@oxygen-agent/cli 1.1010.721 → 1.1010.905

package/node_modules/@oxygen/shared/dist/sending-limits.d.ts

@@ -1,9 +1,9 @@
-import { type RepricingOptions } from "./repricing.js";
+import type { RepricingOptions } from "./repricing.js";
 /**
  * The daily cap a new mailbox gets when nobody names one. New mailboxes were
  * created at 18 a day before the repricing, so this is an increase and is live.
  */
-export declare const EMAIL_MAILBOX_DEFAULT_DAILY_CAP = 25;
+export declare const EMAIL_MAILBOX_DEFAULT_DAILY_CAP: 25;
 /**
  * Who set a mailbox's stored cap. `default` = OXYGEN's default at creation,
  * `user` = a person or agent set it. A row written before the column existed
@@ -12,15 +12,13 @@ export declare const EMAIL_MAILBOX_DEFAULT_DAILY_CAP = 25;
 export declare const EMAIL_MAILBOX_DAILY_CAP_SOURCES: readonly ["default", "user"];
 export type EmailMailboxDailyCapSource = (typeof EMAIL_MAILBOX_DAILY_CAP_SOURCES)[number];
 export declare function readEmailMailboxDailyCapSource(value: unknown): EmailMailboxDailyCapSource | null;
-/** The most a mailbox may be set to send a day, or null while there is no maximum. */
-export declare function emailMailboxDailyCapMaximum(options?: RepricingOptions): number | null;
+/** The most a mailbox may be set to send a day, independent of billing activation. */
+export declare function emailMailboxDailyCapMaximum(_options?: RepricingOptions): number | null;
 /**
  * The configured cap in force for a stored one: every surface that reads a
  * mailbox's cap, and the send claim, go through this.
  *
- * Once the switch is in force, a cap still at the old default of 40 that nobody
- * set by hand sends at the new default, and any cap above the maximum sends at
- * the maximum. Before it, the stored cap is returned unchanged.
+ * Stored choices are retained up to the technical maximum.
  */
 export declare function emailMailboxDailyCapInForce(input: {
     storedCap: number;

package/node_modules/@oxygen/shared/dist/sending-limits.js

@@ -2,18 +2,17 @@
 // decision L3; specification slice S52). Limits guard, credits meter: none of
 // these is sold, and none charges for sending.
 //
-// Email per mailbox: warm-up ramp 5 / 10 / 20 (tenant-db `WARMUP_RAMP_DAILY_CAPS`),
-// then the mailbox's own daily cap, 25 by default. The hard maximum of 50 and the
-// move of mailboxes still on the old default of 40 are limit cuts, held by the
-// 2026-09 effective-date switch (`./repricing.ts`), so they are read through it.
+// Email campaign ramp: 5 / 10 / 20 based on accepted-send days, then the
+// configured cap (25 by default, maximum 50), independent of billing activation.
+// The versioned migration changes old defaults once; later choices are retained.
 //
 // Voice per number: 100 dials a day by default, adjustable up to 300.
-import { EMAIL_MAILBOX_DAILY_CAP_MAXIMUM, EMAIL_MAILBOX_OLD_DEFAULT_DAILY_CAP, repricedValue, } from "./repricing.js";
+import { EMAIL_DELIVERABILITY_DEFAULTS } from "./email-deliverability-policy.js";
 /**
  * The daily cap a new mailbox gets when nobody names one. New mailboxes were
  * created at 18 a day before the repricing, so this is an increase and is live.
  */
-export const EMAIL_MAILBOX_DEFAULT_DAILY_CAP = 25;
+export const EMAIL_MAILBOX_DEFAULT_DAILY_CAP = EMAIL_DELIVERABILITY_DEFAULTS.campaignDailyCap;
 /**
  * Who set a mailbox's stored cap. `default` = OXYGEN's default at creation,
  * `user` = a person or agent set it. A row written before the column existed
@@ -23,25 +22,20 @@ export const EMAIL_MAILBOX_DAILY_CAP_SOURCES = ["default", "user"];
 export function readEmailMailboxDailyCapSource(value) {
     return value === "default" || value === "user" ? value : null;
 }
-/** The most a mailbox may be set to send a day, or null while there is no maximum. */
-export function emailMailboxDailyCapMaximum(options = {}) {
-    return repricedValue(EMAIL_MAILBOX_DAILY_CAP_MAXIMUM, options);
+/** The most a mailbox may be set to send a day, independent of billing activation. */
+export function emailMailboxDailyCapMaximum(_options = {}) {
+    return 50;
 }
 /**
  * The configured cap in force for a stored one: every surface that reads a
  * mailbox's cap, and the send claim, go through this.
  *
- * Once the switch is in force, a cap still at the old default of 40 that nobody
- * set by hand sends at the new default, and any cap above the maximum sends at
- * the maximum. Before it, the stored cap is returned unchanged.
+ * Stored choices are retained up to the technical maximum.
  */
 export function emailMailboxDailyCapInForce(input, options = {}) {
     const stored = Number.isFinite(input.storedCap) ? Math.max(0, Math.floor(input.storedCap)) : 0;
-    const cap = input.source !== "user" && stored === EMAIL_MAILBOX_OLD_DEFAULT_DAILY_CAP.before
-        ? repricedValue(EMAIL_MAILBOX_OLD_DEFAULT_DAILY_CAP, options)
-        : stored;
     const maximum = emailMailboxDailyCapMaximum(options);
-    return maximum === null ? cap : Math.min(cap, maximum);
+    return maximum === null ? stored : Math.min(stored, maximum);
 }
 /** A new voice number may dial this many times a day once it has warmed up. */
 export const VOICE_NUMBER_DEFAULT_DAILY_CAP = 100;

package/node_modules/@oxygen/shared/dist/sending-seats.d.ts

@@ -25,24 +25,15 @@
  * "skips the seat check", it is one that holds a legacy entitlement which
  * SATISFIES the seat check. The gate always runs.
  */
-import { MANAGED_INBOX_USD_CENTS, SENDING_DOMAIN_USD_CENTS, SENDING_SEAT_USD_CENTS, type SendingSeatKey } from "./pricing-snapshot.generated.js";
+import { SENDING_SEAT_USD_CENTS, type SendingSeatKey } from "./pricing-snapshot.generated.js";
+import type { CreditGateKind } from "./credit-gate.js";
 export { SENDING_SEAT_USD_CENTS };
 /**
- * Email infrastructure, kept next to the seats because the relationship between
- * them is the whole design.
- *
- * MANAGED_INBOX_USD_CENTS is ALL-IN: it already contains the sending seat and
- * warm-up. A customer buying an Oxygen mailbox buys ONE thing at ONE price and
- * can never end up holding a mailbox with no seat to send from. A customer
- * bringing their own mailbox pays SENDING_SEAT_USD_CENTS.email_sender instead.
- * The two are alternatives, never both for the same mailbox.
- *
- * The practical consequence for the connect gate: email capacity is
- * (email_sender seats) + (managed inbox slots). Counting only seats would refuse
- * a customer who bought inboxes, which is exactly the assemble-the-parts failure
- * this bundle exists to prevent.
+ * Email infrastructure is no longer sold in dollars (repricing 2026-09, S32/S33):
+ * a managed inbox is priced in credits, 400 for a Google mailbox plus the 100-credit
+ * mailbox connection every sending mailbox holds, warm-up included. A customer
+ * bringing their own mailbox pays the connection alone.
  */
-export { MANAGED_INBOX_USD_CENTS, SENDING_DOMAIN_USD_CENTS };
 export type { SendingSeatKey };
 export declare const SENDING_SEAT_KEYS: readonly ["linkedin", "whatsapp", "phone_number", "email_sender"];
 export type SendingSeatDefinition = {
@@ -64,6 +55,18 @@ export type SendingSeatDefinition = {
 export declare const SENDING_SEAT_CATALOG: {
     readonly [K in SendingSeatKey]: SendingSeatDefinition;
 };
+/**
+ * The credit reservation each sending-seat channel becomes once seats are
+ * retired (repricing 2026-09, decisions 2.7 and 2.9). A seat still held keeps
+ * covering accounts of its kind until the seat subscription ends at renewal, and
+ * only then does each account start reserving credits, so an account is never
+ * paid for twice.
+ */
+export declare const SEAT_RESERVATION_KIND: {
+    readonly [K in SendingSeatKey]: CreditGateKind;
+};
+/** The seat channel whose seats cover a reservation kind, or null for a kind no seat ever covered. */
+export declare function seatKeyForReservationKind(kind: string): SendingSeatKey | null;
 export declare const SENDING_SEAT_LEGACY_CHARGE_KEYS: readonly string[];
 export declare function isSendingSeatKey(value: unknown): value is SendingSeatKey;
 export declare function sendingSeatMonthlyPriceCents(key: SendingSeatKey): number;

package/node_modules/@oxygen/shared/dist/sending-seats.js

@@ -25,24 +25,8 @@
  * "skips the seat check", it is one that holds a legacy entitlement which
  * SATISFIES the seat check. The gate always runs.
  */
-import { MANAGED_INBOX_USD_CENTS, SENDING_DOMAIN_USD_CENTS, SENDING_SEAT_USD_CENTS, } from "./pricing-snapshot.generated.js";
+import { SENDING_SEAT_USD_CENTS, } from "./pricing-snapshot.generated.js";
 export { SENDING_SEAT_USD_CENTS };
-/**
- * Email infrastructure, kept next to the seats because the relationship between
- * them is the whole design.
- *
- * MANAGED_INBOX_USD_CENTS is ALL-IN: it already contains the sending seat and
- * warm-up. A customer buying an Oxygen mailbox buys ONE thing at ONE price and
- * can never end up holding a mailbox with no seat to send from. A customer
- * bringing their own mailbox pays SENDING_SEAT_USD_CENTS.email_sender instead.
- * The two are alternatives, never both for the same mailbox.
- *
- * The practical consequence for the connect gate: email capacity is
- * (email_sender seats) + (managed inbox slots). Counting only seats would refuse
- * a customer who bought inboxes, which is exactly the assemble-the-parts failure
- * this bundle exists to prevent.
- */
-export { MANAGED_INBOX_USD_CENTS, SENDING_DOMAIN_USD_CENTS };
 export const SENDING_SEAT_KEYS = [
     "linkedin",
     "whatsapp",
@@ -88,6 +72,27 @@ export const SENDING_SEAT_CATALOG = {
         stripePriceEnvVar: "STRIPE_PRICE_SEAT_EMAIL_USD",
     },
 };
+/**
+ * The credit reservation each sending-seat channel becomes once seats are
+ * retired (repricing 2026-09, decisions 2.7 and 2.9). A seat still held keeps
+ * covering accounts of its kind until the seat subscription ends at renewal, and
+ * only then does each account start reserving credits, so an account is never
+ * paid for twice.
+ */
+export const SEAT_RESERVATION_KIND = {
+    linkedin: "linkedin_account",
+    whatsapp: "whatsapp_account",
+    phone_number: "phone_number",
+    email_sender: "sending_mailbox",
+};
+/** The seat channel whose seats cover a reservation kind, or null for a kind no seat ever covered. */
+export function seatKeyForReservationKind(kind) {
+    for (const seatKey of SENDING_SEAT_KEYS) {
+        if (SEAT_RESERVATION_KIND[seatKey] === kind)
+            return seatKey;
+    }
+    return null;
+}
 export const SENDING_SEAT_LEGACY_CHARGE_KEYS = SENDING_SEAT_KEYS
     .map((key) => SENDING_SEAT_CATALOG[key].legacyChargeKey)
     .filter((chargeKey) => chargeKey !== null);

package/node_modules/@oxygen/shared/dist/spend-safety.d.ts

@@ -1,5 +1,7 @@
 import type { PlanTier } from "./billing.js";
+import type { PlanBand } from "./plan-band.js";
 import type { LimitsTier } from "./plan-limits.js";
+import { type RepricingOptions } from "./repricing.js";
 /**
  * Spend-safety defaults: plan-scaled ceilings applied when an autonomous
  * spend path was armed WITHOUT an explicit cap. They restore the ADR-0011
@@ -19,18 +21,29 @@ export declare const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES: ReadonlySet<string>;
 /**
  * Per-run managed-credit ceiling for a LIVE workflow run fired by an autonomous
  * trigger when neither run metadata nor the manifest declares `max_credits`.
+ *
+ * These are the ceilings each rung read BEFORE the 2026-09 repricing. The value
+ * in force is resolved per plan by `resolveDefaultTriggerRunCreditCeilingForPlan`
+ * (`plan-band.ts`): 10% of the plan's monthly credits (decision L5.1), where a
+ * larger default applies at once and a smaller one waits for the
+ * effective-date switch with this table as its old value. Read this table
+ * directly only to know the pre-repricing value.
  */
 export declare const DEFAULT_TRIGGER_RUN_CREDIT_CEILING: Record<SpendSafetyPlanTier, number | null>;
 /**
  * Per-delivery credit ceiling stamped onto a standing/webhook table auto-run
- * batch when the armed configuration carries no explicit `max_credits`.
+ * batch when the armed configuration carries no explicit `max_credits`. The
+ * pre-repricing values, like the trigger table above; resolve the value in force
+ * with `resolveDefaultAutoRunBatchCreditCeilingForPlan`.
  */
 export declare const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING: Record<SpendSafetyPlanTier, number | null>;
 /**
  * Row ceiling for a BYOK AI-column run whose caller gave no explicit row bound
  * (no limit, no row_ids, selection "all"). BYOK bills the customer's own
- * provider account, so a credit ceiling is meaningless — row count is the
- * enforceable unit. An explicit limit (up to the 500k platform row cap) wins.
+ * provider account, so OXYGEN's credit ceiling bounds only its own platform fee
+ * (0.05 credits a call from the 2026-09 repricing instant, decision 6.3) and
+ * never the provider's bill — row count stays the enforceable unit for that.
+ * An explicit limit (up to the 500k platform row cap) wins.
  */
 export declare const DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS: Record<SpendSafetyPlanTier, number | null>;
 /**
@@ -89,6 +102,12 @@ export declare function resolveByokProviderDailyCapEnforcementMode(configured?:
  *
  * This applies ONLY to the implicit default. An org that sets its own org-daily
  * policy has chosen a real spend ceiling, and that ceiling counts everything.
+ *
+ * The monthly reservation renewals of the 2026-09 repricing (connected sending
+ * mailboxes, deliverability units, connected accounts and phone numbers, dedicated
+ * IPs) are the same shape and are excluded for the same reason (PROPOSED P-59).
+ * It matters most on the free plan, whose guard is a fixed 1,000 / 5,000 credits
+ * a day: one LinkedIn renewal would otherwise be most of a free day's warning.
  */
 export declare const IMPLICIT_ORG_DAILY_GUARD_EXCLUDED_CATEGORIES: readonly string[];
 export declare const DEFAULT_ORG_DAILY_SPEND_WARN_MULTIPLE = 5;
@@ -101,16 +120,46 @@ export type OrgDailySpendGuard = {
 /**
  * Resolve the implicit guard's thresholds from a plan's monthly grant. `null`
  * means the guard is suppressed because the plan has no finite positive grant to
- * scale from (free at 0, enterprise/custom at null) — the single place that
- * decision is made, so enforcement and the read surfaces cannot drift apart.
+ * scale from (enterprise/custom at null) — the single place that decision is
+ * made, so enforcement and the read surfaces cannot drift apart.
+ *
+ * The free plan has no monthly grant, so it gets a fixed guard instead (decision
+ * L5.2: 1,000 warn / 5,000 block a UTC day). It is a new bound on free, so it
+ * takes effect at the 2026-09 repricing instant; before then free has none.
  */
-export declare function resolveOrgDailySpendGuard(monthlyCredits: number | null | undefined): OrgDailySpendGuard | null;
+export declare function resolveOrgDailySpendGuard(monthlyCredits: number | null | undefined, options?: RepricingOptions & {
+    freePlan?: boolean;
+}): OrgDailySpendGuard | null;
 /** Credits carry 3 decimals everywhere (control-DB numeric(18,3)). */
 export declare function roundCredits(value: number): number;
 /** Credit estimates that present to 2 decimals (cent-grained customer copy). */
 export declare function roundCreditsToCents(value: number): number;
-export declare function resolveDefaultTriggerRunCreditCeiling(tier: SpendSafetyPlanTier): number | null;
-export declare function resolveDefaultAutoRunBatchCreditCeiling(tier: SpendSafetyPlanTier): number | null;
+/**
+ * Platform-owned runaway ceiling for one attended Workspace Copilot turn: 3,000
+ * customer credits, $6 of upstream inference at the ratified 5x markup, the same
+ * on every plan. It is not a user budget or an authorization grant. It lives
+ * here rather than in `@oxygen/copilot` so the limits report can state it next
+ * to the approval-free allowance it must stay above; `@oxygen/copilot/config`
+ * re-exports it.
+ */
+export declare const COPILOT_ATTENDED_INFERENCE_CREDIT_CEILING = 3000;
+/** How much paid work the attended Copilot may start without an approval card. */
+export type CopilotApprovalFreeAllowance = {
+    /** The most one call may declare (its server-enforced `max_credits`). */
+    perCallCredits: number;
+    /** The most all such calls in one session may declare together. */
+    perSessionCredits: number;
+};
+/**
+ * The Copilot's approval-free spend allowance by plan size (decision L5.3). Only
+ * the two ends are ratified: free at 50 / 300 credits ($0.50 / $3) and $1,999 at
+ * 500 / 2,500 ($5 / $25). The middle sizes are PROPOSED (P-55). Every value is
+ * at least the 50 / 300 every plan had before, so the table ships live. The
+ * largest session allowance stays below the attended turn backstop above.
+ */
+export declare const COPILOT_APPROVAL_FREE_ALLOWANCE_BY_PLAN_BAND: Readonly<Record<PlanBand, CopilotApprovalFreeAllowance>>;
+/** A plan size's approval-free Copilot allowance. */
+export declare function copilotApprovalFreeAllowanceForBand(band: PlanBand): CopilotApprovalFreeAllowance;
 export declare function resolveDefaultByokColumnRunMaxRows(tier: SpendSafetyPlanTier): number | null;
 export declare function resolveDefaultByokProviderDailyCallCap(tier: SpendSafetyPlanTier): number | null;
 /**

package/node_modules/@oxygen/shared/dist/spend-safety.js

@@ -1,3 +1,4 @@
+import { FREE_ORG_DAILY_GUARD_BLOCK_CREDITS, FREE_ORG_DAILY_GUARD_WARN_CREDITS, repricedValue, } from "./repricing.js";
 /** Workflow run trigger types that fire without a human in the loop. */
 export const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES = new Set([
     "cron",
@@ -7,6 +8,13 @@ export const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES = new Set([
 /**
  * Per-run managed-credit ceiling for a LIVE workflow run fired by an autonomous
  * trigger when neither run metadata nor the manifest declares `max_credits`.
+ *
+ * These are the ceilings each rung read BEFORE the 2026-09 repricing. The value
+ * in force is resolved per plan by `resolveDefaultTriggerRunCreditCeilingForPlan`
+ * (`plan-band.ts`): 10% of the plan's monthly credits (decision L5.1), where a
+ * larger default applies at once and a smaller one waits for the
+ * effective-date switch with this table as its old value. Read this table
+ * directly only to know the pre-repricing value.
  */
 export const DEFAULT_TRIGGER_RUN_CREDIT_CEILING = {
     free: 50,
@@ -18,7 +26,9 @@ export const DEFAULT_TRIGGER_RUN_CREDIT_CEILING = {
 };
 /**
  * Per-delivery credit ceiling stamped onto a standing/webhook table auto-run
- * batch when the armed configuration carries no explicit `max_credits`.
+ * batch when the armed configuration carries no explicit `max_credits`. The
+ * pre-repricing values, like the trigger table above; resolve the value in force
+ * with `resolveDefaultAutoRunBatchCreditCeilingForPlan`.
  */
 export const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING = {
     free: 50,
@@ -31,8 +41,10 @@ export const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING = {
 /**
  * Row ceiling for a BYOK AI-column run whose caller gave no explicit row bound
  * (no limit, no row_ids, selection "all"). BYOK bills the customer's own
- * provider account, so a credit ceiling is meaningless — row count is the
- * enforceable unit. An explicit limit (up to the 500k platform row cap) wins.
+ * provider account, so OXYGEN's credit ceiling bounds only its own platform fee
+ * (0.05 credits a call from the 2026-09 repricing instant, decision 6.3) and
+ * never the provider's bill — row count stays the enforceable unit for that.
+ * An explicit limit (up to the 500k platform row cap) wins.
  */
 export const DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS = {
     free: null,
@@ -106,20 +118,38 @@ export function resolveByokProviderDailyCapEnforcementMode(configured = process.
  *
  * This applies ONLY to the implicit default. An org that sets its own org-daily
  * policy has chosen a real spend ceiling, and that ceiling counts everything.
+ *
+ * The monthly reservation renewals of the 2026-09 repricing (connected sending
+ * mailboxes, deliverability units, connected accounts and phone numbers, dedicated
+ * IPs) are the same shape and are excluded for the same reason (PROPOSED P-59).
+ * It matters most on the free plan, whose guard is a fixed 1,000 / 5,000 credits
+ * a day: one LinkedIn renewal would otherwise be most of a free day's warning.
  */
 export const IMPLICIT_ORG_DAILY_GUARD_EXCLUDED_CATEGORIES = [
     "managed_warmup",
     "managed_inbox",
+    "managed_mailbox",
+    "managed_deliverability",
+    "managed_seat",
 ];
 export const DEFAULT_ORG_DAILY_SPEND_WARN_MULTIPLE = 5;
 export const DEFAULT_ORG_DAILY_SPEND_BLOCK_MULTIPLE = 20;
 /**
  * Resolve the implicit guard's thresholds from a plan's monthly grant. `null`
  * means the guard is suppressed because the plan has no finite positive grant to
- * scale from (free at 0, enterprise/custom at null) — the single place that
- * decision is made, so enforcement and the read surfaces cannot drift apart.
+ * scale from (enterprise/custom at null) — the single place that decision is
+ * made, so enforcement and the read surfaces cannot drift apart.
+ *
+ * The free plan has no monthly grant, so it gets a fixed guard instead (decision
+ * L5.2: 1,000 warn / 5,000 block a UTC day). It is a new bound on free, so it
+ * takes effect at the 2026-09 repricing instant; before then free has none.
  */
-export function resolveOrgDailySpendGuard(monthlyCredits) {
+export function resolveOrgDailySpendGuard(monthlyCredits, options = {}) {
+    if (options.freePlan) {
+        const warnCredits = repricedValue(FREE_ORG_DAILY_GUARD_WARN_CREDITS, options);
+        const blockCredits = repricedValue(FREE_ORG_DAILY_GUARD_BLOCK_CREDITS, options);
+        return warnCredits === null || blockCredits === null ? null : { warnCredits, blockCredits };
+    }
     if (typeof monthlyCredits !== "number" || !Number.isFinite(monthlyCredits) || monthlyCredits <= 0) {
         return null;
     }
@@ -136,11 +166,34 @@ export function roundCredits(value) {
 export function roundCreditsToCents(value) {
     return Math.round((value + Number.EPSILON) * 100) / 100;
 }
-export function resolveDefaultTriggerRunCreditCeiling(tier) {
-    return DEFAULT_TRIGGER_RUN_CREDIT_CEILING[tier];
-}
-export function resolveDefaultAutoRunBatchCreditCeiling(tier) {
-    return DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING[tier];
+/**
+ * Platform-owned runaway ceiling for one attended Workspace Copilot turn: 3,000
+ * customer credits, $6 of upstream inference at the ratified 5x markup, the same
+ * on every plan. It is not a user budget or an authorization grant. It lives
+ * here rather than in `@oxygen/copilot` so the limits report can state it next
+ * to the approval-free allowance it must stay above; `@oxygen/copilot/config`
+ * re-exports it.
+ */
+export const COPILOT_ATTENDED_INFERENCE_CREDIT_CEILING = 3_000;
+/**
+ * The Copilot's approval-free spend allowance by plan size (decision L5.3). Only
+ * the two ends are ratified: free at 50 / 300 credits ($0.50 / $3) and $1,999 at
+ * 500 / 2,500 ($5 / $25). The middle sizes are PROPOSED (P-55). Every value is
+ * at least the 50 / 300 every plan had before, so the table ships live. The
+ * largest session allowance stays below the attended turn backstop above.
+ */
+export const COPILOT_APPROVAL_FREE_ALLOWANCE_BY_PLAN_BAND = Object.freeze({
+    free: Object.freeze({ perCallCredits: 50, perSessionCredits: 300 }),
+    "49": Object.freeze({ perCallCredits: 100, perSessionCredits: 500 }),
+    "99": Object.freeze({ perCallCredits: 100, perSessionCredits: 500 }),
+    "199": Object.freeze({ perCallCredits: 200, perSessionCredits: 1_000 }),
+    "499": Object.freeze({ perCallCredits: 200, perSessionCredits: 1_000 }),
+    "999": Object.freeze({ perCallCredits: 300, perSessionCredits: 1_500 }),
+    "1999": Object.freeze({ perCallCredits: 500, perSessionCredits: 2_500 }),
+});
+/** A plan size's approval-free Copilot allowance. */
+export function copilotApprovalFreeAllowanceForBand(band) {
+    return COPILOT_APPROVAL_FREE_ALLOWANCE_BY_PLAN_BAND[band];
 }
 export function resolveDefaultByokColumnRunMaxRows(tier) {
     return DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS[tier];

package/node_modules/@oxygen/shared/dist/stripe-price-catalog.d.ts

@@ -1,4 +1,4 @@
-import { CONTACT_SALES_URL, PURCHASABLE_PLAN_KEYS, SELF_SERVE_PLAN_TIERS, normalizeBillingCurrency, type BillingCurrency, type OxygenPlanKey, type PricingPlanDefinition, type SelfServePlanTier } from "./billing.js";
+import { CONTACT_SALES_URL, PURCHASABLE_PLAN_KEYS, SELF_SERVE_PLAN_TIERS, normalizeBillingCurrency, type BillingCurrency, type OxygenPlanKey, type PlanBillingInterval, type PricingPlanDefinition, type SelfServePlanTier } from "./billing.js";
 export { CONTACT_SALES_URL, PURCHASABLE_PLAN_KEYS, SELF_SERVE_PLAN_TIERS, normalizeBillingCurrency, };
 export type { BillingCurrency, OxygenPlanKey, SelfServePlanTier };
 export type PricingPlan = PricingPlanDefinition & {
@@ -17,8 +17,7 @@ export declare const PRICING_PLANS: {
 /** The six purchasable rungs with their Stripe price ids, cheapest first. */
 export declare const PURCHASABLE_PLANS: Record<OxygenPlanKey, PricingPlan>;
 export declare function getPlanPriceId(plan: PricingPlan, currency: BillingCurrency): string;
-/** How often a plan Price bills. Credits are granted monthly on both. */
-export type PlanBillingInterval = "month" | "year";
+export type { PlanBillingInterval };
 /**
  * The configured Price for one rung and interval, or "" when that Price is not
  * configured (every yearly Price, until S14 creates them).
@@ -34,6 +33,14 @@ export declare function getPurchasablePlanPriceId(planKey: OxygenPlanKey, interv
  * whether a paid period is sliced.
  */
 export declare function planBillingIntervalForPriceId(priceId: string | null | undefined): PlanBillingInterval | null;
+/**
+ * Whether yearly billing can be sold: every purchasable rung has a configured
+ * yearly Price. False until S14 creates them, which is what keeps every annual
+ * control (the plan picker's Yearly switch, `--interval year`, the pricing
+ * page's yearly line) dark. All six or nothing, so no surface ever offers a
+ * yearly rung whose checkout would be refused.
+ */
+export declare function annualPlanBillingAvailable(currency?: BillingCurrency): boolean;
 /** Every configured yearly plan Price id (empty until S14). */
 export declare function configuredAnnualPlanPriceIds(): readonly string[];
 /**
@@ -50,10 +57,11 @@ export declare function tierFromPriceId(priceId: string): string | null;
  * family. Catalog audit/migration code consumes this instead of maintaining a
  * second env map that can silently omit grandfathered subscriptions.
  *
- * The yearly Prices are deliberately NOT listed yet: the migration planner
- * matches an outgoing Oxygen Price to its target by amount, and must learn to
- * compare intervals (repricing slice S16) before a yearly Price may enter its
- * source set. S14 adds them when it creates the Prices.
+ * The configured yearly Prices are listed with the Oxygen family (slice S14):
+ * the migration planner compares the billing interval before it matches a
+ * rung by plan key or amount (S16, `stripeMigrationTargetFor`), so a yearly
+ * Price in the source set resolves to itself and can never become the target
+ * of a monthly subscription.
  */
 export declare function recognizedStripePriceIdsBySelfServeTier(): Record<SelfServePlanTier, readonly string[]>;
 export declare function formatMonthlyPrice(priceCents: number | null, currency?: BillingCurrency): string;

package/node_modules/@oxygen/shared/dist/stripe-price-catalog.js

@@ -25,7 +25,8 @@ const STRIPE_PRICE_OXYGEN_IDS = {
  * Product, since month and year are distinct intervals a Portal configuration
  * accepts under one Product.
  *
- * DARK until the yearly Prices exist (slice S14): every env var is unset, an
+ * DARK until the yearly Price ids are configured (`provision` creates the Prices
+ * and prints these names, slice S14): every env var is unset, an
  * unset id is "", and tierFromPriceId refuses "" before any map is consulted, so
  * no subscription resolves to a yearly interval and nothing is ever sliced.
  */
@@ -129,6 +130,16 @@ export function planBillingIntervalForPriceId(priceId) {
     }
     return tierFromPriceId(priceId) === null ? null : "month";
 }
+/**
+ * Whether yearly billing can be sold: every purchasable rung has a configured
+ * yearly Price. False until S14 creates them, which is what keeps every annual
+ * control (the plan picker's Yearly switch, `--interval year`, the pricing
+ * page's yearly line) dark. All six or nothing, so no surface ever offers a
+ * yearly rung whose checkout would be refused.
+ */
+export function annualPlanBillingAvailable(currency = DEFAULT_BILLING_CURRENCY) {
+    return PURCHASABLE_PLAN_KEYS.every((planKey) => getPurchasablePlanPriceId(planKey, "year", currency) !== "");
+}
 /** Every configured yearly plan Price id (empty until S14). */
 export function configuredAnnualPlanPriceIds() {
     return uniqueNonEmptyPriceIds(PURCHASABLE_PLAN_KEYS.flatMap((planKey) => Object.values(STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey])));
@@ -175,15 +186,17 @@ export function tierFromPriceId(priceId) {
  * family. Catalog audit/migration code consumes this instead of maintaining a
  * second env map that can silently omit grandfathered subscriptions.
  *
- * The yearly Prices are deliberately NOT listed yet: the migration planner
- * matches an outgoing Oxygen Price to its target by amount, and must learn to
- * compare intervals (repricing slice S16) before a yearly Price may enter its
- * source set. S14 adds them when it creates the Prices.
+ * The configured yearly Prices are listed with the Oxygen family (slice S14):
+ * the migration planner compares the billing interval before it matches a
+ * rung by plan key or amount (S16, `stripeMigrationTargetFor`), so a yearly
+ * Price in the source set resolves to itself and can never become the target
+ * of a monthly subscription.
  */
 export function recognizedStripePriceIdsBySelfServeTier() {
     const byTier = {
         oxygen: [
             ...PURCHASABLE_PLAN_KEYS.flatMap((planKey) => Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey])),
+            ...configuredAnnualPlanPriceIds(),
             ...LEGACY_CURRENT_PLAN_PRICE_IDS.oxygen,
         ],
         starter: [

package/node_modules/@oxygen/shared/dist/table-capacity.d.ts

@@ -25,18 +25,47 @@ export declare function workspaceDatabaseWarningBytesFor(limitBytes: number): nu
  */
 export declare const PLAN_BAND_TABLE_CAPACITY_TARGETS: Readonly<Record<PlanBand, WorkspaceTableCapacityLimits>>;
 /**
- * Sizes above today's envelope ship only after a capacity test at 5M and 10M
- * rows per Table (decision L1). Until that test passes these bands keep today's
- * envelope; shipping them is removing a band from this list.
+ * Rows per Table above today's 3,000,000 ship only after a capacity test at 5M
+ * and 10M rows per Table. The workspace totals of these bands (rows and
+ * database) are already in force (decision F.1, 2026-09-27, amending L1, which
+ * had gated both); shipping a band's rows per Table is removing it from this list.
  */
-export declare const PLAN_BANDS_AWAITING_CAPACITY_TEST: readonly PlanBand[];
+export declare const PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST: readonly PlanBand[];
 /**
  * The storage limits in force for a plan band right now.
  *
  * - A limit that tightens (free, $49, $99) is a scheduled 2026-09 repricing value
  *   (`storage.<band>.*` in `REPRICING_2026_09_SCHEDULE`): today's envelope until
  *   the effective-date switch, the ratified ladder from it on.
- * - A band awaiting the capacity test keeps today's envelope.
+ * - A band awaiting the rows-per-Table capacity test has its ladder workspace
+ *   totals and keeps today's rows per Table.
  * - Every other band is already at its ladder value.
  */
 export declare function resolveWorkspaceTableCapacity(band: PlanBand, options?: RepricingOptions): WorkspaceTableCapacityLimits;
+/**
+ * Where a band's storage stands against its ratified ladder (decision F.2):
+ *
+ * - `in_force`: the band's values are in force; nothing is pending.
+ * - `scheduled`: the 2026-09 repricing moves them to `target` at `effectiveAt`.
+ * - `awaiting_capacity_test`: `target` applies once the rows-per-Table capacity
+ *   test at that size passes; there is no date.
+ *
+ * A cut is reported only once an operator has set the repricing switch to a
+ * valid future instant. While the switch is unset or invalid a cutting band
+ * reads `in_force` and no target is revealed, the rule `describeRepricingSchedule`
+ * follows for every other scheduled value.
+ */
+export type WorkspaceTableCapacityStatus = {
+    status: "in_force";
+    effectiveAt: null;
+    target: null;
+} | {
+    status: "scheduled";
+    effectiveAt: Date;
+    target: WorkspaceTableCapacityLimits;
+} | {
+    status: "awaiting_capacity_test";
+    effectiveAt: null;
+    target: WorkspaceTableCapacityLimits;
+};
+export declare function describeWorkspaceTableCapacityStatus(band: PlanBand, options?: RepricingOptions): WorkspaceTableCapacityStatus;

package/node_modules/@oxygen/shared/dist/table-capacity.js

@@ -1,4 +1,4 @@
-import { findRepricedValue, repricedValue } from "./repricing.js";
+import { findRepricedValue, readRepricingSwitch, repricedValue, } from "./repricing.js";
 const GIB = 1024 ** 3;
 /**
  * The envelope every workspace had before storage scaled with plan size, and
@@ -43,11 +43,12 @@ export const PLAN_BAND_TABLE_CAPACITY_TARGETS = Object.freeze({
     "1999": ladderRow(10_000_000, 100_000_000, 120),
 });
 /**
- * Sizes above today's envelope ship only after a capacity test at 5M and 10M
- * rows per Table (decision L1). Until that test passes these bands keep today's
- * envelope; shipping them is removing a band from this list.
+ * Rows per Table above today's 3,000,000 ship only after a capacity test at 5M
+ * and 10M rows per Table. The workspace totals of these bands (rows and
+ * database) are already in force (decision F.1, 2026-09-27, amending L1, which
+ * had gated both); shipping a band's rows per Table is removing it from this list.
  */
-export const PLAN_BANDS_AWAITING_CAPACITY_TEST = Object.freeze(["999", "1999"]);
+export const PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST = Object.freeze(["999", "1999"]);
 const STORAGE_FIELDS = [
     ["tableRowLimit", "table_row_limit"],
     ["workspaceRowLimit", "workspace_row_limit"],
@@ -60,13 +61,15 @@ const STORAGE_FIELDS = [
  * - A limit that tightens (free, $49, $99) is a scheduled 2026-09 repricing value
  *   (`storage.<band>.*` in `REPRICING_2026_09_SCHEDULE`): today's envelope until
  *   the effective-date switch, the ratified ladder from it on.
- * - A band awaiting the capacity test keeps today's envelope.
+ * - A band awaiting the rows-per-Table capacity test has its ladder workspace
+ *   totals and keeps today's rows per Table.
  * - Every other band is already at its ladder value.
  */
 export function resolveWorkspaceTableCapacity(band, options = {}) {
-    if (PLAN_BANDS_AWAITING_CAPACITY_TEST.includes(band))
-        return WORKSPACE_TABLE_CAPACITY;
     const target = PLAN_BAND_TABLE_CAPACITY_TARGETS[band];
+    if (PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST.includes(band)) {
+        return Object.freeze({ ...target, tableRowLimit: WORKSPACE_TABLE_CAPACITY.tableRowLimit });
+    }
     const resolved = { ...target };
     for (const [field, key] of STORAGE_FIELDS) {
         const scheduled = findRepricedValue(`storage.${band}.${key}`);
@@ -76,3 +79,17 @@ export function resolveWorkspaceTableCapacity(band, options = {}) {
     }
     return Object.freeze(resolved);
 }
+export function describeWorkspaceTableCapacityStatus(band, options = {}) {
+    if (PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST.includes(band)) {
+        return { status: "awaiting_capacity_test", effectiveAt: null, target: PLAN_BAND_TABLE_CAPACITY_TARGETS[band] };
+    }
+    const state = readRepricingSwitch(options);
+    if (state.status === "scheduled") {
+        const current = resolveWorkspaceTableCapacity(band, options);
+        const target = resolveWorkspaceTableCapacity(band, { ...options, now: state.effectiveAt });
+        if (STORAGE_FIELDS.some(([field]) => current[field] !== target[field])) {
+            return { status: "scheduled", effectiveAt: state.effectiveAt, target };
+        }
+    }
+    return { status: "in_force", effectiveAt: null, target: null };
+}