@oxygen-agent/cli 1.1010.650 → 1.1010.721

package/dist/skills.js

@@ -397,21 +397,36 @@ async function stageAuthenticatedSkills(dir, source, targets, fetchImpl) {
     // installer reads a skill's files from `<root>/<name>/<file>`.
     const skillsRoot = source.index_url.replace(/\/index\.json$/i, "");
     for (const entry of wanted) {
-        // allSettled, not all: on a failed fetch, Promise.all would reject while
-        // sibling fetches are still writing — the caller's finally rmSyncs the temp
-        // dir and a late mkdirSync would silently recreate it as orphan litter.
-        // Waiting for every settle guarantees no write is in flight when we throw.
-        const staged = await Promise.allSettled(entry.files.map(async (file) => {
-            const content = await fetchStagedSkillFile(`${skillsRoot}/${entry.name}/${file}`, fetchImpl);
-            const destination = join(dir, entry.name, ...file.split("/"));
-            mkdirSync(dirname(destination), { recursive: true });
-            writeFileSync(destination, content);
+        // Every worker settles before we throw: on a failed fetch, rejecting early
+        // would leave sibling fetches still writing — the caller's finally rmSyncs the
+        // temp dir and a late mkdirSync would silently recreate it as orphan litter.
+        // Bounded, not one fetch per file: oxygen-gtm alone is ~80 files, and that
+        // burst against the self-hosted production web reset connections, failing
+        // roughly one install in three with a bare "fetch failed" (2026-09-26).
+        let failure;
+        let next = 0;
+        await Promise.all(Array.from({ length: Math.min(entry.files.length, STAGED_FILE_CONCURRENCY) }, async () => {
+            while (failure === undefined && next < entry.files.length) {
+                const file = entry.files[next++];
+                try {
+                    const content = await fetchStagedSkillFile(`${skillsRoot}/${entry.name}/${file}`, fetchImpl);
+                    const destination = join(dir, entry.name, ...file.split("/"));
+                    mkdirSync(dirname(destination), { recursive: true });
+                    writeFileSync(destination, content);
+                }
+                catch (error) {
+                    failure ??= error;
+                }
+            }
         }));
-        const failed = staged.find((result) => result.status === "rejected");
-        if (failed)
-            throw failed.reason;
+        if (failure !== undefined)
+            throw failure;
     }
 }
+const STAGED_FILE_CONCURRENCY = 6;
+const STAGED_FILE_TIMEOUT_MS = 30_000;
+/** Backoff before each retry of a transient failure; its length is the retry budget. */
+const STAGED_FILE_RETRY_DELAYS_MS = [250, 1_000];
 async function fetchStagedSkillEntries(indexUrl, fetchImpl) {
     let response;
     try {
@@ -444,18 +459,29 @@ async function fetchStagedSkillEntries(indexUrl, fetchImpl) {
     }
     return entries;
 }
+/** A transport failure, a timeout, 429 or 5xx is retried; any other status is final. */
 async function fetchStagedSkillFile(url, fetchImpl) {
-    let response;
-    try {
-        response = await fetchImpl(url);
-    }
-    catch (error) {
-        throw stagingFailure("fetch_file", { url, message: errorMessage(error) });
-    }
-    if (!response.ok) {
-        throw stagingFailure("fetch_file", { url, status: response.status });
+    for (let attempt = 0;; attempt += 1) {
+        let details;
+        try {
+            const response = await fetchImpl(url, { signal: AbortSignal.timeout(STAGED_FILE_TIMEOUT_MS) });
+            if (response.ok)
+                return await response.text();
+            if (response.status !== 429 && response.status < 500) {
+                throw stagingFailure("fetch_file", { url, status: response.status });
+            }
+            details = { url, status: response.status };
+        }
+        catch (error) {
+            if (error instanceof OxygenError)
+                throw error;
+            details = { url, message: errorMessage(error) };
+        }
+        const delay = STAGED_FILE_RETRY_DELAYS_MS[attempt];
+        if (delay === undefined)
+            throw stagingFailure("fetch_file", { ...details, attempts: attempt + 1 });
+        await new Promise((resolve) => setTimeout(resolve, delay));
     }
-    return response.text();
 }
 // Mirror the installer-failure error so a staging failure surfaces identically
 // (code, message, exitCode) to the caller — never as a silent URL fallback.

package/node_modules/@oxygen/shared/dist/billing-anchors.d.ts

@@ -45,8 +45,10 @@ export declare function occurrencesInPeriod(from: Date, to: Date, anchorDay: num
  * The block is a STANDING one-month-per-resource reserve (see
  * credit-commitments.ts): because every anchor is at most one month out, holding
  * one month per active resource always covers every fixed charge falling due
- * inside any coming subscription period of <= 1 month. Longer periods (annual
- * plans) need proportionally more held, or the block runs dry mid-term.
+ * inside any coming subscription period of <= 1 month. Longer periods need
+ * proportionally more held, or the block runs dry mid-term. A yearly plan is
+ * not such a period: it grants monthly slices, so its caller passes the current
+ * slice's length (see recomputeOrgCommitmentBlock, P-23).
  *
  * Returns at least 1 — a missing/zero/garbage period length must never collapse
  * the block to nothing, which would silently disable the whole feature.
@@ -58,3 +60,32 @@ export declare function blockPeriodsForSubscription(periodDays: number | null |
  * the millisecond math (and get it wrong across DST by using local dates).
  */
 export declare function periodLengthDays(start: Date | null | undefined, end: Date | null | undefined): number | null;
+/** Longest period that is still ONE monthly grant (matches the allowance-bar guard). */
+export declare const SINGLE_GRANT_PERIOD_MAX_DAYS = 35;
+export type SubscriptionGrantSlice = {
+    /** 0 for the slice the paid invoice starts; the grant key of slice 0 is the period key. */
+    index: number;
+    start: Date;
+    /** Exclusive. The last slice always ends exactly at the period end. */
+    end: Date;
+};
+/**
+ * The monthly grant slices of one paid subscription period.
+ *
+ * A period of at most {@link SINGLE_GRANT_PERIOD_MAX_DAYS} days is a single
+ * slice covering the whole period, which is exactly today's monthly grant. A
+ * longer period is cut on its start's anchor day. The slice count is bounded by
+ * the period's length in average months (12 for a year, including leap years
+ * and clamped anchors), and the last slice absorbs any remainder, so a period
+ * end whose time of day differs from its start by seconds can never produce a
+ * thirteenth sliver.
+ */
+export declare function subscriptionGrantSlices(periodStart: Date, periodEnd: Date): SubscriptionGrantSlice[];
+/**
+ * The slices of a period that have started by `now`, in order. Nothing after the
+ * period end is ever due: a subscription set to cancel at period end, or a row
+ * whose renewal webhook has not arrived yet, stops at its last paid slice.
+ */
+export declare function dueSubscriptionGrantSlices(periodStart: Date, periodEnd: Date, now: Date): SubscriptionGrantSlice[];
+/** The slice `now` falls in, or null outside the period. */
+export declare function currentSubscriptionGrantSlice(periodStart: Date, periodEnd: Date, now: Date): SubscriptionGrantSlice | null;

package/node_modules/@oxygen/shared/dist/billing-anchors.js

@@ -108,8 +108,10 @@ export function occurrencesInPeriod(from, to, anchorDay) {
  * The block is a STANDING one-month-per-resource reserve (see
  * credit-commitments.ts): because every anchor is at most one month out, holding
  * one month per active resource always covers every fixed charge falling due
- * inside any coming subscription period of <= 1 month. Longer periods (annual
- * plans) need proportionally more held, or the block runs dry mid-term.
+ * inside any coming subscription period of <= 1 month. Longer periods need
+ * proportionally more held, or the block runs dry mid-term. A yearly plan is
+ * not such a period: it grants monthly slices, so its caller passes the current
+ * slice's length (see recomputeOrgCommitmentBlock, P-23).
  *
  * Returns at least 1 — a missing/zero/garbage period length must never collapse
  * the block to nothing, which would silently disable the whole feature.
@@ -133,3 +135,66 @@ export function periodLengthDays(start, end) {
         return null;
     return Math.floor(ms / DAY_MS);
 }
+// ---------------------------------------------------------------------------
+// Monthly credit slices of a longer (annual) subscription period
+// ---------------------------------------------------------------------------
+//
+// Repricing 2026-09, decision 1.2: every plan size can be paid annually, and the
+// credits are STILL granted monthly. One paid annual period therefore funds a
+// sequence of monthly grant slices. P-8 (PROPOSED default) anchors the slices to
+// the subscription period start, walked with the same immutable-anchor clamp as
+// the commitment anchors above: a period starting 31 Jan slices at 28 Feb,
+// 31 Mar, 30 Apr ... and never decays to the 28th.
+/** Average Gregorian month length in days: 365.2425 / 12. */
+const AVERAGE_MONTH_DAYS = 365.2425 / 12;
+/** Longest period that is still ONE monthly grant (matches the allowance-bar guard). */
+export const SINGLE_GRANT_PERIOD_MAX_DAYS = 35;
+/**
+ * The monthly grant slices of one paid subscription period.
+ *
+ * A period of at most {@link SINGLE_GRANT_PERIOD_MAX_DAYS} days is a single
+ * slice covering the whole period, which is exactly today's monthly grant. A
+ * longer period is cut on its start's anchor day. The slice count is bounded by
+ * the period's length in average months (12 for a year, including leap years
+ * and clamped anchors), and the last slice absorbs any remainder, so a period
+ * end whose time of day differs from its start by seconds can never produce a
+ * thirteenth sliver.
+ */
+export function subscriptionGrantSlices(periodStart, periodEnd) {
+    if (!(periodStart instanceof Date) || !(periodEnd instanceof Date))
+        return [];
+    if (Number.isNaN(periodStart.getTime()) || Number.isNaN(periodEnd.getTime()))
+        return [];
+    if (periodEnd <= periodStart)
+        return [];
+    const periodDays = (periodEnd.getTime() - periodStart.getTime()) / DAY_MS;
+    if (periodDays <= SINGLE_GRANT_PERIOD_MAX_DAYS) {
+        return [{ index: 0, start: periodStart, end: periodEnd }];
+    }
+    const maxSlices = Math.max(1, Math.round(periodDays / AVERAGE_MONTH_DAYS));
+    const anchorDay = anchorDayOf(periodStart);
+    const slices = [];
+    let cursor = periodStart;
+    for (let index = 0; index < maxSlices; index += 1) {
+        const next = nextAnchorDueAt(cursor, anchorDay);
+        if (index === maxSlices - 1 || next >= periodEnd) {
+            slices.push({ index, start: cursor, end: periodEnd });
+            break;
+        }
+        slices.push({ index, start: cursor, end: next });
+        cursor = next;
+    }
+    return slices;
+}
+/**
+ * The slices of a period that have started by `now`, in order. Nothing after the
+ * period end is ever due: a subscription set to cancel at period end, or a row
+ * whose renewal webhook has not arrived yet, stops at its last paid slice.
+ */
+export function dueSubscriptionGrantSlices(periodStart, periodEnd, now) {
+    return subscriptionGrantSlices(periodStart, periodEnd).filter((slice) => slice.start.getTime() <= now.getTime());
+}
+/** The slice `now` falls in, or null outside the period. */
+export function currentSubscriptionGrantSlice(periodStart, periodEnd, now) {
+    return (subscriptionGrantSlices(periodStart, periodEnd).find((slice) => slice.start.getTime() <= now.getTime() && now.getTime() < slice.end.getTime()) ?? null);
+}

package/node_modules/@oxygen/shared/dist/billing.d.ts

@@ -60,8 +60,8 @@ export declare const CREDIT_TOPUP_DEFAULT_CREDITS = 2000;
 export declare function isValidCreditTopupCredits(credits: number): boolean;
 /**
  * A shortfall expressed as an amount `oxygen billing topup` will actually SELL:
- * rounded up onto the 1,000-credit step and clamped into the purchasable
- * [8,000 .. 1,000,000] band. A next_action (or an alert email) naming a number the
+ * rounded up onto CREDIT_TOPUP_STEP_CREDITS (100) and clamped into the purchasable
+ * [CREDIT_TOPUP_MIN_CREDITS .. CREDIT_TOPUP_MAX_CREDITS] band (800 .. 100,000). A next_action (or an alert email) naming a number the
  * top-up route refuses with `invalid_topup_amount` is not a next action, it is a
  * second dead end during the incident it exists to end.
  *
@@ -76,15 +76,41 @@ export declare function isValidCreditTopupCredits(credits: number): boolean;
  */
 export declare function creditTopupAmountForShortfall(credits: number): number;
 export declare function creditTopupUsdCents(credits: number): number | null;
+/**
+ * Price of a custom top-up at an explicit rate. A checkout session records the
+ * rate it was quoted at (`CREDIT_TOPUP_RATE_METADATA_KEY`), and fulfillment
+ * re-prices it at THAT rate, never the rate in force when Stripe confirms the
+ * payment: a session opened before a rate change and paid after it must still
+ * be credited.
+ */
+export declare function creditTopupUsdCentsAtRate(credits: number, usdCentsPer100: number): number | null;
+/** Checkout-session metadata key carrying the rate a top-up was quoted at. */
+export declare const CREDIT_TOPUP_RATE_METADATA_KEY = "usd_cents_per_100";
+/**
+ * Every top-up rate (US cents per 100 credits) a checkout has ever been minted
+ * at. Append when the rate changes; never remove one, because an unpaid session
+ * quoted at it can still be paid. The first entry is also the rate of sessions
+ * created before the rate was written into their metadata.
+ */
+export declare const CREDIT_TOPUP_SOLD_USD_CENTS_PER_100: readonly [125];
+export declare const CREDIT_TOPUP_LEGACY_USD_CENTS_PER_100: number;
+/**
+ * Whether fulfillment may price a session at `usdCentsPer100`: a rate OXYGEN has
+ * sold at, or the rate in force now. Anything else is metadata no OXYGEN server
+ * wrote, and it is refused rather than credited at a cheaper rate.
+ */
+export declare function isAcceptedCreditTopupRate(usdCentsPer100: number, currentUsdCentsPer100?: number): boolean;
 export declare const AUTOMATION_ACTION_CREDITS = 0.001;
 /** Kinds of resource that carry a fixed monthly credit commitment. */
-export declare const CREDIT_COMMITMENT_KINDS: readonly ["sending_mailbox", "managed_mailbox", "mailbox_warmup", "deliverability_unit", "linkedin_account", "whatsapp_account"];
+export declare const CREDIT_COMMITMENT_KINDS: readonly ["sending_mailbox", "managed_mailbox", "mailbox_warmup", "deliverability_unit", "linkedin_account", "whatsapp_account", "x_account", "phone_number"];
 export type CreditCommitmentKind = (typeof CREDIT_COMMITMENT_KINDS)[number];
 /**
  * Sequencer platform fee per CONNECTED SENDING MAILBOX per month, in credits
  * ($1.00). Charged on EVERY mailbox wired to the sequencer — BYOK/self-connected
  * Gmail and Microsoft inboxes included — and it STACKS on Oxygen-sold mailboxes,
- * which additionally pay their own mailbox/warmup/placement lines.
+ * which additionally pay their own mailbox/warmup/placement lines. Read from the
+ * pricing seed (`commitment.sending_mailbox`) through the generated snapshot, so
+ * there is one definition of the price.
  */
 export declare const SENDING_MAILBOX_MONTHLY_CREDITS = 100;
 /**
@@ -93,12 +119,12 @@ export declare const SENDING_MAILBOX_MONTHLY_CREDITS = 100;
  */
 export declare const MANAGED_MAILBOX_MONTHLY_CREDITS = 300;
 /**
- * Grace window after a commitment goes past_due before the owning subsystem may
- * suspend the resource. Notify -> pause -> lapse; never auto-cancel. Aligned with
- * the subscription entitlement grace so a customer never hits two different
- * clocks for the same missed payment.
+ * Grace window after a commitment goes past_due before the account disconnects.
+ * Repricing 2026-09 decision 2.8: sending from the account pauses at once, and
+ * after 7 days without funds the account disconnects (replacing the earlier 14
+ * days with no auto-cancel). The pause and the disconnect sweep are slice S23.
  */
-export declare const COMMITMENT_PAST_DUE_GRACE_DAYS = 14;
+export declare const COMMITMENT_PAST_DUE_GRACE_DAYS = 7;
 /**
  * Reconnect window in which an ENDED commitment resumes instead of starting a new
  * one. The single most important anti-double-charge rule: a Unipile re-auth, a
@@ -361,6 +387,13 @@ export declare function getCurrentBillingCycleKey(date?: Date): string;
  * billing-anchor shift without admitting a quarterly or annual period.
  */
 export declare const CREDIT_CYCLE_MAX_PERIOD_DAYS = 35;
+/**
+ * Annual billing (Repricing 2026-09, decision 1.2): a year costs ten months of
+ * the monthly price, and the credits are still granted monthly.
+ */
+export declare const ANNUAL_BILLING_MONTHS_CHARGED = 10;
+/** The yearly price of a rung, in cents: ten times its monthly price. */
+export declare function annualPlanPriceCents(monthlyPriceCents: number): number;
 export type CreditCycleSource = "subscription_period" | "calendar_month";
 export type CreditCycleWindow = {
     start: Date;
@@ -389,6 +422,21 @@ export declare function isStripeManagedSubscription(subscription: {
     stripeSubscriptionId?: string | null;
     metadata?: Record<string, unknown> | null;
 }): boolean;
+/**
+ * Whether a Stripe subscription is scheduled to end. A classic-billing-mode
+ * period-end cancel sets `cancel_at_period_end`; a Billing Portal cancel on a
+ * flexible-billing-mode subscription sets only `cancel_at` (to the period end)
+ * and leaves `cancel_at_period_end` false (Stripe billing-mode comparison docs;
+ * reproduced in test mode 2026-09-26). Reading the boolean alone showed a
+ * Portal-cancelled plan as renewing. `cancel_at` on a subscription that has
+ * already ended records when it ended, not a pending cancellation, so it only
+ * counts while the subscription is still live.
+ */
+export declare function stripeSubscriptionCancellationScheduled(subscription: {
+    status: string;
+    cancel_at_period_end?: boolean | null;
+    cancel_at?: number | null;
+}): boolean;
 /**
  * The window the credit-allowance bar measures: "this month's credits", resolved
  * to the boundary at which the plan's grant actually renews.
@@ -412,6 +460,12 @@ export declare function resolveCreditCycleWindow(input: {
         currentPeriodEnd: Date | null;
         /** isOffStripeSubscription(subscription.metadata) — resolved by the caller. */
         offStripe: boolean;
+        /**
+         * planBillingIntervalForPriceId(subscription.stripePriceId). A yearly
+         * period grants its credits in monthly slices, so the cycle the bar measures
+         * is the current slice, anchored to the period start (P-8).
+         */
+        billingInterval?: "month" | "year" | null;
     } | null;
     now?: Date;
 }): CreditCycleWindow;

package/node_modules/@oxygen/shared/dist/billing.js

@@ -1,4 +1,5 @@
-import { AUTOMATION_ACTION_CREDITS as SNAPSHOT_AUTOMATION_ACTION_CREDITS, CREDITS_PER_USD as SNAPSHOT_CREDITS_PER_USD, PRICING_PLAN_SNAPSHOT, TOPUP_USD_CENTS_PER_100_CREDITS as SNAPSHOT_TOPUP_USD_CENTS_PER_100_CREDITS, } from "./pricing-snapshot.generated.js";
+import { AUTOMATION_ACTION_CREDITS as SNAPSHOT_AUTOMATION_ACTION_CREDITS, CREDITS_PER_USD as SNAPSHOT_CREDITS_PER_USD, PRICING_PLAN_SNAPSHOT, SENDING_MAILBOX_CREDITS_PER_MONTH as SNAPSHOT_SENDING_MAILBOX_CREDITS_PER_MONTH, TOPUP_USD_CENTS_PER_100_CREDITS as SNAPSHOT_TOPUP_USD_CENTS_PER_100_CREDITS, } from "./pricing-snapshot.generated.js";
+import { currentSubscriptionGrantSlice } from "./billing-anchors.js";
 import { freeTierEntitlementEnabled } from "./plan-capabilities.js";
 import { asRecordOrNull } from "./type-guards.js";
 export const WEEKLY_USAGE_WINDOW_DAYS = 7;
@@ -65,8 +66,8 @@ export function isValidCreditTopupCredits(credits) {
 }
 /**
  * A shortfall expressed as an amount `oxygen billing topup` will actually SELL:
- * rounded up onto the 1,000-credit step and clamped into the purchasable
- * [8,000 .. 1,000,000] band. A next_action (or an alert email) naming a number the
+ * rounded up onto CREDIT_TOPUP_STEP_CREDITS (100) and clamped into the purchasable
+ * [CREDIT_TOPUP_MIN_CREDITS .. CREDIT_TOPUP_MAX_CREDITS] band (800 .. 100,000). A next_action (or an alert email) naming a number the
  * top-up route refuses with `invalid_topup_amount` is not a next action, it is a
  * second dead end during the incident it exists to end.
  *
@@ -84,9 +85,42 @@ export function creditTopupAmountForShortfall(credits) {
     return Math.min(CREDIT_TOPUP_MAX_CREDITS, Math.max(CREDIT_TOPUP_MIN_CREDITS, stepped));
 }
 export function creditTopupUsdCents(credits) {
+    return creditTopupUsdCentsAtRate(credits, TOPUP_USD_CENTS_PER_100_CREDITS);
+}
+/**
+ * Price of a custom top-up at an explicit rate. A checkout session records the
+ * rate it was quoted at (`CREDIT_TOPUP_RATE_METADATA_KEY`), and fulfillment
+ * re-prices it at THAT rate, never the rate in force when Stripe confirms the
+ * payment: a session opened before a rate change and paid after it must still
+ * be credited.
+ */
+export function creditTopupUsdCentsAtRate(credits, usdCentsPer100) {
     if (!isValidCreditTopupCredits(credits))
         return null;
-    return (credits / 100) * TOPUP_USD_CENTS_PER_100_CREDITS;
+    if (!Number.isInteger(usdCentsPer100) || usdCentsPer100 <= 0)
+        return null;
+    return (credits / 100) * usdCentsPer100;
+}
+/** Checkout-session metadata key carrying the rate a top-up was quoted at. */
+export const CREDIT_TOPUP_RATE_METADATA_KEY = "usd_cents_per_100";
+/**
+ * Every top-up rate (US cents per 100 credits) a checkout has ever been minted
+ * at. Append when the rate changes; never remove one, because an unpaid session
+ * quoted at it can still be paid. The first entry is also the rate of sessions
+ * created before the rate was written into their metadata.
+ */
+export const CREDIT_TOPUP_SOLD_USD_CENTS_PER_100 = [125];
+export const CREDIT_TOPUP_LEGACY_USD_CENTS_PER_100 = CREDIT_TOPUP_SOLD_USD_CENTS_PER_100[0];
+/**
+ * Whether fulfillment may price a session at `usdCentsPer100`: a rate OXYGEN has
+ * sold at, or the rate in force now. Anything else is metadata no OXYGEN server
+ * wrote, and it is refused rather than credited at a cheaper rate.
+ */
+export function isAcceptedCreditTopupRate(usdCentsPer100, currentUsdCentsPer100 = TOPUP_USD_CENTS_PER_100_CREDITS) {
+    if (!Number.isInteger(usdCentsPer100) || usdCentsPer100 <= 0)
+        return false;
+    return usdCentsPer100 === currentUsdCentsPer100
+        || CREDIT_TOPUP_SOLD_USD_CENTS_PER_100.includes(usdCentsPer100);
 }
 // Workflow/automation actions (steps, tool calls, row writes, retries) draw
 // from the same credit pool at a flat capacity-guard rate — the old separate
@@ -122,26 +156,33 @@ export const CREDIT_COMMITMENT_KINDS = [
     "deliverability_unit",
     "linkedin_account",
     "whatsapp_account",
+    // Repricing 2026-09 (S20, decisions 2.2 and 2.4). Priced in the pricing seed
+    // (seat.x_account, seat.phone_number) and reserve nothing until the
+    // repricing's effective-date switch.
+    "x_account",
+    "phone_number",
 ];
 /**
  * Sequencer platform fee per CONNECTED SENDING MAILBOX per month, in credits
  * ($1.00). Charged on EVERY mailbox wired to the sequencer — BYOK/self-connected
  * Gmail and Microsoft inboxes included — and it STACKS on Oxygen-sold mailboxes,
- * which additionally pay their own mailbox/warmup/placement lines.
+ * which additionally pay their own mailbox/warmup/placement lines. Read from the
+ * pricing seed (`commitment.sending_mailbox`) through the generated snapshot, so
+ * there is one definition of the price.
  */
-export const SENDING_MAILBOX_MONTHLY_CREDITS = 100;
+export const SENDING_MAILBOX_MONTHLY_CREDITS = SNAPSHOT_SENDING_MAILBOX_CREDITS_PER_MONTH;
 /**
  * Oxygen-sold managed mailbox per month, in credits ($3.00). Flat, superseding
  * the dynamic vendor-COGS x 1.25 quote for the recurring mailbox line.
  */
 export const MANAGED_MAILBOX_MONTHLY_CREDITS = 300;
 /**
- * Grace window after a commitment goes past_due before the owning subsystem may
- * suspend the resource. Notify -> pause -> lapse; never auto-cancel. Aligned with
- * the subscription entitlement grace so a customer never hits two different
- * clocks for the same missed payment.
+ * Grace window after a commitment goes past_due before the account disconnects.
+ * Repricing 2026-09 decision 2.8: sending from the account pauses at once, and
+ * after 7 days without funds the account disconnects (replacing the earlier 14
+ * days with no auto-cancel). The pause and the disconnect sweep are slice S23.
  */
-export const COMMITMENT_PAST_DUE_GRACE_DAYS = 14;
+export const COMMITMENT_PAST_DUE_GRACE_DAYS = 7;
 /**
  * Reconnect window in which an ENDED commitment resumes instead of starting a new
  * one. The single most important anti-double-charge rule: a Unipile re-auth, a
@@ -187,11 +228,13 @@ export function ratifiedCommitmentCredits(kind) {
         case "mailbox_warmup":
         case "deliverability_unit":
             return null;
-        // Signed in control-db (LINKEDIN_ACCOUNT_MONTHLY_CREDITS /
-        // WHATSAPP_ACCOUNT_MONTHLY_CREDITS) — control-db cannot import @oxygen/shared,
-        // so the constants live there and the caller passes them.
+        // Connected-account reservations are priced in the pricing seed
+        // (seat.*_account, seat.phone_number) and resolved, through the 2026-09
+        // repricing switch, by commitmentPrice in @oxygen/integrations.
         case "linkedin_account":
         case "whatsapp_account":
+        case "x_account":
+        case "phone_number":
             return null;
     }
 }
@@ -751,6 +794,15 @@ export function getCurrentBillingCycleKey(date = new Date()) {
  * billing-anchor shift without admitting a quarterly or annual period.
  */
 export const CREDIT_CYCLE_MAX_PERIOD_DAYS = 35;
+/**
+ * Annual billing (Repricing 2026-09, decision 1.2): a year costs ten months of
+ * the monthly price, and the credits are still granted monthly.
+ */
+export const ANNUAL_BILLING_MONTHS_CHARGED = 10;
+/** The yearly price of a rung, in cents: ten times its monthly price. */
+export function annualPlanPriceCents(monthlyPriceCents) {
+    return monthlyPriceCents * ANNUAL_BILLING_MONTHS_CHARGED;
+}
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
 function startOfUtcMonth(date) {
     return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1));
@@ -800,6 +852,22 @@ export function isStripeManagedSubscription(subscription) {
         && metadata.off_stripe !== "true"
         && metadata.synthetic !== true);
 }
+/**
+ * Whether a Stripe subscription is scheduled to end. A classic-billing-mode
+ * period-end cancel sets `cancel_at_period_end`; a Billing Portal cancel on a
+ * flexible-billing-mode subscription sets only `cancel_at` (to the period end)
+ * and leaves `cancel_at_period_end` false (Stripe billing-mode comparison docs;
+ * reproduced in test mode 2026-09-26). Reading the boolean alone showed a
+ * Portal-cancelled plan as renewing. `cancel_at` on a subscription that has
+ * already ended records when it ended, not a pending cancellation, so it only
+ * counts while the subscription is still live.
+ */
+export function stripeSubscriptionCancellationScheduled(subscription) {
+    if (subscription.cancel_at_period_end === true)
+        return true;
+    const ended = subscription.status === "canceled" || subscription.status === "incomplete_expired";
+    return !ended && subscription.cancel_at != null;
+}
 /**
  * The window the credit-allowance bar measures: "this month's credits", resolved
  * to the boundary at which the plan's grant actually renews.
@@ -822,6 +890,20 @@ export function resolveCreditCycleWindow(input) {
     const subscription = input.subscription;
     const start = subscription?.currentPeriodStart ?? null;
     const end = subscription?.currentPeriodEnd ?? null;
+    if (subscription?.billingInterval === "year"
+        && !subscription.offStripe
+        && start != null
+        && end != null) {
+        const slice = currentSubscriptionGrantSlice(start, end, now);
+        if (slice) {
+            return {
+                start: slice.start,
+                end: slice.end,
+                source: "subscription_period",
+                label: `${formatUtcDay(slice.start)} – ${formatUtcDay(slice.end)}`,
+            };
+        }
+    }
     const usesPeriod = subscription != null
         && !subscription.offStripe
         && start != null

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -505,7 +505,7 @@ export const OXYGEN_CAPABILITY_ROUTES = [
         gatewayCommands: ["linkedin network setup", "linkedin invitations setup", "senders list", "connections import", "inbox list"],
         skills: ["oxygen-linkedin-marketing", "oxygen-sequencer", "oxygen-unibox"],
         endpointSections: ["linkedin"],
-        intentTerms: ["my linkedin", "our linkedin", "own linkedin", "connected linkedin", "connections", "mutual connections", "shared connections", "connections in common", "followers", "my network", "whole network", "linkedin network", "connections and followers", "profile viewers", "sales navigator", "recruiter", "linkedin inbox"],
+        intentTerms: ["my linkedin", "our linkedin", "own linkedin", "connected linkedin", "connections", "mutual connections", "shared connections", "connections in common", "followers", "my network", "whole network", "linkedin network", "connections and followers", "profile viewers", "sales navigator", "recruiter", "linkedin inbox", "working hours", "sending hours", "linkedin limits"],
     },
     {
         id: "connected-whatsapp",
@@ -974,6 +974,12 @@ function recommendationsFor(card, query) {
             exactCommand: LOCAL_BUSINESS_SCRAPE_COMMAND,
         };
     }
+    if (card.id === "connected-linkedin" && isLinkedInAccountLimitsIntent(query)) {
+        return {
+            tools: ["oxygen_senders_limits_get", "oxygen_senders_limits_set", "oxygen_senders_list"],
+            commands: ["senders limits get", "senders limits set", "senders list"],
+        };
+    }
     if (card.id === "connected-linkedin" && isMutualLinkedInConnectionsIntent(query)) {
         return {
             tools: ["oxygen_tools_get", "oxygen_tools_run_live", "oxygen_senders_list"],
@@ -1322,6 +1328,10 @@ function isSenderProfileIntent(query) {
         || (/\bprofiles?\b.{0,64}\b(?:linkedin|whatsapp|mailboxes?|inboxes?|email)\b/.test(query)
             && /\b(?:sender|sending|unif(?:y|ied))\b/.test(query));
 }
+/** The account's own working hours or daily caps (`senders limits`), not its network. */
+function isLinkedInAccountLimitsIntent(query) {
+    return /\b(working hours|sending hours|business hours|office hours|weekdays?|time ?zone|linkedin limits|daily limits?)\b/.test(query);
+}
 function isMutualLinkedInConnectionsIntent(query) {
     const linkedInContext = /\blinkedin\b|\bprofiles?\b/.test(query);
     const mutualContext = /\b(mutual|shared|in common)\b.{0,48}\b(connections?|relations?)\b/.test(query)