@oxygen-agent/cli 1.1010.721 → 1.1010.950

package/node_modules/@oxygen/workflows/dist/index.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import * as vm from "node:vm"; // skipcq: JS-C1003
-import { isWorkflowGraphManifest, WORKFLOW_CODE_V1_DEFAULT_OUTPUT_BYTES, WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES, WORKFLOW_CODE_V1_MAX_TIMEOUT_MS, WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, } from "./graph/types.js";
+import { isWorkflowGraphManifest, WORKFLOW_CODE_V1_DEFAULT_OUTPUT_BYTES, WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, } from "./graph/types.js";
 import { lintWorkflowGraphManifest } from "./graph/lint.js";
 export * from "./usage-estimate.js";
 // Pure event-dispatch semantics, shared by the apps/web and apps/worker event
@@ -162,6 +162,148 @@ export function nextCronRunAfter(input) {
     }
     throw new Error(`Cron expression has no matching run time in the next ${MAX_CRON_LOOKAHEAD_DAYS} days.`);
 }
+/**
+ * The first slot of `cron` strictly after `after` that is also at least
+ * `minIntervalMinutes` after `lastFireAt`. This is how a plan's minimum cron
+ * interval (repricing 2026-09, decision L4.2) is enforced at fire time: a
+ * schedule that fires closer together than the plan allows keeps running, only
+ * slower, and is never deleted (proposal P-47). With no last fire or a minimum
+ * of one minute or less it is exactly `nextCronRunAfter`.
+ */
+export function nextCronRunAfterMinInterval(input) {
+    const minIntervalMs = Math.max(0, input.minIntervalMinutes ?? 0) * 60_000;
+    let after = input.after;
+    if (input.lastFireAt && minIntervalMs > 60_000) {
+        // One millisecond before the earliest allowed instant: nextCronRunAfter
+        // returns the first whole-minute slot strictly after it, so a slot exactly
+        // `minIntervalMinutes` after the last fire is allowed.
+        const earliestAllowed = input.lastFireAt.getTime() + minIntervalMs - 1;
+        if (earliestAllowed > after.getTime())
+            after = new Date(earliestAllowed);
+    }
+    return nextCronRunAfter({ cron: input.cron, timezone: input.timezone ?? null, after });
+}
+// How many calendar days minCronGapMinutes scans for two matching days in a
+// row: two leap cycles, so a Feb 29 or a day-of-month/weekday coincidence is
+// always seen.
+const CRON_GAP_DAY_SCAN = 366 * 8 + 2;
+// Real-time simulation around a daylight-saving change covers the day it falls
+// in plus this many whole days either side (so the fire before a long gap that
+// straddles the change is inside the window), and stops after this many fires.
+const CRON_GAP_DST_WINDOW_DAYS = 1;
+const CRON_GAP_DST_MAX_FIRES = 5_000;
+/**
+ * The smallest gap in minutes between two consecutive fires of `cron`, which is
+ * what a plan's minimum cron interval is checked against (repricing 2026-09,
+ * decision L4.2). It is the smallest gap, never the average: `0,5 9 * * *`
+ * fires once a day on average but twice five minutes apart, so its gap is 5.
+ *
+ * Gaps are measured in real time in `timezone`. A daylight-saving change can
+ * bring two fires closer than their wall-clock times suggest (01:55 and 03:05
+ * are ten minutes apart on the night the clock skips from 02:00 to 03:00, and
+ * a repeated hour can fire 01:45 and then 01:00 again), so the fires around
+ * each change in the coming year are simulated as well.
+ *
+ * Returns null when the schedule never fires twice within the scan (for
+ * example `0 9 29 2 *` fires once every few years and has no meaningful gap
+ * for a minimum to bind). Throws on an unparseable expression, like
+ * `nextCronRunAfter`.
+ */
+export function minCronGapMinutes(input) {
+    const schedule = parseCronSchedule(input.cron);
+    const timezone = input.timezone?.trim() || DEFAULT_WORKFLOW_CRON_TIMEZONE;
+    const fireMinutes = [...schedule.hours]
+        .flatMap((hour) => [...schedule.minutes].map((minute) => hour * 60 + minute))
+        .sort((a, b) => a - b);
+    let gap = Number.POSITIVE_INFINITY;
+    for (let index = 1; index < fireMinutes.length; index += 1) {
+        gap = Math.min(gap, (fireMinutes[index] ?? 0) - (fireMinutes[index - 1] ?? 0));
+    }
+    const dayGap = smallestMatchingDayGap(schedule);
+    const firstFire = fireMinutes[0];
+    const lastFire = fireMinutes[fireMinutes.length - 1];
+    if (dayGap !== null && firstFire !== undefined && lastFire !== undefined) {
+        gap = Math.min(gap, dayGap * 24 * 60 + firstFire - lastFire);
+    }
+    // A one-minute gap is the floor of the cron grammar; daylight saving cannot
+    // bring two fires closer than that.
+    if (gap > 1) {
+        const dstGap = smallestGapAroundDaylightSavingChanges(input.cron, timezone, input.now ?? new Date());
+        if (dstGap !== null)
+            gap = Math.min(gap, dstGap);
+    }
+    return Number.isFinite(gap) ? gap : null;
+}
+/** Fewest days between two calendar days the schedule's date fields both match. */
+function smallestMatchingDayGap(schedule) {
+    // Calendar arithmetic only (no timezone): day-of-month, month and weekday
+    // matching is the same on every clock. A fixed leap-year start covers every
+    // weekday/day-of-month combination within the scan.
+    const start = Date.UTC(2024, 0, 1);
+    let previousMatch = null;
+    let smallest = null;
+    for (let day = 0; day < CRON_GAP_DAY_SCAN; day += 1) {
+        const date = new Date(start + day * 24 * 60 * 60 * 1000);
+        const matches = matchesCronDate(schedule, {
+            minute: 0,
+            hour: 0,
+            dayOfMonth: date.getUTCDate(),
+            month: date.getUTCMonth() + 1,
+            dayOfWeek: date.getUTCDay(),
+        });
+        if (!matches)
+            continue;
+        if (previousMatch !== null) {
+            const gap = day - previousMatch;
+            smallest = smallest === null ? gap : Math.min(smallest, gap);
+            if (smallest === 1)
+                return 1;
+        }
+        previousMatch = day;
+    }
+    return smallest;
+}
+/**
+ * The smallest real-time gap between fires in the days around each
+ * daylight-saving change in the year after `now`; null when the zone has no
+ * change in that year or no two fires fall in any window.
+ */
+function smallestGapAroundDaylightSavingChanges(cron, timezone, now) {
+    const dayMs = 24 * 60 * 60 * 1000;
+    const start = Math.floor(now.getTime() / dayMs) * dayMs;
+    let smallest = null;
+    let previousOffset = zonedOffsetMinutes(new Date(start), timezone);
+    for (let day = 1; day <= 367; day += 1) {
+        const offset = zonedOffsetMinutes(new Date(start + day * dayMs), timezone);
+        if (offset === previousOffset)
+            continue;
+        previousOffset = offset;
+        const windowStart = new Date(start + (day - 1 - CRON_GAP_DST_WINDOW_DAYS) * dayMs);
+        const windowEnd = start + (day + CRON_GAP_DST_WINDOW_DAYS) * dayMs;
+        let fire = nextCronRunAfter({ cron, timezone, after: windowStart });
+        for (let fires = 0; fires < CRON_GAP_DST_MAX_FIRES && fire.getTime() <= windowEnd; fires += 1) {
+            const next = nextCronRunAfter({ cron, timezone, after: fire });
+            if (next.getTime() > windowEnd)
+                break;
+            const gap = Math.round((next.getTime() - fire.getTime()) / 60_000);
+            smallest = smallest === null ? gap : Math.min(smallest, gap);
+            fire = next;
+        }
+    }
+    return smallest;
+}
+/** Minutes the zone's wall clock is ahead of UTC at `date`. */
+function zonedOffsetMinutes(date, timezone) {
+    const formatter = getZonedFormatter(timezone);
+    const parts = new Map();
+    for (const part of formatter.formatToParts(date)) {
+        if (part.type !== "literal")
+            parts.set(part.type, part.value);
+    }
+    const wallClock = Date.UTC(Number(parts.get("year")), Number(parts.get("month")) - 1, Number(parts.get("day")), Number(parts.get("hour")), Number(parts.get("minute")));
+    const instant = Math.floor(date.getTime() / 60_000) * 60_000;
+    return Math.round((wallClock - instant) / 60_000);
+}
 export function transformStep(input) {
     return {
         __oxygen_workflow_step: true,
@@ -983,8 +1125,16 @@ export function lintWorkflowCodeSourceSafety(source, path = "$.source") {
     }
     return issues;
 }
+/**
+ * The ceiling of the legacy synchronous `node:vm` path below. It stays at 10 s
+ * (and its callers pass 1 s) when the typed Code node rose to 30 s (repricing
+ * 2026-09, decision L4.3; proposal P-49): this path runs on the worker's own
+ * event loop, so a long synchronous script would stall every other job and its
+ * queue lock renewal. The typed Code node runs in a separate microVM instead.
+ */
+export const PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS = 10_000;
 export async function runPureWorkflowFunction(input) {
-    const timeoutMs = Math.max(WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, Math.min(input.timeoutMs ?? WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_TIMEOUT_MS));
+    const timeoutMs = Math.max(WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, Math.min(input.timeoutMs ?? WORKFLOW_CODE_V1_DEFAULT_TIMEOUT_MS, PURE_WORKFLOW_FUNCTION_MAX_TIMEOUT_MS));
     const maxOutputBytes = Math.max(WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, Math.min(input.maxOutputBytes ?? WORKFLOW_CODE_V1_DEFAULT_OUTPUT_BYTES, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES));
     const issues = [];
     validatePureFunctionSource(input.source, "$.source", (path, code, message) => {

package/node_modules/@oxygen/workflows/dist/usage-estimate.d.ts

@@ -3,7 +3,12 @@ export type WorkflowAutomationUsageEstimate = {
     scheduledRunsPer30Days: number | null;
     scheduledActionsPer30DaysFloor: number | null;
     dynamicRuntimeActions: boolean;
-    perRowFanout: boolean;
+    /**
+     * Always false: row writes stopped billing per row (repricing 2026-09,
+     * decision 6.2). Kept for one release so older CLIs and pages that read it
+     * still parse; remove after that release.
+     */
+    perRowFanout: false;
 };
 export declare function estimateWorkflowRunAutomationActionsFloor(manifest: unknown): number;
 export declare function estimateWorkflowAutomationUsage(manifest: unknown, cron?: string | null): WorkflowAutomationUsageEstimate | null;
@@ -16,6 +21,8 @@ export type CronCadenceAssessment = {
     floorShareOfIncluded: number;
     basis: "plan_action_quota" | "plan_monthly_credits";
     includedCredits: number | null;
+    spendableCredits: number | null;
+    allowanceCredits: number | null;
     floorCreditsPer30Days: number | null;
     minimumViableIntervalMinutes: number | null;
     verdict: "fits" | "impossible";
@@ -27,6 +34,8 @@ export declare function assessCronCadenceViability(input: {
     overageEnabled: boolean;
     includedCredits?: number | null;
     creditsPerAction?: number | null;
+    /** Credits the workspace can spend right now (its available balance). */
+    spendableCredits?: number | null;
 }): CronCadenceAssessment | null;
 export type CronAggressiveness = {
     level: "aggressive" | "very_aggressive";

package/node_modules/@oxygen/workflows/dist/usage-estimate.js

@@ -1,14 +1,14 @@
-// Static automation-action usage estimation shared by the web workflow page
-// and the worker scheduler's admission gate. The per-run count derived from a
-// manifest is a FLOOR, never a projection: runtime metering bills 1 action per
-// EMITTED checkpoint (recipe code loops multiply), 1 per row written by
-// oxygen.rows_upsert (see estimateAutomationActionsForTool in
-// @oxygen/integrations automation-usage.ts), and retried attempts bill again.
-// Surfaces must present these numbers as minimums; observed run history is the
-// honest projection (projectObservedAutomationUsage below).
+// Static automation usage estimation shared by the web workflow page and the
+// worker scheduler's admission gate. The unit is the workflow STEP: every step a
+// live run executes bills one (repricing 2026-09, decision 6.1) and rows written
+// inside a run are free (decision 6.2), so a row-writing step costs one step
+// however many rows it writes. The per-run count derived from a manifest is a
+// FLOOR, never a projection: recipe code emits one step per checkpoint (loops
+// multiply) and a retried attempt bills again. Surfaces present these numbers as
+// minimums; observed run history is the honest projection
+// (projectObservedAutomationUsage below).
 import { loopBodyNodeIds } from "./graph/topology.js";
 import { isWorkflowGraphManifest, workflowGraphNodeKindBills, MAX_WORKFLOW_LOOP_ITERATIONS, } from "./graph/types.js";
-const ROW_FANOUT_TOOL_IDS = new Set(["oxygen.rows_upsert"]);
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -64,21 +64,6 @@ function manifestHasDynamicRuntimeActions(manifest) {
     return graph.nodes.some((node) => node.hasRecipe
         || (node.kind === "loop" && !node.disabled && declaredLoopIterations(node.maxIterations) === null));
 }
-function manifestWritesRowsPerRun(manifest) {
-    if (!isRecord(manifest))
-        return false;
-    const steps = Array.isArray(manifest.steps) ? manifest.steps : null;
-    if (steps) {
-        return steps.some((step) => isRecord(step) && step.kind === "tool" && typeof step.tool === "string" && ROW_FANOUT_TOOL_IDS.has(step.tool));
-    }
-    const graph = readWorkflowGraph(manifest);
-    if (graph) {
-        return graph.nodes.some((node) => (node.kind === "tool" && typeof node.tool === "string" && ROW_FANOUT_TOOL_IDS.has(node.tool))
-            || node.recipeTools.some((tool) => ROW_FANOUT_TOOL_IDS.has(tool)));
-    }
-    const toolsUsed = Array.isArray(manifest.tools_used) ? manifest.tools_used : [];
-    return toolsUsed.some((tool) => typeof tool === "string" && ROW_FANOUT_TOOL_IDS.has(tool));
-}
 function readWorkflowGraph(manifest) {
     if (!isWorkflowGraphManifest(manifest))
         return null;
@@ -194,7 +179,7 @@ export function estimateWorkflowAutomationUsage(manifest, cron) {
         scheduledRunsPer30Days,
         scheduledActionsPer30DaysFloor: scheduledRunsPer30Days === null ? null : scheduledRunsPer30Days * actionsPerRunFloor,
         dynamicRuntimeActions: manifestHasDynamicRuntimeActions(manifest),
-        perRowFanout: manifestWritesRowsPerRun(manifest),
+        perRowFanout: false,
     };
 }
 // Fixed 30-day month, minute and hour fields treated independently; timezone
@@ -279,8 +264,15 @@ const MINUTES_PER_30_DAYS = 43_200;
 // Cadence-vs-allowance arithmetic for a cron trigger, using the manifest FLOOR
 // (see the header): the cheapest run this workflow can physically have. A
 // verdict of "impossible" is therefore a lower bound that already overruns the
-// plan — the real run cost is only ever higher, because row fan-out is added at
-// runtime and is unbounded.
+// allowance — the real run cost is only ever higher (recipe checkpoints, loops
+// over run-time collections and retries add steps).
+//
+// On the credit basis the allowance is the plan's monthly credits OR the
+// balance the workspace can spend, whichever is larger (proposal P-65): at 0.05
+// a step an every-minute, 5-step cron costs 10,800 credits a month, more than
+// the $99 plan includes, and a workspace that funded that from top-ups must be
+// able to arm it. The fire-time gate charges against the balance, so a funded
+// cron is never paused mid-month either.
 //
 // Returns null when the question is not decidable or not meaningful:
 // no cron (on-demand), an unparseable cron, an unlimited allowance, or overage
@@ -299,6 +291,16 @@ export function assessCronCadenceViability(input) {
         && input.includedCredits > 0
         ? input.includedCredits
         : null;
+    const spendableCredits = typeof input.spendableCredits === "number"
+        && Number.isFinite(input.spendableCredits)
+        && input.spendableCredits > 0
+        ? input.spendableCredits
+        : null;
+    // A plan without monthly credits (free) is never judged here: its crons run on
+    // the balance and the fire-time gate is their only stop, as before.
+    const allowanceCredits = includedCredits === null
+        ? null
+        : Math.max(includedCredits, spendableCredits ?? 0);
     // Prefer a real action quota when the plan still has one; otherwise derive the
     // equivalent action budget from monthly credits.
     const basis = input.includedActions === null
@@ -306,8 +308,8 @@ export function assessCronCadenceViability(input) {
         : "plan_action_quota";
     const includedActions = basis === "plan_action_quota"
         ? input.includedActions
-        : (includedCredits !== null && creditsPerAction !== null
-            ? Math.floor(includedCredits / creditsPerAction)
+        : (allowanceCredits !== null && creditsPerAction !== null
+            ? Math.floor(allowanceCredits / creditsPerAction)
             : null);
     if (includedActions === null)
         return null;
@@ -327,6 +329,8 @@ export function assessCronCadenceViability(input) {
         floorShareOfIncluded: floorActionsPer30Days / includedActions,
         basis,
         includedCredits: basis === "plan_monthly_credits" ? includedCredits : null,
+        spendableCredits: basis === "plan_monthly_credits" ? spendableCredits : null,
+        allowanceCredits: basis === "plan_monthly_credits" ? allowanceCredits : null,
         floorCreditsPer30Days: basis === "plan_monthly_credits" && creditsPerAction !== null
             ? Math.round(floorActionsPer30Days * creditsPerAction * 1000) / 1000
             : null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1010.721",
+  "version": "1.1010.950",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",