@oxygen-agent/cli 1.1010.650 → 1.1010.905

package/node_modules/@oxygen/shared/dist/workspace-file-storage.d.ts

@@ -1,5 +1,10 @@
 export declare const WORKSPACE_VISUAL_SOURCE_MAX_BYTES = 1500000;
 export declare const WORKSPACE_VISUAL_BINARY_MAX_BYTES: number;
+/**
+ * Retained workspace files (CRM record attachments). Table-import staging is not
+ * a workspace file and never reads these two ceilings: it stages under
+ * `imports/` through `presignImportUpload` up to the plan's import file limit.
+ */
 export declare const WORKSPACE_OPAQUE_FILE_MAX_BYTES: number;
 /** Platform abuse guard shared by every plan, not a storage entitlement. */
 export declare const WORKSPACE_RETAINED_FILES_MAX_BYTES: number;

package/node_modules/@oxygen/shared/dist/workspace-file-storage.js

@@ -6,6 +6,11 @@ import { OxygenError } from "./cli-result.js";
 import { resolveObjectStorageClient } from "./object-storage.js";
 export const WORKSPACE_VISUAL_SOURCE_MAX_BYTES = 1_500_000;
 export const WORKSPACE_VISUAL_BINARY_MAX_BYTES = 50 * 1024 * 1024;
+/**
+ * Retained workspace files (CRM record attachments). Table-import staging is not
+ * a workspace file and never reads these two ceilings: it stages under
+ * `imports/` through `presignImportUpload` up to the plan's import file limit.
+ */
 export const WORKSPACE_OPAQUE_FILE_MAX_BYTES = 100 * 1024 * 1024;
 /** Platform abuse guard shared by every plan, not a storage entitlement. */
 export const WORKSPACE_RETAINED_FILES_MAX_BYTES = 1024 * 1024 * 1024;

package/node_modules/@oxygen/workflows/dist/graph/manifest-schema.d.ts

@@ -121,7 +121,7 @@ export declare const workflowCodeV1Schema: {
                 readonly timeout_ms: {
                     readonly type: "integer";
                     readonly minimum: 10;
-                    readonly maximum: 10000;
+                    readonly maximum: 30000;
                     readonly default: 1000;
                 };
                 readonly max_input_bytes: {
@@ -779,7 +779,7 @@ export declare const workflowGraphManifestSchema: {
                                     readonly timeout_ms: {
                                         readonly type: "integer";
                                         readonly minimum: 10;
-                                        readonly maximum: 10000;
+                                        readonly maximum: 30000;
                                         readonly default: 1000;
                                     };
                                     readonly max_input_bytes: {
@@ -1569,7 +1569,7 @@ export declare const portableWorkflowDefinitionSchema: {
                                             readonly timeout_ms: {
                                                 readonly type: "integer";
                                                 readonly minimum: 10;
-                                                readonly maximum: 10000;
+                                                readonly maximum: 30000;
                                                 readonly default: 1000;
                                             };
                                             readonly max_input_bytes: {

package/node_modules/@oxygen/workflows/dist/graph/types.d.ts

@@ -162,8 +162,22 @@ export declare const WORKFLOW_CODE_V1_RUNTIME = "oxygen-js-v1";
 export declare const WORKFLOW_CODE_V1_MAX_SOURCE_BYTES: number;
 export declare const WORKFLOW_CODE_V1_MAX_INPUTS = 100;
 export declare const WORKFLOW_CODE_V1_MIN_TIMEOUT_MS = 10;
-export declare const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 10000;
+/**
+ * The longest a typed Code node may declare (`limits.timeout_ms`): 30 s on every
+ * plan (repricing 2026-09, decision L4.3, up from 10 s). It applies to this
+ * sandboxed microVM runtime only; the legacy synchronous `run_source` path keeps
+ * its own lower ceiling (`PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS`, proposal P-49).
+ */
+export declare const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 30000;
 export declare const WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS = 1000;
+/**
+ * The wall-clock budget of one workflow run attempt on every plan: 30 minutes
+ * (repricing 2026-09, decision L4.3, up from 10). An attempt that reaches it is
+ * stopped and resumed from its durable checkpoints, not failed. The worker's
+ * default recipe timeout reads this; a deployment may still pin a lower value
+ * with `OXYGEN_WORKER_RECIPE_TIMEOUT_MS`.
+ */
+export declare const WORKFLOW_RUN_ATTEMPT_TIMEOUT_MS: number;
 export declare const WORKFLOW_CODE_V1_MIN_INPUT_BYTES = 1000;
 export declare const WORKFLOW_CODE_V1_MAX_INPUT_BYTES = 2000000;
 export declare const WORKFLOW_CODE_V1_DEFAULT_INPUT_BYTES = 250000;

package/node_modules/@oxygen/workflows/dist/graph/types.js

@@ -90,8 +90,22 @@ export const WORKFLOW_CODE_V1_RUNTIME = "oxygen-js-v1";
 export const WORKFLOW_CODE_V1_MAX_SOURCE_BYTES = 64 * 1_024;
 export const WORKFLOW_CODE_V1_MAX_INPUTS = 100;
 export const WORKFLOW_CODE_V1_MIN_TIMEOUT_MS = 10;
-export const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 10_000;
+/**
+ * The longest a typed Code node may declare (`limits.timeout_ms`): 30 s on every
+ * plan (repricing 2026-09, decision L4.3, up from 10 s). It applies to this
+ * sandboxed microVM runtime only; the legacy synchronous `run_source` path keeps
+ * its own lower ceiling (`PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS`, proposal P-49).
+ */
+export const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 30_000;
 export const WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS = 1_000;
+/**
+ * The wall-clock budget of one workflow run attempt on every plan: 30 minutes
+ * (repricing 2026-09, decision L4.3, up from 10). An attempt that reaches it is
+ * stopped and resumed from its durable checkpoints, not failed. The worker's
+ * default recipe timeout reads this; a deployment may still pin a lower value
+ * with `OXYGEN_WORKER_RECIPE_TIMEOUT_MS`.
+ */
+export const WORKFLOW_RUN_ATTEMPT_TIMEOUT_MS = 30 * 60 * 1000;
 export const WORKFLOW_CODE_V1_MIN_INPUT_BYTES = 1_000;
 export const WORKFLOW_CODE_V1_MAX_INPUT_BYTES = 2_000_000;
 export const WORKFLOW_CODE_V1_DEFAULT_INPUT_BYTES = 250_000;

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -341,6 +341,43 @@ export declare function nextCronRunAfter(input: {
     timezone?: string | null;
     after?: Date;
 }): Date;
+/**
+ * The first slot of `cron` strictly after `after` that is also at least
+ * `minIntervalMinutes` after `lastFireAt`. This is how a plan's minimum cron
+ * interval (repricing 2026-09, decision L4.2) is enforced at fire time: a
+ * schedule that fires closer together than the plan allows keeps running, only
+ * slower, and is never deleted (proposal P-47). With no last fire or a minimum
+ * of one minute or less it is exactly `nextCronRunAfter`.
+ */
+export declare function nextCronRunAfterMinInterval(input: {
+    cron: string;
+    timezone?: string | null;
+    after: Date;
+    lastFireAt?: Date | null;
+    minIntervalMinutes?: number | null;
+}): Date;
+/**
+ * The smallest gap in minutes between two consecutive fires of `cron`, which is
+ * what a plan's minimum cron interval is checked against (repricing 2026-09,
+ * decision L4.2). It is the smallest gap, never the average: `0,5 9 * * *`
+ * fires once a day on average but twice five minutes apart, so its gap is 5.
+ *
+ * Gaps are measured in real time in `timezone`. A daylight-saving change can
+ * bring two fires closer than their wall-clock times suggest (01:55 and 03:05
+ * are ten minutes apart on the night the clock skips from 02:00 to 03:00, and
+ * a repeated hour can fire 01:45 and then 01:00 again), so the fires around
+ * each change in the coming year are simulated as well.
+ *
+ * Returns null when the schedule never fires twice within the scan (for
+ * example `0 9 29 2 *` fires once every few years and has no meaningful gap
+ * for a minimum to bind). Throws on an unparseable expression, like
+ * `nextCronRunAfter`.
+ */
+export declare function minCronGapMinutes(input: {
+    cron: string;
+    timezone?: string | null;
+    now?: Date;
+}): number | null;
 export declare function transformStep(input: {
     id: string;
     description?: string;
@@ -449,6 +486,14 @@ export declare function assertRecipeBundleSafe(bundle: string): void;
 export declare function lintRecipeBundleSafety(bundle: string, path?: string): WorkflowLintIssue[];
 /** Comment/string-aware author feedback for the stricter oxygen-js-v1 runtime. */
 export declare function lintWorkflowCodeSourceSafety(source: string, path?: string): WorkflowLintIssue[];
+/**
+ * The ceiling of the legacy synchronous `node:vm` path below. It stays at 10 s
+ * (and its callers pass 1 s) when the typed Code node rose to 30 s (repricing
+ * 2026-09, decision L4.3; proposal P-49): this path runs on the worker's own
+ * event loop, so a long synchronous script would stall every other job and its
+ * queue lock renewal. The typed Code node runs in a separate microVM instead.
+ */
+export declare const PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS = 10000;
 export declare function runPureWorkflowFunction(input: {
     source: string;
     context: Record<string, unknown>;

package/node_modules/@oxygen/workflows/dist/index.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import * as vm from "node:vm"; // skipcq: JS-C1003
-import { isWorkflowGraphManifest, WORKFLOW_CODE_V1_DEFAULT_OUTPUT_BYTES, WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES, WORKFLOW_CODE_V1_MAX_TIMEOUT_MS, WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, } from "./graph/types.js";
+import { isWorkflowGraphManifest, WORKFLOW_CODE_V1_DEFAULT_OUTPUT_BYTES, WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, } from "./graph/types.js";
 import { lintWorkflowGraphManifest } from "./graph/lint.js";
 export * from "./usage-estimate.js";
 // Pure event-dispatch semantics, shared by the apps/web and apps/worker event
@@ -162,6 +162,148 @@ export function nextCronRunAfter(input) {
     }
     throw new Error(`Cron expression has no matching run time in the next ${MAX_CRON_LOOKAHEAD_DAYS} days.`);
 }
+/**
+ * The first slot of `cron` strictly after `after` that is also at least
+ * `minIntervalMinutes` after `lastFireAt`. This is how a plan's minimum cron
+ * interval (repricing 2026-09, decision L4.2) is enforced at fire time: a
+ * schedule that fires closer together than the plan allows keeps running, only
+ * slower, and is never deleted (proposal P-47). With no last fire or a minimum
+ * of one minute or less it is exactly `nextCronRunAfter`.
+ */
+export function nextCronRunAfterMinInterval(input) {
+    const minIntervalMs = Math.max(0, input.minIntervalMinutes ?? 0) * 60_000;
+    let after = input.after;
+    if (input.lastFireAt && minIntervalMs > 60_000) {
+        // One millisecond before the earliest allowed instant: nextCronRunAfter
+        // returns the first whole-minute slot strictly after it, so a slot exactly
+        // `minIntervalMinutes` after the last fire is allowed.
+        const earliestAllowed = input.lastFireAt.getTime() + minIntervalMs - 1;
+        if (earliestAllowed > after.getTime())
+            after = new Date(earliestAllowed);
+    }
+    return nextCronRunAfter({ cron: input.cron, timezone: input.timezone ?? null, after });
+}
+// How many calendar days minCronGapMinutes scans for two matching days in a
+// row: two leap cycles, so a Feb 29 or a day-of-month/weekday coincidence is
+// always seen.
+const CRON_GAP_DAY_SCAN = 366 * 8 + 2;
+// Real-time simulation around a daylight-saving change covers the day it falls
+// in plus this many whole days either side (so the fire before a long gap that
+// straddles the change is inside the window), and stops after this many fires.
+const CRON_GAP_DST_WINDOW_DAYS = 1;
+const CRON_GAP_DST_MAX_FIRES = 5_000;
+/**
+ * The smallest gap in minutes between two consecutive fires of `cron`, which is
+ * what a plan's minimum cron interval is checked against (repricing 2026-09,
+ * decision L4.2). It is the smallest gap, never the average: `0,5 9 * * *`
+ * fires once a day on average but twice five minutes apart, so its gap is 5.
+ *
+ * Gaps are measured in real time in `timezone`. A daylight-saving change can
+ * bring two fires closer than their wall-clock times suggest (01:55 and 03:05
+ * are ten minutes apart on the night the clock skips from 02:00 to 03:00, and
+ * a repeated hour can fire 01:45 and then 01:00 again), so the fires around
+ * each change in the coming year are simulated as well.
+ *
+ * Returns null when the schedule never fires twice within the scan (for
+ * example `0 9 29 2 *` fires once every few years and has no meaningful gap
+ * for a minimum to bind). Throws on an unparseable expression, like
+ * `nextCronRunAfter`.
+ */
+export function minCronGapMinutes(input) {
+    const schedule = parseCronSchedule(input.cron);
+    const timezone = input.timezone?.trim() || DEFAULT_WORKFLOW_CRON_TIMEZONE;
+    const fireMinutes = [...schedule.hours]
+        .flatMap((hour) => [...schedule.minutes].map((minute) => hour * 60 + minute))
+        .sort((a, b) => a - b);
+    let gap = Number.POSITIVE_INFINITY;
+    for (let index = 1; index < fireMinutes.length; index += 1) {
+        gap = Math.min(gap, (fireMinutes[index] ?? 0) - (fireMinutes[index - 1] ?? 0));
+    }
+    const dayGap = smallestMatchingDayGap(schedule);
+    const firstFire = fireMinutes[0];
+    const lastFire = fireMinutes[fireMinutes.length - 1];
+    if (dayGap !== null && firstFire !== undefined && lastFire !== undefined) {
+        gap = Math.min(gap, dayGap * 24 * 60 + firstFire - lastFire);
+    }
+    // A one-minute gap is the floor of the cron grammar; daylight saving cannot
+    // bring two fires closer than that.
+    if (gap > 1) {
+        const dstGap = smallestGapAroundDaylightSavingChanges(input.cron, timezone, input.now ?? new Date());
+        if (dstGap !== null)
+            gap = Math.min(gap, dstGap);
+    }
+    return Number.isFinite(gap) ? gap : null;
+}
+/** Fewest days between two calendar days the schedule's date fields both match. */
+function smallestMatchingDayGap(schedule) {
+    // Calendar arithmetic only (no timezone): day-of-month, month and weekday
+    // matching is the same on every clock. A fixed leap-year start covers every
+    // weekday/day-of-month combination within the scan.
+    const start = Date.UTC(2024, 0, 1);
+    let previousMatch = null;
+    let smallest = null;
+    for (let day = 0; day < CRON_GAP_DAY_SCAN; day += 1) {
+        const date = new Date(start + day * 24 * 60 * 60 * 1000);
+        const matches = matchesCronDate(schedule, {
+            minute: 0,
+            hour: 0,
+            dayOfMonth: date.getUTCDate(),
+            month: date.getUTCMonth() + 1,
+            dayOfWeek: date.getUTCDay(),
+        });
+        if (!matches)
+            continue;
+        if (previousMatch !== null) {
+            const gap = day - previousMatch;
+            smallest = smallest === null ? gap : Math.min(smallest, gap);
+            if (smallest === 1)
+                return 1;
+        }
+        previousMatch = day;
+    }
+    return smallest;
+}
+/**
+ * The smallest real-time gap between fires in the days around each
+ * daylight-saving change in the year after `now`; null when the zone has no
+ * change in that year or no two fires fall in any window.
+ */
+function smallestGapAroundDaylightSavingChanges(cron, timezone, now) {
+    const dayMs = 24 * 60 * 60 * 1000;
+    const start = Math.floor(now.getTime() / dayMs) * dayMs;
+    let smallest = null;
+    let previousOffset = zonedOffsetMinutes(new Date(start), timezone);
+    for (let day = 1; day <= 367; day += 1) {
+        const offset = zonedOffsetMinutes(new Date(start + day * dayMs), timezone);
+        if (offset === previousOffset)
+            continue;
+        previousOffset = offset;
+        const windowStart = new Date(start + (day - 1 - CRON_GAP_DST_WINDOW_DAYS) * dayMs);
+        const windowEnd = start + (day + CRON_GAP_DST_WINDOW_DAYS) * dayMs;
+        let fire = nextCronRunAfter({ cron, timezone, after: windowStart });
+        for (let fires = 0; fires < CRON_GAP_DST_MAX_FIRES && fire.getTime() <= windowEnd; fires += 1) {
+            const next = nextCronRunAfter({ cron, timezone, after: fire });
+            if (next.getTime() > windowEnd)
+                break;
+            const gap = Math.round((next.getTime() - fire.getTime()) / 60_000);
+            smallest = smallest === null ? gap : Math.min(smallest, gap);
+            fire = next;
+        }
+    }
+    return smallest;
+}
+/** Minutes the zone's wall clock is ahead of UTC at `date`. */
+function zonedOffsetMinutes(date, timezone) {
+    const formatter = getZonedFormatter(timezone);
+    const parts = new Map();
+    for (const part of formatter.formatToParts(date)) {
+        if (part.type !== "literal")
+            parts.set(part.type, part.value);
+    }
+    const wallClock = Date.UTC(Number(parts.get("year")), Number(parts.get("month")) - 1, Number(parts.get("day")), Number(parts.get("hour")), Number(parts.get("minute")));
+    const instant = Math.floor(date.getTime() / 60_000) * 60_000;
+    return Math.round((wallClock - instant) / 60_000);
+}
 export function transformStep(input) {
     return {
         __oxygen_workflow_step: true,
@@ -983,8 +1125,16 @@ export function lintWorkflowCodeSourceSafety(source, path = "$.source") {
     }
     return issues;
 }
+/**
+ * The ceiling of the legacy synchronous `node:vm` path below. It stays at 10 s
+ * (and its callers pass 1 s) when the typed Code node rose to 30 s (repricing
+ * 2026-09, decision L4.3; proposal P-49): this path runs on the worker's own
+ * event loop, so a long synchronous script would stall every other job and its
+ * queue lock renewal. The typed Code node runs in a separate microVM instead.
+ */
+export const PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS = 10_000;
 export async function runPureWorkflowFunction(input) {
-    const timeoutMs = Math.max(WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, Math.min(input.timeoutMs ?? WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_TIMEOUT_MS));
+    const timeoutMs = Math.max(WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, Math.min(input.timeoutMs ?? WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS));
     const maxOutputBytes = Math.max(WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, Math.min(input.maxOutputBytes ?? WORKFLOW_CODE_V1_DEFAULT_OUTPUT_BYTES, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES));
     const issues = [];
     validatePureFunctionSource(input.source, "$.source", (path, code, message) => {

package/node_modules/@oxygen/workflows/dist/usage-estimate.d.ts

@@ -3,7 +3,12 @@ export type WorkflowAutomationUsageEstimate = {
     scheduledRunsPer30Days: number | null;
     scheduledActionsPer30DaysFloor: number | null;
     dynamicRuntimeActions: boolean;
-    perRowFanout: boolean;
+    /**
+     * Always false: row writes stopped billing per row (repricing 2026-09,
+     * decision 6.2). Kept for one release so older CLIs and pages that read it
+     * still parse; remove after that release.
+     */
+    perRowFanout: false;
 };
 export declare function estimateWorkflowRunAutomationActionsFloor(manifest: unknown): number;
 export declare function estimateWorkflowAutomationUsage(manifest: unknown, cron?: string | null): WorkflowAutomationUsageEstimate | null;
@@ -16,6 +21,8 @@ export type CronCadenceAssessment = {
     floorShareOfIncluded: number;
     basis: "plan_action_quota" | "plan_monthly_credits";
     includedCredits: number | null;
+    spendableCredits: number | null;
+    allowanceCredits: number | null;
     floorCreditsPer30Days: number | null;
     minimumViableIntervalMinutes: number | null;
     verdict: "fits" | "impossible";
@@ -27,6 +34,8 @@ export declare function assessCronCadenceViability(input: {
     overageEnabled: boolean;
     includedCredits?: number | null;
     creditsPerAction?: number | null;
+    /** Credits the workspace can spend right now (its available balance). */
+    spendableCredits?: number | null;
 }): CronCadenceAssessment | null;
 export type CronAggressiveness = {
     level: "aggressive" | "very_aggressive";

package/node_modules/@oxygen/workflows/dist/usage-estimate.js

@@ -1,14 +1,14 @@
-// Static automation-action usage estimation shared by the web workflow page
-// and the worker scheduler's admission gate. The per-run count derived from a
-// manifest is a FLOOR, never a projection: runtime metering bills 1 action per
-// EMITTED checkpoint (recipe code loops multiply), 1 per row written by
-// oxygen.rows_upsert (see estimateAutomationActionsForTool in
-// @oxygen/integrations automation-usage.ts), and retried attempts bill again.
-// Surfaces must present these numbers as minimums; observed run history is the
-// honest projection (projectObservedAutomationUsage below).
+// Static automation usage estimation shared by the web workflow page and the
+// worker scheduler's admission gate. The unit is the workflow STEP: every step a
+// live run executes bills one (repricing 2026-09, decision 6.1) and rows written
+// inside a run are free (decision 6.2), so a row-writing step costs one step
+// however many rows it writes. The per-run count derived from a manifest is a
+// FLOOR, never a projection: recipe code emits one step per checkpoint (loops
+// multiply) and a retried attempt bills again. Surfaces present these numbers as
+// minimums; observed run history is the honest projection
+// (projectObservedAutomationUsage below).
 import { loopBodyNodeIds } from "./graph/topology.js";
 import { isWorkflowGraphManifest, workflowGraphNodeKindBills, MAX_WORKFLOW_LOOP_ITERATIONS, } from "./graph/types.js";
-const ROW_FANOUT_TOOL_IDS = new Set(["oxygen.rows_upsert"]);
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -64,21 +64,6 @@ function manifestHasDynamicRuntimeActions(manifest) {
     return graph.nodes.some((node) => node.hasRecipe
         || (node.kind === "loop" && !node.disabled && declaredLoopIterations(node.maxIterations) === null));
 }
-function manifestWritesRowsPerRun(manifest) {
-    if (!isRecord(manifest))
-        return false;
-    const steps = Array.isArray(manifest.steps) ? manifest.steps : null;
-    if (steps) {
-        return steps.some((step) => isRecord(step) && step.kind === "tool" && typeof step.tool === "string" && ROW_FANOUT_TOOL_IDS.has(step.tool));
-    }
-    const graph = readWorkflowGraph(manifest);
-    if (graph) {
-        return graph.nodes.some((node) => (node.kind === "tool" && typeof node.tool === "string" && ROW_FANOUT_TOOL_IDS.has(node.tool))
-            || node.recipeTools.some((tool) => ROW_FANOUT_TOOL_IDS.has(tool)));
-    }
-    const toolsUsed = Array.isArray(manifest.tools_used) ? manifest.tools_used : [];
-    return toolsUsed.some((tool) => typeof tool === "string" && ROW_FANOUT_TOOL_IDS.has(tool));
-}
 function readWorkflowGraph(manifest) {
     if (!isWorkflowGraphManifest(manifest))
         return null;
@@ -194,7 +179,7 @@ export function estimateWorkflowAutomationUsage(manifest, cron) {
         scheduledRunsPer30Days,
         scheduledActionsPer30DaysFloor: scheduledRunsPer30Days === null ? null : scheduledRunsPer30Days * actionsPerRunFloor,
         dynamicRuntimeActions: manifestHasDynamicRuntimeActions(manifest),
-        perRowFanout: manifestWritesRowsPerRun(manifest),
+        perRowFanout: false,
     };
 }
 // Fixed 30-day month, minute and hour fields treated independently; timezone
@@ -279,8 +264,15 @@ const MINUTES_PER_30_DAYS = 43_200;
 // Cadence-vs-allowance arithmetic for a cron trigger, using the manifest FLOOR
 // (see the header): the cheapest run this workflow can physically have. A
 // verdict of "impossible" is therefore a lower bound that already overruns the
-// plan — the real run cost is only ever higher, because row fan-out is added at
-// runtime and is unbounded.
+// allowance — the real run cost is only ever higher (recipe checkpoints, loops
+// over run-time collections and retries add steps).
+//
+// On the credit basis the allowance is the plan's monthly credits OR the
+// balance the workspace can spend, whichever is larger (proposal P-65): at 0.05
+// a step an every-minute, 5-step cron costs 10,800 credits a month, more than
+// the $99 plan includes, and a workspace that funded that from top-ups must be
+// able to arm it. The fire-time gate charges against the balance, so a funded
+// cron is never paused mid-month either.
 //
 // Returns null when the question is not decidable or not meaningful:
 // no cron (on-demand), an unparseable cron, an unlimited allowance, or overage
@@ -299,6 +291,16 @@ export function assessCronCadenceViability(input) {
         && input.includedCredits > 0
         ? input.includedCredits
         : null;
+    const spendableCredits = typeof input.spendableCredits === "number"
+        && Number.isFinite(input.spendableCredits)
+        && input.spendableCredits > 0
+        ? input.spendableCredits
+        : null;
+    // A plan without monthly credits (free) is never judged here: its crons run on
+    // the balance and the fire-time gate is their only stop, as before.
+    const allowanceCredits = includedCredits === null
+        ? null
+        : Math.max(includedCredits, spendableCredits ?? 0);
     // Prefer a real action quota when the plan still has one; otherwise derive the
     // equivalent action budget from monthly credits.
     const basis = input.includedActions === null
@@ -306,8 +308,8 @@ export function assessCronCadenceViability(input) {
         : "plan_action_quota";
     const includedActions = basis === "plan_action_quota"
         ? input.includedActions
-        : (includedCredits !== null && creditsPerAction !== null
-            ? Math.floor(includedCredits / creditsPerAction)
+        : (allowanceCredits !== null && creditsPerAction !== null
+            ? Math.floor(allowanceCredits / creditsPerAction)
             : null);
     if (includedActions === null)
         return null;
@@ -327,6 +329,8 @@ export function assessCronCadenceViability(input) {
         floorShareOfIncluded: floorActionsPer30Days / includedActions,
         basis,
         includedCredits: basis === "plan_monthly_credits" ? includedCredits : null,
+        spendableCredits: basis === "plan_monthly_credits" ? spendableCredits : null,
+        allowanceCredits: basis === "plan_monthly_credits" ? allowanceCredits : null,
         floorCreditsPer30Days: basis === "plan_monthly_credits" && creditsPerAction !== null
             ? Math.round(floorActionsPer30Days * creditsPerAction * 1000) / 1000
             : null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1010.650",
+  "version": "1.1010.905",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",

package/node_modules/@oxygen/shared/dist/email-warmup-readiness.d.ts

@@ -1,64 +0,0 @@
-/**
- * PURE warm-up readiness rule: what daily cold volume a sending mailbox can
- * actually carry, given its warm-up age rather than a provider's opinion of it.
- *
- * WHY it lives in @oxygen/shared and not next to the other email-health rules in
- * @oxygen/integrations: the tenant rollup computes this per mailbox, and
- * @oxygen/tenant-db must never import @oxygen/integrations (integrations depends
- * on tenant-db). Duplicating the thresholds so each package could own a copy is
- * exactly how two surfaces start recommending different numbers, so the rule is
- * defined once here and re-exported from
- * packages/integrations/src/email-health/health-state.ts, which stays the
- * email-health surface every caller reads.
- *
- * DIRECTIONAL, like everything else in the deliverability cluster: it produces a
- * recommendation and a launch-preview warning. It never clamps a cap, never
- * pauses a mailbox, and never changes what a sequence sends.
- */
-/** Below this warm-up day a mailbox should carry only the starter cold volume. */
-export declare const WARMUP_EARLY_DAY_LIMIT = 14;
-/** Below this warm-up day a mailbox should stay at the reduced cold volume. */
-export declare const WARMUP_ESTABLISHED_DAY_LIMIT = 28;
-/** Recommended cold sends/day before day 14 (and for an un-warmed young mailbox). */
-export declare const WARMUP_EARLY_DAILY_CAP = 5;
-/** Recommended cold sends/day between day 14 and day 28. */
-export declare const WARMUP_ESTABLISHED_DAILY_CAP = 10;
-/** A warm-up health score under this is treated as "not ready for volume". */
-export declare const WARMUP_HEALTH_SCORE_FLOOR = 60;
-/** Hard-bounce rate above which a fleet is burning its domains, not just its list. */
-export declare const HARD_BOUNCE_RATE_CEILING = 0.03;
-/** Below this send volume a bounce rate is noise, not a signal. */
-export declare const HARD_BOUNCE_RATE_MIN_SENDS = 20;
-/**
- * The DIRECTIONAL per-mailbox daily cold-send ceiling warm-up readiness supports,
- * or null when nothing in the evidence argues for holding volume back.
- *
- * Pure — the caller resolves `mailboxAgeDays` from created_at, so this stays
- * clock-free and identical on every surface.
- *
- *   - warm-up day < 14                                    -> 5/day
- *   - mailbox younger than 28 days, with either no active
- *     warm-up or no warm-up day reported at all           -> 5/day
- *   - warm-up day < 28                                    -> 10/day
- *   - warm-up health score < 60                           -> at most 5/day
- *   - otherwise                                           -> null (no advice)
- *
- * The second rule is the one that matters for a freshly provisioned fleet: a
- * mailbox whose warm-up never started (state "unknown") reports no day at all,
- * and a rule keyed only on the day number would have said nothing about the exact
- * mailboxes most likely to get blocked.
- */
-export declare function recommendedDailyCapForWarmup(input: {
-    warmupState?: string | null;
-    warmupDay?: number | null;
-    warmupHealthScore?: number | null;
-    mailboxAgeDays?: number | null;
-}): number | null;
-/**
- * True when a hard-bounce count is high enough, over enough sends, to be a real
- * reputation problem rather than list noise.
- */
-export declare function hardBounceRateIsHigh(input: {
-    hardBounces: number;
-    coldSends: number;
-}): boolean;

package/node_modules/@oxygen/shared/dist/email-warmup-readiness.js

@@ -1,90 +0,0 @@
-/**
- * PURE warm-up readiness rule: what daily cold volume a sending mailbox can
- * actually carry, given its warm-up age rather than a provider's opinion of it.
- *
- * WHY it lives in @oxygen/shared and not next to the other email-health rules in
- * @oxygen/integrations: the tenant rollup computes this per mailbox, and
- * @oxygen/tenant-db must never import @oxygen/integrations (integrations depends
- * on tenant-db). Duplicating the thresholds so each package could own a copy is
- * exactly how two surfaces start recommending different numbers, so the rule is
- * defined once here and re-exported from
- * packages/integrations/src/email-health/health-state.ts, which stays the
- * email-health surface every caller reads.
- *
- * DIRECTIONAL, like everything else in the deliverability cluster: it produces a
- * recommendation and a launch-preview warning. It never clamps a cap, never
- * pauses a mailbox, and never changes what a sequence sends.
- */
-/** Below this warm-up day a mailbox should carry only the starter cold volume. */
-export const WARMUP_EARLY_DAY_LIMIT = 14;
-/** Below this warm-up day a mailbox should stay at the reduced cold volume. */
-export const WARMUP_ESTABLISHED_DAY_LIMIT = 28;
-/** Recommended cold sends/day before day 14 (and for an un-warmed young mailbox). */
-export const WARMUP_EARLY_DAILY_CAP = 5;
-/** Recommended cold sends/day between day 14 and day 28. */
-export const WARMUP_ESTABLISHED_DAILY_CAP = 10;
-/** A warm-up health score under this is treated as "not ready for volume". */
-export const WARMUP_HEALTH_SCORE_FLOOR = 60;
-/** Hard-bounce rate above which a fleet is burning its domains, not just its list. */
-export const HARD_BOUNCE_RATE_CEILING = 0.03;
-/** Below this send volume a bounce rate is noise, not a signal. */
-export const HARD_BOUNCE_RATE_MIN_SENDS = 20;
-/** Warm-up states in which a vendor is actively conditioning the mailbox. */
-const ACTIVE_WARMUP_STATES = new Set(["warming", "active"]);
-function finiteOrNull(value) {
-    return typeof value === "number" && Number.isFinite(value) ? value : null;
-}
-/**
- * The DIRECTIONAL per-mailbox daily cold-send ceiling warm-up readiness supports,
- * or null when nothing in the evidence argues for holding volume back.
- *
- * Pure — the caller resolves `mailboxAgeDays` from created_at, so this stays
- * clock-free and identical on every surface.
- *
- *   - warm-up day < 14                                    -> 5/day
- *   - mailbox younger than 28 days, with either no active
- *     warm-up or no warm-up day reported at all           -> 5/day
- *   - warm-up day < 28                                    -> 10/day
- *   - warm-up health score < 60                           -> at most 5/day
- *   - otherwise                                           -> null (no advice)
- *
- * The second rule is the one that matters for a freshly provisioned fleet: a
- * mailbox whose warm-up never started (state "unknown") reports no day at all,
- * and a rule keyed only on the day number would have said nothing about the exact
- * mailboxes most likely to get blocked.
- */
-export function recommendedDailyCapForWarmup(input) {
-    const day = finiteOrNull(input.warmupDay);
-    const ageDays = finiteOrNull(input.mailboxAgeDays);
-    const healthScore = finiteOrNull(input.warmupHealthScore);
-    const warmingNow = ACTIVE_WARMUP_STATES.has((input.warmupState ?? "").trim().toLowerCase());
-    let cap = null;
-    if (day !== null && day < WARMUP_EARLY_DAY_LIMIT) {
-        cap = WARMUP_EARLY_DAILY_CAP;
-    }
-    else if (ageDays !== null &&
-        ageDays < WARMUP_ESTABLISHED_DAY_LIMIT &&
-        (day === null || !warmingNow)) {
-        // A rail that reports "warming" but no day number proves nothing about how
-        // far the ramp got, so age still governs. Gating this on !warmingNow alone
-        // left exactly that mailbox — enrolled, young, no telemetry — with no advice.
-        cap = WARMUP_EARLY_DAILY_CAP;
-    }
-    else if (day !== null && day < WARMUP_ESTABLISHED_DAY_LIMIT) {
-        cap = WARMUP_ESTABLISHED_DAILY_CAP;
-    }
-    if (healthScore !== null && healthScore < WARMUP_HEALTH_SCORE_FLOOR) {
-        cap = cap === null ? WARMUP_EARLY_DAILY_CAP : Math.min(cap, WARMUP_EARLY_DAILY_CAP);
-    }
-    return cap;
-}
-/**
- * True when a hard-bounce count is high enough, over enough sends, to be a real
- * reputation problem rather than list noise.
- */
-export function hardBounceRateIsHigh(input) {
-    if (!Number.isFinite(input.coldSends) || input.coldSends < HARD_BOUNCE_RATE_MIN_SENDS) {
-        return false;
-    }
-    return input.hardBounces / input.coldSends > HARD_BOUNCE_RATE_CEILING;
-}