@oxygen-agent/cli 1.1010.650 → 1.1010.905

package/node_modules/@oxygen/shared/dist/table-capacity.d.ts

@@ -1,13 +1,71 @@
-/**
- * Plan-independent infrastructure envelope for durable Workspace Tables.
- * Plans do not sell different storage entitlements; every workspace gets the
- * same safety boundary and plans continue to differ through operation/rate and
- * credit limits.
- */
-export declare const WORKSPACE_TABLE_CAPACITY: Readonly<{
-    tableRowLimit: 3000000;
-    workspaceRowLimit: 25000000;
+import type { PlanBand } from "./plan-band.js";
+import { type RepricingOptions } from "./repricing.js";
+export type WorkspaceTableCapacityLimits = {
+    tableRowLimit: number;
+    workspaceRowLimit: number;
     workspaceDatabaseWarningBytes: number;
     workspaceDatabaseLimitBytes: number;
-}>;
+};
+/**
+ * The envelope every workspace had before storage scaled with plan size, and
+ * still the value in force for any workspace whose plan-resolved limits have not
+ * been written to its tenant yet. The tenant capacity trigger falls back to these
+ * exact numbers when its per-workspace limit columns are NULL (tenant migration
+ * `0451_workspace_capacity_plan_limits.sql`,
+ * enforced by `0452_workspace_capacity_plan_limit_enforcement.sql`); a test pins the two together.
+ */
+export declare const WORKSPACE_TABLE_CAPACITY: Readonly<WorkspaceTableCapacityLimits>;
 export declare const WORKSPACE_TABLE_DATABASE_STORAGE_SCOPE: "postgres_workspace_tables_heap_indexes_toast";
+/** Two thirds of the hard limit, rounded down (PROPOSED P-48, repricing spec § 4.1). */
+export declare function workspaceDatabaseWarningBytesFor(limitBytes: number): number;
+/**
+ * Storage by plan size, as ratified (decision L1, 2026-09-26; repricing spec
+ * § 4.1). This is the target ladder, not what is in force: see
+ * `resolveWorkspaceTableCapacity`.
+ */
+export declare const PLAN_BAND_TABLE_CAPACITY_TARGETS: Readonly<Record<PlanBand, WorkspaceTableCapacityLimits>>;
+/**
+ * Rows per Table above today's 3,000,000 ship only after a capacity test at 5M
+ * and 10M rows per Table. The workspace totals of these bands (rows and
+ * database) are already in force (decision F.1, 2026-09-27, amending L1, which
+ * had gated both); shipping a band's rows per Table is removing it from this list.
+ */
+export declare const PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST: readonly PlanBand[];
+/**
+ * The storage limits in force for a plan band right now.
+ *
+ * - A limit that tightens (free, $49, $99) is a scheduled 2026-09 repricing value
+ *   (`storage.<band>.*` in `REPRICING_2026_09_SCHEDULE`): today's envelope until
+ *   the effective-date switch, the ratified ladder from it on.
+ * - A band awaiting the rows-per-Table capacity test has its ladder workspace
+ *   totals and keeps today's rows per Table.
+ * - Every other band is already at its ladder value.
+ */
+export declare function resolveWorkspaceTableCapacity(band: PlanBand, options?: RepricingOptions): WorkspaceTableCapacityLimits;
+/**
+ * Where a band's storage stands against its ratified ladder (decision F.2):
+ *
+ * - `in_force`: the band's values are in force; nothing is pending.
+ * - `scheduled`: the 2026-09 repricing moves them to `target` at `effectiveAt`.
+ * - `awaiting_capacity_test`: `target` applies once the rows-per-Table capacity
+ *   test at that size passes; there is no date.
+ *
+ * A cut is reported only once an operator has set the repricing switch to a
+ * valid future instant. While the switch is unset or invalid a cutting band
+ * reads `in_force` and no target is revealed, the rule `describeRepricingSchedule`
+ * follows for every other scheduled value.
+ */
+export type WorkspaceTableCapacityStatus = {
+    status: "in_force";
+    effectiveAt: null;
+    target: null;
+} | {
+    status: "scheduled";
+    effectiveAt: Date;
+    target: WorkspaceTableCapacityLimits;
+} | {
+    status: "awaiting_capacity_test";
+    effectiveAt: null;
+    target: WorkspaceTableCapacityLimits;
+};
+export declare function describeWorkspaceTableCapacityStatus(band: PlanBand, options?: RepricingOptions): WorkspaceTableCapacityStatus;

package/node_modules/@oxygen/shared/dist/table-capacity.js

@@ -1,9 +1,12 @@
+import { findRepricedValue, readRepricingSwitch, repricedValue, } from "./repricing.js";
 const GIB = 1024 ** 3;
 /**
- * Plan-independent infrastructure envelope for durable Workspace Tables.
- * Plans do not sell different storage entitlements; every workspace gets the
- * same safety boundary and plans continue to differ through operation/rate and
- * credit limits.
+ * The envelope every workspace had before storage scaled with plan size, and
+ * still the value in force for any workspace whose plan-resolved limits have not
+ * been written to its tenant yet. The tenant capacity trigger falls back to these
+ * exact numbers when its per-workspace limit columns are NULL (tenant migration
+ * `0451_workspace_capacity_plan_limits.sql`,
+ * enforced by `0452_workspace_capacity_plan_limit_enforcement.sql`); a test pins the two together.
  */
 export const WORKSPACE_TABLE_CAPACITY = Object.freeze({
     tableRowLimit: 3_000_000,
@@ -12,3 +15,81 @@ export const WORKSPACE_TABLE_CAPACITY = Object.freeze({
     workspaceDatabaseLimitBytes: 30 * GIB,
 });
 export const WORKSPACE_TABLE_DATABASE_STORAGE_SCOPE = "postgres_workspace_tables_heap_indexes_toast";
+/** Two thirds of the hard limit, rounded down (PROPOSED P-48, repricing spec § 4.1). */
+export function workspaceDatabaseWarningBytesFor(limitBytes) {
+    return Math.floor((limitBytes * 2) / 3);
+}
+function ladderRow(tableRowLimit, workspaceRowLimit, databaseGib) {
+    const workspaceDatabaseLimitBytes = databaseGib * GIB;
+    return Object.freeze({
+        tableRowLimit,
+        workspaceRowLimit,
+        workspaceDatabaseWarningBytes: workspaceDatabaseWarningBytesFor(workspaceDatabaseLimitBytes),
+        workspaceDatabaseLimitBytes,
+    });
+}
+/**
+ * Storage by plan size, as ratified (decision L1, 2026-09-26; repricing spec
+ * § 4.1). This is the target ladder, not what is in force: see
+ * `resolveWorkspaceTableCapacity`.
+ */
+export const PLAN_BAND_TABLE_CAPACITY_TARGETS = Object.freeze({
+    free: ladderRow(100_000, 1_000_000, 2),
+    "49": ladderRow(1_000_000, 5_000_000, 10),
+    "99": ladderRow(2_000_000, 10_000_000, 20),
+    "199": ladderRow(3_000_000, 25_000_000, 30),
+    "499": ladderRow(3_000_000, 25_000_000, 30),
+    "999": ladderRow(5_000_000, 50_000_000, 60),
+    "1999": ladderRow(10_000_000, 100_000_000, 120),
+});
+/**
+ * Rows per Table above today's 3,000,000 ship only after a capacity test at 5M
+ * and 10M rows per Table. The workspace totals of these bands (rows and
+ * database) are already in force (decision F.1, 2026-09-27, amending L1, which
+ * had gated both); shipping a band's rows per Table is removing it from this list.
+ */
+export const PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST = Object.freeze(["999", "1999"]);
+const STORAGE_FIELDS = [
+    ["tableRowLimit", "table_row_limit"],
+    ["workspaceRowLimit", "workspace_row_limit"],
+    ["workspaceDatabaseWarningBytes", "workspace_database_warning_bytes"],
+    ["workspaceDatabaseLimitBytes", "workspace_database_limit_bytes"],
+];
+/**
+ * The storage limits in force for a plan band right now.
+ *
+ * - A limit that tightens (free, $49, $99) is a scheduled 2026-09 repricing value
+ *   (`storage.<band>.*` in `REPRICING_2026_09_SCHEDULE`): today's envelope until
+ *   the effective-date switch, the ratified ladder from it on.
+ * - A band awaiting the rows-per-Table capacity test has its ladder workspace
+ *   totals and keeps today's rows per Table.
+ * - Every other band is already at its ladder value.
+ */
+export function resolveWorkspaceTableCapacity(band, options = {}) {
+    const target = PLAN_BAND_TABLE_CAPACITY_TARGETS[band];
+    if (PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST.includes(band)) {
+        return Object.freeze({ ...target, tableRowLimit: WORKSPACE_TABLE_CAPACITY.tableRowLimit });
+    }
+    const resolved = { ...target };
+    for (const [field, key] of STORAGE_FIELDS) {
+        const scheduled = findRepricedValue(`storage.${band}.${key}`);
+        if (scheduled && typeof scheduled.before === "number" && typeof scheduled.after === "number") {
+            resolved[field] = repricedValue({ before: scheduled.before, after: scheduled.after }, options);
+        }
+    }
+    return Object.freeze(resolved);
+}
+export function describeWorkspaceTableCapacityStatus(band, options = {}) {
+    if (PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST.includes(band)) {
+        return { status: "awaiting_capacity_test", effectiveAt: null, target: PLAN_BAND_TABLE_CAPACITY_TARGETS[band] };
+    }
+    const state = readRepricingSwitch(options);
+    if (state.status === "scheduled") {
+        const current = resolveWorkspaceTableCapacity(band, options);
+        const target = resolveWorkspaceTableCapacity(band, { ...options, now: state.effectiveAt });
+        if (STORAGE_FIELDS.some(([field]) => current[field] !== target[field])) {
+            return { status: "scheduled", effectiveAt: state.effectiveAt, target };
+        }
+    }
+    return { status: "in_force", effectiveAt: null, target: null };
+}

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.d.ts

@@ -46,6 +46,12 @@ export type TelemetryExportObserverOptions = {
     windowMs?: number | undefined;
     now?: (() => number) | undefined;
 };
+/**
+ * Copies the optional reader-facing exporter methods (FORWARDED_METHODS) from
+ * `inner` onto `wrapper`, bound to `inner`. Every exporter wrapper in this
+ * package uses it, so a method the SDK starts probing is added in one place.
+ */
+export declare function forwardExporterMethods(inner: object, wrapper: Record<string, unknown>): void;
 /** Origin + path only: never query strings, fragments or URL credentials. */
 export declare function telemetryEndpointForLog(endpoint: string): string;
 /**

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.js

@@ -12,6 +12,18 @@ const FORWARDED_METHODS = [
     "selectAggregationTemporality",
     "selectAggregation",
 ];
+/**
+ * Copies the optional reader-facing exporter methods (FORWARDED_METHODS) from
+ * `inner` onto `wrapper`, bound to `inner`. Every exporter wrapper in this
+ * package uses it, so a method the SDK starts probing is added in one place.
+ */
+export function forwardExporterMethods(inner, wrapper) {
+    for (const method of FORWARDED_METHODS) {
+        const fn = inner[method];
+        if (typeof fn === "function")
+            wrapper[method] = fn.bind(inner);
+    }
+}
 /** Origin + path only: never query strings, fragments or URL credentials. */
 export function telemetryEndpointForLog(endpoint) {
     try {
@@ -187,11 +199,7 @@ export function observeTelemetryExporter(inner, options) {
             return inner.shutdown();
         },
     };
-    for (const method of FORWARDED_METHODS) {
-        const fn = inner[method];
-        if (typeof fn === "function")
-            observed[method] = fn.bind(inner);
-    }
+    forwardExporterMethods(inner, observed);
     return observed;
 }
 const DROPPED_SPANS_MESSAGE = /^Dropped (\d+) spans because maxQueueSize reached$/;

package/node_modules/@oxygen/shared/dist/telemetry-resource.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Which OTel resource each telemetry destination of this process receives.
+ *
+ * A process has ONE TracerProvider / MeterProvider and therefore one resource,
+ * but up to two destinations: Axiom (the managed-era store, whose dashboards and
+ * monitors filter on `deployment.environment == 'production'`) and the opt-in
+ * OTLP collector (DEV1 SigNoz, whose production receiver keeps only
+ * `deployment.environment == 'prod'` rows and whose dev receiver only `dev`).
+ *
+ * Production is the one tier where the two labels disagree, so production is the
+ * one tier that splits: the SDK resource stays exactly what a production process
+ * without a collector exports (the Axiom label, resource auto-detection on), and
+ * the collector's exporters swap in `collectorAttributes` — declared attributes
+ * only, never detected ones, because Node's process detector copies argv
+ * verbatim. Every other tier (dev, shadow, managed) keeps its single shared
+ * resource exactly as before.
+ */
+export type TelemetryResourcePlan = {
+    /** The SDK resource's `deployment.environment`: what Axiom receives. */
+    deploymentEnvironment: string;
+    /** The SDK resource attributes. */
+    resourceAttributes: Record<string, string>;
+    /** False when the collector shares the SDK resource, so nothing is detected into it. */
+    autoDetectResources: boolean;
+    /**
+     * Set only when the collector must see a different resource than Axiom: the
+     * declared attributes plus the process identity, labelled with the tier.
+     */
+    collectorAttributes: Record<string, string> | null;
+};
+export type TelemetryResourcePlanInput = {
+    /** Every resource attribute except `deployment.environment`. */
+    declared: Record<string, string>;
+    /** The surface's managed fallback chain, used when OXYGEN_DEPLOY_ENV is unset. */
+    managedEnvironment: string;
+    /** True when OXYGEN_OTLP_ENDPOINT is configured for this process. */
+    collectorConfigured: boolean;
+    env?: NodeJS.ProcessEnv;
+};
+export declare function planTelemetryResource({ declared, managedEnvironment, collectorConfigured, env, }: TelemetryResourcePlanInput): TelemetryResourcePlan;

package/node_modules/@oxygen/shared/dist/telemetry-resource.js

@@ -0,0 +1,35 @@
+import { deployEnvTelemetryEnvironment, resolveDeployEnv } from "./deploy-env.js";
+import { processResourceIdentity } from "./process-resource.js";
+export function planTelemetryResource({ declared, managedEnvironment, collectorConfigured, env = process.env, }) {
+    // The label a process without a collector has always exported: `production`
+    // on selfhost-prod, `development` on shadow/dev, the managed chain otherwise.
+    const axiomEnvironment = deployEnvTelemetryEnvironment(env) ?? managedEnvironment;
+    const withEnvironment = (environment, attributes) => ({
+        ...attributes,
+        "deployment.environment": environment,
+    });
+    if (!collectorConfigured) {
+        return {
+            deploymentEnvironment: axiomEnvironment,
+            resourceAttributes: withEnvironment(axiomEnvironment, declared),
+            autoDetectResources: true,
+            collectorAttributes: null,
+        };
+    }
+    const collectorEnvironment = env.OXYGEN_DEPLOY_ENV?.trim() ? resolveDeployEnv(env).tier : axiomEnvironment;
+    const collectorAttributes = withEnvironment(collectorEnvironment, { ...processResourceIdentity(), ...declared });
+    if (collectorEnvironment === "prod") {
+        return {
+            deploymentEnvironment: axiomEnvironment,
+            resourceAttributes: withEnvironment(axiomEnvironment, declared),
+            autoDetectResources: true,
+            collectorAttributes,
+        };
+    }
+    return {
+        deploymentEnvironment: collectorEnvironment,
+        resourceAttributes: collectorAttributes,
+        autoDetectResources: false,
+        collectorAttributes: null,
+    };
+}

package/node_modules/@oxygen/shared/dist/telemetry.d.ts

@@ -1,6 +1,7 @@
 export type TelemetryAttributes = Record<string, unknown>;
 export type WithTelemetrySpanOptions = {
     isTransient?: (error: unknown) => boolean;
+    traceparent?: string | null | undefined;
 };
 export declare function withTelemetrySpan<T>(tracerName: string, name: string, attributes: TelemetryAttributes | undefined, fn: () => Promise<T>, options?: WithTelemetrySpanOptions): Promise<T>;
 /**
@@ -18,5 +19,13 @@ export declare function setActiveTelemetryAttributes(attributes: TelemetryAttrib
 export declare function markActiveTelemetryError(message: string, attributes?: TelemetryAttributes): void;
 export declare function recordTelemetryCounter(name: string, value?: number, attributes?: TelemetryAttributes): void;
 export declare function recordTelemetryHistogram(name: string, value: number, attributes?: TelemetryAttributes): void;
+/**
+ * Records the latest observed value of a level (a queue depth, a pool size).
+ * A synchronous gauge rather than an observable one: the callers already sample
+ * on their own cadence (the BullMQ relay reads Redis counts every 10s), and a
+ * collection-time callback would have to reach into that loop's state. The
+ * exported point is the last value recorded before each export.
+ */
+export declare function recordTelemetryGauge(name: string, value: number, attributes?: TelemetryAttributes): void;
 export declare function commonTelemetryAttributes(attributes?: TelemetryAttributes): TelemetryAttributes;
 export declare function metricSafeAttributes(attributes?: TelemetryAttributes): TelemetryAttributes;

package/node_modules/@oxygen/shared/dist/telemetry.js

@@ -3,14 +3,21 @@ import { deployEnvTelemetryEnvironment, deployPlatformAttribute } from "./deploy
 import { errorId } from "./log.js";
 import { normalizeTelemetryAttributes } from "./redaction.js";
 import { redactSqlParameters, sqlErrorTelemetryAttributes } from "./sql-error.js";
+import { remoteParentContext } from "./trace-context.js";
 import { OXYGEN_VERSION } from "./version.js";
 const counterCache = new Map();
 const histogramCache = new Map();
+const gaugeCache = new Map();
 // skipcq: JS-0116 — `async` keeps synchronous setup throws (getTracer / attribute
 // normalization) as rejections so the Promise<T> contract holds for all callers.
 export async function withTelemetrySpan(tracerName, name, attributes, fn, options) {
     const tracer = trace.getTracer(tracerName, OXYGEN_VERSION);
-    return tracer.startActiveSpan(name, { attributes: normalizeTelemetryAttributes(commonTelemetryAttributes(attributes)) }, async (span) => {
+    const remote = options?.traceparent ? remoteParentContext(options.traceparent) : null;
+    const spanOptions = {
+        attributes: normalizeTelemetryAttributes(commonTelemetryAttributes(remote ? { ...attributes, "oxygen.trace.propagated": true } : attributes)),
+        ...(remote && remote.links.length > 0 ? { links: remote.links } : {}),
+    };
+    const run = async (span) => {
         try {
             return await fn();
         }
@@ -37,7 +44,10 @@ export async function withTelemetrySpan(tracerName, name, attributes, fn, option
         finally {
             span.end();
         }
-    });
+    };
+    return remote
+        ? tracer.startActiveSpan(name, spanOptions, remote.context, run)
+        : tracer.startActiveSpan(name, spanOptions, run);
 }
 /**
  * The active global span's trace id: the join key into SigNoz/Axiom traces.
@@ -84,6 +94,23 @@ export function recordTelemetryHistogram(name, value, attributes) {
     const histogram = getHistogram(name);
     histogram.record(value, normalizeTelemetryAttributes(metricSafeAttributes(commonTelemetryAttributes(attributes))));
 }
+/**
+ * Records the latest observed value of a level (a queue depth, a pool size).
+ * A synchronous gauge rather than an observable one: the callers already sample
+ * on their own cadence (the BullMQ relay reads Redis counts every 10s), and a
+ * collection-time callback would have to reach into that loop's state. The
+ * exported point is the last value recorded before each export.
+ */
+export function recordTelemetryGauge(name, value, attributes) {
+    if (!Number.isFinite(value))
+        return;
+    let gauge = gaugeCache.get(name);
+    if (!gauge) {
+        gauge = getMeter().createGauge(name);
+        gaugeCache.set(name, gauge);
+    }
+    gauge.record(value, normalizeTelemetryAttributes(metricSafeAttributes(commonTelemetryAttributes(attributes))));
+}
 export function commonTelemetryAttributes(attributes) {
     const workerProcess = isWorkerProcess();
     // Each attribute reads an ordered env-var fallback chain that differs by
@@ -199,7 +226,19 @@ const METRIC_SAFE_ATTRIBUTE_KEYS = new Set([
     "worker.cycle.slow",
     "table_action.lane",
     "tenant.ticket_reason",
+    // oxygen.worker.tenant_queue_wait_ms: the ticket's narrow scope
+    // (copilot | publishing | none) and the tenant's plan band (the seven bands
+    // plus "unresolved"), which the worker-share target is read by. Closed enums.
+    "tenant.wake_kind",
+    "tenant.plan_band",
     "queue.stalled",
+    // BullMQ execution queue dimensions (oxygen.worker.queue.*). `queue.lane` is
+    // the closed EXECUTION_LANES enum, `queue.role` the lane or "relay",
+    // `queue.state` one of BullMQ's five job-count states. Never the execution id
+    // or tenant id: those stay on the worker.job span and the lifecycle log.
+    "queue.lane",
+    "queue.role",
+    "queue.state",
     "scope",
     "rail",
     "overall_status",

package/node_modules/@oxygen/shared/dist/trace-context.d.ts

@@ -0,0 +1,29 @@
+import { type Context, type Link, type SpanContext } from "@opentelemetry/api";
+/** Parses a W3C `traceparent`; anything malformed or all-zero yields null. */
+export declare function parseTraceparent(value: unknown): SpanContext | null;
+/** The validated traceparent, or undefined — for optional fields that must drop bad input. */
+export declare function validTraceparent(value: unknown): string | undefined;
+export declare function formatTraceparent(spanContext: SpanContext | undefined | null): string | null;
+/** The `traceparent` of the currently active span, or null outside any span. */
+export declare function activeTraceparent(): string | null;
+/**
+ * The parent context for a span that continues a stored traceparent.
+ *
+ * The remote span becomes the PARENT, so request -> job -> provider.* reads as
+ * one trace; whatever span was active (a worker cycle, the BullMQ runtime) is
+ * kept as a LINK so the scheduling side stays navigable. Every non-span context
+ * value (baggage, suppression flags) is preserved. Null for a missing or
+ * invalid traceparent: the caller then starts an ordinary child of the active
+ * context.
+ */
+export declare function remoteParentContext(traceparent: unknown): {
+    context: Context;
+    links: Link[];
+} | null;
+/**
+ * Links the active span to a stored enqueue traceparent. For work that is
+ * already inside its execution span (a BullMQ `bullmq.execute`) and only learns
+ * the enqueuing request once it has loaded its own row: a link joins the two
+ * traces without a second per-job span. Returns whether a link was added.
+ */
+export declare function linkActiveSpanToTraceparent(traceparent: unknown): boolean;

package/node_modules/@oxygen/shared/dist/trace-context.js

@@ -0,0 +1,88 @@
+import { context, isSpanContextValid, trace, } from "@opentelemetry/api";
+/**
+ * W3C Trace Context carried across the durable enqueue boundary.
+ *
+ * A web request that enqueues work (a table-action run, a BullMQ execution) and
+ * the worker that later executes it run in different processes, minutes apart,
+ * with Postgres in between. Nothing propagated the OTel context across that gap,
+ * so a provider call made by the worker lived in a worker trace that could not
+ * be joined to the request that paid for it. The enqueuing request stores a
+ * `traceparent` string next to its correlation `trace_id`; the worker parents
+ * its job span on it (see `withTelemetrySpan`'s `traceparent` option).
+ *
+ * The value is built from and parsed into a span context directly rather than
+ * through the globally registered propagator: the propagator is whatever the
+ * host SDK installed (or a no-op in tests and in a process without telemetry),
+ * and a stored value must mean the same thing on every reader.
+ */
+// Version 00 only: a later version may append fields this reader cannot judge.
+// Lowercase hex per the spec; all-zero trace/parent ids are explicitly invalid.
+const TRACEPARENT_PATTERN = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
+/** Parses a W3C `traceparent`; anything malformed or all-zero yields null. */
+export function parseTraceparent(value) {
+    if (typeof value !== "string")
+        return null;
+    const match = TRACEPARENT_PATTERN.exec(value);
+    if (!match)
+        return null;
+    const spanContext = {
+        traceId: match[1],
+        spanId: match[2],
+        traceFlags: Number.parseInt(match[3], 16),
+        isRemote: true,
+    };
+    return isSpanContextValid(spanContext) ? spanContext : null;
+}
+/** The validated traceparent, or undefined — for optional fields that must drop bad input. */
+export function validTraceparent(value) {
+    return parseTraceparent(value) ? value : undefined;
+}
+export function formatTraceparent(spanContext) {
+    if (!spanContext || !isSpanContextValid(spanContext))
+        return null;
+    const flags = (spanContext.traceFlags & 0xff).toString(16).padStart(2, "0");
+    return `00-${spanContext.traceId}-${spanContext.spanId}-${flags}`;
+}
+/** The `traceparent` of the currently active span, or null outside any span. */
+export function activeTraceparent() {
+    return formatTraceparent(trace.getActiveSpan()?.spanContext());
+}
+/**
+ * The parent context for a span that continues a stored traceparent.
+ *
+ * The remote span becomes the PARENT, so request -> job -> provider.* reads as
+ * one trace; whatever span was active (a worker cycle, the BullMQ runtime) is
+ * kept as a LINK so the scheduling side stays navigable. Every non-span context
+ * value (baggage, suppression flags) is preserved. Null for a missing or
+ * invalid traceparent: the caller then starts an ordinary child of the active
+ * context.
+ */
+export function remoteParentContext(traceparent) {
+    const remote = parseTraceparent(traceparent);
+    if (!remote)
+        return null;
+    const active = context.active();
+    const current = trace.getSpanContext(active);
+    return {
+        context: trace.setSpanContext(active, remote),
+        links: current && isSpanContextValid(current)
+            ? [{ context: current, attributes: { "oxygen.link.kind": "worker.dispatch" } }]
+            : [],
+    };
+}
+/**
+ * Links the active span to a stored enqueue traceparent. For work that is
+ * already inside its execution span (a BullMQ `bullmq.execute`) and only learns
+ * the enqueuing request once it has loaded its own row: a link joins the two
+ * traces without a second per-job span. Returns whether a link was added.
+ */
+export function linkActiveSpanToTraceparent(traceparent) {
+    const remote = parseTraceparent(traceparent);
+    const span = trace.getActiveSpan();
+    if (!remote || !span || !isSpanContextValid(span.spanContext()))
+        return false;
+    if (span.spanContext().traceId === remote.traceId)
+        return false;
+    span.addLink({ context: remote, attributes: { "oxygen.link.kind": "enqueue" } });
+    return true;
+}

package/node_modules/@oxygen/shared/dist/ugc.d.ts

@@ -150,3 +150,18 @@ export type UgcVoiceImport = {
 };
 export declare const UGC_MONTHLY_CREATOR_CREDITS = 10000;
 export declare const UGC_SPONSORED_LINKEDIN_SEATS = 1;
+/**
+ * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
+ * Creators tab and the MCP widget alike: a card sponsorship waiting on its
+ * checkout reads differently from one waiting on the provider, and a stopped
+ * renewal says so while its paid period runs.
+ */
+export declare function ugcSponsorshipStatusLabel(row: {
+    status: string;
+    checkout_url?: string | null;
+    cancellation_pending?: boolean;
+}): string;
+/** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */
+export declare const UGC_SPONSORSHIP_PLAN_LABELS: Readonly<Record<string, string>>;
+/** When a new credit sponsorship's reservation starts (`participants[].reservation_starts`). */
+export declare const UGC_RESERVATION_START_LABELS: Readonly<Record<string, string>>;

package/node_modules/@oxygen/shared/dist/ugc.js

@@ -10,3 +10,32 @@ export function ugcPostingTarget(program) {
 }
 export const UGC_MONTHLY_CREATOR_CREDITS = 10_000;
 export const UGC_SPONSORED_LINKEDIN_SEATS = 1;
+/**
+ * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
+ * Creators tab and the MCP widget alike: a card sponsorship waiting on its
+ * checkout reads differently from one waiting on the provider, and a stopped
+ * renewal says so while its paid period runs.
+ */
+export function ugcSponsorshipStatusLabel(row) {
+    if (row.cancellation_pending)
+        return "Renewal stopping";
+    if (row.status === "active")
+        return "Sponsored";
+    if (row.status === "pending")
+        return row.checkout_url ? "Checkout open" : "Pending";
+    if (row.status === "cancelled")
+        return "Renewal stopped";
+    return "Not sponsored";
+}
+/** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */
+export const UGC_SPONSORSHIP_PLAN_LABELS = {
+    new: "Starts",
+    already_active: "Already sponsored",
+    stripe_period_running: "Moves to credits when the card period ends",
+    checkout_open: "Card checkout still open; cancel it first",
+};
+/** When a new credit sponsorship's reservation starts (`participants[].reservation_starts`). */
+export const UGC_RESERVATION_START_LABELS = {
+    now: "Now",
+    when_linkedin_connects: "When they connect LinkedIn",
+};

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,4 +1,2 @@
 export declare const OXYGEN_VERSION: string;
-export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
-export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
-export declare const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";
+export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.906.0";

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1010.650";
+export declare const OXYGEN_BUILD_VERSION = "1.1010.905";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1010.650";
+export const OXYGEN_BUILD_VERSION = "1.1010.905";

package/node_modules/@oxygen/shared/dist/version.js

@@ -26,7 +26,8 @@ export const OXYGEN_VERSION = OXYGEN_BUILD_VERSION;
 // So floors LAG one release: publish the CLI in release N, raise the floor to it in
 // release N+1. And a contract change that breaks ONE surface belongs on that
 // surface — pass `minimumCliVersion` to requireCliIdentity/requireCliOrWebIdentity
-// (see MANAGED_INBOX_MINIMUM_CLI_VERSION). A per-route floor fails one command
+// (declare it here as <SURFACE>_MINIMUM_CLI_VERSION, above the global floor; the
+// release gate checks it too). A per-route floor fails one command
 // safely; a global floor fails the whole product. OXY-4091.
 //
 // 1.328.1: paid table action runs and background columns run require
@@ -34,29 +35,15 @@ export const OXYGEN_VERSION = OXYGEN_BUILD_VERSION;
 // 1.328.1: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
 // (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and
 // removed the old /api/cli/linkedin/* routes — older CLIs would 404.
-export const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
-// Per-surface floor for the whitelabel/managed-inbox purchase path, enforced by
-// BOTH paid inbox routes: /api/cli/managed-inboxes/subscribe and
-// /api/cli/managed-inboxes/[domain]/mailboxes. (The comment used to say subscribe
-// only; the expansion route has enforced it too since it shipped, and three
-// separate reads of this file have since reasoned from the wrong half.)
-//
-// 1.326.2: Pricing Model 2.0 (2026-07-14) moved whitelabel inbox subscribe from the
-// USD Stripe rail back to Oxygen credits: the preview now returns
-// monthly_credits/one_off_credits and the approved execute RESERVES credits instead
-// of creating a Stripe subscription. An older CLI mis-renders the price/shape of a
-// PAID order (and would misread the reserved-not-charged response), so it is refused
-// on THIS route only. The floor lags one release per OXY-4091: the 1.326.2 CLI
-// publishes from the 1.326.x prod deploy, and this floor rides the 1.330.0 release —
-// so it can never exceed npm's newest CLI. (1.298.0 was the prior credits→Stripe
-// contract move.) Do NOT raise the global OXYGEN_MINIMUM_CLI_VERSION for this.
-export const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
-// Per-surface floor for guarded Plain agent reply + Done. CLI 1.747.0 is the
-// first client that declares --agent, binds the latest customer-visible
-// conversation-head message and
-// body-authenticated preview token, carries the live agent_done_token into the
-// separate Done confirmation, and never falls through to the retired resolve
-// shape. This floor MUST remain dormant in production until 1.747.0 has been
-// published by the preceding release per OXY-4091; the live feature gate is the
-// rollout boundary that preserves that two-phase ordering.
-export const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";
+// 1.906.0 (2026-09-27): the floor had sat at 1.181.0, below both of those
+// breaks, so CLIs that could no longer run paid actions or reach the Sequencer
+// were still admitted. 1.906.0 has been the npm `latest` since 2026-08-29, far
+// behind today's latest, so the lag rule holds. Measured before the raise
+// (PostHog `cli_command_run`, PROD, 14 days): 9 of 87 active organizations
+// were newest on an older CLI; each gets `cli_update_required` and one
+// `oxygen update` away from working. CLIs that ship packages/cli/src/auto-update.ts
+// update themselves on that rejection and re-run the command, so later raises
+// stop costing a manual step — the lag rule still applies unchanged. The raise
+// also retired both per-route floors, managed inboxes (1.326.2) and the guarded
+// support agent reply (1.747.0): below the global floor they could refuse no one.
+export const OXYGEN_MINIMUM_CLI_VERSION = "1.906.0";