@oxygen-agent/cli 1.1010.721 → 1.1010.905

package/node_modules/@oxygen/shared/dist/plan-band.js

@@ -1,7 +1,8 @@
-import { resolveBasePricingPlan } from "./billing.js";
-import { planLimitsForTier, limitsTierForPlanTier } from "./plan-limits.js";
-import { DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING, DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS, DEFAULT_BYOK_PROVIDER_DAILY_CALL_CAP, DEFAULT_TRIGGER_RUN_CREDIT_CEILING, resolveOrgDailySpendGuard, } from "./spend-safety.js";
-import { resolveWorkspaceTableCapacity } from "./table-capacity.js";
+import { planVolumeBonusCredits, planVolumeBonusPercent, resolveBasePricingPlan } from "./billing.js";
+import { planLimitsForTier, limitsTierForPlanTier, resolveCronMinIntervalMinutes, resolvePlanAgentCreditLimits, } from "./plan-limits.js";
+import { COPILOT_ATTENDED_INFERENCE_CREDIT_CEILING, DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING, DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS, DEFAULT_BYOK_PROVIDER_DAILY_CALL_CAP, DEFAULT_TRIGGER_RUN_CREDIT_CEILING, copilotApprovalFreeAllowanceForBand, resolveOrgDailySpendGuard, resolveSpendSafetyPlanTier, } from "./spend-safety.js";
+import { isRepricingInForce, tenthOfMonthlyCreditsRoundedHalfUp, } from "./repricing.js";
+import { describeWorkspaceTableCapacityStatus, resolveWorkspaceTableCapacity, } from "./table-capacity.js";
 export const PLAN_BAND_ORDER = [
     "free",
     "49",
@@ -21,6 +22,24 @@ export const PLAN_BAND_LIMITS_TIER = Object.freeze({
     "999": "team",
     "1999": "scale",
 });
+/**
+ * L4.1 (repricing 2026-09, slice S55; decision record "Worker share"): a
+ * tenant's share of the legacy worker's tenant queue while other tenants wait.
+ * A weight-16 tenant gets sixteen quanta for every one a weight-1 tenant gets;
+ * with nobody else waiting every tenant is served at once, whatever its weight.
+ * It is a scheduling share, never a sold limit: capacity is sized so contention
+ * is rare (`.agents/skills/oxygen-worker-performance`, "Worker share target").
+ * An org whose band is not yet resolved schedules at the free weight.
+ */
+export const PLAN_BAND_WORKER_SHARE_WEIGHT = Object.freeze({
+    free: 1,
+    "49": 2,
+    "99": 2,
+    "199": 4,
+    "499": 4,
+    "999": 8,
+    "1999": 16,
+});
 /**
  * PROPOSED (P-57, repricing spec § 4): a grandfathered or legacy plan takes the
  * band of the limits rung it enforces at today, so no grandfathered customer
@@ -82,6 +101,115 @@ export function planBandMonthlyPriceCents(band) {
 export function planBandLabel(band) {
     return band === "free" ? "Free" : `Oxygen $${Number(band).toLocaleString("en-US")}`;
 }
+// ---- Default credit ceiling of one unattended delivery (decision L5.1) ------
+/**
+ * PROPOSED (P-54): the free plan keeps a 50-credit default. It has no monthly
+ * grant to take 10% of (10% of its one-time 1,000 would be 100).
+ */
+export const FREE_PLAN_DEFAULT_DELIVERY_CREDIT_CEILING = 50;
+/**
+ * The grandfathered plans that take 10% of their OWN monthly credits (PROPOSED
+ * P-62: Starter 990, Pro 2,490, Team 7,490) rather than their band's. Other
+ * legacy plan keys take the band of the rung they enforce at (P-57).
+ */
+const OWN_CREDITS_DELIVERY_CEILING_PLAN_KEYS = new Set(["starter", "pro", "team"]);
+/**
+ * A plan size's target default delivery ceiling: 10% of its monthly credits,
+ * rounded half up (decision L5.1; the volume bonus counts, the partner bonus
+ * does not, P-54). This is the target, not always the value in force: see
+ * `resolveDefaultTriggerRunCreditCeilingForPlan`.
+ */
+export function planBandDeliveryCreditCeilingTarget(band) {
+    if (band === "free")
+        return FREE_PLAN_DEFAULT_DELIVERY_CREDIT_CEILING;
+    const monthlyCredits = resolveBasePricingPlan(`oxygen_${band}`)?.monthlyCredits;
+    if (typeof monthlyCredits !== "number" || !(monthlyCredits > 0)) {
+        throw new Error(`plan-band: no monthly credits for the ${band} plan`);
+    }
+    return tenthOfMonthlyCreditsRoundedHalfUp(monthlyCredits);
+}
+function planBandForSpendResolution(resolution) {
+    return resolution.planTier
+        ? planBandForPlanTier(resolution.planTier)
+        : LEGACY_PLAN_BAND_BY_LIMITS_TIER[resolution.limitsTier];
+}
+function resolveDeliveryCreditCeiling(resolution, preRepricingTable, options) {
+    const before = preRepricingTable[resolveSpendSafetyPlanTier(resolution.planTier, resolution.limitsTier)];
+    // Enterprise runs on custom limits and has no default, before or after.
+    if (before === null || before === undefined)
+        return null;
+    const ownPlan = resolution.planTier && OWN_CREDITS_DELIVERY_CEILING_PLAN_KEYS.has(resolution.planTier)
+        ? resolveBasePricingPlan(resolution.planTier)
+        : null;
+    const target = ownPlan && typeof ownPlan.monthlyCredits === "number" && ownPlan.monthlyCredits > 0
+        ? tenthOfMonthlyCreditsRoundedHalfUp(ownPlan.monthlyCredits)
+        : planBandDeliveryCreditCeilingTarget(planBandForSpendResolution(resolution));
+    // A larger default ships on release; a smaller one is a tightening and waits
+    // for the effective-date switch (`spend.<band>.default_delivery_credit_ceiling`).
+    if (target >= before)
+        return target;
+    return isRepricingInForce(options) ? target : before;
+}
+/**
+ * The default credit ceiling of one LIVE workflow run fired by an unattended
+ * trigger (cron, webhook, event) that declares no `max_credits`, for a plan.
+ * `null` means no default applies (enterprise); an explicit cap always wins and
+ * is never clamped by this.
+ */
+export function resolveDefaultTriggerRunCreditCeilingForPlan(resolution, options = {}) {
+    return resolveDeliveryCreditCeiling(resolution, DEFAULT_TRIGGER_RUN_CREDIT_CEILING, options);
+}
+/** The same default for one standing or webhook table auto-run batch. */
+export function resolveDefaultAutoRunBatchCreditCeilingForPlan(resolution, options = {}) {
+    return resolveDeliveryCreditCeiling(resolution, DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING, options);
+}
+/** The spend resolution a plan size stands for (its Oxygen plan key). */
+function bandSpendResolution(band) {
+    return { planTier: band === "free" ? null : `oxygen_${band}`, limitsTier: PLAN_BAND_LIMITS_TIER[band] };
+}
+/**
+ * Public webhook ingress (repricing 2026-09, decision L4.4, ratified
+ * 2026-09-26): deliveries a minute that one webhook target (a Table endpoint,
+ * a workflow or Agent trigger, the workspace's RB2B receiver) accepts. It used
+ * to be a flat 600 per target, with 60 per sender IP on most targets. Every
+ * value rises, so this is live on release rather than held behind the
+ * repricing switch.
+ */
+export const PUBLIC_WEBHOOK_INGRESS_PER_TARGET_PER_MINUTE = Object.freeze({
+    free: 600,
+    "49": 1_500,
+    "99": 1_500,
+    "199": 3_000,
+    "499": 3_000,
+    "999": 6_000,
+    "1999": 12_000,
+});
+/**
+ * PROPOSED (P-50, repricing spec § 4.4): the decision raises the per-IP limit
+ * "to match", read as equal to the per-target limit (a share of 1). One sender
+ * (a form tool, a CRM) usually posts from one address, so any lower per-IP
+ * limit would cap a real integration below its plan's rate.
+ */
+export const PUBLIC_WEBHOOK_INGRESS_PER_IP_SHARE_OF_TARGET = 1;
+export const PUBLIC_WEBHOOK_INGRESS_WINDOW_SECONDS = 60;
+/** The webhook ingress limits a band enforces. */
+export function resolvePublicWebhookIngressLimits(band) {
+    const perTarget = PUBLIC_WEBHOOK_INGRESS_PER_TARGET_PER_MINUTE[band];
+    return {
+        perTargetPerMinute: perTarget,
+        perSenderIpPerMinute: Math.round(perTarget * PUBLIC_WEBHOOK_INGRESS_PER_IP_SHARE_OF_TARGET),
+        windowSeconds: PUBLIC_WEBHOOK_INGRESS_WINDOW_SECONDS,
+    };
+}
+/** The webhook ingress limits of one band, as the `/api/cli/limits` contract reports them. */
+export function describeWebhookIngress(band) {
+    const ingress = resolvePublicWebhookIngressLimits(band);
+    return {
+        ingress_requests_per_target_per_minute: ingress.perTargetPerMinute,
+        ingress_requests_per_sender_ip_per_minute: ingress.perSenderIpPerMinute,
+        window_seconds: ingress.windowSeconds,
+    };
+}
 /** The API rates a limits rung enforces, read from `PLAN_LIMITS`. */
 export function describeApiRateLimits(tier) {
     const cli = planLimitsForTier(tier).cli;
@@ -100,6 +228,24 @@ export function describeApiRateLimits(tier) {
         rows_written_per_org: { rows: cli.tenantWrite.orgUnits.limit, window_seconds: cli.tenantWrite.orgUnits.windowSeconds },
     };
 }
+function storageTarget(limits) {
+    return {
+        table_row_limit: limits.tableRowLimit,
+        workspace_row_limit: limits.workspaceRowLimit,
+        workspace_database_warning_bytes: limits.workspaceDatabaseWarningBytes,
+        workspace_database_limit_bytes: limits.workspaceDatabaseLimitBytes,
+        import_max_rows_per_file: limits.tableRowLimit,
+    };
+}
+/** A band's storage status as `/api/cli/limits` reports it (`plan_bands[].storage` and `storage_capacity`). */
+export function describePlanBandStorageStatus(band, options = {}) {
+    const status = describeWorkspaceTableCapacityStatus(band, options);
+    return {
+        status: status.status,
+        effective_at: status.effectiveAt?.toISOString() ?? null,
+        target: status.target ? storageTarget(status.target) : null,
+    };
+}
 export function describePlanBandLimits(band, options = {}) {
     const limitsTier = PLAN_BAND_LIMITS_TIER[band];
     const storage = resolveWorkspaceTableCapacity(band, options);
@@ -108,12 +254,20 @@ export function describePlanBandLimits(band, options = {}) {
     const monthlyCredits = band === "free"
         ? null
         : resolveBasePricingPlan(`oxygen_${band}`)?.monthlyCredits ?? null;
-    const dailyGuard = resolveOrgDailySpendGuard(monthlyCredits);
+    const dailyGuard = resolveOrgDailySpendGuard(monthlyCredits, { ...options, freePlan: band === "free" });
+    const agentLimits = resolvePlanAgentCreditLimits(limitsTier, options);
+    const copilotAllowance = copilotApprovalFreeAllowanceForBand(band);
     return {
         band,
         label: planBandLabel(band),
         monthly_price_usd: monthlyPriceCents === null ? null : monthlyPriceCents / 100,
         monthly_credits: monthlyCredits,
+        volume_bonus_credits: band === "free" ? null : planVolumeBonusCredits(`oxygen_${band}`),
+        volume_bonus_percent: band === "free" ? null : planVolumeBonusPercent(`oxygen_${band}`),
+        usd_per_100_credits: monthlyPriceCents === null || !monthlyCredits
+            ? null
+            // Four decimals: $1,999 buys 229,885 credits, $0.8696 per 100.
+            : Math.round((monthlyPriceCents / monthlyCredits) * 10_000) / 10_000,
         limits_tier: limitsTier,
         api: describeApiRateLimits(limitsTier),
         storage: {
@@ -123,22 +277,33 @@ export function describePlanBandLimits(band, options = {}) {
             workspace_database_limit_bytes: storage.workspaceDatabaseLimitBytes,
             import_max_rows_per_file: storage.tableRowLimit,
             import_max_file_bytes: limits.import.maxFileBytes,
+            ...describePlanBandStorageStatus(band, options),
         },
         spend: {
-            // Bands are Oxygen plan sizes, so their spend tier is their limits rung.
-            trigger_run_credit_ceiling: DEFAULT_TRIGGER_RUN_CREDIT_CEILING[limitsTier],
-            auto_run_batch_credit_ceiling: DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING[limitsTier],
-            agent_run_max_total_credits: limits.agents.maxTotalCredits,
-            agent_run_max_inference_credits: limits.agents.maxInferenceCredits,
+            trigger_run_credit_ceiling: resolveDefaultTriggerRunCreditCeilingForPlan(bandSpendResolution(band), options),
+            auto_run_batch_credit_ceiling: resolveDefaultAutoRunBatchCreditCeilingForPlan(bandSpendResolution(band), options),
+            agent_run_max_total_credits: agentLimits.maxTotalCredits,
+            agent_run_max_inference_credits: agentLimits.maxInferenceCredits,
+            copilot_approval_free_per_call_credits: copilotAllowance.perCallCredits,
+            copilot_approval_free_per_session_credits: copilotAllowance.perSessionCredits,
+            copilot_attended_turn_backstop_credits: COPILOT_ATTENDED_INFERENCE_CREDIT_CEILING,
             org_daily_guard_warn_credits: dailyGuard?.warnCredits ?? null,
             org_daily_guard_block_credits: dailyGuard?.blockCredits ?? null,
             byok_column_run_max_rows: DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS[limitsTier],
             byok_provider_daily_calls: DEFAULT_BYOK_PROVIDER_DAILY_CALL_CAP[limitsTier],
         },
+        tables: {
+            max_rows_per_write_request: limits.cli.maxWriteRowsPerRequest,
+            max_columns_per_run: limits.tableActions.maxActionsPerRun,
+        },
         signals: {
             max_events: limits.signals.maxEvents,
             max_window_days: limits.signals.maxWindowDays,
         },
+        webhooks: describeWebhookIngress(band),
+        workflows: {
+            cron_min_interval_minutes: resolveCronMinIntervalMinutes(limitsTier, options),
+        },
     };
 }
 /** Every band's limits in force today, smallest first. */

package/node_modules/@oxygen/shared/dist/plan-capabilities.d.ts

@@ -25,14 +25,22 @@
  * live in docs/free-tier-capability-matrix.md.
  *
  * WHY GATES ARE CHECKED BEFORE BALANCE. A connected sender is also a FIXED
- * monthly credit commitment (1,000 per mailbox, 10,000 per LinkedIn account,
- * 10,000 per WhatsApp number), and top-ups stay purchasable on free — so a free
- * workspace could buy 10,000 credits for $12.50 and fund a LinkedIn seat that
+ * monthly credit commitment (100 per mailbox, 1,000 per LinkedIn account,
+ * 1,000 per WhatsApp number), and top-ups stay purchasable on free — so a free
+ * workspace could buy 1,000 credits for $12.50 and fund a LinkedIn seat that
  * Starter prices at $99. Enforcing by balance would therefore price sending at
  * an eighth of Starter. The capability gate must run BEFORE any balance or
  * commitment check so the customer is told to upgrade, not to top up.
+ *
+ * THE 2026-09 REPRICING ENDS THAT ARGUMENT (decision 2.7). Connected accounts
+ * are repriced as credit reservations at their real price, so once they are
+ * billed that way (the credit gate, `OXYGEN_CREDIT_GATE_ENABLED`) credits are the
+ * only gate and the sending walls retire: `CREDIT_GATE_RETIRED_CAPABILITIES`.
+ * Until the gate is in force everything above still holds.
  */
-import type { PlanTier } from "./billing.js";
+import type { PlanTier, PricingPlanDefinition } from "./billing.js";
+import { CREDIT_GATE_RETIRED_CAPABILITIES, isCapabilityRetiredByCreditGate } from "./credit-gate.js";
+import { type RepricingOptions } from "./repricing.js";
 export declare const PLAN_GATED_CAPABILITIES: readonly ["sender_connect", "sequence_dispatch", "publishing_connect", "publishing_deliver", "managed_email_infrastructure", "byok_provider_keys"];
 export type PlanGatedCapability = (typeof PLAN_GATED_CAPABILITIES)[number];
 /**
@@ -56,14 +64,76 @@ export type PlanGatedCapabilityCopy = {
 export declare const PLAN_GATED_CAPABILITY_COPY: Record<PlanGatedCapability, PlanGatedCapabilityCopy>;
 export declare function isPlanGatedCapability(value: unknown): value is PlanGatedCapability;
 /**
- * The whole boundary, in one expression.
+ * The walls credits replace once the credit gate is in force (repricing
+ * 2026-09, decision 2.7, slice S22).
+ *
+ * "Credits are the only gate": a free workspace may connect accounts, send,
+ * publish and buy managed infrastructure if it holds the credits. Each of these
+ * is paid for by a monthly credit reservation or a credit purchase, so the plan
+ * wall has nothing left to protect — but only once those reservations are
+ * actually BILLED, which is exactly what the credit gate asserts at boot
+ * (`assertCreditGateArmed`). Until then every one of them stays walled exactly
+ * as before.
+ *
+ * Two capabilities stay walled under the gate:
+ * - `byok_provider_keys`: bringing your own keys needs a plan that includes it
+ *   ($99 or above from the repricing's effective date).
+ * - `publishing_connect`: the only publishing connects that still reach it are
+ *   Instagram, TikTok, YouTube and Facebook, which have no reservation price yet
+ *   (P-18). Connecting them without one would make them free and unmetered, so
+ *   they stay on the plan until that price is ratified.
+ */
+export { CREDIT_GATE_RETIRED_CAPABILITIES, isCapabilityRetiredByCreditGate };
+/**
+ * The whole boundary for one plan, in one expression.
  *
- * Note this asks about the TIER, not about entitlement. A churned workspace and
+ * Note this asks about the PLAN, not about entitlement. A churned workspace and
  * a brand-new one both resolve to `free` and both get the same answer here —
  * one entitlement, one capability set, differing only in grants and upgrade
  * copy (founder, 2026-08-17).
+ *
+ * BYOK reads the plan's own `byokEnabled`, never the tier: every Oxygen size
+ * shares the tier `oxygen`, and only $99 and above include BYOK once the
+ * repricing is in force. Everything else is the founder's one line, free versus
+ * paid. `creditGateInForce` retires the walls credits pay for (above).
+ */
+export declare function planAllowsCapability(plan: Pick<PricingPlanDefinition, "tier" | "byokEnabled">, capability: PlanGatedCapability, options?: {
+    creditGateInForce?: boolean;
+}): boolean;
+/**
+ * The smallest purchasable plan that includes BYOK right now: `oxygen_49` until
+ * the repricing's effective date, `oxygen_99` from it (decision 2.7).
  */
-export declare function planTierAllowsCapability(tier: PlanTier, _capability: PlanGatedCapability): boolean;
+export declare function byokMinimumPlanKey(options?: RepricingOptions): "oxygen_49" | "oxygen_99";
+/** How a refusal names `byokMinimumPlanKey` in a sentence: "a paid plan" or "the $99 plan or above". */
+export declare function byokMinimumPlanPhrase(options?: RepricingOptions): string;
+/**
+ * P-20 (PROPOSED default): a $49 workspace keeps using the keys it connected
+ * before the repricing's effective date until its plan changes; new keys need
+ * $99. True only for a connection made before an instant that has passed, on
+ * the plan key `oxygen_49` — any other plan either includes BYOK or never did.
+ *
+ * "Until the plan changes" is read from the current plan key: a move off $49
+ * ends the grandfathering. No plan-change history is stored, so a workspace that
+ * leaves $49 and comes back after the date is not told apart from one that
+ * stayed; only keys connected before the date ever qualify.
+ */
+export declare function byokConnectionGrandfathered(input: {
+    planKey: string | null | undefined;
+    connectionCreatedAt: Date | string | null | undefined;
+}, options?: RepricingOptions): boolean;
+/**
+ * The access requirements of a tool that runs ONLY on the customer's own key.
+ *
+ * One definition for the provider catalog, the Composio catalog and both access
+ * resolvers. The tier list is display metadata: every paid tier has at least one
+ * plan with BYOK, and whether THIS plan has it is `plan.byokEnabled`, which the
+ * access resolver checks separately.
+ */
+export declare function byokOnlyAccessRequirements(): {
+    byok_required: true;
+    required_plan_tiers: PlanTier[];
+};
 export declare const FREE_TIER_ENTITLEMENT_ENABLED_ENV_VAR = "OXYGEN_FREE_TIER_ENTITLEMENT_ENABLED";
 /**
  * Fail-closed rollout switch for capability-scoped entitlement.

package/node_modules/@oxygen/shared/dist/plan-capabilities.js

@@ -25,13 +25,21 @@
  * live in docs/free-tier-capability-matrix.md.
  *
  * WHY GATES ARE CHECKED BEFORE BALANCE. A connected sender is also a FIXED
- * monthly credit commitment (1,000 per mailbox, 10,000 per LinkedIn account,
- * 10,000 per WhatsApp number), and top-ups stay purchasable on free — so a free
- * workspace could buy 10,000 credits for $12.50 and fund a LinkedIn seat that
+ * monthly credit commitment (100 per mailbox, 1,000 per LinkedIn account,
+ * 1,000 per WhatsApp number), and top-ups stay purchasable on free — so a free
+ * workspace could buy 1,000 credits for $12.50 and fund a LinkedIn seat that
  * Starter prices at $99. Enforcing by balance would therefore price sending at
  * an eighth of Starter. The capability gate must run BEFORE any balance or
  * commitment check so the customer is told to upgrade, not to top up.
+ *
+ * THE 2026-09 REPRICING ENDS THAT ARGUMENT (decision 2.7). Connected accounts
+ * are repriced as credit reservations at their real price, so once they are
+ * billed that way (the credit gate, `OXYGEN_CREDIT_GATE_ENABLED`) credits are the
+ * only gate and the sending walls retire: `CREDIT_GATE_RETIRED_CAPABILITIES`.
+ * Until the gate is in force everything above still holds.
  */
+import { CREDIT_GATE_RETIRED_CAPABILITIES, isCapabilityRetiredByCreditGate } from "./credit-gate.js";
+import { OXYGEN_49_BYOK_REPRICING, readRepricingSwitch, repricedValue, } from "./repricing.js";
 export const PLAN_GATED_CAPABILITIES = [
     "sender_connect",
     "sequence_dispatch",
@@ -94,15 +102,87 @@ export function isPlanGatedCapability(value) {
         && PLAN_GATED_CAPABILITIES.includes(value));
 }
 /**
- * The whole boundary, in one expression.
+ * The walls credits replace once the credit gate is in force (repricing
+ * 2026-09, decision 2.7, slice S22).
+ *
+ * "Credits are the only gate": a free workspace may connect accounts, send,
+ * publish and buy managed infrastructure if it holds the credits. Each of these
+ * is paid for by a monthly credit reservation or a credit purchase, so the plan
+ * wall has nothing left to protect — but only once those reservations are
+ * actually BILLED, which is exactly what the credit gate asserts at boot
+ * (`assertCreditGateArmed`). Until then every one of them stays walled exactly
+ * as before.
+ *
+ * Two capabilities stay walled under the gate:
+ * - `byok_provider_keys`: bringing your own keys needs a plan that includes it
+ *   ($99 or above from the repricing's effective date).
+ * - `publishing_connect`: the only publishing connects that still reach it are
+ *   Instagram, TikTok, YouTube and Facebook, which have no reservation price yet
+ *   (P-18). Connecting them without one would make them free and unmetered, so
+ *   they stay on the plan until that price is ratified.
+ */
+export { CREDIT_GATE_RETIRED_CAPABILITIES, isCapabilityRetiredByCreditGate };
+/**
+ * The whole boundary for one plan, in one expression.
  *
- * Note this asks about the TIER, not about entitlement. A churned workspace and
+ * Note this asks about the PLAN, not about entitlement. A churned workspace and
  * a brand-new one both resolve to `free` and both get the same answer here —
  * one entitlement, one capability set, differing only in grants and upgrade
  * copy (founder, 2026-08-17).
+ *
+ * BYOK reads the plan's own `byokEnabled`, never the tier: every Oxygen size
+ * shares the tier `oxygen`, and only $99 and above include BYOK once the
+ * repricing is in force. Everything else is the founder's one line, free versus
+ * paid. `creditGateInForce` retires the walls credits pay for (above).
+ */
+export function planAllowsCapability(plan, capability, options = {}) {
+    if (options.creditGateInForce && isCapabilityRetiredByCreditGate(capability))
+        return true;
+    if (capability === "byok_provider_keys")
+        return plan.byokEnabled;
+    return plan.tier !== "free";
+}
+/**
+ * The smallest purchasable plan that includes BYOK right now: `oxygen_49` until
+ * the repricing's effective date, `oxygen_99` from it (decision 2.7).
+ */
+export function byokMinimumPlanKey(options = {}) {
+    return repricedValue(OXYGEN_49_BYOK_REPRICING, options) ? "oxygen_49" : "oxygen_99";
+}
+/** How a refusal names `byokMinimumPlanKey` in a sentence: "a paid plan" or "the $99 plan or above". */
+export function byokMinimumPlanPhrase(options = {}) {
+    return byokMinimumPlanKey(options) === "oxygen_99" ? "the $99 plan or above" : "a paid plan";
+}
+/**
+ * P-20 (PROPOSED default): a $49 workspace keeps using the keys it connected
+ * before the repricing's effective date until its plan changes; new keys need
+ * $99. True only for a connection made before an instant that has passed, on
+ * the plan key `oxygen_49` — any other plan either includes BYOK or never did.
+ *
+ * "Until the plan changes" is read from the current plan key: a move off $49
+ * ends the grandfathering. No plan-change history is stored, so a workspace that
+ * leaves $49 and comes back after the date is not told apart from one that
+ * stayed; only keys connected before the date ever qualify.
+ */
+export function byokConnectionGrandfathered(input, options = {}) {
+    if (input.planKey !== "oxygen_49" || !input.connectionCreatedAt)
+        return false;
+    const state = readRepricingSwitch(options);
+    if (state.status !== "in_force")
+        return false;
+    const createdAt = new Date(input.connectionCreatedAt).getTime();
+    return Number.isFinite(createdAt) && createdAt < state.effectiveAt.getTime();
+}
+/**
+ * The access requirements of a tool that runs ONLY on the customer's own key.
+ *
+ * One definition for the provider catalog, the Composio catalog and both access
+ * resolvers. The tier list is display metadata: every paid tier has at least one
+ * plan with BYOK, and whether THIS plan has it is `plan.byokEnabled`, which the
+ * access resolver checks separately.
  */
-export function planTierAllowsCapability(tier, _capability) {
-    return tier !== "free";
+export function byokOnlyAccessRequirements() {
+    return { byok_required: true, required_plan_tiers: [...PLAN_GATE_QUALIFYING_TIERS] };
 }
 export const FREE_TIER_ENTITLEMENT_ENABLED_ENV_VAR = "OXYGEN_FREE_TIER_ENTITLEMENT_ENABLED";
 /**