@oxygen-agent/cli 1.1010.721 → 1.1010.950

package/node_modules/@oxygen/shared/dist/table-capacity.js

@@ -1,4 +1,4 @@
-import { findRepricedValue, repricedValue } from "./repricing.js";
+import { findRepricedValue, readRepricingSwitch, repricedValue, } from "./repricing.js";
 const GIB = 1024 ** 3;
 /**
  * The envelope every workspace had before storage scaled with plan size, and
@@ -43,11 +43,26 @@ export const PLAN_BAND_TABLE_CAPACITY_TARGETS = Object.freeze({
     "1999": ladderRow(10_000_000, 100_000_000, 120),
 });
 /**
- * Sizes above today's envelope ship only after a capacity test at 5M and 10M
- * rows per Table (decision L1). Until that test passes these bands keep today's
- * envelope; shipping them is removing a band from this list.
+ * Rows per Table above today's 3,000,000 ship only after a capacity test at 5M
+ * and 10M rows per Table. The workspace totals of these bands (rows and
+ * database) are already in force (decision F.1, 2026-09-27, amending L1, which
+ * had gated both); shipping a band's rows per Table is removing it from this list.
  */
-export const PLAN_BANDS_AWAITING_CAPACITY_TEST = Object.freeze(["999", "1999"]);
+export const PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST = Object.freeze(["999", "1999"]);
+/**
+ * The capacity test itself runs on the self-hosted dev deployment, which
+ * therefore applies the awaiting bands' full ladder: a 10,000,000-row Table
+ * cannot be measured behind a 3,000,000-row limit. Every other deployment,
+ * production included, keeps the list above. The exact selector is compared
+ * (not `resolveDeployEnv`, which throws on a typo) so a malformed value keeps
+ * the production answer instead of failing a limits read.
+ */
+function awaitsTableRowCapacityTest(band, options) {
+    if (!PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST.includes(band))
+        return false;
+    const env = options.env ?? process.env;
+    return env.OXYGEN_DEPLOY_ENV?.trim().toLowerCase() !== "selfhost-dev";
+}
 const STORAGE_FIELDS = [
     ["tableRowLimit", "table_row_limit"],
     ["workspaceRowLimit", "workspace_row_limit"],
@@ -60,13 +75,16 @@ const STORAGE_FIELDS = [
  * - A limit that tightens (free, $49, $99) is a scheduled 2026-09 repricing value
  *   (`storage.<band>.*` in `REPRICING_2026_09_SCHEDULE`): today's envelope until
  *   the effective-date switch, the ratified ladder from it on.
- * - A band awaiting the capacity test keeps today's envelope.
+ * - A band awaiting the rows-per-Table capacity test has its ladder workspace
+ *   totals and keeps today's rows per Table, except on the self-hosted dev
+ *   deployment, where the test runs.
  * - Every other band is already at its ladder value.
  */
 export function resolveWorkspaceTableCapacity(band, options = {}) {
-    if (PLAN_BANDS_AWAITING_CAPACITY_TEST.includes(band))
-        return WORKSPACE_TABLE_CAPACITY;
     const target = PLAN_BAND_TABLE_CAPACITY_TARGETS[band];
+    if (awaitsTableRowCapacityTest(band, options)) {
+        return Object.freeze({ ...target, tableRowLimit: WORKSPACE_TABLE_CAPACITY.tableRowLimit });
+    }
     const resolved = { ...target };
     for (const [field, key] of STORAGE_FIELDS) {
         const scheduled = findRepricedValue(`storage.${band}.${key}`);
@@ -76,3 +94,17 @@ export function resolveWorkspaceTableCapacity(band, options = {}) {
     }
     return Object.freeze(resolved);
 }
+export function describeWorkspaceTableCapacityStatus(band, options = {}) {
+    if (awaitsTableRowCapacityTest(band, options)) {
+        return { status: "awaiting_capacity_test", effectiveAt: null, target: PLAN_BAND_TABLE_CAPACITY_TARGETS[band] };
+    }
+    const state = readRepricingSwitch(options);
+    if (state.status === "scheduled") {
+        const current = resolveWorkspaceTableCapacity(band, options);
+        const target = resolveWorkspaceTableCapacity(band, { ...options, now: state.effectiveAt });
+        if (STORAGE_FIELDS.some(([field]) => current[field] !== target[field])) {
+            return { status: "scheduled", effectiveAt: state.effectiveAt, target };
+        }
+    }
+    return { status: "in_force", effectiveAt: null, target: null };
+}

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.d.ts

@@ -46,6 +46,12 @@ export type TelemetryExportObserverOptions = {
     windowMs?: number | undefined;
     now?: (() => number) | undefined;
 };
+/**
+ * Copies the optional reader-facing exporter methods (FORWARDED_METHODS) from
+ * `inner` onto `wrapper`, bound to `inner`. Every exporter wrapper in this
+ * package uses it, so a method the SDK starts probing is added in one place.
+ */
+export declare function forwardExporterMethods(inner: object, wrapper: Record<string, unknown>): void;
 /** Origin + path only: never query strings, fragments or URL credentials. */
 export declare function telemetryEndpointForLog(endpoint: string): string;
 /**

package/node_modules/@oxygen/shared/dist/telemetry-export-observer.js

@@ -12,6 +12,18 @@ const FORWARDED_METHODS = [
     "selectAggregationTemporality",
     "selectAggregation",
 ];
+/**
+ * Copies the optional reader-facing exporter methods (FORWARDED_METHODS) from
+ * `inner` onto `wrapper`, bound to `inner`. Every exporter wrapper in this
+ * package uses it, so a method the SDK starts probing is added in one place.
+ */
+export function forwardExporterMethods(inner, wrapper) {
+    for (const method of FORWARDED_METHODS) {
+        const fn = inner[method];
+        if (typeof fn === "function")
+            wrapper[method] = fn.bind(inner);
+    }
+}
 /** Origin + path only: never query strings, fragments or URL credentials. */
 export function telemetryEndpointForLog(endpoint) {
     try {
@@ -187,11 +199,7 @@ export function observeTelemetryExporter(inner, options) {
             return inner.shutdown();
         },
     };
-    for (const method of FORWARDED_METHODS) {
-        const fn = inner[method];
-        if (typeof fn === "function")
-            observed[method] = fn.bind(inner);
-    }
+    forwardExporterMethods(inner, observed);
     return observed;
 }
 const DROPPED_SPANS_MESSAGE = /^Dropped (\d+) spans because maxQueueSize reached$/;

package/node_modules/@oxygen/shared/dist/telemetry-resource.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Which OTel resource each telemetry destination of this process receives.
+ *
+ * A process has ONE TracerProvider / MeterProvider and therefore one resource,
+ * but up to two destinations: Axiom (the managed-era store, whose dashboards and
+ * monitors filter on `deployment.environment == 'production'`) and the opt-in
+ * OTLP collector (DEV1 SigNoz, whose production receiver keeps only
+ * `deployment.environment == 'prod'` rows and whose dev receiver only `dev`).
+ *
+ * Production is the one tier where the two labels disagree, so production is the
+ * one tier that splits: the SDK resource stays exactly what a production process
+ * without a collector exports (the Axiom label, resource auto-detection on), and
+ * the collector's exporters swap in `collectorAttributes` — declared attributes
+ * only, never detected ones, because Node's process detector copies argv
+ * verbatim. Every other tier (dev, shadow, managed) keeps its single shared
+ * resource exactly as before.
+ */
+export type TelemetryResourcePlan = {
+    /** The SDK resource's `deployment.environment`: what Axiom receives. */
+    deploymentEnvironment: string;
+    /** The SDK resource attributes. */
+    resourceAttributes: Record<string, string>;
+    /** False when the collector shares the SDK resource, so nothing is detected into it. */
+    autoDetectResources: boolean;
+    /**
+     * Set only when the collector must see a different resource than Axiom: the
+     * declared attributes plus the process identity, labelled with the tier.
+     */
+    collectorAttributes: Record<string, string> | null;
+};
+export type TelemetryResourcePlanInput = {
+    /** Every resource attribute except `deployment.environment`. */
+    declared: Record<string, string>;
+    /** The surface's managed fallback chain, used when OXYGEN_DEPLOY_ENV is unset. */
+    managedEnvironment: string;
+    /** True when OXYGEN_OTLP_ENDPOINT is configured for this process. */
+    collectorConfigured: boolean;
+    env?: NodeJS.ProcessEnv;
+};
+export declare function planTelemetryResource({ declared, managedEnvironment, collectorConfigured, env, }: TelemetryResourcePlanInput): TelemetryResourcePlan;

package/node_modules/@oxygen/shared/dist/telemetry-resource.js

@@ -0,0 +1,35 @@
+import { deployEnvTelemetryEnvironment, resolveDeployEnv } from "./deploy-env.js";
+import { processResourceIdentity } from "./process-resource.js";
+export function planTelemetryResource({ declared, managedEnvironment, collectorConfigured, env = process.env, }) {
+    // The label a process without a collector has always exported: `production`
+    // on selfhost-prod, `development` on shadow/dev, the managed chain otherwise.
+    const axiomEnvironment = deployEnvTelemetryEnvironment(env) ?? managedEnvironment;
+    const withEnvironment = (environment, attributes) => ({
+        ...attributes,
+        "deployment.environment": environment,
+    });
+    if (!collectorConfigured) {
+        return {
+            deploymentEnvironment: axiomEnvironment,
+            resourceAttributes: withEnvironment(axiomEnvironment, declared),
+            autoDetectResources: true,
+            collectorAttributes: null,
+        };
+    }
+    const collectorEnvironment = env.OXYGEN_DEPLOY_ENV?.trim() ? resolveDeployEnv(env).tier : axiomEnvironment;
+    const collectorAttributes = withEnvironment(collectorEnvironment, { ...processResourceIdentity(), ...declared });
+    if (collectorEnvironment === "prod") {
+        return {
+            deploymentEnvironment: axiomEnvironment,
+            resourceAttributes: withEnvironment(axiomEnvironment, declared),
+            autoDetectResources: true,
+            collectorAttributes,
+        };
+    }
+    return {
+        deploymentEnvironment: collectorEnvironment,
+        resourceAttributes: collectorAttributes,
+        autoDetectResources: false,
+        collectorAttributes: null,
+    };
+}

package/node_modules/@oxygen/shared/dist/telemetry.js

@@ -226,6 +226,11 @@ const METRIC_SAFE_ATTRIBUTE_KEYS = new Set([
     "worker.cycle.slow",
     "table_action.lane",
     "tenant.ticket_reason",
+    // oxygen.worker.tenant_queue_wait_ms: the ticket's narrow scope
+    // (copilot | publishing | none) and the tenant's plan band (the seven bands
+    // plus "unresolved"), which the worker-share target is read by. Closed enums.
+    "tenant.wake_kind",
+    "tenant.plan_band",
     "queue.stalled",
     // BullMQ execution queue dimensions (oxygen.worker.queue.*). `queue.lane` is
     // the closed EXECUTION_LANES enum, `queue.role` the lane or "relay",

package/node_modules/@oxygen/shared/dist/ugc.d.ts

@@ -150,3 +150,18 @@ export type UgcVoiceImport = {
 };
 export declare const UGC_MONTHLY_CREATOR_CREDITS = 10000;
 export declare const UGC_SPONSORED_LINKEDIN_SEATS = 1;
+/**
+ * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
+ * Creators tab and the MCP widget alike: a card sponsorship waiting on its
+ * checkout reads differently from one waiting on the provider, and a stopped
+ * renewal says so while its paid period runs.
+ */
+export declare function ugcSponsorshipStatusLabel(row: {
+    status: string;
+    checkout_url?: string | null;
+    cancellation_pending?: boolean;
+}): string;
+/** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */
+export declare const UGC_SPONSORSHIP_PLAN_LABELS: Readonly<Record<string, string>>;
+/** When a new credit sponsorship's reservation starts (`participants[].reservation_starts`). */
+export declare const UGC_RESERVATION_START_LABELS: Readonly<Record<string, string>>;

package/node_modules/@oxygen/shared/dist/ugc.js

@@ -10,3 +10,32 @@ export function ugcPostingTarget(program) {
 }
 export const UGC_MONTHLY_CREATOR_CREDITS = 10_000;
 export const UGC_SPONSORED_LINKEDIN_SEATS = 1;
+/**
+ * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
+ * Creators tab and the MCP widget alike: a card sponsorship waiting on its
+ * checkout reads differently from one waiting on the provider, and a stopped
+ * renewal says so while its paid period runs.
+ */
+export function ugcSponsorshipStatusLabel(row) {
+    if (row.cancellation_pending)
+        return "Renewal stopping";
+    if (row.status === "active")
+        return "Sponsored";
+    if (row.status === "pending")
+        return row.checkout_url ? "Checkout open" : "Pending";
+    if (row.status === "cancelled")
+        return "Renewal stopped";
+    return "Not sponsored";
+}
+/** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */
+export const UGC_SPONSORSHIP_PLAN_LABELS = {
+    new: "Starts",
+    already_active: "Already sponsored",
+    stripe_period_running: "Moves to credits when the card period ends",
+    checkout_open: "Card checkout still open; cancel it first",
+};
+/** When a new credit sponsorship's reservation starts (`participants[].reservation_starts`). */
+export const UGC_RESERVATION_START_LABELS = {
+    now: "Now",
+    when_linkedin_connects: "When they connect LinkedIn",
+};

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,4 +1,2 @@
 export declare const OXYGEN_VERSION: string;
-export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
-export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
-export declare const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";
+export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.906.0";

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1010.721";
+export declare const OXYGEN_BUILD_VERSION = "1.1010.950";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1010.721";
+export const OXYGEN_BUILD_VERSION = "1.1010.950";

package/node_modules/@oxygen/shared/dist/version.js

@@ -26,7 +26,8 @@ export const OXYGEN_VERSION = OXYGEN_BUILD_VERSION;
 // So floors LAG one release: publish the CLI in release N, raise the floor to it in
 // release N+1. And a contract change that breaks ONE surface belongs on that
 // surface — pass `minimumCliVersion` to requireCliIdentity/requireCliOrWebIdentity
-// (see MANAGED_INBOX_MINIMUM_CLI_VERSION). A per-route floor fails one command
+// (declare it here as <SURFACE>_MINIMUM_CLI_VERSION, above the global floor; the
+// release gate checks it too). A per-route floor fails one command
 // safely; a global floor fails the whole product. OXY-4091.
 //
 // 1.328.1: paid table action runs and background columns run require
@@ -34,29 +35,18 @@ export const OXYGEN_VERSION = OXYGEN_BUILD_VERSION;
 // 1.328.1: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
 // (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and
 // removed the old /api/cli/linkedin/* routes — older CLIs would 404.
-export const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
-// Per-surface floor for the whitelabel/managed-inbox purchase path, enforced by
-// BOTH paid inbox routes: /api/cli/managed-inboxes/subscribe and
-// /api/cli/managed-inboxes/[domain]/mailboxes. (The comment used to say subscribe
-// only; the expansion route has enforced it too since it shipped, and three
-// separate reads of this file have since reasoned from the wrong half.)
-//
-// 1.326.2: Pricing Model 2.0 (2026-07-14) moved whitelabel inbox subscribe from the
-// USD Stripe rail back to Oxygen credits: the preview now returns
-// monthly_credits/one_off_credits and the approved execute RESERVES credits instead
-// of creating a Stripe subscription. An older CLI mis-renders the price/shape of a
-// PAID order (and would misread the reserved-not-charged response), so it is refused
-// on THIS route only. The floor lags one release per OXY-4091: the 1.326.2 CLI
-// publishes from the 1.326.x prod deploy, and this floor rides the 1.330.0 release —
-// so it can never exceed npm's newest CLI. (1.298.0 was the prior credits→Stripe
-// contract move.) Do NOT raise the global OXYGEN_MINIMUM_CLI_VERSION for this.
-export const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
-// Per-surface floor for guarded Plain agent reply + Done. CLI 1.747.0 is the
-// first client that declares --agent, binds the latest customer-visible
-// conversation-head message and
-// body-authenticated preview token, carries the live agent_done_token into the
-// separate Done confirmation, and never falls through to the retired resolve
-// shape. This floor MUST remain dormant in production until 1.747.0 has been
-// published by the preceding release per OXY-4091; the live feature gate is the
-// rollout boundary that preserves that two-phase ordering.
-export const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";
+// 1.906.0 (2026-09-27): the floor had sat at 1.181.0, below both of those
+// breaks, so CLIs that could no longer run paid actions or reach the Sequencer
+// were still admitted. 1.906.0 has been the npm `latest` since 2026-08-29, far
+// behind today's latest, so the lag rule holds. Measured before the raise
+// (PostHog `cli_command_run`, PROD, 14 days): 9 of 87 active organizations
+// were newest on an older CLI; each gets `cli_update_required` and one
+// `oxygen update` away from working. CLIs that ship packages/cli/src/auto-update.ts
+// update themselves on that rejection and re-run the command, so later raises
+// stop costing a manual step — the lag rule still applies unchanged. The raise
+// also retired both per-route floors, managed inboxes (1.326.2) and the guarded
+// support agent reply (1.747.0): below the global floor they could refuse no one.
+// Since 2026-09-28 the release-preparation step advances this literal to the
+// highest CLI version published on npm for at least 30 days. It never lowers
+// the floor. The source change lands on dev before the next production release.
+export const OXYGEN_MINIMUM_CLI_VERSION = "1.906.0";

package/node_modules/@oxygen/shared/dist/workspace-file-storage.d.ts

@@ -1,5 +1,10 @@
 export declare const WORKSPACE_VISUAL_SOURCE_MAX_BYTES = 1500000;
 export declare const WORKSPACE_VISUAL_BINARY_MAX_BYTES: number;
+/**
+ * Retained workspace files (CRM record attachments). Table-import staging is not
+ * a workspace file and never reads these two ceilings: it stages under
+ * `imports/` through `presignImportUpload` up to the plan's import file limit.
+ */
 export declare const WORKSPACE_OPAQUE_FILE_MAX_BYTES: number;
 /** Platform abuse guard shared by every plan, not a storage entitlement. */
 export declare const WORKSPACE_RETAINED_FILES_MAX_BYTES: number;

package/node_modules/@oxygen/shared/dist/workspace-file-storage.js

@@ -6,6 +6,11 @@ import { OxygenError } from "./cli-result.js";
 import { resolveObjectStorageClient } from "./object-storage.js";
 export const WORKSPACE_VISUAL_SOURCE_MAX_BYTES = 1_500_000;
 export const WORKSPACE_VISUAL_BINARY_MAX_BYTES = 50 * 1024 * 1024;
+/**
+ * Retained workspace files (CRM record attachments). Table-import staging is not
+ * a workspace file and never reads these two ceilings: it stages under
+ * `imports/` through `presignImportUpload` up to the plan's import file limit.
+ */
 export const WORKSPACE_OPAQUE_FILE_MAX_BYTES = 100 * 1024 * 1024;
 /** Platform abuse guard shared by every plan, not a storage entitlement. */
 export const WORKSPACE_RETAINED_FILES_MAX_BYTES = 1024 * 1024 * 1024;

package/node_modules/@oxygen/workflows/dist/graph/manifest-schema.d.ts

@@ -121,7 +121,7 @@ export declare const workflowCodeV1Schema: {
                 readonly timeout_ms: {
                     readonly type: "integer";
                     readonly minimum: 10;
-                    readonly maximum: 10000;
+                    readonly maximum: 30000;
                     readonly default: 1000;
                 };
                 readonly max_input_bytes: {
@@ -779,7 +779,7 @@ export declare const workflowGraphManifestSchema: {
                                     readonly timeout_ms: {
                                         readonly type: "integer";
                                         readonly minimum: 10;
-                                        readonly maximum: 10000;
+                                        readonly maximum: 30000;
                                         readonly default: 1000;
                                     };
                                     readonly max_input_bytes: {
@@ -1569,7 +1569,7 @@ export declare const portableWorkflowDefinitionSchema: {
                                             readonly timeout_ms: {
                                                 readonly type: "integer";
                                                 readonly minimum: 10;
-                                                readonly maximum: 10000;
+                                                readonly maximum: 30000;
                                                 readonly default: 1000;
                                             };
                                             readonly max_input_bytes: {

package/node_modules/@oxygen/workflows/dist/graph/types.d.ts

@@ -162,8 +162,22 @@ export declare const WORKFLOW_CODE_V1_RUNTIME = "oxygen-js-v1";
 export declare const WORKFLOW_CODE_V1_MAX_SOURCE_BYTES: number;
 export declare const WORKFLOW_CODE_V1_MAX_INPUTS = 100;
 export declare const WORKFLOW_CODE_V1_MIN_TIMEOUT_MS = 10;
-export declare const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 10000;
+/**
+ * The longest a typed Code node may declare (`limits.timeout_ms`): 30 s on every
+ * plan (repricing 2026-09, decision L4.3, up from 10 s). It applies to this
+ * sandboxed microVM runtime only; the legacy synchronous `run_source` path keeps
+ * its own lower ceiling (`PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS`, proposal P-49).
+ */
+export declare const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 30000;
 export declare const WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS = 1000;
+/**
+ * The wall-clock budget of one workflow run attempt on every plan: 30 minutes
+ * (repricing 2026-09, decision L4.3, up from 10). An attempt that reaches it is
+ * stopped and resumed from its durable checkpoints, not failed. The worker's
+ * default recipe timeout reads this; a deployment may still pin a lower value
+ * with `OXYGEN_WORKER_RECIPE_TIMEOUT_MS`.
+ */
+export declare const WORKFLOW_RUN_ATTEMPT_TIMEOUT_MS: number;
 export declare const WORKFLOW_CODE_V1_MIN_INPUT_BYTES = 1000;
 export declare const WORKFLOW_CODE_V1_MAX_INPUT_BYTES = 2000000;
 export declare const WORKFLOW_CODE_V1_DEFAULT_INPUT_BYTES = 250000;

package/node_modules/@oxygen/workflows/dist/graph/types.js

@@ -90,8 +90,22 @@ export const WORKFLOW_CODE_V1_RUNTIME = "oxygen-js-v1";
 export const WORKFLOW_CODE_V1_MAX_SOURCE_BYTES = 64 * 1_024;
 export const WORKFLOW_CODE_V1_MAX_INPUTS = 100;
 export const WORKFLOW_CODE_V1_MIN_TIMEOUT_MS = 10;
-export const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 10_000;
+/**
+ * The longest a typed Code node may declare (`limits.timeout_ms`): 30 s on every
+ * plan (repricing 2026-09, decision L4.3, up from 10 s). It applies to this
+ * sandboxed microVM runtime only; the legacy synchronous `run_source` path keeps
+ * its own lower ceiling (`PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS`, proposal P-49).
+ */
+export const WORKFLOW_CODE_V1_MAX_TIMEOUT_MS = 30_000;
 export const WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS = 1_000;
+/**
+ * The wall-clock budget of one workflow run attempt on every plan: 30 minutes
+ * (repricing 2026-09, decision L4.3, up from 10). An attempt that reaches it is
+ * stopped and resumed from its durable checkpoints, not failed. The worker's
+ * default recipe timeout reads this; a deployment may still pin a lower value
+ * with `OXYGEN_WORKER_RECIPE_TIMEOUT_MS`.
+ */
+export const WORKFLOW_RUN_ATTEMPT_TIMEOUT_MS = 30 * 60 * 1000;
 export const WORKFLOW_CODE_V1_MIN_INPUT_BYTES = 1_000;
 export const WORKFLOW_CODE_V1_MAX_INPUT_BYTES = 2_000_000;
 export const WORKFLOW_CODE_V1_DEFAULT_INPUT_BYTES = 250_000;

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -341,6 +341,43 @@ export declare function nextCronRunAfter(input: {
     timezone?: string | null;
     after?: Date;
 }): Date;
+/**
+ * The first slot of `cron` strictly after `after` that is also at least
+ * `minIntervalMinutes` after `lastFireAt`. This is how a plan's minimum cron
+ * interval (repricing 2026-09, decision L4.2) is enforced at fire time: a
+ * schedule that fires closer together than the plan allows keeps running, only
+ * slower, and is never deleted (proposal P-47). With no last fire or a minimum
+ * of one minute or less it is exactly `nextCronRunAfter`.
+ */
+export declare function nextCronRunAfterMinInterval(input: {
+    cron: string;
+    timezone?: string | null;
+    after: Date;
+    lastFireAt?: Date | null;
+    minIntervalMinutes?: number | null;
+}): Date;
+/**
+ * The smallest gap in minutes between two consecutive fires of `cron`, which is
+ * what a plan's minimum cron interval is checked against (repricing 2026-09,
+ * decision L4.2). It is the smallest gap, never the average: `0,5 9 * * *`
+ * fires once a day on average but twice five minutes apart, so its gap is 5.
+ *
+ * Gaps are measured in real time in `timezone`. A daylight-saving change can
+ * bring two fires closer than their wall-clock times suggest (01:55 and 03:05
+ * are ten minutes apart on the night the clock skips from 02:00 to 03:00, and
+ * a repeated hour can fire 01:45 and then 01:00 again), so the fires around
+ * each change in the coming year are simulated as well.
+ *
+ * Returns null when the schedule never fires twice within the scan (for
+ * example `0 9 29 2 *` fires once every few years and has no meaningful gap
+ * for a minimum to bind). Throws on an unparseable expression, like
+ * `nextCronRunAfter`.
+ */
+export declare function minCronGapMinutes(input: {
+    cron: string;
+    timezone?: string | null;
+    now?: Date;
+}): number | null;
 export declare function transformStep(input: {
     id: string;
     description?: string;
@@ -449,6 +486,14 @@ export declare function assertRecipeBundleSafe(bundle: string): void;
 export declare function lintRecipeBundleSafety(bundle: string, path?: string): WorkflowLintIssue[];
 /** Comment/string-aware author feedback for the stricter oxygen-js-v1 runtime. */
 export declare function lintWorkflowCodeSourceSafety(source: string, path?: string): WorkflowLintIssue[];
+/**
+ * The ceiling of the legacy synchronous `node:vm` path below. It stays at 10 s
+ * (and its callers pass 1 s) when the typed Code node rose to 30 s (repricing
+ * 2026-09, decision L4.3; proposal P-49): this path runs on the worker's own
+ * event loop, so a long synchronous script would stall every other job and its
+ * queue lock renewal. The typed Code node runs in a separate microVM instead.
+ */
+export declare const PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS = 10000;
 export declare function runPureWorkflowFunction(input: {
     source: string;
     context: Record<string, unknown>;