@oxygen-agent/cli 1.1010.721 → 1.1010.905

package/node_modules/@oxygen/shared/dist/feature-gates.d.ts

@@ -76,6 +76,10 @@ export type FeatureGateResolution = {
  *   (`packages/shared/src/repricing.ts`). A remotely flippable value would let
  *   a mis-click move every customer's prices; it changes only through Doppler,
  *   with explicit human approval.
+ * - OXYGEN_CREDIT_GATE_ENABLED — (b). Lets a connect through on the balance
+ *   instead of a sending seat (`packages/shared/src/credit-gate.ts`). A wrong
+ *   "on" while commitments do not bill every connectable kind would admit
+ *   accounts nothing ever charges.
  *
  * The list is a guard, not a to-do: none of these is migrated, and
  * `findFeatureGateRegistryViolations` fails the build's tests if one ever is.

package/node_modules/@oxygen/shared/dist/feature-gates.js

@@ -67,6 +67,10 @@
  *   (`packages/shared/src/repricing.ts`). A remotely flippable value would let
  *   a mis-click move every customer's prices; it changes only through Doppler,
  *   with explicit human approval.
+ * - OXYGEN_CREDIT_GATE_ENABLED — (b). Lets a connect through on the balance
+ *   instead of a sending seat (`packages/shared/src/credit-gate.ts`). A wrong
+ *   "on" while commitments do not bill every connectable kind would admit
+ *   accounts nothing ever charges.
  *
  * The list is a guard, not a to-do: none of these is migrated, and
  * `findFeatureGateRegistryViolations` fails the build's tests if one ever is.
@@ -82,6 +86,7 @@ export const NEVER_FLAGGABLE = [
     "OXYGEN_TRIGGER_DEFAULT_CAPS",
     "OXYGEN_BYOK_DAILY_CAPS",
     "OXYGEN_REPRICING_2026_09_EFFECTIVE_AT",
+    "OXYGEN_CREDIT_GATE_ENABLED",
 ];
 /**
  * Every server-side gate resolved through PostHog.

package/node_modules/@oxygen/shared/dist/file-import.d.ts

@@ -1,6 +1,6 @@
 import { type Row } from "read-excel-file/node";
 import { type ImportColumnDataType } from "./column-types.js";
-export { MAX_BUFFERED_IMPORT_PARSE_BYTES } from "./import-limits.js";
+export { IMPORT_OBJECT_SINGLE_PUT_MAX_BYTES, MAX_BUFFERED_IMPORT_PARSE_BYTES, MAX_URL_IMPORT_BYTES, bufferedImportTooLargeMessage, isBufferedOnlyImportFormat, } from "./import-limits.js";
 export type RowsFileFormat = "json" | "jsonl" | "csv" | "xlsx";
 export type ImportTableColumn = {
     label: string;
@@ -68,3 +68,15 @@ export declare function parseRowsSampleText(text: string, format: Exclude<RowsFi
 export declare function inferImportColumnLabels(rows: Record<string, unknown>[]): string[];
 export declare function normalizeRowsForNewTable(rows: Record<string, unknown>[]): NewTableImportRows;
 export declare function normalizeImportColumnKey(value: string): string;
+/**
+ * Refuse a JSON or XLSX file over the buffered-parse ceiling before anything is
+ * uploaded or queued. CSV and JSONL stream, so they pass at any size and only
+ * the plan's file limit applies to them.
+ */
+export declare function assertImportFormatWithinBufferedLimit(format: RowsFileFormat, fileBytes: number): void;
+/**
+ * Refuse a file sent whole inside one request (the multipart fallback used when
+ * object storage is not configured) over the buffered ceiling: that path holds
+ * the file in the web process, whatever the plan's file limit says.
+ */
+export declare function assertInlineImportWithinLimit(fileBytes: number): void;

package/node_modules/@oxygen/shared/dist/file-import.js

@@ -3,8 +3,8 @@ import readXlsxFile from "read-excel-file/node";
 import { inferImportColumnDataType, parseDateValueToIso, } from "./column-types.js";
 import { OxygenError } from "./cli-result.js";
 import { makeUniqueIdentifier, toSnakeIdentifier } from "./identifiers.js";
-import { MAX_BUFFERED_IMPORT_PARSE_BYTES } from "./import-limits.js";
-export { MAX_BUFFERED_IMPORT_PARSE_BYTES } from "./import-limits.js";
+import { MAX_BUFFERED_IMPORT_PARSE_BYTES, bufferedImportTooLargeMessage, isBufferedOnlyImportFormat, } from "./import-limits.js";
+export { IMPORT_OBJECT_SINGLE_PUT_MAX_BYTES, MAX_BUFFERED_IMPORT_PARSE_BYTES, MAX_URL_IMPORT_BYTES, bufferedImportTooLargeMessage, isBufferedOnlyImportFormat, } from "./import-limits.js";
 export function inferRowsFileFormat(path) {
     const extension = extname(path).toLowerCase();
     if (extension === ".jsonl" || extension === ".ndjson")
@@ -497,10 +497,11 @@ async function streamToLimitedBuffer(chunks, format) {
         const buffer = Buffer.from(toUint8Array(chunk));
         total += buffer.byteLength;
         if (total > MAX_BUFFERED_IMPORT_PARSE_BYTES) {
-            throw new OxygenError("import_file_too_large_for_format", `${format.toUpperCase()} imports must be uploaded as CSV or JSONL for large files.`, {
+            throw new OxygenError("import_file_too_large_for_format", bufferedImportTooLargeMessage(format), {
                 details: {
                     format,
                     max_buffered_parse_bytes: MAX_BUFFERED_IMPORT_PARSE_BYTES,
+                    next_step: "Save the file as CSV or JSONL and import it again.",
                 },
                 exitCode: 1,
             });
@@ -523,13 +524,39 @@ function normalizeBatchSize(value) {
     return Math.max(1, Math.trunc(value));
 }
 function assertBufferedParseWithinLimit(buffer, format) {
-    if (buffer.byteLength <= MAX_BUFFERED_IMPORT_PARSE_BYTES)
+    assertImportFormatWithinBufferedLimit(format, buffer.byteLength);
+}
+/**
+ * Refuse a JSON or XLSX file over the buffered-parse ceiling before anything is
+ * uploaded or queued. CSV and JSONL stream, so they pass at any size and only
+ * the plan's file limit applies to them.
+ */
+export function assertImportFormatWithinBufferedLimit(format, fileBytes) {
+    if (!isBufferedOnlyImportFormat(format) || fileBytes <= MAX_BUFFERED_IMPORT_PARSE_BYTES)
         return;
-    throw new OxygenError("buffered_import_too_large", "Large JSON array and XLSX imports require buffered parsing; use CSV or JSONL for large staged imports.", {
+    throw new OxygenError("buffered_import_too_large", bufferedImportTooLargeMessage(format, fileBytes), {
         details: {
             format,
-            file_bytes: buffer.byteLength,
+            file_bytes: fileBytes,
             max_buffered_parse_bytes: MAX_BUFFERED_IMPORT_PARSE_BYTES,
+            next_step: "Save the file as CSV or JSONL and import it again.",
+        },
+        exitCode: 1,
+    });
+}
+/**
+ * Refuse a file sent whole inside one request (the multipart fallback used when
+ * object storage is not configured) over the buffered ceiling: that path holds
+ * the file in the web process, whatever the plan's file limit says.
+ */
+export function assertInlineImportWithinLimit(fileBytes) {
+    if (fileBytes <= MAX_BUFFERED_IMPORT_PARSE_BYTES)
+        return;
+    throw new OxygenError("request_too_large", "Files this large upload straight to file storage, which is not available for this request.", {
+        details: {
+            file_bytes: fileBytes,
+            max_inline_file_bytes: MAX_BUFFERED_IMPORT_PARSE_BYTES,
+            next_step: "Import it with `oxygen tables import --file <path>` or the web import, which stage large files in object storage.",
         },
         exitCode: 1,
     });

package/node_modules/@oxygen/shared/dist/hosted-ai.d.ts

@@ -36,7 +36,12 @@ export type CopilotAiLevel = HostedAiLevel | "auto";
 export type HostedAiModelSpec = {
     /** OpenRouter model id, e.g. "deepseek/deepseek-v4-flash". */
     model: string;
-    /** Human-readable label for dashboards/UI. */
+    /**
+     * What a customer sees for this tier: always the Oxygen tier label, never the
+     * vendor model name ("DO not expose MODELs names to users", Philipp,
+     * 2026-09-26). Customer surfaces read this (e.g. the Copilot session's
+     * `model_display_name`); staff and logs read `model`.
+     */
     displayName: string;
     /** Ordered fallback model ids tried when `model` is unavailable. */
     fallbackModels: readonly string[];
@@ -54,12 +59,29 @@ export type HostedAiModelSpec = {
     estCompletionUsdPerM: number;
     /** Upper bound on completion tokens requested for this tier. */
     maxOutputTokens: number;
+    /**
+     * Send `reasoning: {enabled: false}` on a managed call to this tier's default
+     * model. Only where cost and quality were MEASURED with reasoning off: it is
+     * what the tier's price is calibrated against (ai_column Balanced, 2026-09-26).
+     */
+    disableReasoning?: boolean;
 };
 export declare const HOSTED_AI_MODEL_REGISTRY: {
     ai_column: Record<HostedAiLevel, HostedAiModelSpec>;
     copilot: Record<CopilotAiLevel, HostedAiModelSpec>;
     agent: Record<HostedAiLevel, HostedAiModelSpec>;
 };
+/**
+ * Managed AI-column model ids that USED to back a tier, mapped to the tier they
+ * billed at. A managed column saved with one of these pinned keeps validating
+ * (tenant-db `resolveManagedAiModelTier`) and runs on that tier's CURRENT model,
+ * so retiring a model never strands a saved column or keeps it on a model we no
+ * longer sell. A BYOK column keeps whatever it pinned: that is the customer's
+ * own key and choice. Retired 2026-09-26 (see the ai_column block above).
+ */
+export declare const LEGACY_MANAGED_AI_COLUMN_MODELS: Readonly<Record<string, HostedAiLevel>>;
+/** The tier a retired managed AI-column model id billed at, or null. */
+export declare function legacyManagedAiColumnLevel(model: string): HostedAiLevel | null;
 /**
  * What a MANAGED AI column's reasoning tier is called in front of a customer.
  *
@@ -123,8 +145,8 @@ export declare const AGENT_DEFAULT_LEVEL: HostedAiLevel;
  * Resolve the model spec for a hosted-AI use case + reasoning level.
  *
  * For `copilot`, Doppler overrides are applied here:
- *   - `OXYGEN_COPILOT_MODEL_{LOW,MEDIUM,HIGH}` replaces `.model` (and, since no
- *     separate label is supplied, `.displayName` falls back to the model id).
+ *   - `OXYGEN_COPILOT_MODEL_{LOW,MEDIUM,HIGH}` replaces `.model`; `.displayName`
+ *     keeps the tier label, because a customer never sees a model id.
  *   - `OXYGEN_COPILOT_FALLBACK_{LOW,MEDIUM,HIGH}` replaces `.fallbackModels`
  *     from a comma-separated list.
  *
@@ -146,6 +168,54 @@ export declare function resolveHostedAiModel(input: {
     level: CopilotAiLevel;
     env?: Record<string, string | undefined>;
 }): HostedAiModelSpec;
+/**
+ * The customer-facing label for a model id OXYGEN manages, or null when the id is
+ * not one of ours (a BYOK pin, a customer's own request). OpenRouter can answer
+ * with a dated or routed variant (`vendor/model-20260915`, `vendor/model:nitro`),
+ * so those match their base id.
+ */
+export declare function managedModelLabel(model: string, preferredUseCase?: HostedAiUseCase): string | null;
+/**
+ * What an AI-column run's provenance records as its model: the tier label for
+ * a managed run, and the model itself only when the customer pinned it on
+ * their own key. A BYOK run on the tier default is still OXYGEN's pick.
+ */
+export declare function customerFacingAiColumnModel(input: {
+    model: string;
+    credentialMode: "managed" | "byok";
+    reasoningLevel: HostedAiLevel;
+}): string;
+/**
+ * The model OpenRouter reports it answered with, for the same provenance. A
+ * managed run may have been served by a fallback, so it reads as the tier; a
+ * customer's own pin (or its dated variant) stays theirs.
+ */
+export declare function customerFacingAiColumnResponseModel(input: {
+    model: string;
+    credentialMode: "managed" | "byok";
+    reasoningLevel: HostedAiLevel;
+    responseModel: string | null;
+}): string | null;
+/**
+ * An AI-column request summary as the customer reads it: its `model` is the
+ * tier (or their pin), and any other managed id inside is redacted too.
+ */
+export declare function customerFacingAiColumnRequest<T extends Record<string, unknown>>(summary: T, input: {
+    model: string;
+    credentialMode: "managed" | "byok";
+    reasoningLevel: HostedAiLevel;
+}): T;
+/**
+ * Replace every string in `value` that is a managed model id with its tier
+ * label. Walks objects and arrays; only a string that IS a model id is touched,
+ * so prose that merely mentions a model is left alone. `allow` lists ids the
+ * customer chose (a BYOK pin), which pass through untouched.
+ */
+export declare function redactManagedModelIds<T>(value: T, options?: {
+    allow?: readonly (string | null | undefined)[];
+    preferredUseCase?: HostedAiUseCase;
+    env?: Record<string, string | undefined>;
+}): T;
 /**
  * Convenience map of each reasoning tier's default `.model` id for a use case.
  * `@oxygen/integrations` and `@oxygen/tenant-db` re-source their AI-column

package/node_modules/@oxygen/shared/dist/hosted-ai.js

@@ -21,29 +21,87 @@
  * can re-source the catalog without dragging in the shared barrel.
  */
 export const HOSTED_AI_MODEL_REGISTRY = {
+    /**
+     * Managed AI-column tiers, re-picked 2026-09-26 on measured evidence
+     * (Philipp, 2026-09-26: Clay-level quality, faster, 30-50% cheaper than Clay,
+     * and at least 5x markup on AI and research columns -- with one explicit
+     * founder exception for Max, below).
+     *
+     * Quality: a blind bakeoff of 13 OpenRouter models x 60 synthetic rows on the
+     * four jobs AI columns do (classify, extract, copy, grounded research), every
+     * request built by the runner's own buildOpenRouterRequestBody; copy and
+     * research graded 1-5 by a blind opus judge (spend $1.74). The previous tiers
+     * (DeepSeek V4 Flash / V4 Pro / Kimi K2.6) placed 11th-13th of 13.
+     *
+     * Cost: a second, production-shaped calibration run (golden-prodshape.json:
+     * research with 6-10 sources totalling ~6-20k tokens, copy with ~2.5k tokens
+     * of workspace context, extract/classify over ~1.5-3k tokens of scraped text;
+     * spend $1.80). Each model's mean cost on that set is taken as a multiple of
+     * a reference model whose REAL production mean is known from Langfuse, and
+     * that multiple is the projection. Harness: scripts/ops/ai-column-bakeoff
+     * (`--golden`, `summarize --reference`).
+     *
+     *   tier      model                        blind overall   prod-mean $/row  credits  markup
+     *   Fast      gpt-6-luna                   4.13 (res 4.80) 0.0013 (1.68x v4-flash @ $0.00077)  1.5  ~11x
+     *   Balanced  deepseek-v4.1-flash, no reasoning  4.23      0.0079 (0.60x v4-pro @ $0.0132)     4    ~5.1x
+     *   Max       gpt-6-sol                    4.13 (5th; fastest, 1-3 s)  0.098            25   ~2.5x
+     *
+     * Balanced runs with reasoning OFF (`disableReasoning`): on the prod-shaped
+     * set it cost $0.00141/row against reasoning-on v4-pro's $0.00235 with
+     * classify, extract and research accuracy unchanged (100%; research citations
+     * 90%). With reasoning on it would not clear 5x at 4 credits.
+     *
+     * Max at ~2.5x is an EXPLICIT founder exception to the 5x rule (Philipp,
+     * 2026-09-26: "gpt-6 sol @ 2.5x markup"). Sol answered research correctly on
+     * every prod-shaped row and is the fastest of the 13. Two earlier Max picks
+     * were dropped the same day on cost: claude-opus-5.5 (#1, 4.63) billed ~1.8x
+     * the input tokens for the same rows, and kimi-k3 (#2, 4.37) projects to
+     * ~$0.183/row -- about 92 credits at 5x, its copy rows costing 48x v4-pro's.
+     * The first token-average projection (Langfuse token profile x list price)
+     * undercounted real cost by ~4x, which is why pricing now uses the
+     * calibration above. Neither never-shipped id is in the legacy map.
+     *
+     * Against Clay: fixed content models cost 0.2 Data Credits (GPT-5 Nano), 0.5
+     * (Gemini 2.5 Flash) and 1 (GPT-4.1/Helium) at >= $0.05 per Data Credit
+     * ($0.074-0.083 on plans) plus ~$0.01 per Action, so Fast and Balanced land
+     * well under Clay. Clay passes frontier models through at cost.
+     *
+     * Each tier falls back to a different vendor through OpenRouter's `models`
+     * routing, sent only when the tier default runs (ai-column-runner).
+     *
+     * The $49 trap, as an aside: one synthetic research row lists the real plan
+     * ($199/location/month) beside a $49 dental-school education price. 9 of 13
+     * models answered $49, including Luna, V4.1 Flash and Sol; Gemini 3.8 Flash
+     * (Max's fallback) was one of the four that did not.
+     *
+     * `reasoningEffort` is deliberately unset on every tier; the only reasoning
+     * control measured for columns is Balanced's off switch above.
+     * Retired ids live in LEGACY_MANAGED_AI_COLUMN_MODELS.
+     */
     ai_column: {
         low: {
-            model: "deepseek/deepseek-v4-flash",
-            displayName: "DeepSeek V4 Flash",
-            fallbackModels: [],
-            estPromptUsdPerM: 0.09,
-            estCompletionUsdPerM: 0.18,
+            model: "openai/gpt-6-luna",
+            displayName: "Oxygen Fast",
+            fallbackModels: ["deepseek/deepseek-v4.1-flash"],
+            estPromptUsdPerM: 0.1,
+            estCompletionUsdPerM: 0.5,
             maxOutputTokens: 4096,
         },
         medium: {
-            model: "deepseek/deepseek-v4-pro",
-            displayName: "DeepSeek V4 Pro",
-            fallbackModels: [],
-            estPromptUsdPerM: 0.435,
-            estCompletionUsdPerM: 0.87,
+            model: "deepseek/deepseek-v4.1-flash",
+            displayName: "Oxygen Balanced",
+            fallbackModels: ["openai/gpt-6-luna"],
+            estPromptUsdPerM: 0.3,
+            estCompletionUsdPerM: 1.2,
             maxOutputTokens: 4096,
+            disableReasoning: true,
         },
         high: {
-            model: "moonshotai/kimi-k2.6",
-            displayName: "Kimi K2.6",
-            fallbackModels: [],
-            estPromptUsdPerM: 0.66,
-            estCompletionUsdPerM: 3.41,
+            model: "openai/gpt-6-sol",
+            displayName: "Oxygen Max",
+            fallbackModels: ["google/gemini-3.8-flash"],
+            estPromptUsdPerM: 2,
+            estCompletionUsdPerM: 10,
             maxOutputTokens: 4096,
         },
     },
@@ -104,7 +162,7 @@ export const HOSTED_AI_MODEL_REGISTRY = {
             // (classifyModelError sends it straight to the next model), so a 20%
             // error rate here is a 20% double round trip on every delegation.
             model: "deepseek/deepseek-v4-flash",
-            displayName: "DeepSeek V4 Flash",
+            displayName: "Oxygen Fast",
             // v4.1-flash earns its place HERE: it works 4 times in 5 and it is a
             // genuinely different endpoint on a different provider, which is the one
             // thing a fallback has to be.
@@ -116,7 +174,7 @@ export const HOSTED_AI_MODEL_REGISTRY = {
         },
         medium: {
             model: "deepseek/deepseek-v4-pro",
-            displayName: "DeepSeek V4 Pro",
+            displayName: "Oxygen Balanced",
             fallbackModels: [],
             reasoningEffort: "high",
             estPromptUsdPerM: 0.435,
@@ -132,7 +190,7 @@ export const HOSTED_AI_MODEL_REGISTRY = {
          */
         high: {
             model: "moonshotai/kimi-k3",
-            displayName: "Kimi K3",
+            displayName: "Oxygen Max",
             fallbackModels: ["z-ai/glm-5.3"],
             reasoningEffort: "medium",
             estPromptUsdPerM: 1.7,
@@ -143,7 +201,7 @@ export const HOSTED_AI_MODEL_REGISTRY = {
     agent: {
         low: {
             model: "deepseek/deepseek-v4-flash",
-            displayName: "DeepSeek V4 Flash",
+            displayName: "Oxygen Fast",
             fallbackModels: [],
             reasoningEffort: "medium",
             estPromptUsdPerM: 0.09,
@@ -152,7 +210,7 @@ export const HOSTED_AI_MODEL_REGISTRY = {
         },
         medium: {
             model: "deepseek/deepseek-v4-pro",
-            displayName: "DeepSeek V4 Pro",
+            displayName: "Oxygen Balanced",
             fallbackModels: ["deepseek/deepseek-v4-flash"],
             reasoningEffort: "high",
             estPromptUsdPerM: 0.435,
@@ -161,7 +219,7 @@ export const HOSTED_AI_MODEL_REGISTRY = {
         },
         high: {
             model: "moonshotai/kimi-k2.6",
-            displayName: "Kimi K2.6",
+            displayName: "Oxygen Max",
             fallbackModels: ["deepseek/deepseek-v4-pro"],
             estPromptUsdPerM: 0.66,
             estCompletionUsdPerM: 3.41,
@@ -169,6 +227,25 @@ export const HOSTED_AI_MODEL_REGISTRY = {
         },
     },
 };
+/**
+ * Managed AI-column model ids that USED to back a tier, mapped to the tier they
+ * billed at. A managed column saved with one of these pinned keeps validating
+ * (tenant-db `resolveManagedAiModelTier`) and runs on that tier's CURRENT model,
+ * so retiring a model never strands a saved column or keeps it on a model we no
+ * longer sell. A BYOK column keeps whatever it pinned: that is the customer's
+ * own key and choice. Retired 2026-09-26 (see the ai_column block above).
+ */
+export const LEGACY_MANAGED_AI_COLUMN_MODELS = {
+    "deepseek/deepseek-v4-flash": "low",
+    "deepseek/deepseek-v4-pro": "medium",
+    "moonshotai/kimi-k2.6": "high",
+};
+/** The tier a retired managed AI-column model id billed at, or null. */
+export function legacyManagedAiColumnLevel(model) {
+    return Object.prototype.hasOwnProperty.call(LEGACY_MANAGED_AI_COLUMN_MODELS, model)
+        ? LEGACY_MANAGED_AI_COLUMN_MODELS[model] ?? null
+        : null;
+}
 /**
  * What a MANAGED AI column's reasoning tier is called in front of a customer.
  *
@@ -258,8 +335,8 @@ function parseFallbackCsv(raw) {
  * Resolve the model spec for a hosted-AI use case + reasoning level.
  *
  * For `copilot`, Doppler overrides are applied here:
- *   - `OXYGEN_COPILOT_MODEL_{LOW,MEDIUM,HIGH}` replaces `.model` (and, since no
- *     separate label is supplied, `.displayName` falls back to the model id).
+ *   - `OXYGEN_COPILOT_MODEL_{LOW,MEDIUM,HIGH}` replaces `.model`; `.displayName`
+ *     keeps the tier label, because a customer never sees a model id.
  *   - `OXYGEN_COPILOT_FALLBACK_{LOW,MEDIUM,HIGH}` replaces `.fallbackModels`
  *     from a comma-separated list.
  *
@@ -311,13 +388,158 @@ export function resolveHostedAiModel(input) {
     const resolved = { ...base };
     if (modelOverride !== undefined) {
         resolved.model = modelOverride;
-        resolved.displayName = modelOverride;
     }
     if (fallbackOverride !== undefined) {
         resolved.fallbackModels = fallbackOverride;
     }
     return resolved;
 }
+/**
+ * "DO not expose MODELs names to users" (Philipp, 2026-09-26).
+ *
+ * A customer buys an Oxygen tier, so every customer surface names the tier
+ * (Oxygen Fast / Balanced / Max / Auto) and never the vendor model OXYGEN picked
+ * behind it. The model ids stay in logs, Langfuse and staff surfaces. The only
+ * model a customer sees is one they chose themselves: a BYOK pin or a Copilot
+ * `--model` request, which callers pass as `allow`.
+ *
+ * Provenance written before this rule (cell sources, run events, Copilot events)
+ * still carries raw ids, so the redaction runs where a payload leaves for a
+ * customer rather than where it is written.
+ */
+const BACKUP_MODEL_LABEL = "Oxygen backup model";
+// TypeSafe's System One classifier (`SYSTEM_ONE_MODEL` in @oxygen/integrations,
+// pinned as `jev-<version>`) is OXYGEN's choice too. It answers classification
+// columns and inbox triage at the managed Fast price, so provenance written with
+// its id (before the write-time fix, or by a later version bump) reads as that
+// tier. Matched by shape so a version bump stays covered.
+const SYSTEM_ONE_MODEL_ID = /^jev-(?:\d+(?:\.\d+)*|latest)$/;
+const SYSTEM_ONE_MODEL_LABEL = MANAGED_AI_TIER_LABELS.low;
+// Doppler can swap any tier's model without a deploy; the swapped-in id is still
+// OXYGEN's choice, so it is redacted like the registry default it replaces.
+const MODEL_OVERRIDE_ENV_PREFIXES = ["OXYGEN_OPENROUTER_MODEL_", "OXYGEN_COPILOT_MODEL_", "OXYGEN_AGENT_MODEL_"];
+function managedModelLabels(preferredUseCase, env = typeof process === "undefined" ? {} : process.env) {
+    const labels = new Map();
+    for (const prefix of MODEL_OVERRIDE_ENV_PREFIXES) {
+        for (const level of ["LOW", "MEDIUM", "HIGH", "AUTO"]) {
+            const model = readTrimmedEnv(env, `${prefix}${level}`);
+            if (!model || labels.has(model))
+                continue;
+            labels.set(model, level === "AUTO" ? COPILOT_TIER_LABELS.auto : MANAGED_AI_TIER_LABELS[level.toLowerCase()]);
+        }
+    }
+    const useCases = Object.keys(HOSTED_AI_MODEL_REGISTRY);
+    const ordered = preferredUseCase
+        ? [preferredUseCase, ...useCases.filter((useCase) => useCase !== preferredUseCase)]
+        : useCases;
+    for (const useCase of ordered) {
+        for (const spec of Object.values(HOSTED_AI_MODEL_REGISTRY[useCase])) {
+            if (!labels.has(spec.model))
+                labels.set(spec.model, spec.displayName);
+        }
+    }
+    for (const [model, level] of Object.entries(LEGACY_MANAGED_AI_COLUMN_MODELS)) {
+        if (!labels.has(model))
+            labels.set(model, MANAGED_AI_TIER_LABELS[level]);
+    }
+    for (const useCase of ordered) {
+        for (const spec of Object.values(HOSTED_AI_MODEL_REGISTRY[useCase])) {
+            for (const fallback of spec.fallbackModels) {
+                if (!labels.has(fallback))
+                    labels.set(fallback, BACKUP_MODEL_LABEL);
+            }
+        }
+    }
+    return labels;
+}
+/**
+ * The customer-facing label for a model id OXYGEN manages, or null when the id is
+ * not one of ours (a BYOK pin, a customer's own request). OpenRouter can answer
+ * with a dated or routed variant (`vendor/model-20260915`, `vendor/model:nitro`),
+ * so those match their base id.
+ */
+export function managedModelLabel(model, preferredUseCase) {
+    return labelForManagedModel(managedModelLabels(preferredUseCase), model);
+}
+function labelForManagedModel(labels, model) {
+    const exact = labels.get(model);
+    if (exact)
+        return exact;
+    for (const [id, label] of labels) {
+        if (model.startsWith(`${id}-`) || model.startsWith(`${id}:`))
+            return label;
+    }
+    if (SYSTEM_ONE_MODEL_ID.test(model))
+        return SYSTEM_ONE_MODEL_LABEL;
+    return null;
+}
+/**
+ * What an AI-column run's provenance records as its model: the tier label for
+ * a managed run, and the model itself only when the customer pinned it on
+ * their own key. A BYOK run on the tier default is still OXYGEN's pick.
+ */
+export function customerFacingAiColumnModel(input) {
+    if (input.credentialMode === "byok" && managedModelLabel(input.model, "ai_column") === null)
+        return input.model;
+    return MANAGED_AI_TIER_LABELS[input.reasoningLevel];
+}
+/**
+ * The model OpenRouter reports it answered with, for the same provenance. A
+ * managed run may have been served by a fallback, so it reads as the tier; a
+ * customer's own pin (or its dated variant) stays theirs.
+ */
+export function customerFacingAiColumnResponseModel(input) {
+    if (input.responseModel === null)
+        return null;
+    const requested = customerFacingAiColumnModel(input);
+    return requested === input.model ? input.responseModel : requested;
+}
+/**
+ * An AI-column request summary as the customer reads it: its `model` is the
+ * tier (or their pin), and any other managed id inside is redacted too.
+ */
+export function customerFacingAiColumnRequest(summary, input) {
+    const redacted = redactManagedModelIds(summary, { preferredUseCase: "ai_column" });
+    return "model" in summary ? { ...redacted, model: customerFacingAiColumnModel(input) } : redacted;
+}
+/**
+ * Replace every string in `value` that is a managed model id with its tier
+ * label. Walks objects and arrays; only a string that IS a model id is touched,
+ * so prose that merely mentions a model is left alone. `allow` lists ids the
+ * customer chose (a BYOK pin), which pass through untouched.
+ */
+export function redactManagedModelIds(value, options = {}) {
+    const allow = new Set((options.allow ?? []).filter((id) => typeof id === "string" && id.length > 0));
+    const labels = managedModelLabels(options.preferredUseCase, options.env);
+    const labelFor = (model) => allow.has(model) ? null : labelForManagedModel(labels, model);
+    const walk = (node) => {
+        if (typeof node === "string")
+            return labelFor(node) ?? node;
+        if (Array.isArray(node)) {
+            let changed = false;
+            const next = node.map((item) => {
+                const mapped = walk(item);
+                if (mapped !== item)
+                    changed = true;
+                return mapped;
+            });
+            return changed ? next : node;
+        }
+        if (node && typeof node === "object" && !(node instanceof Date)) {
+            let changed = false;
+            const next = {};
+            for (const [key, item] of Object.entries(node)) {
+                const mapped = walk(item);
+                if (mapped !== item)
+                    changed = true;
+                next[key] = mapped;
+            }
+            return changed ? next : node;
+        }
+        return node;
+    };
+    return walk(value);
+}
 /**
  * Convenience map of each reasoning tier's default `.model` id for a use case.
  * `@oxygen/integrations` and `@oxygen/tenant-db` re-source their AI-column

package/node_modules/@oxygen/shared/dist/import-limits.d.ts

@@ -13,9 +13,27 @@
 /**
  * Formats that must be held in memory to parse at all — a JSON array has no
  * record boundary to stream from, and XLSX is a zip container. CSV and JSONL
- * stream, so only these two are capped this low.
+ * stream from object storage up to the plan's file limit, so only these two
+ * carry this lower ceiling (raised from 10 MiB by decision F.8, 2026-09-27).
+ *
+ * It also bounds every path that holds a whole file in one request: the inline
+ * multipart import used when object storage is not configured.
  */
 export declare const MAX_BUFFERED_IMPORT_PARSE_BYTES: number;
+/**
+ * A link import (`--url`, `oxygen_tables_import_url`, the wizard's link card)
+ * is downloaded and parsed inside the web request, so it keeps its own small
+ * ceiling. It is not a plan limit: a bigger file is downloaded and imported
+ * with `tables import --file`, which stages it in object storage.
+ */
+export declare const MAX_URL_IMPORT_BYTES: number;
+/**
+ * The largest object one presigned PUT may carry on an S3-compatible store (S3
+ * and Ceph-based stores such as Hetzner Object Storage cap a single PUT at
+ * 5 GiB). A staged import is one PUT, so no plan's import file limit may
+ * exceed it.
+ */
+export declare const IMPORT_OBJECT_SINGLE_PUT_MAX_BYTES: number;
 /**
  * The platform's request-body ceiling — infrastructure, not a plan limit.
  *
@@ -26,3 +44,9 @@ export declare const MAX_BUFFERED_IMPORT_PARSE_BYTES: number;
 export declare const VERCEL_REQUEST_BODY_LIMIT_BYTES: number;
 /** True for the formats that cannot stream and so carry the buffered ceiling. */
 export declare function isBufferedOnlyImportFormat(format: string): boolean;
+/**
+ * The refusal every surface gives a JSON or XLSX file over the buffered
+ * ceiling. It names the ceiling and the two formats that take a larger file,
+ * so the reader knows the fix is a format change, not a plan change.
+ */
+export declare function bufferedImportTooLargeMessage(format: string, fileBytes?: number | null): string;