  */
 export const WORKSPACE_TABLE_CAPACITY = Object.freeze({
     tableRowLimit: 3_000_000,
@@ -12,3 +15,64 @@ export const WORKSPACE_TABLE_CAPACITY = Object.freeze({
     workspaceDatabaseLimitBytes: 30 * GIB,
 });
 export const WORKSPACE_TABLE_DATABASE_STORAGE_SCOPE = "postgres_workspace_tables_heap_indexes_toast";
+/** Two thirds of the hard limit, rounded down (PROPOSED P-48, repricing spec § 4.1). */
+export function workspaceDatabaseWarningBytesFor(limitBytes) {
+    return Math.floor((limitBytes * 2) / 3);
+}
+function ladderRow(tableRowLimit, workspaceRowLimit, databaseGib) {
+    const workspaceDatabaseLimitBytes = databaseGib * GIB;
+    return Object.freeze({
+        tableRowLimit,
+        workspaceRowLimit,
+        workspaceDatabaseWarningBytes: workspaceDatabaseWarningBytesFor(workspaceDatabaseLimitBytes),
+        workspaceDatabaseLimitBytes,
+    });
+}
+/**
+ * Storage by plan size, as ratified (decision L1, 2026-09-26; repricing spec
+ * § 4.1). This is the target ladder, not what is in force: see
+ * `resolveWorkspaceTableCapacity`.
+ */
+export const PLAN_BAND_TABLE_CAPACITY_TARGETS = Object.freeze({
+    free: ladderRow(100_000, 1_000_000, 2),
+    "49": ladderRow(1_000_000, 5_000_000, 10),
+    "99": ladderRow(2_000_000, 10_000_000, 20),
+    "199": ladderRow(3_000_000, 25_000_000, 30),
+    "499": ladderRow(3_000_000, 25_000_000, 30),
+    "999": ladderRow(5_000_000, 50_000_000, 60),
+    "1999": ladderRow(10_000_000, 100_000_000, 120),
+});
+/**
+ * Sizes above today's envelope ship only after a capacity test at 5M and 10M
+ * rows per Table (decision L1). Until that test passes these bands keep today's
+ * envelope; shipping them is removing a band from this list.
+ */
+export const PLAN_BANDS_AWAITING_CAPACITY_TEST = Object.freeze(["999", "1999"]);
+const STORAGE_FIELDS = [
+    ["tableRowLimit", "table_row_limit"],
+    ["workspaceRowLimit", "workspace_row_limit"],
+    ["workspaceDatabaseWarningBytes", "workspace_database_warning_bytes"],
+    ["workspaceDatabaseLimitBytes", "workspace_database_limit_bytes"],
+];
+/**
+ * The storage limits in force for a plan band right now.
+ *
+ * - A limit that tightens (free, $49, $99) is a scheduled 2026-09 repricing value
+ *   (`storage.<band>.*` in `REPRICING_2026_09_SCHEDULE`): today's envelope until
+ *   the effective-date switch, the ratified ladder from it on.
+ * - A band awaiting the capacity test keeps today's envelope.
+ * - Every other band is already at its ladder value.
+ */
+export function resolveWorkspaceTableCapacity(band, options = {}) {
+    if (PLAN_BANDS_AWAITING_CAPACITY_TEST.includes(band))
+        return WORKSPACE_TABLE_CAPACITY;
+    const target = PLAN_BAND_TABLE_CAPACITY_TARGETS[band];
+    const resolved = { ...target };
+    for (const [field, key] of STORAGE_FIELDS) {
+        const scheduled = findRepricedValue(`storage.${band}.${key}`);
+        if (scheduled && typeof scheduled.before === "number" && typeof scheduled.after === "number") {
+            resolved[field] = repricedValue({ before: scheduled.before, after: scheduled.after }, options);
+        }
+    }
+    return Object.freeze(resolved);
+}

package/node_modules/@oxygen/shared/dist/telemetry.d.ts

@@ -1,6 +1,7 @@
 export type TelemetryAttributes = Record<string, unknown>;
 export type WithTelemetrySpanOptions = {
     isTransient?: (error: unknown) => boolean;
+    traceparent?: string | null | undefined;
 };
 export declare function withTelemetrySpan<T>(tracerName: string, name: string, attributes: TelemetryAttributes | undefined, fn: () => Promise<T>, options?: WithTelemetrySpanOptions): Promise<T>;
 /**
@@ -18,5 +19,13 @@ export declare function setActiveTelemetryAttributes(attributes: TelemetryAttrib
 export declare function markActiveTelemetryError(message: string, attributes?: TelemetryAttributes): void;
 export declare function recordTelemetryCounter(name: string, value?: number, attributes?: TelemetryAttributes): void;
 export declare function recordTelemetryHistogram(name: string, value: number, attributes?: TelemetryAttributes): void;
+/**
+ * Records the latest observed value of a level (a queue depth, a pool size).
+ * A synchronous gauge rather than an observable one: the callers already sample
+ * on their own cadence (the BullMQ relay reads Redis counts every 10s), and a
+ * collection-time callback would have to reach into that loop's state. The
+ * exported point is the last value recorded before each export.
+ */
+export declare function recordTelemetryGauge(name: string, value: number, attributes?: TelemetryAttributes): void;
 export declare function commonTelemetryAttributes(attributes?: TelemetryAttributes): TelemetryAttributes;
 export declare function metricSafeAttributes(attributes?: TelemetryAttributes): TelemetryAttributes;

package/node_modules/@oxygen/shared/dist/telemetry.js

@@ -3,14 +3,21 @@ import { deployEnvTelemetryEnvironment, deployPlatformAttribute } from "./deploy
 import { errorId } from "./log.js";
 import { normalizeTelemetryAttributes } from "./redaction.js";
 import { redactSqlParameters, sqlErrorTelemetryAttributes } from "./sql-error.js";
+import { remoteParentContext } from "./trace-context.js";
 import { OXYGEN_VERSION } from "./version.js";
 const counterCache = new Map();
 const histogramCache = new Map();
+const gaugeCache = new Map();
 // skipcq: JS-0116 — `async` keeps synchronous setup throws (getTracer / attribute
 // normalization) as rejections so the Promise<T> contract holds for all callers.
 export async function withTelemetrySpan(tracerName, name, attributes, fn, options) {
     const tracer = trace.getTracer(tracerName, OXYGEN_VERSION);
-    return tracer.startActiveSpan(name, { attributes: normalizeTelemetryAttributes(commonTelemetryAttributes(attributes)) }, async (span) => {
+    const remote = options?.traceparent ? remoteParentContext(options.traceparent) : null;
+    const spanOptions = {
+        attributes: normalizeTelemetryAttributes(commonTelemetryAttributes(remote ? { ...attributes, "oxygen.trace.propagated": true } : attributes)),
+        ...(remote && remote.links.length > 0 ? { links: remote.links } : {}),
+    };
+    const run = async (span) => {
         try {
             return await fn();
         }
@@ -37,7 +44,10 @@ export async function withTelemetrySpan(tracerName, name, attributes, fn, option
         finally {
             span.end();
         }
-    });
+    };
+    return remote
+        ? tracer.startActiveSpan(name, spanOptions, remote.context, run)
+        : tracer.startActiveSpan(name, spanOptions, run);
 }
 /**
  * The active global span's trace id: the join key into SigNoz/Axiom traces.
@@ -84,6 +94,23 @@ export function recordTelemetryHistogram(name, value, attributes) {
     const histogram = getHistogram(name);
     histogram.record(value, normalizeTelemetryAttributes(metricSafeAttributes(commonTelemetryAttributes(attributes))));
 }
+/**
+ * Records the latest observed value of a level (a queue depth, a pool size).
+ * A synchronous gauge rather than an observable one: the callers already sample
+ * on their own cadence (the BullMQ relay reads Redis counts every 10s), and a
+ * collection-time callback would have to reach into that loop's state. The
+ * exported point is the last value recorded before each export.
+ */
+export function recordTelemetryGauge(name, value, attributes) {
+    if (!Number.isFinite(value))
+        return;
+    let gauge = gaugeCache.get(name);
+    if (!gauge) {
+        gauge = getMeter().createGauge(name);
+        gaugeCache.set(name, gauge);
+    }
+    gauge.record(value, normalizeTelemetryAttributes(metricSafeAttributes(commonTelemetryAttributes(attributes))));
+}
 export function commonTelemetryAttributes(attributes) {
     const workerProcess = isWorkerProcess();
     // Each attribute reads an ordered env-var fallback chain that differs by
@@ -200,6 +227,13 @@ const METRIC_SAFE_ATTRIBUTE_KEYS = new Set([
     "table_action.lane",
     "tenant.ticket_reason",
     "queue.stalled",
+    // BullMQ execution queue dimensions (oxygen.worker.queue.*). `queue.lane` is
+    // the closed EXECUTION_LANES enum, `queue.role` the lane or "relay",
+    // `queue.state` one of BullMQ's five job-count states. Never the execution id
+    // or tenant id: those stay on the worker.job span and the lifecycle log.
+    "queue.lane",
+    "queue.role",
+    "queue.state",
     "scope",
     "rail",
     "overall_status",

package/node_modules/@oxygen/shared/dist/trace-context.d.ts

@@ -0,0 +1,29 @@
+import { type Context, type Link, type SpanContext } from "@opentelemetry/api";
+/** Parses a W3C `traceparent`; anything malformed or all-zero yields null. */
+export declare function parseTraceparent(value: unknown): SpanContext | null;
+/** The validated traceparent, or undefined — for optional fields that must drop bad input. */
+export declare function validTraceparent(value: unknown): string | undefined;
+export declare function formatTraceparent(spanContext: SpanContext | undefined | null): string | null;
+/** The `traceparent` of the currently active span, or null outside any span. */
+export declare function activeTraceparent(): string | null;
+/**
+ * The parent context for a span that continues a stored traceparent.
+ *
+ * The remote span becomes the PARENT, so request -> job -> provider.* reads as
+ * one trace; whatever span was active (a worker cycle, the BullMQ runtime) is
+ * kept as a LINK so the scheduling side stays navigable. Every non-span context
+ * value (baggage, suppression flags) is preserved. Null for a missing or
+ * invalid traceparent: the caller then starts an ordinary child of the active
+ * context.
+ */
+export declare function remoteParentContext(traceparent: unknown): {
+    context: Context;
+    links: Link[];
+} | null;
+/**
+ * Links the active span to a stored enqueue traceparent. For work that is
+ * already inside its execution span (a BullMQ `bullmq.execute`) and only learns
+ * the enqueuing request once it has loaded its own row: a link joins the two
+ * traces without a second per-job span. Returns whether a link was added.
+ */
+export declare function linkActiveSpanToTraceparent(traceparent: unknown): boolean;

package/node_modules/@oxygen/shared/dist/trace-context.js

@@ -0,0 +1,88 @@
+import { context, isSpanContextValid, trace, } from "@opentelemetry/api";
+/**
+ * W3C Trace Context carried across the durable enqueue boundary.
+ *
+ * A web request that enqueues work (a table-action run, a BullMQ execution) and
+ * the worker that later executes it run in different processes, minutes apart,
+ * with Postgres in between. Nothing propagated the OTel context across that gap,
+ * so a provider call made by the worker lived in a worker trace that could not
+ * be joined to the request that paid for it. The enqueuing request stores a
+ * `traceparent` string next to its correlation `trace_id`; the worker parents
+ * its job span on it (see `withTelemetrySpan`'s `traceparent` option).
+ *
+ * The value is built from and parsed into a span context directly rather than
+ * through the globally registered propagator: the propagator is whatever the
+ * host SDK installed (or a no-op in tests and in a process without telemetry),
+ * and a stored value must mean the same thing on every reader.
+ */
+// Version 00 only: a later version may append fields this reader cannot judge.
+// Lowercase hex per the spec; all-zero trace/parent ids are explicitly invalid.
+const TRACEPARENT_PATTERN = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
+/** Parses a W3C `traceparent`; anything malformed or all-zero yields null. */
+export function parseTraceparent(value) {
+    if (typeof value !== "string")
+        return null;
+    const match = TRACEPARENT_PATTERN.exec(value);
+    if (!match)
+        return null;
+    const spanContext = {
+        traceId: match[1],
+        spanId: match[2],
+        traceFlags: Number.parseInt(match[3], 16),
+        isRemote: true,
+    };
+    return isSpanContextValid(spanContext) ? spanContext : null;
+}
+/** The validated traceparent, or undefined — for optional fields that must drop bad input. */
+export function validTraceparent(value) {
+    return parseTraceparent(value) ? value : undefined;
+}
+export function formatTraceparent(spanContext) {
+    if (!spanContext || !isSpanContextValid(spanContext))
+        return null;
+    const flags = (spanContext.traceFlags & 0xff).toString(16).padStart(2, "0");
+    return `00-${spanContext.traceId}-${spanContext.spanId}-${flags}`;
+}
+/** The `traceparent` of the currently active span, or null outside any span. */
+export function activeTraceparent() {
+    return formatTraceparent(trace.getActiveSpan()?.spanContext());
+}
+/**
+ * The parent context for a span that continues a stored traceparent.
+ *
+ * The remote span becomes the PARENT, so request -> job -> provider.* reads as
+ * one trace; whatever span was active (a worker cycle, the BullMQ runtime) is
+ * kept as a LINK so the scheduling side stays navigable. Every non-span context
+ * value (baggage, suppression flags) is preserved. Null for a missing or
+ * invalid traceparent: the caller then starts an ordinary child of the active
+ * context.
+ */
+export function remoteParentContext(traceparent) {
+    const remote = parseTraceparent(traceparent);
+    if (!remote)
+        return null;
+    const active = context.active();
+    const current = trace.getSpanContext(active);
+    return {
+        context: trace.setSpanContext(active, remote),
+        links: current && isSpanContextValid(current)
+            ? [{ context: current, attributes: { "oxygen.link.kind": "worker.dispatch" } }]
+            : [],
+    };
+}
+/**
+ * Links the active span to a stored enqueue traceparent. For work that is
+ * already inside its execution span (a BullMQ `bullmq.execute`) and only learns
+ * the enqueuing request once it has loaded its own row: a link joins the two
+ * traces without a second per-job span. Returns whether a link was added.
+ */
+export function linkActiveSpanToTraceparent(traceparent) {
+    const remote = parseTraceparent(traceparent);
+    const span = trace.getActiveSpan();
+    if (!remote || !span || !isSpanContextValid(span.spanContext()))
+        return false;
+    if (span.spanContext().traceId === remote.traceId)
+        return false;
+    span.addLink({ context: remote, attributes: { "oxygen.link.kind": "enqueue" } });
+    return true;
+}

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1010.644";
+export declare const OXYGEN_BUILD_VERSION = "1.1010.721";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1010.644";
+export const OXYGEN_BUILD_VERSION = "1.1010.721";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1010.644",
+  "version": "1.1010.721",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",

package/node_modules/@oxygen/shared/dist/email-warmup-readiness.d.ts

@@ -1,64 +0,0 @@
-/**
- * PURE warm-up readiness rule: what daily cold volume a sending mailbox can
- * actually carry, given its warm-up age rather than a provider's opinion of it.
- *
- * WHY it lives in @oxygen/shared and not next to the other email-health rules in
- * @oxygen/integrations: the tenant rollup computes this per mailbox, and
- * @oxygen/tenant-db must never import @oxygen/integrations (integrations depends
- * on tenant-db). Duplicating the thresholds so each package could own a copy is
- * exactly how two surfaces start recommending different numbers, so the rule is
- * defined once here and re-exported from
- * packages/integrations/src/email-health/health-state.ts, which stays the
- * email-health surface every caller reads.
- *
- * DIRECTIONAL, like everything else in the deliverability cluster: it produces a
- * recommendation and a launch-preview warning. It never clamps a cap, never
- * pauses a mailbox, and never changes what a sequence sends.
- */
-/** Below this warm-up day a mailbox should carry only the starter cold volume. */
-export declare const WARMUP_EARLY_DAY_LIMIT = 14;
-/** Below this warm-up day a mailbox should stay at the reduced cold volume. */
-export declare const WARMUP_ESTABLISHED_DAY_LIMIT = 28;
-/** Recommended cold sends/day before day 14 (and for an un-warmed young mailbox). */
-export declare const WARMUP_EARLY_DAILY_CAP = 5;
-/** Recommended cold sends/day between day 14 and day 28. */
-export declare const WARMUP_ESTABLISHED_DAILY_CAP = 10;
-/** A warm-up health score under this is treated as "not ready for volume". */
-export declare const WARMUP_HEALTH_SCORE_FLOOR = 60;
-/** Hard-bounce rate above which a fleet is burning its domains, not just its list. */
-export declare const HARD_BOUNCE_RATE_CEILING = 0.03;
-/** Below this send volume a bounce rate is noise, not a signal. */
-export declare const HARD_BOUNCE_RATE_MIN_SENDS = 20;
-/**
- * The DIRECTIONAL per-mailbox daily cold-send ceiling warm-up readiness supports,
- * or null when nothing in the evidence argues for holding volume back.
- *
- * Pure — the caller resolves `mailboxAgeDays` from created_at, so this stays
- * clock-free and identical on every surface.
- *
- *   - warm-up day < 14                                    -> 5/day
- *   - mailbox younger than 28 days, with either no active
- *     warm-up or no warm-up day reported at all           -> 5/day
- *   - warm-up day < 28                                    -> 10/day
- *   - warm-up health score < 60                           -> at most 5/day
- *   - otherwise                                           -> null (no advice)
- *
- * The second rule is the one that matters for a freshly provisioned fleet: a
- * mailbox whose warm-up never started (state "unknown") reports no day at all,
- * and a rule keyed only on the day number would have said nothing about the exact
- * mailboxes most likely to get blocked.
- */
-export declare function recommendedDailyCapForWarmup(input: {
-    warmupState?: string | null;
-    warmupDay?: number | null;
-    warmupHealthScore?: number | null;
-    mailboxAgeDays?: number | null;
-}): number | null;
-/**
- * True when a hard-bounce count is high enough, over enough sends, to be a real
- * reputation problem rather than list noise.
- */
-export declare function hardBounceRateIsHigh(input: {
-    hardBounces: number;
-    coldSends: number;
-}): boolean;

package/node_modules/@oxygen/shared/dist/email-warmup-readiness.js

@@ -1,90 +0,0 @@
-/**
- * PURE warm-up readiness rule: what daily cold volume a sending mailbox can
- * actually carry, given its warm-up age rather than a provider's opinion of it.
- *
- * WHY it lives in @oxygen/shared and not next to the other email-health rules in
- * @oxygen/integrations: the tenant rollup computes this per mailbox, and
- * @oxygen/tenant-db must never import @oxygen/integrations (integrations depends
- * on tenant-db). Duplicating the thresholds so each package could own a copy is
- * exactly how two surfaces start recommending different numbers, so the rule is
- * defined once here and re-exported from
- * packages/integrations/src/email-health/health-state.ts, which stays the
- * email-health surface every caller reads.
- *
- * DIRECTIONAL, like everything else in the deliverability cluster: it produces a
- * recommendation and a launch-preview warning. It never clamps a cap, never
- * pauses a mailbox, and never changes what a sequence sends.
- */
-/** Below this warm-up day a mailbox should carry only the starter cold volume. */
-export const WARMUP_EARLY_DAY_LIMIT = 14;
-/** Below this warm-up day a mailbox should stay at the reduced cold volume. */
-export const WARMUP_ESTABLISHED_DAY_LIMIT = 28;
-/** Recommended cold sends/day before day 14 (and for an un-warmed young mailbox). */
-export const WARMUP_EARLY_DAILY_CAP = 5;
-/** Recommended cold sends/day between day 14 and day 28. */
-export const WARMUP_ESTABLISHED_DAILY_CAP = 10;
-/** A warm-up health score under this is treated as "not ready for volume". */
-export const WARMUP_HEALTH_SCORE_FLOOR = 60;
-/** Hard-bounce rate above which a fleet is burning its domains, not just its list. */
-export const HARD_BOUNCE_RATE_CEILING = 0.03;
-/** Below this send volume a bounce rate is noise, not a signal. */
-export const HARD_BOUNCE_RATE_MIN_SENDS = 20;
-/** Warm-up states in which a vendor is actively conditioning the mailbox. */
-const ACTIVE_WARMUP_STATES = new Set(["warming", "active"]);
-function finiteOrNull(value) {
-    return typeof value === "number" && Number.isFinite(value) ? value : null;
-}
-/**
- * The DIRECTIONAL per-mailbox daily cold-send ceiling warm-up readiness supports,
- * or null when nothing in the evidence argues for holding volume back.
- *
- * Pure — the caller resolves `mailboxAgeDays` from created_at, so this stays
- * clock-free and identical on every surface.
- *
- *   - warm-up day < 14                                    -> 5/day
- *   - mailbox younger than 28 days, with either no active
- *     warm-up or no warm-up day reported at all           -> 5/day
- *   - warm-up day < 28                                    -> 10/day
- *   - warm-up health score < 60                           -> at most 5/day
- *   - otherwise                                           -> null (no advice)
- *
- * The second rule is the one that matters for a freshly provisioned fleet: a
- * mailbox whose warm-up never started (state "unknown") reports no day at all,
- * and a rule keyed only on the day number would have said nothing about the exact
- * mailboxes most likely to get blocked.
- */
-export function recommendedDailyCapForWarmup(input) {
-    const day = finiteOrNull(input.warmupDay);
-    const ageDays = finiteOrNull(input.mailboxAgeDays);
-    const healthScore = finiteOrNull(input.warmupHealthScore);
-    const warmingNow = ACTIVE_WARMUP_STATES.has((input.warmupState ?? "").trim().toLowerCase());
-    let cap = null;
-    if (day !== null && day < WARMUP_EARLY_DAY_LIMIT) {
-        cap = WARMUP_EARLY_DAILY_CAP;
-    }
-    else if (ageDays !== null &&
-        ageDays < WARMUP_ESTABLISHED_DAY_LIMIT &&
-        (day === null || !warmingNow)) {
-        // A rail that reports "warming" but no day number proves nothing about how
-        // far the ramp got, so age still governs. Gating this on !warmingNow alone
-        // left exactly that mailbox — enrolled, young, no telemetry — with no advice.
-        cap = WARMUP_EARLY_DAILY_CAP;
-    }
-    else if (day !== null && day < WARMUP_ESTABLISHED_DAY_LIMIT) {
-        cap = WARMUP_ESTABLISHED_DAILY_CAP;
-    }
-    if (healthScore !== null && healthScore < WARMUP_HEALTH_SCORE_FLOOR) {
-        cap = cap === null ? WARMUP_EARLY_DAILY_CAP : Math.min(cap, WARMUP_EARLY_DAILY_CAP);
-    }
-    return cap;
-}
-/**
- * True when a hard-bounce count is high enough, over enough sends, to be a real
- * reputation problem rather than list noise.
- */
-export function hardBounceRateIsHigh(input) {
-    if (!Number.isFinite(input.coldSends) || input.coldSends < HARD_BOUNCE_RATE_MIN_SENDS) {
-        return false;
-    }
-    return input.hardBounces / input.coldSends > HARD_BOUNCE_RATE_CEILING;
-}