@oxygen-agent/cli 1.1010.650 → 1.1010.905

package/node_modules/@oxygen/shared/dist/plan-limits.js

@@ -1,5 +1,7 @@
 import { resolveBasePricingPlan } from "./billing.js";
+import { OxygenError } from "./cli-result.js";
 import { WORKSPACE_TABLE_CAPACITY } from "./table-capacity.js";
+import { findRepricedValue, repricedValue } from "./repricing.js";
 export const LIMITS_TIER_ORDER = [
     "free",
     "starter",
@@ -11,10 +13,12 @@ const HOUR = 60 * 60;
 const DAY = 24 * HOUR;
 const MIB = 1024 * 1024;
 /**
- * One platform-wide Table import ceiling. A file can fill an empty physical
- * Table exactly to its retained-row capacity on every plan; imports into a
- * non-empty Table remain subject to that Table's remaining capacity and the
- * workspace-wide capacity envelope.
+ * The per-rung Table import ceiling this matrix reports: today's envelope. The
+ * ceiling ENFORCED on an import is the workspace's plan-band rows-per-Table
+ * limit (`resolveWorkspaceTableCapacity`, PROPOSED P-60: a file can fill an
+ * empty Table exactly), which the web import paths resolve per organization.
+ * Imports into a non-empty Table remain subject to that Table's remaining
+ * capacity and the workspace-wide envelope.
  */
 export const TABLE_IMPORT_ROW_LIMIT = WORKSPACE_TABLE_CAPACITY.tableRowLimit;
 // The platform request-body ceiling belongs to the same question as the import
@@ -29,42 +33,77 @@ export { VERCEL_REQUEST_BODY_LIMIT_BYTES } from "./import-limits.js";
  * in the CLI alone — an older server would still 413 at the old number.
  */
 export const MAX_CLI_JSON_BODY_BYTES = 2_000_000;
+/**
+ * Derived plan-scaled limits (repricing 2026-09 decision L6, spec § 4.7):
+ * import file size, columns per action run or standing auto-run and the signals
+ * feed. Each only rises against the pre-repricing ladder, so no paid customer
+ * loses a limit and nothing here waits for the effective-date switch. Rows per
+ * write request stay 5,000 free / 50,000 paid: the 2 MB request body
+ * (`MAX_CLI_JSON_BODY_BYTES`) binds first.
+ *
+ * `importFileBytes` is ratified (decision F.8, Philipp 2026-09-27): free 500 MiB,
+ * $49–$99 1 GiB, $199–$499 2 GiB, $999–$1,999 5 GiB. It is live on every plan
+ * and no longer waits for the per-Table capacity test: rows per Table still cap
+ * what one import can load, so a bigger file never buys more rows. 5 GiB is also
+ * the largest single PUT an S3-compatible store accepts
+ * (`IMPORT_OBJECT_SINGLE_PUT_MAX_BYTES`), which is the one upload a staged
+ * import makes.
+ */
+export const DERIVED_PLAN_LIMIT_TARGETS = {
+    free: { importFileBytes: 500 * MIB, maxActionsPerRun: 10, signals: { maxEvents: 100, maxWindowDays: 30 } },
+    starter: { importFileBytes: 1_024 * MIB, maxActionsPerRun: 25, signals: { maxEvents: 200, maxWindowDays: 90 } },
+    pro: { importFileBytes: 2_048 * MIB, maxActionsPerRun: 25, signals: { maxEvents: 500, maxWindowDays: 180 } },
+    team: { importFileBytes: 5_120 * MIB, maxActionsPerRun: 50, signals: { maxEvents: 1_000, maxWindowDays: 365 } },
+    scale: { importFileBytes: 5_120 * MIB, maxActionsPerRun: 50, signals: { maxEvents: 1_000, maxWindowDays: 365 } },
+};
+/** The import file size a rung enforces (see `DERIVED_PLAN_LIMIT_TARGETS`). */
+export function importMaxFileBytesForTier(tier) {
+    return DERIVED_PLAN_LIMIT_TARGETS[tier].importFileBytes;
+}
 /**
  * The per-rung limit matrix. `ai_live` deliberately equals `tool_live` at every
  * rung — one "live actions" mental model; the per-call cost asymmetry between
  * AI and tool calls is priced in credits, not throttled here.
+ *
+ * API rates follow the 2026-09 repricing (decision L2, ratified 2026-09-26):
+ * `cli.global` is the per-organization and per-key request total per minute,
+ * 1,200 / 3,000 / 6,000 / 12,000 / 30,000 from free to scale. The per-operation
+ * buckets below are PROPOSED (P-52, repricing spec § 4.2): each pre-repricing
+ * bucket multiplied by its rung's organization factor, 2x on free and 5x on
+ * every paid rung, and never above the rung's per-key total. `tenantSchema` and
+ * the flat `tenant_admin` guard in the web rate limiter are DDL abuse guards and
+ * stay unscaled.
  */
 export const PLAN_LIMITS = {
     free: {
         cli: {
-            global: { keyRequestsPerMinute: 120, orgRequestsPerMinute: 600 },
-            tenantRead: { requestsPerMinute: 60, orgUnits: { limit: 500_000, windowSeconds: HOUR } },
-            tenantWrite: { requestsPerMinute: 30, orgUnits: { limit: 100_000, windowSeconds: HOUR } },
-            bulkImport: { requestsPerMinute: 10, orgRequests: { limit: 100, windowSeconds: HOUR } },
-            aiLive: { requestsPerMinute: 20, orgRequests: { limit: 100, windowSeconds: HOUR } },
-            toolLive: { requestsPerMinute: 20, orgRequests: { limit: 100, windowSeconds: HOUR } },
-            toolDryRun: { requestsPerMinute: 60, orgRequests: { limit: 500, windowSeconds: HOUR } },
+            global: { keyRequestsPerMinute: 1_200, orgRequestsPerMinute: 1_200 },
+            tenantRead: { requestsPerMinute: 120, orgUnits: { limit: 1_000_000, windowSeconds: HOUR } },
+            tenantWrite: { requestsPerMinute: 60, orgUnits: { limit: 200_000, windowSeconds: HOUR } },
+            bulkImport: { requestsPerMinute: 20, orgRequests: { limit: 200, windowSeconds: HOUR } },
+            aiLive: { requestsPerMinute: 40, orgRequests: { limit: 200, windowSeconds: HOUR } },
+            toolLive: { requestsPerMinute: 40, orgRequests: { limit: 200, windowSeconds: HOUR } },
+            toolDryRun: { requestsPerMinute: 120, orgRequests: { limit: 1_000, windowSeconds: HOUR } },
             tenantSchema: { requestsPerMinute: 20, orgRequests: { limit: 100, windowSeconds: HOUR } },
             maxWriteRowsPerRequest: 5_000,
         },
         web: {
-            tenantRead: { requestsPerMinute: 120, orgUnits: { limit: 1_000_000, windowSeconds: HOUR } },
-            tenantWrite: { requestsPerMinute: 60, orgUnits: { limit: 500_000, windowSeconds: HOUR } },
-            columnRun: { requestsPerMinute: 30, orgUnits: { limit: 2_000, windowSeconds: HOUR } },
-            import: { requestsPerMinute: 10, orgRequests: { limit: 100, windowSeconds: HOUR } },
+            tenantRead: { requestsPerMinute: 240, orgUnits: { limit: 2_000_000, windowSeconds: HOUR } },
+            tenantWrite: { requestsPerMinute: 120, orgUnits: { limit: 1_000_000, windowSeconds: HOUR } },
+            columnRun: { requestsPerMinute: 60, orgUnits: { limit: 4_000, windowSeconds: HOUR } },
+            import: { requestsPerMinute: 20, orgRequests: { limit: 200, windowSeconds: HOUR } },
         },
         import: {
             maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
-            maxFileBytes: 100 * MIB,
+            maxFileBytes: importMaxFileBytesForTier("free"),
             maxDirectCsvBodyBytes: 10_000_000,
         },
-        // Sized against the free tier's actual funding (OXP-10.2.4, 2026-08-17):
-        // 5,000 credits at signup plus 5,000 on CLI/MCP activation, one time each,
-        // with no monthly allowance to refill them. The previous ceilings were
-        // written when `free` meant a churned org that could spend nothing, so they
-        // were harmless at any value; now a single Agent run capped at 10,000 could
-        // consume the ENTIRE lifetime grant, and one capped at 5,000 could consume
-        // the whole signup grant before the customer saw anything work.
+        // Sized against the free tier's actual funding (OXP-10.2.4, 2026-08-17): one
+        // signup grant of FREE_SIGNUP_GRANT_CREDITS (1,000) with no monthly allowance
+        // to refill it. The previous ceilings were written when `free` meant a
+        // churned org that could spend nothing, so they were harmless at any value;
+        // an Agent run capped at the old 1,000 (today's unit) could consume the
+        // ENTIRE lifetime grant before the customer saw anything work.
         //
         // These are runaway guards, not the billing meter — a workspace that tops up
         // is bounded by its balance, not by these. The intent is only that no single
@@ -75,36 +114,40 @@ export const PLAN_LIMITS = {
             maxUpstreamCostUsd: 10,
             maxUpstreamCostUsdByok: 10,
         },
-        // Left at 5,000/1,500 deliberately. The signup grant is exactly one default
-        // Copilot session, and that is the point: a founder who picks the in-product
-        // path over the CLI must be able to complete one real session on the base
-        // grant alone. Lowering this would re-create the dead-on-arrival Copilot the
-        // split grant exists to prevent.
+        // Left at 500/150 deliberately (5,000/1,500 before the 2026-09-19 unit
+        // change). A founder who picks the in-product path over the CLI must be able
+        // to complete one real Copilot session on the 1,000-credit signup grant
+        // alone. Lowering this would re-create a dead-on-arrival Copilot.
         copilot: { maxSessionBudgetCredits: 500, defaultPerTurnCreditCeiling: 150 },
-        signals: { maxEvents: 100, maxWindowDays: 30 },
-        tableActions: { maxActionsPerRun: 10 },
+        signals: DERIVED_PLAN_LIMIT_TARGETS.free.signals,
+        tableActions: { maxActionsPerRun: DERIVED_PLAN_LIMIT_TARGETS.free.maxActionsPerRun },
+        // Decision L4.2 (ratified 2026-09-26): a free workspace schedules at most
+        // every 15 minutes, paid plans every minute. Dark until the repricing switch
+        // (FREE_CRON_MIN_INTERVAL_REPRICING); a faster schedule already armed is
+        // slowed to this interval at fire time, never deleted (proposal P-47).
+        workflows: { cronMinIntervalMinutes: 15 },
     },
     starter: {
         cli: {
-            global: { keyRequestsPerMinute: 240, orgRequestsPerMinute: 600 },
-            tenantRead: { requestsPerMinute: 120, orgUnits: { limit: 25_000_000, windowSeconds: DAY } },
-            tenantWrite: { requestsPerMinute: 120, orgUnits: { limit: 5_000_000, windowSeconds: DAY } },
-            bulkImport: { requestsPerMinute: 30, orgRequests: { limit: 500, windowSeconds: HOUR } },
-            aiLive: { requestsPerMinute: 60, orgRequests: { limit: 5_000, windowSeconds: HOUR } },
-            toolLive: { requestsPerMinute: 60, orgRequests: { limit: 5_000, windowSeconds: HOUR } },
-            toolDryRun: { requestsPerMinute: 120, orgRequests: { limit: 2_000, windowSeconds: HOUR } },
+            global: { keyRequestsPerMinute: 3_000, orgRequestsPerMinute: 3_000 },
+            tenantRead: { requestsPerMinute: 600, orgUnits: { limit: 125_000_000, windowSeconds: DAY } },
+            tenantWrite: { requestsPerMinute: 600, orgUnits: { limit: 25_000_000, windowSeconds: DAY } },
+            bulkImport: { requestsPerMinute: 150, orgRequests: { limit: 2_500, windowSeconds: HOUR } },
+            aiLive: { requestsPerMinute: 300, orgRequests: { limit: 25_000, windowSeconds: HOUR } },
+            toolLive: { requestsPerMinute: 300, orgRequests: { limit: 25_000, windowSeconds: HOUR } },
+            toolDryRun: { requestsPerMinute: 600, orgRequests: { limit: 10_000, windowSeconds: HOUR } },
             tenantSchema: { requestsPerMinute: 60, orgRequests: { limit: 600, windowSeconds: HOUR } },
             maxWriteRowsPerRequest: 50_000,
         },
         web: {
-            tenantRead: { requestsPerMinute: 300, orgUnits: { limit: 20_000_000, windowSeconds: DAY } },
-            tenantWrite: { requestsPerMinute: 180, orgUnits: { limit: 10_000_000, windowSeconds: DAY } },
-            columnRun: { requestsPerMinute: 120, orgUnits: { limit: 500_000, windowSeconds: DAY } },
-            import: { requestsPerMinute: 30, orgRequests: { limit: 500, windowSeconds: HOUR } },
+            tenantRead: { requestsPerMinute: 1_500, orgUnits: { limit: 100_000_000, windowSeconds: DAY } },
+            tenantWrite: { requestsPerMinute: 900, orgUnits: { limit: 50_000_000, windowSeconds: DAY } },
+            columnRun: { requestsPerMinute: 600, orgUnits: { limit: 2_500_000, windowSeconds: DAY } },
+            import: { requestsPerMinute: 150, orgRequests: { limit: 2_500, windowSeconds: HOUR } },
         },
         import: {
             maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
-            maxFileBytes: 250 * MIB,
+            maxFileBytes: importMaxFileBytesForTier("starter"),
             maxDirectCsvBodyBytes: 10_000_000,
         },
         agents: {
@@ -114,30 +157,31 @@ export const PLAN_LIMITS = {
             maxUpstreamCostUsdByok: 250,
         },
         copilot: { maxSessionBudgetCredits: 500, defaultPerTurnCreditCeiling: 150 },
-        signals: { maxEvents: 200, maxWindowDays: 90 },
-        tableActions: { maxActionsPerRun: 25 },
+        signals: DERIVED_PLAN_LIMIT_TARGETS.starter.signals,
+        tableActions: { maxActionsPerRun: DERIVED_PLAN_LIMIT_TARGETS.starter.maxActionsPerRun },
+        workflows: { cronMinIntervalMinutes: 1 },
     },
     pro: {
         cli: {
-            global: { keyRequestsPerMinute: 240, orgRequestsPerMinute: 1_200 },
-            tenantRead: { requestsPerMinute: 240, orgUnits: { limit: 50_000_000, windowSeconds: DAY } },
-            tenantWrite: { requestsPerMinute: 240, orgUnits: { limit: 10_000_000, windowSeconds: DAY } },
-            bulkImport: { requestsPerMinute: 60, orgRequests: { limit: 1_000, windowSeconds: HOUR } },
-            aiLive: { requestsPerMinute: 120, orgRequests: { limit: 12_000, windowSeconds: HOUR } },
-            toolLive: { requestsPerMinute: 120, orgRequests: { limit: 12_000, windowSeconds: HOUR } },
-            toolDryRun: { requestsPerMinute: 120, orgRequests: { limit: 2_000, windowSeconds: HOUR } },
+            global: { keyRequestsPerMinute: 6_000, orgRequestsPerMinute: 6_000 },
+            tenantRead: { requestsPerMinute: 1_200, orgUnits: { limit: 250_000_000, windowSeconds: DAY } },
+            tenantWrite: { requestsPerMinute: 1_200, orgUnits: { limit: 50_000_000, windowSeconds: DAY } },
+            bulkImport: { requestsPerMinute: 300, orgRequests: { limit: 5_000, windowSeconds: HOUR } },
+            aiLive: { requestsPerMinute: 600, orgRequests: { limit: 60_000, windowSeconds: HOUR } },
+            toolLive: { requestsPerMinute: 600, orgRequests: { limit: 60_000, windowSeconds: HOUR } },
+            toolDryRun: { requestsPerMinute: 600, orgRequests: { limit: 10_000, windowSeconds: HOUR } },
             tenantSchema: { requestsPerMinute: 60, orgRequests: { limit: 600, windowSeconds: HOUR } },
             maxWriteRowsPerRequest: 50_000,
         },
         web: {
-            tenantRead: { requestsPerMinute: 600, orgUnits: { limit: 40_000_000, windowSeconds: DAY } },
-            tenantWrite: { requestsPerMinute: 360, orgUnits: { limit: 20_000_000, windowSeconds: DAY } },
-            columnRun: { requestsPerMinute: 240, orgUnits: { limit: 1_000_000, windowSeconds: DAY } },
-            import: { requestsPerMinute: 60, orgRequests: { limit: 1_000, windowSeconds: HOUR } },
+            tenantRead: { requestsPerMinute: 3_000, orgUnits: { limit: 200_000_000, windowSeconds: DAY } },
+            tenantWrite: { requestsPerMinute: 1_800, orgUnits: { limit: 100_000_000, windowSeconds: DAY } },
+            columnRun: { requestsPerMinute: 1_200, orgUnits: { limit: 5_000_000, windowSeconds: DAY } },
+            import: { requestsPerMinute: 300, orgRequests: { limit: 5_000, windowSeconds: HOUR } },
         },
         import: {
             maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
-            maxFileBytes: 250 * MIB,
+            maxFileBytes: importMaxFileBytesForTier("pro"),
             maxDirectCsvBodyBytes: 10_000_000,
         },
         agents: {
@@ -147,30 +191,31 @@ export const PLAN_LIMITS = {
             maxUpstreamCostUsdByok: 250,
         },
         copilot: { maxSessionBudgetCredits: 1_000, defaultPerTurnCreditCeiling: 250 },
-        signals: { maxEvents: 200, maxWindowDays: 180 },
-        tableActions: { maxActionsPerRun: 25 },
+        signals: DERIVED_PLAN_LIMIT_TARGETS.pro.signals,
+        tableActions: { maxActionsPerRun: DERIVED_PLAN_LIMIT_TARGETS.pro.maxActionsPerRun },
+        workflows: { cronMinIntervalMinutes: 1 },
     },
     team: {
         cli: {
-            global: { keyRequestsPerMinute: 240, orgRequestsPerMinute: 2_400 },
-            tenantRead: { requestsPerMinute: 480, orgUnits: { limit: 100_000_000, windowSeconds: DAY } },
-            tenantWrite: { requestsPerMinute: 480, orgUnits: { limit: 25_000_000, windowSeconds: DAY } },
-            bulkImport: { requestsPerMinute: 120, orgRequests: { limit: 2_000, windowSeconds: HOUR } },
-            aiLive: { requestsPerMinute: 240, orgRequests: { limit: 30_000, windowSeconds: HOUR } },
-            toolLive: { requestsPerMinute: 240, orgRequests: { limit: 30_000, windowSeconds: HOUR } },
-            toolDryRun: { requestsPerMinute: 120, orgRequests: { limit: 2_000, windowSeconds: HOUR } },
+            global: { keyRequestsPerMinute: 12_000, orgRequestsPerMinute: 12_000 },
+            tenantRead: { requestsPerMinute: 2_400, orgUnits: { limit: 500_000_000, windowSeconds: DAY } },
+            tenantWrite: { requestsPerMinute: 2_400, orgUnits: { limit: 125_000_000, windowSeconds: DAY } },
+            bulkImport: { requestsPerMinute: 600, orgRequests: { limit: 10_000, windowSeconds: HOUR } },
+            aiLive: { requestsPerMinute: 1_200, orgRequests: { limit: 150_000, windowSeconds: HOUR } },
+            toolLive: { requestsPerMinute: 1_200, orgRequests: { limit: 150_000, windowSeconds: HOUR } },
+            toolDryRun: { requestsPerMinute: 600, orgRequests: { limit: 10_000, windowSeconds: HOUR } },
             tenantSchema: { requestsPerMinute: 60, orgRequests: { limit: 600, windowSeconds: HOUR } },
             maxWriteRowsPerRequest: 50_000,
         },
         web: {
-            tenantRead: { requestsPerMinute: 1_200, orgUnits: { limit: 100_000_000, windowSeconds: DAY } },
-            tenantWrite: { requestsPerMinute: 720, orgUnits: { limit: 50_000_000, windowSeconds: DAY } },
-            columnRun: { requestsPerMinute: 480, orgUnits: { limit: 2_500_000, windowSeconds: DAY } },
-            import: { requestsPerMinute: 120, orgRequests: { limit: 2_000, windowSeconds: HOUR } },
+            tenantRead: { requestsPerMinute: 6_000, orgUnits: { limit: 500_000_000, windowSeconds: DAY } },
+            tenantWrite: { requestsPerMinute: 3_600, orgUnits: { limit: 250_000_000, windowSeconds: DAY } },
+            columnRun: { requestsPerMinute: 2_400, orgUnits: { limit: 12_500_000, windowSeconds: DAY } },
+            import: { requestsPerMinute: 600, orgRequests: { limit: 10_000, windowSeconds: HOUR } },
         },
         import: {
             maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
-            maxFileBytes: 250 * MIB,
+            maxFileBytes: importMaxFileBytesForTier("team"),
             maxDirectCsvBodyBytes: 10_000_000,
         },
         agents: {
@@ -180,30 +225,31 @@ export const PLAN_LIMITS = {
             maxUpstreamCostUsdByok: 250,
         },
         copilot: { maxSessionBudgetCredits: 2_000, defaultPerTurnCreditCeiling: 500 },
-        signals: { maxEvents: 200, maxWindowDays: 365 },
-        tableActions: { maxActionsPerRun: 25 },
+        signals: DERIVED_PLAN_LIMIT_TARGETS.team.signals,
+        tableActions: { maxActionsPerRun: DERIVED_PLAN_LIMIT_TARGETS.team.maxActionsPerRun },
+        workflows: { cronMinIntervalMinutes: 1 },
     },
     scale: {
         cli: {
-            global: { keyRequestsPerMinute: 240, orgRequestsPerMinute: 6_000 },
-            tenantRead: { requestsPerMinute: 1_000, orgUnits: { limit: 500_000_000, windowSeconds: DAY } },
-            tenantWrite: { requestsPerMinute: 1_000, orgUnits: { limit: 100_000_000, windowSeconds: DAY } },
-            bulkImport: { requestsPerMinute: 240, orgRequests: { limit: 5_000, windowSeconds: HOUR } },
-            aiLive: { requestsPerMinute: 600, orgRequests: { limit: 100_000, windowSeconds: HOUR } },
-            toolLive: { requestsPerMinute: 600, orgRequests: { limit: 100_000, windowSeconds: HOUR } },
-            toolDryRun: { requestsPerMinute: 120, orgRequests: { limit: 2_000, windowSeconds: HOUR } },
+            global: { keyRequestsPerMinute: 30_000, orgRequestsPerMinute: 30_000 },
+            tenantRead: { requestsPerMinute: 5_000, orgUnits: { limit: 2_500_000_000, windowSeconds: DAY } },
+            tenantWrite: { requestsPerMinute: 5_000, orgUnits: { limit: 500_000_000, windowSeconds: DAY } },
+            bulkImport: { requestsPerMinute: 1_200, orgRequests: { limit: 25_000, windowSeconds: HOUR } },
+            aiLive: { requestsPerMinute: 3_000, orgRequests: { limit: 500_000, windowSeconds: HOUR } },
+            toolLive: { requestsPerMinute: 3_000, orgRequests: { limit: 500_000, windowSeconds: HOUR } },
+            toolDryRun: { requestsPerMinute: 600, orgRequests: { limit: 10_000, windowSeconds: HOUR } },
             tenantSchema: { requestsPerMinute: 60, orgRequests: { limit: 600, windowSeconds: HOUR } },
             maxWriteRowsPerRequest: 50_000,
         },
         web: {
-            tenantRead: { requestsPerMinute: 2_000, orgUnits: { limit: 400_000_000, windowSeconds: DAY } },
-            tenantWrite: { requestsPerMinute: 1_500, orgUnits: { limit: 200_000_000, windowSeconds: DAY } },
-            columnRun: { requestsPerMinute: 1_000, orgUnits: { limit: 10_000_000, windowSeconds: DAY } },
-            import: { requestsPerMinute: 240, orgRequests: { limit: 5_000, windowSeconds: HOUR } },
+            tenantRead: { requestsPerMinute: 10_000, orgUnits: { limit: 2_000_000_000, windowSeconds: DAY } },
+            tenantWrite: { requestsPerMinute: 7_500, orgUnits: { limit: 1_000_000_000, windowSeconds: DAY } },
+            columnRun: { requestsPerMinute: 5_000, orgUnits: { limit: 50_000_000, windowSeconds: DAY } },
+            import: { requestsPerMinute: 1_200, orgRequests: { limit: 25_000, windowSeconds: HOUR } },
         },
         import: {
             maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
-            maxFileBytes: 250 * MIB,
+            maxFileBytes: importMaxFileBytesForTier("scale"),
             maxDirectCsvBodyBytes: 10_000_000,
         },
         agents: {
@@ -213,10 +259,32 @@ export const PLAN_LIMITS = {
             maxUpstreamCostUsdByok: 250,
         },
         copilot: { maxSessionBudgetCredits: 5_000, defaultPerTurnCreditCeiling: 1_000 },
-        signals: { maxEvents: 200, maxWindowDays: 365 },
-        tableActions: { maxActionsPerRun: 25 },
+        signals: DERIVED_PLAN_LIMIT_TARGETS.scale.signals,
+        tableActions: { maxActionsPerRun: DERIVED_PLAN_LIMIT_TARGETS.scale.maxActionsPerRun },
+        workflows: { cronMinIntervalMinutes: 1 },
     },
 };
+/**
+ * The fastest cron cadence, in minutes, a rung may schedule right now. The free
+ * rung's cut from every minute to every 15 (decision L4.2) is a tightening, so
+ * it resolves through the 2026-09 repricing switch: every minute until the
+ * effective instant, `PLAN_LIMITS.free.workflows.cronMinIntervalMinutes` from it.
+ */
+export function resolveCronMinIntervalMinutes(tier, options = {}) {
+    const scheduled = findRepricedValue(`workflows.${tier}.cron_min_interval_minutes`);
+    if (scheduled && typeof scheduled.before === "number" && typeof scheduled.after === "number") {
+        return repricedValue({ before: scheduled.before, after: scheduled.after }, options);
+    }
+    return PLAN_LIMITS[tier].workflows.cronMinIntervalMinutes;
+}
+/**
+ * The largest minimum cron interval any rung enforces right now. A schedule
+ * whose fires are never closer than this fits every plan, so a caller can skip
+ * the plan lookup for it.
+ */
+export function highestCronMinIntervalMinutes(options = {}) {
+    return Math.max(...LIMITS_TIER_ORDER.map((tier) => resolveCronMinIntervalMinutes(tier, options)));
+}
 /**
  * Which enforcement rung a rung of the six-rung Oxygen plan lands on.
  *
@@ -260,3 +328,126 @@ export function limitsTierForPlanTier(tier) {
 export function planLimitsForTier(tier) {
     return PLAN_LIMITS[tier];
 }
+/**
+ * The default credit ceilings of one Agent run in force on a rung right now.
+ *
+ * `PLAN_LIMITS[tier].agents` holds the values each rung read before the 2026-09
+ * repricing. The team and scale rungs drop to 2,500 total / 1,250 inference
+ * (decision L5.4, inference half PROPOSED P-56), and a cut waits for the
+ * effective-date switch (`agents.<tier>.*` in `REPRICING_2026_09_SCHEDULE`).
+ * Every Agent budget check reads this, never the table, so the cut lands
+ * everywhere at the same instant.
+ */
+export function resolvePlanAgentCreditLimits(tier, options = {}) {
+    const agents = PLAN_LIMITS[tier].agents;
+    const resolve = (field, fallback) => {
+        const scheduled = findRepricedValue(`agents.${tier}.${field}`);
+        return scheduled && typeof scheduled.before === "number" && typeof scheduled.after === "number"
+            ? repricedValue({ before: scheduled.before, after: scheduled.after }, options)
+            : fallback;
+    };
+    return {
+        maxTotalCredits: resolve("max_total_credits", agents.maxTotalCredits),
+        maxInferenceCredits: resolve("max_inference_credits", agents.maxInferenceCredits),
+    };
+}
+/**
+ * The platform's hard backstop on one Agent run's approved credit ceiling
+ * (decision F.4, ratified 2026-09-27).
+ *
+ * The plan's Agent run ceiling is a DEFAULT: a run or trigger whose approved
+ * `max_credits` fits under it needs only the usual approval. Going above it
+ * takes a second, explicit per-run (or per-trigger) approval, and even that
+ * approval stops here. 25,000 credits ($250) is the largest standing
+ * per-delivery default any plan has carried (the pre-2026-09 scale trigger
+ * default), so an approved Agent run never outspends one delivery of the
+ * largest plan's own automation. The other backstops stay in force whatever is
+ * approved: the plan's upstream-USD clamp, the iteration, tool-call and
+ * active-minute bounds, the balance check on every reservation and the org
+ * daily spend guard.
+ */
+export const AGENT_RUN_APPROVED_CEILING_MAX_CREDITS = 25_000;
+/**
+ * The default Agent run ceilings for an org: its plan rung's, unless an
+ * enterprise contract names its own default (decision F.4). The contract value
+ * replaces the rung's total and model calls take half of it, as on every paid
+ * rung. A contract value is clamped to the platform backstop; an unusable one
+ * (absent, non-numeric, not positive) is ignored.
+ */
+export function resolveAgentRunDefaultCeilings(input) {
+    const contract = input.enterpriseDefaultCredits;
+    if (typeof contract === "number" && Number.isFinite(contract) && contract >= 1) {
+        const total = Math.min(Math.floor(contract), AGENT_RUN_APPROVED_CEILING_MAX_CREDITS);
+        return {
+            maxTotalCredits: total,
+            maxInferenceCredits: Math.max(1, Math.floor(total / 2)),
+            source: "enterprise_contract",
+        };
+    }
+    return { ...resolvePlanAgentCreditLimits(input.tier, input.options), source: "plan" };
+}
+/** `details.approval_kind` on the refusal below, so every surface can render its own approval card. */
+export const AGENT_CEILING_ABOVE_DEFAULT_APPROVAL_KIND = "agent_ceiling_above_default";
+/**
+ * Check one run's (or one trigger's per-delivery) approved ceiling against the
+ * org's default before anything is created.
+ *
+ * - At or under the default: nothing more to approve.
+ * - Above it: refused with `approval_required` unless the caller also passed the
+ *   explicit above-default approval. The details carry the numbers and the flag
+ *   each surface re-sends, so the refusal is the approval card.
+ * - Above the platform backstop: refused outright; no approval raises it.
+ *
+ * Returns whether the approved ceiling is above the default; the caller persists
+ * that as the run's or trigger's above-default approval.
+ */
+export function assertAgentRunCeilingApproval(input) {
+    const defaultMax = input.defaults.maxTotalCredits;
+    const subject = input.scope === "trigger" ? "each delivery of this trigger" : "this run";
+    if (input.maxCredits > AGENT_RUN_APPROVED_CEILING_MAX_CREDITS) {
+        throw new OxygenError("invalid_request", `max_credits ${input.maxCredits} is above the platform maximum of ${AGENT_RUN_APPROVED_CEILING_MAX_CREDITS} credits for ${subject}.`, {
+            exitCode: 2,
+            details: {
+                requested_max_credits: input.maxCredits,
+                default_max_credits: defaultMax,
+                platform_max_credits: AGENT_RUN_APPROVED_CEILING_MAX_CREDITS,
+            },
+        });
+    }
+    if (input.maxCredits <= defaultMax)
+        return { aboveDefault: false };
+    if (input.approveAboveDefault)
+        return { aboveDefault: true };
+    throw new OxygenError("approval_required", `max_credits ${input.maxCredits} is above your default Agent run ceiling of ${defaultMax} credits. Approve the higher ceiling for ${subject} with approve_above_default=true, or lower max_credits to ${defaultMax} or less.`, {
+        exitCode: 7,
+        details: {
+            approval_kind: AGENT_CEILING_ABOVE_DEFAULT_APPROVAL_KIND,
+            scope: input.scope,
+            requested_max_credits: input.maxCredits,
+            default_max_credits: defaultMax,
+            default_source: input.defaults.source,
+            platform_max_credits: AGENT_RUN_APPROVED_CEILING_MAX_CREDITS,
+            next_step: `Re-send with approve_above_default=true (CLI: --approve-above-default) to approve up to ${input.maxCredits} credits for ${subject}.`,
+        },
+    });
+}
+/**
+ * The ceilings one run is held to, for the worker and every budget check that
+ * reads a run's authority. A run with a recorded above-default approval is
+ * bounded by its own approved `max_credits` (applied by the caller as a user
+ * limit) under the platform backstop. Every other run is bounded by the default,
+ * so a ceiling approved without the second approval — including every one
+ * approved before this rule — still binds at the default exactly as before.
+ */
+export function agentRunEnforcedCeilings(input) {
+    if (!input.aboveDefaultApproved) {
+        return {
+            maxTotalCredits: input.defaults.maxTotalCredits,
+            maxInferenceCredits: input.defaults.maxInferenceCredits,
+        };
+    }
+    return {
+        maxTotalCredits: AGENT_RUN_APPROVED_CEILING_MAX_CREDITS,
+        maxInferenceCredits: AGENT_RUN_APPROVED_CEILING_MAX_CREDITS,
+    };
+}