@oxygen-agent/cli 1.1010.650 → 1.1010.905

package/node_modules/@oxygen/shared/dist/semver.d.ts

@@ -0,0 +1,21 @@
+export type SemanticVersion = {
+    major: number;
+    minor: number;
+    patch: number;
+};
+/**
+ * Parse a three-segment semantic version (e.g. `1.142.17`). Pre-release and
+ * build metadata suffixes (`-rc.1`, `+build`) are tolerated but ignored.
+ * Returns `null` when the input is not a parseable `major.minor.patch` string.
+ */
+export declare function parseSemver(version: string): SemanticVersion | null;
+/**
+ * Compare two semantic versions. Returns -1 when `a < b`, 1 when `a > b`, and
+ * 0 when they are equal. Unparseable inputs compare as equal (0) so callers
+ * fail open rather than misordering garbage.
+ */
+export declare function compareSemver(a: string, b: string): -1 | 0 | 1;
+/** True when `a` is a strictly greater semantic version than `b`. */
+export declare function isVersionGreater(a: string, b: string): boolean;
+/** True when `a` is a strictly lesser semantic version than `b`. */
+export declare function isVersionLess(a: string, b: string): boolean;

package/node_modules/@oxygen/shared/dist/semver.js

@@ -0,0 +1,41 @@
+/**
+ * Parse a three-segment semantic version (e.g. `1.142.17`). Pre-release and
+ * build metadata suffixes (`-rc.1`, `+build`) are tolerated but ignored.
+ * Returns `null` when the input is not a parseable `major.minor.patch` string.
+ */
+export function parseSemver(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(version);
+    if (!match)
+        return null;
+    return {
+        major: Number(match[1]),
+        minor: Number(match[2]),
+        patch: Number(match[3]),
+    };
+}
+/**
+ * Compare two semantic versions. Returns -1 when `a < b`, 1 when `a > b`, and
+ * 0 when they are equal. Unparseable inputs compare as equal (0) so callers
+ * fail open rather than misordering garbage.
+ */
+export function compareSemver(a, b) {
+    const left = parseSemver(a);
+    const right = parseSemver(b);
+    if (!left || !right)
+        return 0;
+    for (const key of ["major", "minor", "patch"]) {
+        if (left[key] > right[key])
+            return 1;
+        if (left[key] < right[key])
+            return -1;
+    }
+    return 0;
+}
+/** True when `a` is a strictly greater semantic version than `b`. */
+export function isVersionGreater(a, b) {
+    return compareSemver(a, b) > 0;
+}
+/** True when `a` is a strictly lesser semantic version than `b`. */
+export function isVersionLess(a, b) {
+    return compareSemver(a, b) < 0;
+}

package/node_modules/@oxygen/shared/dist/sending-limits.d.ts

@@ -0,0 +1,30 @@
+import type { RepricingOptions } from "./repricing.js";
+/**
+ * The daily cap a new mailbox gets when nobody names one. New mailboxes were
+ * created at 18 a day before the repricing, so this is an increase and is live.
+ */
+export declare const EMAIL_MAILBOX_DEFAULT_DAILY_CAP: 25;
+/**
+ * Who set a mailbox's stored cap. `default` = OXYGEN's default at creation,
+ * `user` = a person or agent set it. A row written before the column existed
+ * has no source (null): its cap may be the old column default or a choice.
+ */
+export declare const EMAIL_MAILBOX_DAILY_CAP_SOURCES: readonly ["default", "user"];
+export type EmailMailboxDailyCapSource = (typeof EMAIL_MAILBOX_DAILY_CAP_SOURCES)[number];
+export declare function readEmailMailboxDailyCapSource(value: unknown): EmailMailboxDailyCapSource | null;
+/** The most a mailbox may be set to send a day, independent of billing activation. */
+export declare function emailMailboxDailyCapMaximum(_options?: RepricingOptions): number | null;
+/**
+ * The configured cap in force for a stored one: every surface that reads a
+ * mailbox's cap, and the send claim, go through this.
+ *
+ * Stored choices are retained up to the technical maximum.
+ */
+export declare function emailMailboxDailyCapInForce(input: {
+    storedCap: number;
+    source: EmailMailboxDailyCapSource | null;
+}, options?: RepricingOptions): number;
+/** A new voice number may dial this many times a day once it has warmed up. */
+export declare const VOICE_NUMBER_DEFAULT_DAILY_CAP = 100;
+/** The most a voice number may be set to dial a day. */
+export declare const VOICE_NUMBER_MAX_DAILY_CAP = 300;

package/node_modules/@oxygen/shared/dist/sending-limits.js

@@ -0,0 +1,43 @@
+// Per-channel sending limits that are the same on every plan (2026-09 repricing,
+// decision L3; specification slice S52). Limits guard, credits meter: none of
+// these is sold, and none charges for sending.
+//
+// Email campaign ramp: 5 / 10 / 20 based on accepted-send days, then the
+// configured cap (25 by default, maximum 50), independent of billing activation.
+// The versioned migration changes old defaults once; later choices are retained.
+//
+// Voice per number: 100 dials a day by default, adjustable up to 300.
+import { EMAIL_DELIVERABILITY_DEFAULTS } from "./email-deliverability-policy.js";
+/**
+ * The daily cap a new mailbox gets when nobody names one. New mailboxes were
+ * created at 18 a day before the repricing, so this is an increase and is live.
+ */
+export const EMAIL_MAILBOX_DEFAULT_DAILY_CAP = EMAIL_DELIVERABILITY_DEFAULTS.campaignDailyCap;
+/**
+ * Who set a mailbox's stored cap. `default` = OXYGEN's default at creation,
+ * `user` = a person or agent set it. A row written before the column existed
+ * has no source (null): its cap may be the old column default or a choice.
+ */
+export const EMAIL_MAILBOX_DAILY_CAP_SOURCES = ["default", "user"];
+export function readEmailMailboxDailyCapSource(value) {
+    return value === "default" || value === "user" ? value : null;
+}
+/** The most a mailbox may be set to send a day, independent of billing activation. */
+export function emailMailboxDailyCapMaximum(_options = {}) {
+    return 50;
+}
+/**
+ * The configured cap in force for a stored one: every surface that reads a
+ * mailbox's cap, and the send claim, go through this.
+ *
+ * Stored choices are retained up to the technical maximum.
+ */
+export function emailMailboxDailyCapInForce(input, options = {}) {
+    const stored = Number.isFinite(input.storedCap) ? Math.max(0, Math.floor(input.storedCap)) : 0;
+    const maximum = emailMailboxDailyCapMaximum(options);
+    return maximum === null ? stored : Math.min(stored, maximum);
+}
+/** A new voice number may dial this many times a day once it has warmed up. */
+export const VOICE_NUMBER_DEFAULT_DAILY_CAP = 100;
+/** The most a voice number may be set to dial a day. */
+export const VOICE_NUMBER_MAX_DAILY_CAP = 300;

package/node_modules/@oxygen/shared/dist/sending-seats.d.ts

@@ -25,24 +25,15 @@
  * "skips the seat check", it is one that holds a legacy entitlement which
  * SATISFIES the seat check. The gate always runs.
  */
-import { MANAGED_INBOX_USD_CENTS, SENDING_DOMAIN_USD_CENTS, SENDING_SEAT_USD_CENTS, type SendingSeatKey } from "./pricing-snapshot.generated.js";
+import { SENDING_SEAT_USD_CENTS, type SendingSeatKey } from "./pricing-snapshot.generated.js";
+import type { CreditGateKind } from "./credit-gate.js";
 export { SENDING_SEAT_USD_CENTS };
 /**
- * Email infrastructure, kept next to the seats because the relationship between
- * them is the whole design.
- *
- * MANAGED_INBOX_USD_CENTS is ALL-IN: it already contains the sending seat and
- * warm-up. A customer buying an Oxygen mailbox buys ONE thing at ONE price and
- * can never end up holding a mailbox with no seat to send from. A customer
- * bringing their own mailbox pays SENDING_SEAT_USD_CENTS.email_sender instead.
- * The two are alternatives, never both for the same mailbox.
- *
- * The practical consequence for the connect gate: email capacity is
- * (email_sender seats) + (managed inbox slots). Counting only seats would refuse
- * a customer who bought inboxes, which is exactly the assemble-the-parts failure
- * this bundle exists to prevent.
+ * Email infrastructure is no longer sold in dollars (repricing 2026-09, S32/S33):
+ * a managed inbox is priced in credits, 400 for a Google mailbox plus the 100-credit
+ * mailbox connection every sending mailbox holds, warm-up included. A customer
+ * bringing their own mailbox pays the connection alone.
  */
-export { MANAGED_INBOX_USD_CENTS, SENDING_DOMAIN_USD_CENTS };
 export type { SendingSeatKey };
 export declare const SENDING_SEAT_KEYS: readonly ["linkedin", "whatsapp", "phone_number", "email_sender"];
 export type SendingSeatDefinition = {
@@ -64,6 +55,18 @@ export type SendingSeatDefinition = {
 export declare const SENDING_SEAT_CATALOG: {
     readonly [K in SendingSeatKey]: SendingSeatDefinition;
 };
+/**
+ * The credit reservation each sending-seat channel becomes once seats are
+ * retired (repricing 2026-09, decisions 2.7 and 2.9). A seat still held keeps
+ * covering accounts of its kind until the seat subscription ends at renewal, and
+ * only then does each account start reserving credits, so an account is never
+ * paid for twice.
+ */
+export declare const SEAT_RESERVATION_KIND: {
+    readonly [K in SendingSeatKey]: CreditGateKind;
+};
+/** The seat channel whose seats cover a reservation kind, or null for a kind no seat ever covered. */
+export declare function seatKeyForReservationKind(kind: string): SendingSeatKey | null;
 export declare const SENDING_SEAT_LEGACY_CHARGE_KEYS: readonly string[];
 export declare function isSendingSeatKey(value: unknown): value is SendingSeatKey;
 export declare function sendingSeatMonthlyPriceCents(key: SendingSeatKey): number;

package/node_modules/@oxygen/shared/dist/sending-seats.js

@@ -25,24 +25,8 @@
  * "skips the seat check", it is one that holds a legacy entitlement which
  * SATISFIES the seat check. The gate always runs.
  */
-import { MANAGED_INBOX_USD_CENTS, SENDING_DOMAIN_USD_CENTS, SENDING_SEAT_USD_CENTS, } from "./pricing-snapshot.generated.js";
+import { SENDING_SEAT_USD_CENTS, } from "./pricing-snapshot.generated.js";
 export { SENDING_SEAT_USD_CENTS };
-/**
- * Email infrastructure, kept next to the seats because the relationship between
- * them is the whole design.
- *
- * MANAGED_INBOX_USD_CENTS is ALL-IN: it already contains the sending seat and
- * warm-up. A customer buying an Oxygen mailbox buys ONE thing at ONE price and
- * can never end up holding a mailbox with no seat to send from. A customer
- * bringing their own mailbox pays SENDING_SEAT_USD_CENTS.email_sender instead.
- * The two are alternatives, never both for the same mailbox.
- *
- * The practical consequence for the connect gate: email capacity is
- * (email_sender seats) + (managed inbox slots). Counting only seats would refuse
- * a customer who bought inboxes, which is exactly the assemble-the-parts failure
- * this bundle exists to prevent.
- */
-export { MANAGED_INBOX_USD_CENTS, SENDING_DOMAIN_USD_CENTS };
 export const SENDING_SEAT_KEYS = [
     "linkedin",
     "whatsapp",
@@ -88,6 +72,27 @@ export const SENDING_SEAT_CATALOG = {
         stripePriceEnvVar: "STRIPE_PRICE_SEAT_EMAIL_USD",
     },
 };
+/**
+ * The credit reservation each sending-seat channel becomes once seats are
+ * retired (repricing 2026-09, decisions 2.7 and 2.9). A seat still held keeps
+ * covering accounts of its kind until the seat subscription ends at renewal, and
+ * only then does each account start reserving credits, so an account is never
+ * paid for twice.
+ */
+export const SEAT_RESERVATION_KIND = {
+    linkedin: "linkedin_account",
+    whatsapp: "whatsapp_account",
+    phone_number: "phone_number",
+    email_sender: "sending_mailbox",
+};
+/** The seat channel whose seats cover a reservation kind, or null for a kind no seat ever covered. */
+export function seatKeyForReservationKind(kind) {
+    for (const seatKey of SENDING_SEAT_KEYS) {
+        if (SEAT_RESERVATION_KIND[seatKey] === kind)
+            return seatKey;
+    }
+    return null;
+}
 export const SENDING_SEAT_LEGACY_CHARGE_KEYS = SENDING_SEAT_KEYS
     .map((key) => SENDING_SEAT_CATALOG[key].legacyChargeKey)
     .filter((chargeKey) => chargeKey !== null);

package/node_modules/@oxygen/shared/dist/sequence-failures.js

@@ -172,8 +172,11 @@ function classifySequenceFailure(input) {
         .toLowerCase();
     // Ambiguous effects win every other classification. A 429-shaped code or a
     // provider name must never make a possibly-applied write safe to replay.
+    // `write[_-]?ambiguous` is the LinkedIn client's `provider_write_ambiguous`:
+    // stored rows written before that error carried `effect_outcome` would
+    // otherwise read back as a recipient hard bounce.
     if (input.effectOutcome === "unknown" ||
-        /(?:effect|outcome)[_-]?unknown|ambiguous[_-]?(?:effect|write)/i.test(codes)) {
+        /(?:effect|outcome)[_-]?unknown|ambiguous[_-]?(?:effect|write)|write[_-]?ambiguous/i.test(codes)) {
         return "effect_unknown";
     }
     if ([input.code, input.providerSubtype].some((code) => isProviderFundingErrorCode(code)))

package/node_modules/@oxygen/shared/dist/spend-safety.d.ts

@@ -1,5 +1,7 @@
 import type { PlanTier } from "./billing.js";
+import type { PlanBand } from "./plan-band.js";
 import type { LimitsTier } from "./plan-limits.js";
+import { type RepricingOptions } from "./repricing.js";
 /**
  * Spend-safety defaults: plan-scaled ceilings applied when an autonomous
  * spend path was armed WITHOUT an explicit cap. They restore the ADR-0011
@@ -19,18 +21,29 @@ export declare const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES: ReadonlySet<string>;
 /**
  * Per-run managed-credit ceiling for a LIVE workflow run fired by an autonomous
  * trigger when neither run metadata nor the manifest declares `max_credits`.
+ *
+ * These are the ceilings each rung read BEFORE the 2026-09 repricing. The value
+ * in force is resolved per plan by `resolveDefaultTriggerRunCreditCeilingForPlan`
+ * (`plan-band.ts`): 10% of the plan's monthly credits (decision L5.1), where a
+ * larger default applies at once and a smaller one waits for the
+ * effective-date switch with this table as its old value. Read this table
+ * directly only to know the pre-repricing value.
  */
 export declare const DEFAULT_TRIGGER_RUN_CREDIT_CEILING: Record<SpendSafetyPlanTier, number | null>;
 /**
  * Per-delivery credit ceiling stamped onto a standing/webhook table auto-run
- * batch when the armed configuration carries no explicit `max_credits`.
+ * batch when the armed configuration carries no explicit `max_credits`. The
+ * pre-repricing values, like the trigger table above; resolve the value in force
+ * with `resolveDefaultAutoRunBatchCreditCeilingForPlan`.
  */
 export declare const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING: Record<SpendSafetyPlanTier, number | null>;
 /**
  * Row ceiling for a BYOK AI-column run whose caller gave no explicit row bound
  * (no limit, no row_ids, selection "all"). BYOK bills the customer's own
- * provider account, so a credit ceiling is meaningless — row count is the
- * enforceable unit. An explicit limit (up to the 500k platform row cap) wins.
+ * provider account, so OXYGEN's credit ceiling bounds only its own platform fee
+ * (0.05 credits a call from the 2026-09 repricing instant, decision 6.3) and
+ * never the provider's bill — row count stays the enforceable unit for that.
+ * An explicit limit (up to the 500k platform row cap) wins.
  */
 export declare const DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS: Record<SpendSafetyPlanTier, number | null>;
 /**
@@ -89,6 +102,12 @@ export declare function resolveByokProviderDailyCapEnforcementMode(configured?:
  *
  * This applies ONLY to the implicit default. An org that sets its own org-daily
  * policy has chosen a real spend ceiling, and that ceiling counts everything.
+ *
+ * The monthly reservation renewals of the 2026-09 repricing (connected sending
+ * mailboxes, deliverability units, connected accounts and phone numbers, dedicated
+ * IPs) are the same shape and are excluded for the same reason (PROPOSED P-59).
+ * It matters most on the free plan, whose guard is a fixed 1,000 / 5,000 credits
+ * a day: one LinkedIn renewal would otherwise be most of a free day's warning.
  */
 export declare const IMPLICIT_ORG_DAILY_GUARD_EXCLUDED_CATEGORIES: readonly string[];
 export declare const DEFAULT_ORG_DAILY_SPEND_WARN_MULTIPLE = 5;
@@ -101,16 +120,46 @@ export type OrgDailySpendGuard = {
 /**
  * Resolve the implicit guard's thresholds from a plan's monthly grant. `null`
  * means the guard is suppressed because the plan has no finite positive grant to
- * scale from (free at 0, enterprise/custom at null) — the single place that
- * decision is made, so enforcement and the read surfaces cannot drift apart.
+ * scale from (enterprise/custom at null) — the single place that decision is
+ * made, so enforcement and the read surfaces cannot drift apart.
+ *
+ * The free plan has no monthly grant, so it gets a fixed guard instead (decision
+ * L5.2: 1,000 warn / 5,000 block a UTC day). It is a new bound on free, so it
+ * takes effect at the 2026-09 repricing instant; before then free has none.
  */
-export declare function resolveOrgDailySpendGuard(monthlyCredits: number | null | undefined): OrgDailySpendGuard | null;
+export declare function resolveOrgDailySpendGuard(monthlyCredits: number | null | undefined, options?: RepricingOptions & {
+    freePlan?: boolean;
+}): OrgDailySpendGuard | null;
 /** Credits carry 3 decimals everywhere (control-DB numeric(18,3)). */
 export declare function roundCredits(value: number): number;
 /** Credit estimates that present to 2 decimals (cent-grained customer copy). */
 export declare function roundCreditsToCents(value: number): number;
-export declare function resolveDefaultTriggerRunCreditCeiling(tier: SpendSafetyPlanTier): number | null;
-export declare function resolveDefaultAutoRunBatchCreditCeiling(tier: SpendSafetyPlanTier): number | null;
+/**
+ * Platform-owned runaway ceiling for one attended Workspace Copilot turn: 3,000
+ * customer credits, $6 of upstream inference at the ratified 5x markup, the same
+ * on every plan. It is not a user budget or an authorization grant. It lives
+ * here rather than in `@oxygen/copilot` so the limits report can state it next
+ * to the approval-free allowance it must stay above; `@oxygen/copilot/config`
+ * re-exports it.
+ */
+export declare const COPILOT_ATTENDED_INFERENCE_CREDIT_CEILING = 3000;
+/** How much paid work the attended Copilot may start without an approval card. */
+export type CopilotApprovalFreeAllowance = {
+    /** The most one call may declare (its server-enforced `max_credits`). */
+    perCallCredits: number;
+    /** The most all such calls in one session may declare together. */
+    perSessionCredits: number;
+};
+/**
+ * The Copilot's approval-free spend allowance by plan size (decision L5.3). Only
+ * the two ends are ratified: free at 50 / 300 credits ($0.50 / $3) and $1,999 at
+ * 500 / 2,500 ($5 / $25). The middle sizes are PROPOSED (P-55). Every value is
+ * at least the 50 / 300 every plan had before, so the table ships live. The
+ * largest session allowance stays below the attended turn backstop above.
+ */
+export declare const COPILOT_APPROVAL_FREE_ALLOWANCE_BY_PLAN_BAND: Readonly<Record<PlanBand, CopilotApprovalFreeAllowance>>;
+/** A plan size's approval-free Copilot allowance. */
+export declare function copilotApprovalFreeAllowanceForBand(band: PlanBand): CopilotApprovalFreeAllowance;
 export declare function resolveDefaultByokColumnRunMaxRows(tier: SpendSafetyPlanTier): number | null;
 export declare function resolveDefaultByokProviderDailyCallCap(tier: SpendSafetyPlanTier): number | null;
 /**

package/node_modules/@oxygen/shared/dist/spend-safety.js

@@ -1,3 +1,4 @@
+import { FREE_ORG_DAILY_GUARD_BLOCK_CREDITS, FREE_ORG_DAILY_GUARD_WARN_CREDITS, repricedValue, } from "./repricing.js";
 /** Workflow run trigger types that fire without a human in the loop. */
 export const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES = new Set([
     "cron",
@@ -7,6 +8,13 @@ export const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES = new Set([
 /**
  * Per-run managed-credit ceiling for a LIVE workflow run fired by an autonomous
  * trigger when neither run metadata nor the manifest declares `max_credits`.
+ *
+ * These are the ceilings each rung read BEFORE the 2026-09 repricing. The value
+ * in force is resolved per plan by `resolveDefaultTriggerRunCreditCeilingForPlan`
+ * (`plan-band.ts`): 10% of the plan's monthly credits (decision L5.1), where a
+ * larger default applies at once and a smaller one waits for the
+ * effective-date switch with this table as its old value. Read this table
+ * directly only to know the pre-repricing value.
  */
 export const DEFAULT_TRIGGER_RUN_CREDIT_CEILING = {
     free: 50,
@@ -18,7 +26,9 @@ export const DEFAULT_TRIGGER_RUN_CREDIT_CEILING = {
 };
 /**
  * Per-delivery credit ceiling stamped onto a standing/webhook table auto-run
- * batch when the armed configuration carries no explicit `max_credits`.
+ * batch when the armed configuration carries no explicit `max_credits`. The
+ * pre-repricing values, like the trigger table above; resolve the value in force
+ * with `resolveDefaultAutoRunBatchCreditCeilingForPlan`.
  */
 export const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING = {
     free: 50,
@@ -31,8 +41,10 @@ export const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING = {
 /**
  * Row ceiling for a BYOK AI-column run whose caller gave no explicit row bound
  * (no limit, no row_ids, selection "all"). BYOK bills the customer's own
- * provider account, so a credit ceiling is meaningless — row count is the
- * enforceable unit. An explicit limit (up to the 500k platform row cap) wins.
+ * provider account, so OXYGEN's credit ceiling bounds only its own platform fee
+ * (0.05 credits a call from the 2026-09 repricing instant, decision 6.3) and
+ * never the provider's bill — row count stays the enforceable unit for that.
+ * An explicit limit (up to the 500k platform row cap) wins.
  */
 export const DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS = {
     free: null,
@@ -106,20 +118,38 @@ export function resolveByokProviderDailyCapEnforcementMode(configured = process.
  *
  * This applies ONLY to the implicit default. An org that sets its own org-daily
  * policy has chosen a real spend ceiling, and that ceiling counts everything.
+ *
+ * The monthly reservation renewals of the 2026-09 repricing (connected sending
+ * mailboxes, deliverability units, connected accounts and phone numbers, dedicated
+ * IPs) are the same shape and are excluded for the same reason (PROPOSED P-59).
+ * It matters most on the free plan, whose guard is a fixed 1,000 / 5,000 credits
+ * a day: one LinkedIn renewal would otherwise be most of a free day's warning.
  */
 export const IMPLICIT_ORG_DAILY_GUARD_EXCLUDED_CATEGORIES = [
     "managed_warmup",
     "managed_inbox",
+    "managed_mailbox",
+    "managed_deliverability",
+    "managed_seat",
 ];
 export const DEFAULT_ORG_DAILY_SPEND_WARN_MULTIPLE = 5;
 export const DEFAULT_ORG_DAILY_SPEND_BLOCK_MULTIPLE = 20;
 /**
  * Resolve the implicit guard's thresholds from a plan's monthly grant. `null`
  * means the guard is suppressed because the plan has no finite positive grant to
- * scale from (free at 0, enterprise/custom at null) — the single place that
- * decision is made, so enforcement and the read surfaces cannot drift apart.
+ * scale from (enterprise/custom at null) — the single place that decision is
+ * made, so enforcement and the read surfaces cannot drift apart.
+ *
+ * The free plan has no monthly grant, so it gets a fixed guard instead (decision
+ * L5.2: 1,000 warn / 5,000 block a UTC day). It is a new bound on free, so it
+ * takes effect at the 2026-09 repricing instant; before then free has none.
  */
-export function resolveOrgDailySpendGuard(monthlyCredits) {
+export function resolveOrgDailySpendGuard(monthlyCredits, options = {}) {
+    if (options.freePlan) {
+        const warnCredits = repricedValue(FREE_ORG_DAILY_GUARD_WARN_CREDITS, options);
+        const blockCredits = repricedValue(FREE_ORG_DAILY_GUARD_BLOCK_CREDITS, options);
+        return warnCredits === null || blockCredits === null ? null : { warnCredits, blockCredits };
+    }
     if (typeof monthlyCredits !== "number" || !Number.isFinite(monthlyCredits) || monthlyCredits <= 0) {
         return null;
     }
@@ -136,11 +166,34 @@ export function roundCredits(value) {
 export function roundCreditsToCents(value) {
     return Math.round((value + Number.EPSILON) * 100) / 100;
 }
-export function resolveDefaultTriggerRunCreditCeiling(tier) {
-    return DEFAULT_TRIGGER_RUN_CREDIT_CEILING[tier];
-}
-export function resolveDefaultAutoRunBatchCreditCeiling(tier) {
-    return DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING[tier];
+/**
+ * Platform-owned runaway ceiling for one attended Workspace Copilot turn: 3,000
+ * customer credits, $6 of upstream inference at the ratified 5x markup, the same
+ * on every plan. It is not a user budget or an authorization grant. It lives
+ * here rather than in `@oxygen/copilot` so the limits report can state it next
+ * to the approval-free allowance it must stay above; `@oxygen/copilot/config`
+ * re-exports it.
+ */
+export const COPILOT_ATTENDED_INFERENCE_CREDIT_CEILING = 3_000;
+/**
+ * The Copilot's approval-free spend allowance by plan size (decision L5.3). Only
+ * the two ends are ratified: free at 50 / 300 credits ($0.50 / $3) and $1,999 at
+ * 500 / 2,500 ($5 / $25). The middle sizes are PROPOSED (P-55). Every value is
+ * at least the 50 / 300 every plan had before, so the table ships live. The
+ * largest session allowance stays below the attended turn backstop above.
+ */
+export const COPILOT_APPROVAL_FREE_ALLOWANCE_BY_PLAN_BAND = Object.freeze({
+    free: Object.freeze({ perCallCredits: 50, perSessionCredits: 300 }),
+    "49": Object.freeze({ perCallCredits: 100, perSessionCredits: 500 }),
+    "99": Object.freeze({ perCallCredits: 100, perSessionCredits: 500 }),
+    "199": Object.freeze({ perCallCredits: 200, perSessionCredits: 1_000 }),
+    "499": Object.freeze({ perCallCredits: 200, perSessionCredits: 1_000 }),
+    "999": Object.freeze({ perCallCredits: 300, perSessionCredits: 1_500 }),
+    "1999": Object.freeze({ perCallCredits: 500, perSessionCredits: 2_500 }),
+});
+/** A plan size's approval-free Copilot allowance. */
+export function copilotApprovalFreeAllowanceForBand(band) {
+    return COPILOT_APPROVAL_FREE_ALLOWANCE_BY_PLAN_BAND[band];
 }
 export function resolveDefaultByokColumnRunMaxRows(tier) {
     return DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS[tier];

package/node_modules/@oxygen/shared/dist/stripe-price-catalog.d.ts

@@ -1,4 +1,4 @@
-import { CONTACT_SALES_URL, PURCHASABLE_PLAN_KEYS, SELF_SERVE_PLAN_TIERS, normalizeBillingCurrency, type BillingCurrency, type OxygenPlanKey, type PricingPlanDefinition, type SelfServePlanTier } from "./billing.js";
+import { CONTACT_SALES_URL, PURCHASABLE_PLAN_KEYS, SELF_SERVE_PLAN_TIERS, normalizeBillingCurrency, type BillingCurrency, type OxygenPlanKey, type PlanBillingInterval, type PricingPlanDefinition, type SelfServePlanTier } from "./billing.js";
 export { CONTACT_SALES_URL, PURCHASABLE_PLAN_KEYS, SELF_SERVE_PLAN_TIERS, normalizeBillingCurrency, };
 export type { BillingCurrency, OxygenPlanKey, SelfServePlanTier };
 export type PricingPlan = PricingPlanDefinition & {
@@ -17,6 +17,32 @@ export declare const PRICING_PLANS: {
 /** The six purchasable rungs with their Stripe price ids, cheapest first. */
 export declare const PURCHASABLE_PLANS: Record<OxygenPlanKey, PricingPlan>;
 export declare function getPlanPriceId(plan: PricingPlan, currency: BillingCurrency): string;
+export type { PlanBillingInterval };
+/**
+ * The configured Price for one rung and interval, or "" when that Price is not
+ * configured (every yearly Price, until S14 creates them).
+ */
+export declare function getPurchasablePlanPriceId(planKey: OxygenPlanKey, interval: PlanBillingInterval, currency?: BillingCurrency): string;
+/**
+ * The billing interval of a recognized plan Price. "year" only for a configured
+ * yearly Oxygen Price; every other recognized Price (monthly rungs and every
+ * grandfathered or legacy plan) is "month"; an unrecognized id is null.
+ *
+ * This is the one definition the credit-grant paths read, so the Stripe webhook,
+ * the lazy grant on a balance read and the slice sweep can never disagree about
+ * whether a paid period is sliced.
+ */
+export declare function planBillingIntervalForPriceId(priceId: string | null | undefined): PlanBillingInterval | null;
+/**
+ * Whether yearly billing can be sold: every purchasable rung has a configured
+ * yearly Price. False until S14 creates them, which is what keeps every annual
+ * control (the plan picker's Yearly switch, `--interval year`, the pricing
+ * page's yearly line) dark. All six or nothing, so no surface ever offers a
+ * yearly rung whose checkout would be refused.
+ */
+export declare function annualPlanBillingAvailable(currency?: BillingCurrency): boolean;
+/** Every configured yearly plan Price id (empty until S14). */
+export declare function configuredAnnualPlanPriceIds(): readonly string[];
 /**
  * Resolve a Stripe price id to the plan key stored in `subscriptions.tier`.
  *
@@ -30,6 +56,12 @@ export declare function tierFromPriceId(priceId: string): string | null;
  * Complete runtime-recognized Price set grouped by the current self-serve
  * family. Catalog audit/migration code consumes this instead of maintaining a
  * second env map that can silently omit grandfathered subscriptions.
+ *
+ * The configured yearly Prices are listed with the Oxygen family (slice S14):
+ * the migration planner compares the billing interval before it matches a
+ * rung by plan key or amount (S16, `stripeMigrationTargetFor`), so a yearly
+ * Price in the source set resolves to itself and can never become the target
+ * of a monthly subscription.
  */
 export declare function recognizedStripePriceIdsBySelfServeTier(): Record<SelfServePlanTier, readonly string[]>;
 export declare function formatMonthlyPrice(priceCents: number | null, currency?: BillingCurrency): string;

package/node_modules/@oxygen/shared/dist/stripe-price-catalog.js

@@ -19,6 +19,25 @@ const STRIPE_PRICE_OXYGEN_IDS = {
     oxygen_999: { usd: process.env.STRIPE_PRICE_OXYGEN_999_USD ?? "" },
     oxygen_1999: { usd: process.env.STRIPE_PRICE_OXYGEN_1999_USD ?? "" },
 };
+/**
+ * The yearly Price of each rung (Repricing 2026-09, decision 1.2: pay 10 months,
+ * get 12, credits still granted monthly). A second Price on the rung's existing
+ * Product, since month and year are distinct intervals a Portal configuration
+ * accepts under one Product.
+ *
+ * DARK until the yearly Price ids are configured (`provision` creates the Prices
+ * and prints these names, slice S14): every env var is unset, an
+ * unset id is "", and tierFromPriceId refuses "" before any map is consulted, so
+ * no subscription resolves to a yearly interval and nothing is ever sliced.
+ */
+const STRIPE_PRICE_OXYGEN_ANNUAL_IDS = {
+    oxygen_49: { usd: process.env.STRIPE_PRICE_OXYGEN_49_ANNUAL_USD ?? "" },
+    oxygen_99: { usd: process.env.STRIPE_PRICE_OXYGEN_99_ANNUAL_USD ?? "" },
+    oxygen_199: { usd: process.env.STRIPE_PRICE_OXYGEN_199_ANNUAL_USD ?? "" },
+    oxygen_499: { usd: process.env.STRIPE_PRICE_OXYGEN_499_ANNUAL_USD ?? "" },
+    oxygen_999: { usd: process.env.STRIPE_PRICE_OXYGEN_999_ANNUAL_USD ?? "" },
+    oxygen_1999: { usd: process.env.STRIPE_PRICE_OXYGEN_1999_ANNUAL_USD ?? "" },
+};
 // Grandfathered on 2026-09-19. These three stay pointed at their LIVE prices
 // (35 Starter + 2 Pro subscriptions bill against them) rather than moving into
 // the legacy CSV lists: tierFromPriceId must keep returning "starter"/"pro"/
@@ -82,6 +101,49 @@ export function getPlanPriceId(plan, currency) {
     return (plan.priceIds[currency]
         || (currency === DEFAULT_BILLING_CURRENCY ? plan.priceId : ""));
 }
+/**
+ * The configured Price for one rung and interval, or "" when that Price is not
+ * configured (every yearly Price, until S14 creates them).
+ */
+export function getPurchasablePlanPriceId(planKey, interval, currency = DEFAULT_BILLING_CURRENCY) {
+    const ids = interval === "year"
+        ? STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey]
+        : STRIPE_PRICE_OXYGEN_IDS[planKey];
+    return ids[currency] || "";
+}
+/**
+ * The billing interval of a recognized plan Price. "year" only for a configured
+ * yearly Oxygen Price; every other recognized Price (monthly rungs and every
+ * grandfathered or legacy plan) is "month"; an unrecognized id is null.
+ *
+ * This is the one definition the credit-grant paths read, so the Stripe webhook,
+ * the lazy grant on a balance read and the slice sweep can never disagree about
+ * whether a paid period is sliced.
+ */
+export function planBillingIntervalForPriceId(priceId) {
+    if (!priceId)
+        return null;
+    for (const planKey of PURCHASABLE_PLAN_KEYS) {
+        if (Object.values(STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey]).includes(priceId)) {
+            return "year";
+        }
+    }
+    return tierFromPriceId(priceId) === null ? null : "month";
+}
+/**
+ * Whether yearly billing can be sold: every purchasable rung has a configured
+ * yearly Price. False until S14 creates them, which is what keeps every annual
+ * control (the plan picker's Yearly switch, `--interval year`, the pricing
+ * page's yearly line) dark. All six or nothing, so no surface ever offers a
+ * yearly rung whose checkout would be refused.
+ */
+export function annualPlanBillingAvailable(currency = DEFAULT_BILLING_CURRENCY) {
+    return PURCHASABLE_PLAN_KEYS.every((planKey) => getPurchasablePlanPriceId(planKey, "year", currency) !== "");
+}
+/** Every configured yearly plan Price id (empty until S14). */
+export function configuredAnnualPlanPriceIds() {
+    return uniqueNonEmptyPriceIds(PURCHASABLE_PLAN_KEYS.flatMap((planKey) => Object.values(STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey])));
+}
 /**
  * Resolve a Stripe price id to the plan key stored in `subscriptions.tier`.
  *
@@ -97,7 +159,8 @@ export function tierFromPriceId(priceId) {
     if (!priceId)
         return null;
     for (const planKey of PURCHASABLE_PLAN_KEYS) {
-        if (Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey]).includes(priceId)) {
+        if (Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey]).includes(priceId)
+            || Object.values(STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey]).includes(priceId)) {
             return planKey;
         }
     }
@@ -122,11 +185,18 @@ export function tierFromPriceId(priceId) {
  * Complete runtime-recognized Price set grouped by the current self-serve
  * family. Catalog audit/migration code consumes this instead of maintaining a
  * second env map that can silently omit grandfathered subscriptions.
+ *
+ * The configured yearly Prices are listed with the Oxygen family (slice S14):
+ * the migration planner compares the billing interval before it matches a
+ * rung by plan key or amount (S16, `stripeMigrationTargetFor`), so a yearly
+ * Price in the source set resolves to itself and can never become the target
+ * of a monthly subscription.
  */
 export function recognizedStripePriceIdsBySelfServeTier() {
     const byTier = {
         oxygen: [
             ...PURCHASABLE_PLAN_KEYS.flatMap((planKey) => Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey])),
+            ...configuredAnnualPlanPriceIds(),
             ...LEGACY_CURRENT_PLAN_PRICE_IDS.oxygen,
         ],
         starter: [