@oxygen-agent/cli 1.1010.721 → 1.1010.905

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.d.ts

@@ -46,6 +46,12 @@ export type TelemetryExportObserverOptions = {
     windowMs?: number | undefined;
     now?: (() => number) | undefined;
 };
+/**
+ * Copies the optional reader-facing exporter methods (FORWARDED_METHODS) from
+ * `inner` onto `wrapper`, bound to `inner`. Every exporter wrapper in this
+ * package uses it, so a method the SDK starts probing is added in one place.
+ */
+export declare function forwardExporterMethods(inner: object, wrapper: Record<string, unknown>): void;
 /** Origin + path only: never query strings, fragments or URL credentials. */
 export declare function telemetryEndpointForLog(endpoint: string): string;
 /**

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.js

@@ -12,6 +12,18 @@ const FORWARDED_METHODS = [
     "selectAggregationTemporality",
     "selectAggregation",
 ];
+/**
+ * Copies the optional reader-facing exporter methods (FORWARDED_METHODS) from
+ * `inner` onto `wrapper`, bound to `inner`. Every exporter wrapper in this
+ * package uses it, so a method the SDK starts probing is added in one place.
+ */
+export function forwardExporterMethods(inner, wrapper) {
+    for (const method of FORWARDED_METHODS) {
+        const fn = inner[method];
+        if (typeof fn === "function")
+            wrapper[method] = fn.bind(inner);
+    }
+}
 /** Origin + path only: never query strings, fragments or URL credentials. */
 export function telemetryEndpointForLog(endpoint) {
     try {
@@ -187,11 +199,7 @@ export function observeTelemetryExporter(inner, options) {
             return inner.shutdown();
         },
     };
-    for (const method of FORWARDED_METHODS) {
-        const fn = inner[method];
-        if (typeof fn === "function")
-            observed[method] = fn.bind(inner);
-    }
+    forwardExporterMethods(inner, observed);
     return observed;
 }
 const DROPPED_SPANS_MESSAGE = /^Dropped (\d+) spans because maxQueueSize reached$/;

package/node_modules/@oxygen/shared/dist/telemetry-resource.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Which OTel resource each telemetry destination of this process receives.
+ *
+ * A process has ONE TracerProvider / MeterProvider and therefore one resource,
+ * but up to two destinations: Axiom (the managed-era store, whose dashboards and
+ * monitors filter on `deployment.environment == 'production'`) and the opt-in
+ * OTLP collector (DEV1 SigNoz, whose production receiver keeps only
+ * `deployment.environment == 'prod'` rows and whose dev receiver only `dev`).
+ *
+ * Production is the one tier where the two labels disagree, so production is the
+ * one tier that splits: the SDK resource stays exactly what a production process
+ * without a collector exports (the Axiom label, resource auto-detection on), and
+ * the collector's exporters swap in `collectorAttributes` — declared attributes
+ * only, never detected ones, because Node's process detector copies argv
+ * verbatim. Every other tier (dev, shadow, managed) keeps its single shared
+ * resource exactly as before.
+ */
+export type TelemetryResourcePlan = {
+    /** The SDK resource's `deployment.environment`: what Axiom receives. */
+    deploymentEnvironment: string;
+    /** The SDK resource attributes. */
+    resourceAttributes: Record<string, string>;
+    /** False when the collector shares the SDK resource, so nothing is detected into it. */
+    autoDetectResources: boolean;
+    /**
+     * Set only when the collector must see a different resource than Axiom: the
+     * declared attributes plus the process identity, labelled with the tier.
+     */
+    collectorAttributes: Record<string, string> | null;
+};
+export type TelemetryResourcePlanInput = {
+    /** Every resource attribute except `deployment.environment`. */
+    declared: Record<string, string>;
+    /** The surface's managed fallback chain, used when OXYGEN_DEPLOY_ENV is unset. */
+    managedEnvironment: string;
+    /** True when OXYGEN_OTLP_ENDPOINT is configured for this process. */
+    collectorConfigured: boolean;
+    env?: NodeJS.ProcessEnv;
+};
+export declare function planTelemetryResource({ declared, managedEnvironment, collectorConfigured, env, }: TelemetryResourcePlanInput): TelemetryResourcePlan;

package/node_modules/@oxygen/shared/dist/telemetry-resource.js

@@ -0,0 +1,35 @@
+import { deployEnvTelemetryEnvironment, resolveDeployEnv } from "./deploy-env.js";
+import { processResourceIdentity } from "./process-resource.js";
+export function planTelemetryResource({ declared, managedEnvironment, collectorConfigured, env = process.env, }) {
+    // The label a process without a collector has always exported: `production`
+    // on selfhost-prod, `development` on shadow/dev, the managed chain otherwise.
+    const axiomEnvironment = deployEnvTelemetryEnvironment(env) ?? managedEnvironment;
+    const withEnvironment = (environment, attributes) => ({
+        ...attributes,
+        "deployment.environment": environment,
+    });
+    if (!collectorConfigured) {
+        return {
+            deploymentEnvironment: axiomEnvironment,
+            resourceAttributes: withEnvironment(axiomEnvironment, declared),
+            autoDetectResources: true,
+            collectorAttributes: null,
+        };
+    }
+    const collectorEnvironment = env.OXYGEN_DEPLOY_ENV?.trim() ? resolveDeployEnv(env).tier : axiomEnvironment;
+    const collectorAttributes = withEnvironment(collectorEnvironment, { ...processResourceIdentity(), ...declared });
+    if (collectorEnvironment === "prod") {
+        return {
+            deploymentEnvironment: axiomEnvironment,
+            resourceAttributes: withEnvironment(axiomEnvironment, declared),
+            autoDetectResources: true,
+            collectorAttributes,
+        };
+    }
+    return {
+        deploymentEnvironment: collectorEnvironment,
+        resourceAttributes: collectorAttributes,
+        autoDetectResources: false,
+        collectorAttributes: null,
+    };
+}

package/node_modules/@oxygen/shared/dist/telemetry.js

@@ -226,6 +226,11 @@ const METRIC_SAFE_ATTRIBUTE_KEYS = new Set([
     "worker.cycle.slow",
     "table_action.lane",
     "tenant.ticket_reason",
+    // oxygen.worker.tenant_queue_wait_ms: the ticket's narrow scope
+    // (copilot | publishing | none) and the tenant's plan band (the seven bands
+    // plus "unresolved"), which the worker-share target is read by. Closed enums.
+    "tenant.wake_kind",
+    "tenant.plan_band",
     "queue.stalled",
     // BullMQ execution queue dimensions (oxygen.worker.queue.*). `queue.lane` is
     // the closed EXECUTION_LANES enum, `queue.role` the lane or "relay",

package/node_modules/@oxygen/shared/dist/ugc.d.ts

@@ -150,3 +150,18 @@ export type UgcVoiceImport = {
 };
 export declare const UGC_MONTHLY_CREATOR_CREDITS = 10000;
 export declare const UGC_SPONSORED_LINKEDIN_SEATS = 1;
+/**
+ * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
+ * Creators tab and the MCP widget alike: a card sponsorship waiting on its
+ * checkout reads differently from one waiting on the provider, and a stopped
+ * renewal says so while its paid period runs.
+ */
+export declare function ugcSponsorshipStatusLabel(row: {
+    status: string;
+    checkout_url?: string | null;
+    cancellation_pending?: boolean;
+}): string;
+/** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */
+export declare const UGC_SPONSORSHIP_PLAN_LABELS: Readonly<Record<string, string>>;
+/** When a new credit sponsorship's reservation starts (`participants[].reservation_starts`). */
+export declare const UGC_RESERVATION_START_LABELS: Readonly<Record<string, string>>;

package/node_modules/@oxygen/shared/dist/ugc.js

@@ -10,3 +10,32 @@ export function ugcPostingTarget(program) {
 }
 export const UGC_MONTHLY_CREATOR_CREDITS = 10_000;
 export const UGC_SPONSORED_LINKEDIN_SEATS = 1;
+/**
+ * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
+ * Creators tab and the MCP widget alike: a card sponsorship waiting on its
+ * checkout reads differently from one waiting on the provider, and a stopped
+ * renewal says so while its paid period runs.
+ */
+export function ugcSponsorshipStatusLabel(row) {
+    if (row.cancellation_pending)
+        return "Renewal stopping";
+    if (row.status === "active")
+        return "Sponsored";
+    if (row.status === "pending")
+        return row.checkout_url ? "Checkout open" : "Pending";
+    if (row.status === "cancelled")
+        return "Renewal stopped";
+    return "Not sponsored";
+}
+/** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */
+export const UGC_SPONSORSHIP_PLAN_LABELS = {
+    new: "Starts",
+    already_active: "Already sponsored",
+    stripe_period_running: "Moves to credits when the card period ends",
+    checkout_open: "Card checkout still open; cancel it first",
+};
+/** When a new credit sponsorship's reservation starts (`participants[].reservation_starts`). */
+export const UGC_RESERVATION_START_LABELS = {
+    now: "Now",
+    when_linkedin_connects: "When they connect LinkedIn",
+};

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,4 +1,2 @@
 export declare const OXYGEN_VERSION: string;
-export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
-export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
-export declare const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";
+export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.906.0";

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1010.721";
+export declare const OXYGEN_BUILD_VERSION = "1.1010.905";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1010.721";
+export const OXYGEN_BUILD_VERSION = "1.1010.905";

package/node_modules/@oxygen/shared/dist/version.js

@@ -26,7 +26,8 @@ export const OXYGEN_VERSION = OXYGEN_BUILD_VERSION;
 // So floors LAG one release: publish the CLI in release N, raise the floor to it in
 // release N+1. And a contract change that breaks ONE surface belongs on that
 // surface — pass `minimumCliVersion` to requireCliIdentity/requireCliOrWebIdentity
-// (see MANAGED_INBOX_MINIMUM_CLI_VERSION). A per-route floor fails one command
+// (declare it here as <SURFACE>_MINIMUM_CLI_VERSION, above the global floor; the
+// release gate checks it too). A per-route floor fails one command
 // safely; a global floor fails the whole product. OXY-4091.
 //
 // 1.328.1: paid table action runs and background columns run require
@@ -34,29 +35,15 @@ export const OXYGEN_VERSION = OXYGEN_BUILD_VERSION;
 // 1.328.1: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
 // (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and
 // removed the old /api/cli/linkedin/* routes — older CLIs would 404.
-export const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
-// Per-surface floor for the whitelabel/managed-inbox purchase path, enforced by
-// BOTH paid inbox routes: /api/cli/managed-inboxes/subscribe and
-// /api/cli/managed-inboxes/[domain]/mailboxes. (The comment used to say subscribe
-// only; the expansion route has enforced it too since it shipped, and three
-// separate reads of this file have since reasoned from the wrong half.)
-//
-// 1.326.2: Pricing Model 2.0 (2026-07-14) moved whitelabel inbox subscribe from the
-// USD Stripe rail back to Oxygen credits: the preview now returns
-// monthly_credits/one_off_credits and the approved execute RESERVES credits instead
-// of creating a Stripe subscription. An older CLI mis-renders the price/shape of a
-// PAID order (and would misread the reserved-not-charged response), so it is refused
-// on THIS route only. The floor lags one release per OXY-4091: the 1.326.2 CLI
-// publishes from the 1.326.x prod deploy, and this floor rides the 1.330.0 release —
-// so it can never exceed npm's newest CLI. (1.298.0 was the prior credits→Stripe
-// contract move.) Do NOT raise the global OXYGEN_MINIMUM_CLI_VERSION for this.
-export const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
-// Per-surface floor for guarded Plain agent reply + Done. CLI 1.747.0 is the
-// first client that declares --agent, binds the latest customer-visible
-// conversation-head message and
-// body-authenticated preview token, carries the live agent_done_token into the
-// separate Done confirmation, and never falls through to the retired resolve
-// shape. This floor MUST remain dormant in production until 1.747.0 has been
-// published by the preceding release per OXY-4091; the live feature gate is the
-// rollout boundary that preserves that two-phase ordering.
-export const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";
+// 1.906.0 (2026-09-27): the floor had sat at 1.181.0, below both of those
+// breaks, so CLIs that could no longer run paid actions or reach the Sequencer
+// were still admitted. 1.906.0 has been the npm `latest` since 2026-08-29, far
+// behind today's latest, so the lag rule holds. Measured before the raise
+// (PostHog `cli_command_run`, PROD, 14 days): 9 of 87 active organizations
+// were newest on an older CLI; each gets `cli_update_required` and one
+// `oxygen update` away from working. CLIs that ship packages/cli/src/auto-update.ts
+// update themselves on that rejection and re-run the command, so later raises
+// stop costing a manual step — the lag rule still applies unchanged. The raise
+// also retired both per-route floors, managed inboxes (1.326.2) and the guarded
+// support agent reply (1.747.0): below the global floor they could refuse no one.
+export const OXYGEN_MINIMUM_CLI_VERSION = "1.906.0";

package/node_modules/@oxygen/shared/dist/workspace-file-storage.d.ts

@@ -1,5 +1,10 @@
 export declare const WORKSPACE_VISUAL_SOURCE_MAX_BYTES = 1500000;
 export declare const WORKSPACE_VISUAL_BINARY_MAX_BYTES: number;
+/**
+ * Retained workspace files (CRM record attachments). Table-import staging is not
+ * a workspace file and never reads these two ceilings: it stages under
+ * `imports/` through `presignImportUpload` up to the plan's import file limit.
+ */
 export declare const WORKSPACE_OPAQUE_FILE_MAX_BYTES: number;
 /** Platform abuse guard shared by every plan, not a storage entitlement. */
 export declare const WORKSPACE_RETAINED_FILES_MAX_BYTES: number;

package/node_modules/@oxygen/shared/dist/workspace-file-storage.js

@@ -6,6 +6,11 @@ import { OxygenError } from "./cli-result.js";
 import { resolveObjectStorageClient } from "./object-storage.js";
 export const WORKSPACE_VISUAL_SOURCE_MAX_BYTES = 1_500_000;
 export const WORKSPACE_VISUAL_BINARY_MAX_BYTES = 50 * 1024 * 1024;
+/**
+ * Retained workspace files (CRM record attachments). Table-import staging is not
+ * a workspace file and never reads these two ceilings: it stages under
+ * `imports/` through `presignImportUpload` up to the plan's import file limit.
+ */
 export const WORKSPACE_OPAQUE_FILE_MAX_BYTES = 100 * 1024 * 1024;
 /** Platform abuse guard shared by every plan, not a storage entitlement. */
 export const WORKSPACE_RETAINED_FILES_MAX_BYTES = 1024 * 1024 * 1024;

package/node_modules/@oxygen/workflows/dist/graph/manifest-schema.d.ts

@@ -121,7 +121,7 @@ export declare const workflowCodeV1Schema: {
                 readonly timeout_ms: {
                     readonly type: "integer";
                     readonly minimum: 10;
-                    readonly maximum: 10000;
+                    readonly maximum: 30000;
                     readonly default: 1000;
                 };
                 readonly max_input_bytes: {
@@ -779,7 +779,7 @@ export declare const workflowGraphManifestSchema: {
                                     readonly timeout_ms: {
                                         readonly type: "integer";
                                         readonly minimum: 10;
-                                        readonly maximum: 10000;
+                                        readonly maximum: 30000;
                                         readonly default: 1000;
                                     };
                                     readonly max_input_bytes: {
@@ -1569,7 +1569,7 @@ export declare const portableWorkflowDefinitionSchema: {
                                             readonly timeout_ms: {
                                                 readonly type: "integer";
                                                 readonly minimum: 10;
-                                                readonly maximum: 10000;
+                                                readonly maximum: 30000;
                                                 readonly default: 1000;
                                             };
                                             readonly max_input_bytes: {

package/node_modules/@oxygen/workflows/dist/graph/types.d.ts

@@ -162,8 +162,22 @@ export declare const WORKFLOW_CODE_V1_RUNTIME = "oxygen-js-v1";
 export declare const WORKFLOW_CODE_V1_MAX_SOURCE_BYTES: number;
 export declare const WORKFLOW_CODE_V1_MAX_INPUTS = 100;
 export declare const WORKFLOW_CODE_V1_MIN_TIMEOUT_MS = 10;
-export declare const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 10000;
+/**
+ * The longest a typed Code node may declare (`limits.timeout_ms`): 30 s on every
+ * plan (repricing 2026-09, decision L4.3, up from 10 s). It applies to this
+ * sandboxed microVM runtime only; the legacy synchronous `run_source` path keeps
+ * its own lower ceiling (`PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS`, proposal P-49).
+ */
+export declare const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 30000;
 export declare const WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS = 1000;
+/**
+ * The wall-clock budget of one workflow run attempt on every plan: 30 minutes
+ * (repricing 2026-09, decision L4.3, up from 10). An attempt that reaches it is
+ * stopped and resumed from its durable checkpoints, not failed. The worker's
+ * default recipe timeout reads this; a deployment may still pin a lower value
+ * with `OXYGEN_WORKER_RECIPE_TIMEOUT_MS`.
+ */
+export declare const WORKFLOW_RUN_ATTEMPT_TIMEOUT_MS: number;
 export declare const WORKFLOW_CODE_V1_MIN_INPUT_BYTES = 1000;
 export declare const WORKFLOW_CODE_V1_MAX_INPUT_BYTES = 2000000;
 export declare const WORKFLOW_CODE_V1_DEFAULT_INPUT_BYTES = 250000;

package/node_modules/@oxygen/workflows/dist/graph/types.js

@@ -90,8 +90,22 @@ export const WORKFLOW_CODE_V1_RUNTIME = "oxygen-js-v1";
 export const WORKFLOW_CODE_V1_MAX_SOURCE_BYTES = 64 * 1_024;
 export const WORKFLOW_CODE_V1_MAX_INPUTS = 100;
 export const WORKFLOW_CODE_V1_MIN_TIMEOUT_MS = 10;
-export const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 10_000;
+/**
+ * The longest a typed Code node may declare (`limits.timeout_ms`): 30 s on every
+ * plan (repricing 2026-09, decision L4.3, up from 10 s). It applies to this
+ * sandboxed microVM runtime only; the legacy synchronous `run_source` path keeps
+ * its own lower ceiling (`PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS`, proposal P-49).
+ */
+export const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 30_000;
 export const WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS = 1_000;
+/**
+ * The wall-clock budget of one workflow run attempt on every plan: 30 minutes
+ * (repricing 2026-09, decision L4.3, up from 10). An attempt that reaches it is
+ * stopped and resumed from its durable checkpoints, not failed. The worker's
+ * default recipe timeout reads this; a deployment may still pin a lower value
+ * with `OXYGEN_WORKER_RECIPE_TIMEOUT_MS`.
+ */
+export const WORKFLOW_RUN_ATTEMPT_TIMEOUT_MS = 30 * 60 * 1000;
 export const WORKFLOW_CODE_V1_MIN_INPUT_BYTES = 1_000;
 export const WORKFLOW_CODE_V1_MAX_INPUT_BYTES = 2_000_000;
 export const WORKFLOW_CODE_V1_DEFAULT_INPUT_BYTES = 250_000;

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -341,6 +341,43 @@ export declare function nextCronRunAfter(input: {
     timezone?: string | null;
     after?: Date;
 }): Date;
+/**
+ * The first slot of `cron` strictly after `after` that is also at least
+ * `minIntervalMinutes` after `lastFireAt`. This is how a plan's minimum cron
+ * interval (repricing 2026-09, decision L4.2) is enforced at fire time: a
+ * schedule that fires closer together than the plan allows keeps running, only
+ * slower, and is never deleted (proposal P-47). With no last fire or a minimum
+ * of one minute or less it is exactly `nextCronRunAfter`.
+ */
+export declare function nextCronRunAfterMinInterval(input: {
+    cron: string;
+    timezone?: string | null;
+    after: Date;
+    lastFireAt?: Date | null;
+    minIntervalMinutes?: number | null;
+}): Date;
+/**
+ * The smallest gap in minutes between two consecutive fires of `cron`, which is
+ * what a plan's minimum cron interval is checked against (repricing 2026-09,
+ * decision L4.2). It is the smallest gap, never the average: `0,5 9 * * *`
+ * fires once a day on average but twice five minutes apart, so its gap is 5.
+ *
+ * Gaps are measured in real time in `timezone`. A daylight-saving change can
+ * bring two fires closer than their wall-clock times suggest (01:55 and 03:05
+ * are ten minutes apart on the night the clock skips from 02:00 to 03:00, and
+ * a repeated hour can fire 01:45 and then 01:00 again), so the fires around
+ * each change in the coming year are simulated as well.
+ *
+ * Returns null when the schedule never fires twice within the scan (for
+ * example `0 9 29 2 *` fires once every few years and has no meaningful gap
+ * for a minimum to bind). Throws on an unparseable expression, like
+ * `nextCronRunAfter`.
+ */
+export declare function minCronGapMinutes(input: {
+    cron: string;
+    timezone?: string | null;
+    now?: Date;
+}): number | null;
 export declare function transformStep(input: {
     id: string;
     description?: string;
@@ -449,6 +486,14 @@ export declare function assertRecipeBundleSafe(bundle: string): void;
 export declare function lintRecipeBundleSafety(bundle: string, path?: string): WorkflowLintIssue[];
 /** Comment/string-aware author feedback for the stricter oxygen-js-v1 runtime. */
 export declare function lintWorkflowCodeSourceSafety(source: string, path?: string): WorkflowLintIssue[];
+/**
+ * The ceiling of the legacy synchronous `node:vm` path below. It stays at 10 s
+ * (and its callers pass 1 s) when the typed Code node rose to 30 s (repricing
+ * 2026-09, decision L4.3; proposal P-49): this path runs on the worker's own
+ * event loop, so a long synchronous script would stall every other job and its
+ * queue lock renewal. The typed Code node runs in a separate microVM instead.
+ */
+export declare const PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS = 10000;
 export declare function runPureWorkflowFunction(input: {
     source: string;
     context: Record<string, unknown>;

package/node_modules/@oxygen/workflows/dist/index.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import * as vm from "node:vm"; // skipcq: JS-C1003
-import { isWorkflowGraphManifest, WORKFLOW_CODE_V1_DEFAULT_OUTPUT_BYTES, WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES, WORKFLOW_CODE_V1_MAX_TIMEOUT_MS, WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, } from "./graph/types.js";
+import { isWorkflowGraphManifest, WORKFLOW_CODE_V1_DEFAULT_OUTPUT_BYTES, WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, } from "./graph/types.js";
 import { lintWorkflowGraphManifest } from "./graph/lint.js";
 export * from "./usage-estimate.js";
 // Pure event-dispatch semantics, shared by the apps/web and apps/worker event
@@ -162,6 +162,148 @@ export function nextCronRunAfter(input) {
     }
     throw new Error(`Cron expression has no matching run time in the next ${MAX_CRON_LOOKAHEAD_DAYS} days.`);
 }
+/**
+ * The first slot of `cron` strictly after `after` that is also at least
+ * `minIntervalMinutes` after `lastFireAt`. This is how a plan's minimum cron
+ * interval (repricing 2026-09, decision L4.2) is enforced at fire time: a
+ * schedule that fires closer together than the plan allows keeps running, only
+ * slower, and is never deleted (proposal P-47). With no last fire or a minimum
+ * of one minute or less it is exactly `nextCronRunAfter`.
+ */
+export function nextCronRunAfterMinInterval(input) {
+    const minIntervalMs = Math.max(0, input.minIntervalMinutes ?? 0) * 60_000;
+    let after = input.after;
+    if (input.lastFireAt && minIntervalMs > 60_000) {
+        // One millisecond before the earliest allowed instant: nextCronRunAfter
+        // returns the first whole-minute slot strictly after it, so a slot exactly
+        // `minIntervalMinutes` after the last fire is allowed.
+        const earliestAllowed = input.lastFireAt.getTime() + minIntervalMs - 1;
+        if (earliestAllowed > after.getTime())
+            after = new Date(earliestAllowed);
+    }
+    return nextCronRunAfter({ cron: input.cron, timezone: input.timezone ?? null, after });
+}
+// How many calendar days minCronGapMinutes scans for two matching days in a
+// row: two leap cycles, so a Feb 29 or a day-of-month/weekday coincidence is
+// always seen.
+const CRON_GAP_DAY_SCAN = 366 * 8 + 2;
+// Real-time simulation around a daylight-saving change covers the day it falls
+// in plus this many whole days either side (so the fire before a long gap that
+// straddles the change is inside the window), and stops after this many fires.
+const CRON_GAP_DST_WINDOW_DAYS = 1;
+const CRON_GAP_DST_MAX_FIRES = 5_000;
+/**
+ * The smallest gap in minutes between two consecutive fires of `cron`, which is
+ * what a plan's minimum cron interval is checked against (repricing 2026-09,
+ * decision L4.2). It is the smallest gap, never the average: `0,5 9 * * *`
+ * fires once a day on average but twice five minutes apart, so its gap is 5.
+ *
+ * Gaps are measured in real time in `timezone`. A daylight-saving change can
+ * bring two fires closer than their wall-clock times suggest (01:55 and 03:05
+ * are ten minutes apart on the night the clock skips from 02:00 to 03:00, and
+ * a repeated hour can fire 01:45 and then 01:00 again), so the fires around
+ * each change in the coming year are simulated as well.
+ *
+ * Returns null when the schedule never fires twice within the scan (for
+ * example `0 9 29 2 *` fires once every few years and has no meaningful gap
+ * for a minimum to bind). Throws on an unparseable expression, like
+ * `nextCronRunAfter`.
+ */
+export function minCronGapMinutes(input) {
+    const schedule = parseCronSchedule(input.cron);
+    const timezone = input.timezone?.trim() || DEFAULT_WORKFLOW_CRON_TIMEZONE;
+    const fireMinutes = [...schedule.hours]
+        .flatMap((hour) => [...schedule.minutes].map((minute) => hour * 60 + minute))
+        .sort((a, b) => a - b);
+    let gap = Number.POSITIVE_INFINITY;
+    for (let index = 1; index < fireMinutes.length; index += 1) {
+        gap = Math.min(gap, (fireMinutes[index] ?? 0) - (fireMinutes[index - 1] ?? 0));
+    }
+    const dayGap = smallestMatchingDayGap(schedule);
+    const firstFire = fireMinutes[0];
+    const lastFire = fireMinutes[fireMinutes.length - 1];
+    if (dayGap !== null && firstFire !== undefined && lastFire !== undefined) {
+        gap = Math.min(gap, dayGap * 24 * 60 + firstFire - lastFire);
+    }
+    // A one-minute gap is the floor of the cron grammar; daylight saving cannot
+    // bring two fires closer than that.
+    if (gap > 1) {
+        const dstGap = smallestGapAroundDaylightSavingChanges(input.cron, timezone, input.now ?? new Date());
+        if (dstGap !== null)
+            gap = Math.min(gap, dstGap);
+    }
+    return Number.isFinite(gap) ? gap : null;
+}
+/** Fewest days between two calendar days the schedule's date fields both match. */
+function smallestMatchingDayGap(schedule) {
+    // Calendar arithmetic only (no timezone): day-of-month, month and weekday
+    // matching is the same on every clock. A fixed leap-year start covers every
+    // weekday/day-of-month combination within the scan.
+    const start = Date.UTC(2024, 0, 1);
+    let previousMatch = null;
+    let smallest = null;
+    for (let day = 0; day < CRON_GAP_DAY_SCAN; day += 1) {
+        const date = new Date(start + day * 24 * 60 * 60 * 1000);
+        const matches = matchesCronDate(schedule, {
+            minute: 0,
+            hour: 0,
+            dayOfMonth: date.getUTCDate(),
+            month: date.getUTCMonth() + 1,
+            dayOfWeek: date.getUTCDay(),
+        });
+        if (!matches)
+            continue;
+        if (previousMatch !== null) {
+            const gap = day - previousMatch;
+            smallest = smallest === null ? gap : Math.min(smallest, gap);
+            if (smallest === 1)
+                return 1;
+        }
+        previousMatch = day;
+    }
+    return smallest;
+}
+/**
+ * The smallest real-time gap between fires in the days around each
+ * daylight-saving change in the year after `now`; null when the zone has no
+ * change in that year or no two fires fall in any window.
+ */
+function smallestGapAroundDaylightSavingChanges(cron, timezone, now) {
+    const dayMs = 24 * 60 * 60 * 1000;
+    const start = Math.floor(now.getTime() / dayMs) * dayMs;
+    let smallest = null;
+    let previousOffset = zonedOffsetMinutes(new Date(start), timezone);
+    for (let day = 1; day <= 367; day += 1) {
+        const offset = zonedOffsetMinutes(new Date(start + day * dayMs), timezone);
+        if (offset === previousOffset)
+            continue;
+        previousOffset = offset;
+        const windowStart = new Date(start + (day - 1 - CRON_GAP_DST_WINDOW_DAYS) * dayMs);
+        const windowEnd = start + (day + CRON_GAP_DST_WINDOW_DAYS) * dayMs;
+        let fire = nextCronRunAfter({ cron, timezone, after: windowStart });
+        for (let fires = 0; fires < CRON_GAP_DST_MAX_FIRES && fire.getTime() <= windowEnd; fires += 1) {
+            const next = nextCronRunAfter({ cron, timezone, after: fire });
+            if (next.getTime() > windowEnd)
+                break;
+            const gap = Math.round((next.getTime() - fire.getTime()) / 60_000);
+            smallest = smallest === null ? gap : Math.min(smallest, gap);
+            fire = next;
+        }
+    }
+    return smallest;
+}
+/** Minutes the zone's wall clock is ahead of UTC at `date`. */
+function zonedOffsetMinutes(date, timezone) {
+    const formatter = getZonedFormatter(timezone);
+    const parts = new Map();
+    for (const part of formatter.formatToParts(date)) {
+        if (part.type !== "literal")
+            parts.set(part.type, part.value);
+    }
+    const wallClock = Date.UTC(Number(parts.get("year")), Number(parts.get("month")) - 1, Number(parts.get("day")), Number(parts.get("hour")), Number(parts.get("minute")));
+    const instant = Math.floor(date.getTime() / 60_000) * 60_000;
+    return Math.round((wallClock - instant) / 60_000);
+}
 export function transformStep(input) {
     return {
         __oxygen_workflow_step: true,
@@ -983,8 +1125,16 @@ export function lintWorkflowCodeSourceSafety(source, path = "$.source") {
     }
     return issues;
 }
+/**
+ * The ceiling of the legacy synchronous `node:vm` path below. It stays at 10 s
+ * (and its callers pass 1 s) when the typed Code node rose to 30 s (repricing
+ * 2026-09, decision L4.3; proposal P-49): this path runs on the worker's own
+ * event loop, so a long synchronous script would stall every other job and its
+ * queue lock renewal. The typed Code node runs in a separate microVM instead.
+ */
+export const PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS = 10_000;
 export async function runPureWorkflowFunction(input) {
-    const timeoutMs = Math.max(WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, Math.min(input.timeoutMs ?? WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_TIMEOUT_MS));
+    const timeoutMs = Math.max(WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, Math.min(input.timeoutMs ?? WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS));
     const maxOutputBytes = Math.max(WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, Math.min(input.maxOutputBytes ?? WORKFLOW_CODE_V1_DEFAULT_OUTPUT_BYTES, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES));
     const issues = [];
     validatePureFunctionSource(input.source, "$.source", (path, code, message) => {

package/node_modules/@oxygen/workflows/dist/usage-estimate.d.ts

@@ -3,7 +3,12 @@ export type WorkflowAutomationUsageEstimate = {
     scheduledRunsPer30Days: number | null;
     scheduledActionsPer30DaysFloor: number | null;
     dynamicRuntimeActions: boolean;
-    perRowFanout: boolean;
+    /**
+     * Always false: row writes stopped billing per row (repricing 2026-09,
+     * decision 6.2). Kept for one release so older CLIs and pages that read it
+     * still parse; remove after that release.
+     */
+    perRowFanout: false;
 };
 export declare function estimateWorkflowRunAutomationActionsFloor(manifest: unknown): number;
 export declare function estimateWorkflowAutomationUsage(manifest: unknown, cron?: string | null): WorkflowAutomationUsageEstimate | null;
@@ -16,6 +21,8 @@ export type CronCadenceAssessment = {
     floorShareOfIncluded: number;
     basis: "plan_action_quota" | "plan_monthly_credits";
     includedCredits: number | null;
+    spendableCredits: number | null;
+    allowanceCredits: number | null;
     floorCreditsPer30Days: number | null;
     minimumViableIntervalMinutes: number | null;
     verdict: "fits" | "impossible";
@@ -27,6 +34,8 @@ export declare function assessCronCadenceViability(input: {
     overageEnabled: boolean;
     includedCredits?: number | null;
     creditsPerAction?: number | null;
+    /** Credits the workspace can spend right now (its available balance). */
+    spendableCredits?: number | null;
 }): CronCadenceAssessment | null;
 export type CronAggressiveness = {
     level: "aggressive" | "very_aggressive";