@oxygen-agent/cli 1.1011.21 → 1.1011.95

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.1011.21
+Version: 1.1011.95

package/dist/command-manifest.js

@@ -25,6 +25,7 @@ const COMMAND_SEARCH_STOP_WORDS = new Set([
 // leaf in the tree using that verb, so the default (mutates:false) would have
 // advertised the most consequential collaboration write as a read.
 const MUTATING_VERBS = new Set([
+    "start-whatsapp",
     "brand-approve", "revoke-invite", "confirm",
     // Exact leaf: `ugc creators set-target` writes one creator's posting deal.
     "set-target",

package/dist/index.js

@@ -3716,7 +3716,7 @@ export function createProgram() {
         });
     }));
     workspaceCommand.addCommand(new Command("infrastructure-exit")
-        .description("Leave, close or offboard a workspace's managed external infrastructure in one action. Preview every renewing resource, then with --approved stop renewals and begin provider teardown through paid terms. Sending connections are disconnected; records and history remain. Requires an exact workspace confirmation and the fresh preview hash. Free, 0 credits.")
+        .description("Leave, close or offboard a workspace's managed external infrastructure in one action. Preview every renewing resource and its release-timing note, then with --approved stop renewals and begin provider teardown. Known paid terms are honored; some dates are estimated or unavailable. Sending connections are disconnected; records and history remain. Requires an exact workspace confirmation and the fresh preview hash. Free, 0 credits.")
         .option("--approved", "Begin the approved teardown.")
         .option("--confirm <workspace>", "Echo the exact workspace slug or ID from the preview.")
         .option("--plan-hash <hash>", "The plan_hash from the immediately preceding preview.")
@@ -4364,13 +4364,13 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .command("db")
         .description("Tenant database commands.")
         .addCommand(new Command("status")
-        .description("Show the current organization's tenant database status. Staff can pass global --org to inspect another org.")
+        .description("Show the current database provider and status. Hosting is included in your plan; Neon IDs on a PostgreSQL row are historical lineage. Staff can pass global --org to inspect another org.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("db status", options, () => requestOxygen("/api/cli/db/status"));
     }))
         .addCommand(new Command("provision")
-        .description("Provision a managed Neon tenant database for the current organization. Staff can pass global --org to repair another org.")
+        .description("Provision the current organization on a registered PostgreSQL shard. Staff can pass global --org to repair another org.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("db provision", options, () => requestOxygen("/api/cli/db/provision", { method: "POST", body: {} }));
@@ -4499,14 +4499,14 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("cost-policy")
-        .description("Show tenant database cost controls and reconciliation status.")
+        .description("Show the historical Neon cost-policy record. PostgreSQL hosting has no Neon endpoint controls.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("db cost-policy", options, () => requestOxygen("/api/cli/db/cost-policy"));
     }))
         .addCommand(new Command("reconcile-cost-policy")
-        .description("Apply tenant database cost controls to the managed Neon endpoint.")
-        .option("--suspend-idle", "Request immediate Neon compute suspension when the tenant is idle.")
+        .description("Retired compatibility command: report that Neon endpoint controls no longer apply.")
+        .option("--suspend-idle", "Retired compatibility flag; does not suspend PostgreSQL.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("db reconcile-cost-policy", options, () => requestOxygen("/api/cli/db/reconcile-cost-policy", {
@@ -6808,7 +6808,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("insert")
-        .description("Insert rows into a workspace table.")
+        .description("Insert rows into a workspace table. Table writes cost 0 Oxygen credits; paid column runs are separate.")
         .argument("<table>", "Table id or slug.")
         .requiredOption("--rows-json <json>", 'JSON array of row objects keyed by column key, e.g. [{"name":"Acme","domain":"acme.test"},{"name":"Globex","domain":"globex.test"}].')
         .option("--request-id <id>", "Stable retry key. Reuse it after a timeout to return the committed write without duplicating rows.")
@@ -7057,7 +7057,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .description("Describe a workspace table and its columns. Add --stats for row count and per-column fill rates (0 credits). Next: `tools search --for-table <table>` lists what these columns can be enriched with and what each costs per row (0 credits).")
         .argument("<table>", "Table id or slug.")
         .option("--include-archived", "Include archived columns.")
-        .option("--stats", "Include summary stats: exact row count and per-column fill rates. Exact at or under 100 rows; above that fill rates come from a 100-row sample (summary.statsSampled, summary.statsSampledRowCount) while rowCount stays exact. For whole-table fill rates on a bigger list use `tables preview <table> --summary-only` \u2014 exact up to 20,000 rows, 2,000-row sample above. 0 credits.")
+        .option("--stats", "Include stats.rowCount (also summary.rowCount) and per-column fill rates. Row count is exact; above 100 rows fill rates use a 100-row sample (stats.statsSampled). For whole-table fill rates on a bigger list use `tables preview <table> --summary-only` \u2014 exact up to 20,000 rows, 2,000-row sample above. 0 credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, options) => {
         await handleAsyncAction("tables describe", options, () => requestOxygen("/api/cli/tables/describe", {
@@ -9959,7 +9959,7 @@ Examples:
         });
     }))
         .addCommand(new Command("convert")
-        .description("Convert a column between an AI column and a Web Research Agent column (--to agent or --to ai), or switch an agent to Keyword search and back. Keeps its key, label, position, prompt, inputs and model tier, and clears its results, so it needs --yes; without it this prints what would change.")
+        .description("Convert a column between an AI column and a Web Research Agent column (--to agent or --to ai), or switch an agent to Keyword search and back. Keyword search returns a raw search-result list, not a sourced answer; the saved search question becomes its query. Conversion keeps the key, label and position, clears results, and needs --yes; without it this prints what would change.")
         .argument("<table>", "Table id or slug.")
         .argument("<column>", "Column id or key.")
         .requiredOption("--to <target>", "agent (Web Research Agent), ai (AI column, no web access) or keyword (Keyword search).")
@@ -10947,6 +10947,7 @@ Examples:
     program
         .command("limits")
         .description("Plan-tier limits, spend-safety defaults, per-channel sending limits, and storage capacity posture.")
+        .addHelpText("after", "\nRun `oxygen limits show --json` to see your current plan's API and webhook rates, Table and workspace storage headroom, and the next scheduled change. The $999 and $1,999 rows-per-Table increases remain held until capacity testing passes.\n")
         .addCommand(new Command("show")
         .description("Compare every plan size: price, monthly credits, volume bonus and price per 100 credits (`plan_bands`). Show your plan band and its limits beside every plan size's (API rate, webhook ingress, storage, import file size, columns per auto-run, signals feed, spend defaults incl. Agent and Copilot caps, fastest workflow schedule), the per-channel sending limits every plan shares (emails per mailbox, WhatsApp, LinkedIn, calls) and its workflow Code-step and run-attempt limits, plus Tables capacity usage naming the largest Table. Each plan size's storage says whether it is in force, scheduled to change on a date, or awaiting its rows-per-Table capacity test, with the values it moves to. `spend_safety_defaults.applies_to` says what each spend default bounds: an unattended trigger delivery, a table auto-run batch, one Agent run, or the attended Copilot. `web_url` opens the same view in the web app (Settings → Plan limits), including any scheduled change. Read-only; spends no credits. Recovery: https://oxygen-agent.com/docs/safety/billing.")
         .option("--json", "Print a JSON envelope.")
@@ -10999,7 +11000,7 @@ Examples:
         .command("billing")
         .description("Plan and managed credit commands. Spend splits into FLEXIBLE (ad-hoc: enrichment, AI, automation — drawn from your free-to-spend balance) and FIXED recurring per-resource monthly commitments blocked out of it; see `billing commitments`. THREE CLOCKS, deliberately different: the CREDIT CYCLE that `billing allowance` reports against (your plan's monthly grant window); each resource's own COMMITMENT RENEWAL, anchored to the day you connected it, so `billing commitments --json` next_due_at rarely matches the cycle end; and your SUBSCRIPTION PERIOD in `billing balance` (annual plans span many credit cycles). A number from one clock will not reconcile against another. On a plan that pays for several workspaces, `billing usage --group-by workspace` totals what each one spent. To price a month of outreach before building it (leads, enrichment, sequence steps, senders), run `billing estimate`. Failed-payment grace, suspension, and recovery: https://oxygen-agent.com/docs/safety/billing.")
         .addCommand(new Command("change")
-        .description("Start a first plan or preview an upgrade, downgrade or billing-interval change, and return the Stripe link to approve it (`approval_url`), with the target plan's monthly credits (`target_plan`). On a workspace with no plan (`mode: first_subscription`) the link is the same Stripe Checkout the web Subscribe button opens, and credits arrive once Stripe confirms the first payment; subscribing needs an organization admin. Nothing is charged or changed until you confirm in Stripe. `interval` is how the plan bills after the change; `recurring_amount` is what each interval bills and `recurring_monthly` its per-month equivalent (a yearly $99 plan: $990, $82.50). Without --interval the plan keeps its current interval. Moving to yearly applies on confirmation with proration; moving to monthly waits for the period end. To compare every plan's credits, volume bonus and price per 100 credits without creating a link, run `limits show`.")
+        .description("Create a Stripe approval link to start a first plan or change an existing plan, and return that link (`approval_url`), with the target plan's monthly credits (`target_plan`). On a workspace with no plan (`mode: first_subscription`) the link is the same Stripe Checkout the web Subscribe button opens, and credits arrive once Stripe confirms the first payment; subscribing needs an organization admin. Nothing is charged or changed until you confirm in Stripe. `interval` is how the plan bills after the change; `recurring_amount` is what each interval bills and `recurring_monthly` its per-month equivalent (a yearly $99 plan: $990, $82.50). Without --interval the plan keeps its current interval. Moving to yearly applies on confirmation with proration; moving to monthly waits for the period end. To compare every plan's credits, volume bonus and price per 100 credits without creating a link, run `limits show`.")
         .requiredOption("--to <plan>", 
     // Derived from the catalog, never retyped: this help text is the only
     // place a customer's agent learns which plans exist, and it named
@@ -11020,7 +11021,7 @@ Examples:
             : "";
         return `${key} ($${cents / 100}/mo${creditText})`;
     }).join(", ")}.`)
-        .option("--interval <interval>", "Bill monthly (`month`) or yearly (`year`: ten months' price for twelve, credits still granted monthly). Omit to keep the current interval (monthly for a first plan). Monthly to yearly adds no extra month: credits already granted for the rest of the month count toward the first yearly month. Yearly is refused with `annual_billing_unavailable` until it is offered.")
+        .option("--interval <interval>", "Bill monthly (`month`) or yearly (`year`: ten months' price for twelve, credits still granted monthly). Omit to keep the current interval (monthly for a first plan). Monthly to yearly adds no extra month: credits already granted for the rest of the month count toward the first yearly month. Check `annual_billing_available` with `oxygen billing balance --json` before creating a Stripe link. Yearly is refused with `annual_billing_unavailable` until it is offered.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing change", options, () => requestOxygen("/api/cli/billing/change", {
@@ -11030,7 +11031,7 @@ Examples:
         }));
     }))
         .addCommand(new Command("balance")
-        .description("Show the current plan, subscription entitlement, and managed credit balance: available and reserved credits, FIXED credits committed to recurring per-resource charges, and the FLEXIBLE free-to-spend remainder. `next_renewal` answers \"will I be charged?\": read `will_charge` first — true only when this workspace's own Stripe plan is going to charge its card, in which case `charge_at` and the plan's monthly list price in money say when and roughly how much (the exact amount, with any promotion code or tax, is on the invoice); `period_ends_at` is the trial or period end either way, `cancellation_scheduled` says whether a cancellation is already set, and `stop_command` names the one command that changes it (`billing cancel`, undone by `billing resume`) or is null when nothing here can stop it (staff-invoiced, billed through another workspace, not active). `billing_interval` says whether the plan bills monthly or yearly; a yearly plan still grants its credits monthly, and `next_credit_grant_at` says when the next monthly grant arrives. `renewals_past_due` lists infrastructure renewals (managed-inbox domains, warm-ups) OXYGEN could NOT charge this month, what they cost, and the exact top-up that clears them — nothing is cancelled and billing retries automatically after a top-up. `warnings` also flags a recurring_shortfall when your connected infrastructure costs more per month than the plan grants. `partner_bonus` says whether this workspace earns the agency partner bonus (+15% credits a month for a published directory partner on $99 or above), how many credits, and why not when it does not; the bonus arrives as its own ledger line (`billing usage --category partner_bonus`), never inside plan.monthly_credits. A workspace linked to another organization (`orgs billing-link`) reads its billing at that owner: the balance is the owner's pool, `shared_billing` is true and `billing_owner_organization_id` names the owner. After failed-payment grace expires, mutations stop while read/export and billing recovery remain available. Recovery: https://oxygen-agent.com/billing. Policy: https://oxygen-agent.com/docs/safety/billing.")
+        .description("Show the current plan, whether yearly billing is offered (`annual_billing_available`), subscription entitlement, and managed credit balance: available and reserved credits, FIXED credits committed to recurring per-resource charges, and the FLEXIBLE free-to-spend remainder. `next_renewal` answers \"will I be charged?\": read `will_charge` first — true only when this workspace's own Stripe plan is going to charge its card, in which case `charge_at` and the plan's monthly list price in money say when and roughly how much (the exact amount, with any promotion code or tax, is on the invoice); `period_ends_at` is the trial or period end either way, `cancellation_scheduled` says whether a cancellation is already set, and `stop_command` names the one command that changes it (`billing cancel`, undone by `billing resume`) or is null when nothing here can stop it (staff-invoiced, billed through another workspace, not active). `billing_interval` says whether the plan bills monthly or yearly; a yearly plan still grants its credits monthly, and `next_credit_grant_at` says when the next monthly grant arrives. `renewals_past_due` lists infrastructure renewals (managed-inbox domains, warm-ups) OXYGEN could NOT charge this month, what they cost, and the exact top-up that clears them — nothing is cancelled and billing retries automatically after a top-up. `warnings` also flags a recurring_shortfall when your connected infrastructure costs more per month than the plan grants. `partner_bonus` says whether this workspace earns the agency partner bonus (+15% credits a month for a published directory partner on $99 or above), how many credits, and why not when it does not; the bonus arrives as its own ledger line (`billing usage --category partner_bonus`), never inside plan.monthly_credits. A workspace linked to another organization (`orgs billing-link`) reads its billing at that owner: the balance is the owner's pool, `shared_billing` is true and `billing_owner_organization_id` names the owner. After failed-payment grace expires, mutations stop while read/export and billing recovery remain available. Recovery: https://oxygen-agent.com/billing. Policy: https://oxygen-agent.com/docs/safety/billing.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing balance", options, () => requestOxygen("/api/cli/billing/balance"));
@@ -11266,7 +11267,7 @@ Examples:
         .command("budget")
         .description("Standing credit caps (org/table daily/monthly hard-blocks) beyond per-run max_credits.")
         .addCommand(new Command("list")
-        .description("List the organization's standing budget policies, plus the plan defaults that apply without one: the daily spend guard (until you set your own org daily budget) and the per-run ceilings of one Agent run, trigger delivery or auto-run batch. Every spend default: `oxygen limits show`.")
+        .description("Read-only, 0 credits. List standing caps with each policy's current spend and remaining credits, plus plan defaults: the daily spend guard and per-run ceilings of one Agent run, trigger delivery or auto-run batch. Daily/monthly windows start at 00:00 UTC; spend counts reservations minus releases, including open holds. Scoped caps currently measure workspace-wide spend. Every spend default: `oxygen limits show`.")
         .option("--scope <scope>", `Filter by scope: ${formatPublicBudgetScopes()}.`)
         .option("--status <status>", "Filter by status. Defaults to all.")
         .option("--json", "Print a JSON envelope.")
@@ -11282,7 +11283,7 @@ Examples:
         });
     }))
         .addCommand(new Command("set")
-        .description("Set, raise, or lower a standing credit cap (idempotent per scope+window).")
+        .description("Set, raise, or lower a standing credit cap (idempotent per scope+window). Daily/monthly windows start at 00:00 UTC and count reservations minus releases; inspect current use with `oxygen budget list`.")
         .requiredOption("--scope <scope>", formatPublicBudgetScopes())
         .requiredOption("--window <window>", "per_run, daily, or monthly.")
         .requiredOption("--max-credits <credits>", "Cap in Oxygen credits.")
@@ -12123,7 +12124,7 @@ Examples:
         });
     }))
         .addCommand(new Command("triggers")
-        .description("List Workspace Agent cron, internal event, and webhook triggers.")
+        .description("List Workspace Agent cron, internal event, and webhook triggers. A legacy cron held to the plan minimum includes slowed_to_plan_minimum and its next run time.")
         .argument("<slug>", "Currently: workspace.")
         .option("--json", "Print a JSON envelope.")
         .action(async (slug, options) => {
@@ -14536,7 +14537,7 @@ Examples:
         });
     })));
     program.addCommand(new Command("inbox")
-        .description("Unified inbox (unibox): private email + LinkedIn DM + WhatsApp conversations in one stream (the default), or a single channel with --channel; `get` and `send` resolve a conversation's channel from its id. Public comments on owned LinkedIn posts are not inbox messages; use `publishing comments`. Scan, read threads, and reply.")
+        .description("Unified inbox (unibox): private email + LinkedIn DM + WhatsApp conversations in one stream (the default), or a single channel with --channel; `get` and `send` resolve a conversation's channel from its id. Public comments on owned LinkedIn posts are not inbox messages; use `publishing comments`. Scan, read, reply, or start a WhatsApp chat.")
         .addCommand(new Command("list")
         .description("List conversations newest first across email, LinkedIn, and WhatsApp — the merged stream is the default, --channels narrows it, and --channel email/linkedin/whatsapp lists a single channel. Primary excludes the negative tier (not_now, not_interested, lost, bounced); All includes every ordinary conversation. Background AI reply triage sets each conversation's status, so triage is a filter, not a script: `--status interested` is positive sales intent, `--status not_interested` is who said no, and `--unanswered` only means the last message is theirs. None of them means a thread needs a reply: interested includes thank-yous and booking confirmations, and neutral can hold real questions. A reply that just arrived can read neutral until it is analyzed (`inbox analyze <id>` classifies one now). In --json, `count` is the rows on this page (follow next_cursor for more); on email, `total_conversations` and the `sidebar_counts` facets are mailbox-wide and do not apply your filters, so never read them as the size of a filtered list.")
         .option("--channel <channel>", "Inbox channel: all (default, the merged stream), email, linkedin, or whatsapp.")
@@ -14644,13 +14645,58 @@ Examples:
         .option("--channel <channel>", "Optional: email, linkedin, or whatsapp. Resolved from the conversation when omitted.")
         .option("--approved", "Approve and send the message. Without this flag, returns a preview only.")
         .option("--draft-id <id>", "When approving an AI reply-agent draft (email or LinkedIn), its id (marks it sent on success). Use the matching --channel.")
-        .option("--attach <url>", "LinkedIn only: attach a file by public URL (image/document). Repeatable, up to 5.", collectRepeatable, [])
+        .option("--attach <path-or-url>", "Email: local PDF, DOCX, XLSX, PPTX, TXT, or CSV path; preview uploads it for 24 hours without sending. LinkedIn: public URL. Repeatable, up to 5 files and 10 MiB total for email.", collectRepeatable, [])
         .option("--json", "Print a JSON envelope.")
         .action(async (conversation, options) => {
-        await handleAsyncAction("inbox send", options, () => {
-            const channel = readOption(options.channel);
+        await handleAsyncAction("inbox send", options, async () => {
+            let channel = readOption(options.channel);
             const draftId = readOption(options.draftId);
-            const attachments = (options.attach ?? []).map((url) => url.trim()).filter(Boolean).map((url) => ({ url }));
+            const attached = (options.attach ?? []).map((value) => value.trim()).filter(Boolean);
+            if (attached.length > 5)
+                throw new OxygenError("invalid_attachments", "Attach up to five files.", { exitCode: 1 });
+            if (attached.length && !channel) {
+                const detail = await requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}`);
+                channel = readRecordString(detail, "channel");
+            }
+            const attachments = channel === "linkedin" ? attached.map((url) => ({ url })) : [];
+            const attachmentIds = [];
+            if (attached.length && channel === "email") {
+                const { readFile, stat } = await import("node:fs/promises");
+                const { basename } = await import("node:path");
+                const { createHash } = await import("node:crypto");
+                let totalBytes = 0;
+                const base = `/api/cli/inbox/${encodeURIComponent(conversation)}/attachments`;
+                for (const filePath of attached) {
+                    const info = await stat(filePath);
+                    totalBytes += info.size;
+                    if (!info.isFile() || info.size < 1 || totalBytes > 10 * 1024 * 1024) {
+                        throw new OxygenError("attachment_size_invalid", "Email attachments must be files totaling at most 10 MiB.", { exitCode: 1 });
+                    }
+                    const bytes = await readFile(filePath);
+                    const ticket = await requestOxygen(`${base}/upload-url`, {
+                        method: "POST", body: { name: basename(filePath), byte_length: bytes.byteLength,
+                            sha256: createHash("sha256").update(bytes).digest("hex") },
+                    });
+                    const uploadUrl = readRecordString(ticket, "upload_url");
+                    const file = ticket.file;
+                    const fileId = file && typeof file === "object" && !Array.isArray(file)
+                        ? readRecordString(file, "id") : null;
+                    if (!uploadUrl || !fileId)
+                        throw new OxygenError("attachment_upload_failed", "The server did not return a complete upload ticket.", { exitCode: 1 });
+                    const put = await fetch(uploadUrl, { method: "PUT", headers: {
+                            "content-type": readRecordString(ticket, "upload_content_type") ?? "application/octet-stream",
+                        }, body: new Uint8Array(bytes) });
+                    if (!put.ok)
+                        throw new OxygenError("attachment_upload_failed", `Object storage rejected the upload (${put.status}).`, { exitCode: 1 });
+                    await requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}/attachments/${encodeURIComponent(fileId)}/uploaded`, {
+                        method: "POST", body: {},
+                    });
+                    attachmentIds.push(fileId);
+                }
+            }
+            else if (attached.length && channel !== "linkedin") {
+                throw new OxygenError("attachments_unsupported", "Files can only be attached to email replies or LinkedIn public URLs.", { exitCode: 1 });
+            }
             return requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}/send`, {
                 method: "POST",
                 body: {
@@ -14659,9 +14705,27 @@ Examples:
                     ...(options.approved ? { approved: true } : {}),
                     ...(draftId ? { draft_id: draftId } : {}),
                     ...(attachments.length > 0 ? { attachments } : {}),
+                    ...(attachmentIds.length > 0 ? { attachment_ids: attachmentIds } : {}),
                 },
             });
         });
+    }))
+        .addCommand(new Command("start-whatsapp")
+        .description("Start a one-to-one WhatsApp chat from the Unibox. Choose a connected sender and either a phone with country code or a CRM person row id. Without --approved, preview the exact recipient and first message. Cold chats use an unofficial linked-device connection and can increase account restriction risk.")
+        .requiredOption("--sender <id>", "Connected WhatsApp sender account id.")
+        .option("--phone <number>", "Recipient phone with country code, e.g. +14155550142.")
+        .option("--person-row-id <id>", "CRM people record row id; uses that person's phone.")
+        .requiredOption("--text <message>", "First message to send.")
+        .option("--approved", "Approve and send the WhatsApp message. Without this flag, returns a preview.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox start-whatsapp", options, () => requestOxygen("/api/cli/inbox/whatsapp/start", {
+            method: "POST",
+            body: { sender_account_id: readOption(options.sender),
+                ...(options.phone ? { phone: readOption(options.phone) } : {}),
+                ...(options.personRowId ? { person_row_id: readOption(options.personRowId) } : {}),
+                text: readOption(options.text), ...(options.approved ? { approved: true } : {}) },
+        }));
     }))
         .addCommand(new Command("delete-message")
         .description("Delete your sent LinkedIn message for everyone within 60 minutes. This cannot be undone. Omit --approved for a preview; show it before approving. Other channels and inbound messages are unsupported.")
@@ -14700,7 +14764,7 @@ Examples:
         .option("--domain <domains>", "Email only: comma-separated counterpart domains to include.")
         .option("--exclude-domain <domains>", "Email only: comma-separated counterpart domains to exclude.")
         .option("--mailbox-id <ids>", "Email only: comma-separated mailbox ids.")
-        .option("--sender-account-id <ids>", "DMs only: comma-separated LinkedIn/WhatsApp sender account ids.")
+        .option("--sender-account-id <ids>", "DMs only: comma-separated OXYGEN sender UUIDs from `oxygen senders list --json` (not LinkedIn member ids).")
         .option("--since <iso>", "Only conversations whose last message is on/after this ISO date/timestamp. Cross-channel.")
         .option("--until <iso>", "Only conversations whose last message is on/before this ISO date/timestamp. Cross-channel.")
         .option("--search <text>", "Fuzzy search (typos, word order, prefixes) over names, addresses, subjects and the text of every message in EVERY non-warmup conversation: all channels unless --channel narrows, archived and sent-only threads included. --segment, --unanswered and the Primary tab's negative-tier exclusion are ignored while set; explicit facets such as --status still narrow.")
@@ -15485,7 +15549,7 @@ Examples:
     }))
         .addCommand(new Command("create")
         .description("Create a draft multichannel sequence from a steps JSON file. Supports LinkedIn, email, WhatsApp, human call_task, and connected-CRM crm_task journeys. Assign LinkedIn senders with --senders (optional at create — a draft can sit senderless, but enroll/start require at least one for LinkedIn journeys). Native email sends through connected Google/Microsoft mailboxes, including Microsoft SMTP transport; optional --email-* flags bind an Instantly campaign. Install/read the oxygen-sequencer skill for complete mapped CRM task examples.")
-        .addHelpText("after", "\nEmail From: selected sender profiles rotate new leads across their inboxes; normal email steps stay with the lead's assigned inbox. In a draft email_send step, sender_mailbox_id chooses one exact inbox for that step. Give sender transitions, including the return to the assigned inbox, their own subject_template to start new threads.\n")
+        .addHelpText("after", "\nSenders: each new lead gets one of the --sender-profiles people, and its LinkedIn and email steps come from that person (email from one of their inboxes). Per step, in the steps file: email_send.sender_mailbox_id sends that email from one exact inbox; a LinkedIn step's sender_profile_id sends it from one selected person. Invite, message, inmail and withdraw_invite steps must share one sender_profile_id or none: that person then owns every lead's LinkedIn thread (LinkedIn allows one of your accounts per conversation). visit_profile, follow, like_post and comment_post may each name anyone selected. An email whose From changes, including the return to the lead's inbox, needs its own subject_template.\n")
         .requiredOption("--name <name>", "Human-readable sequence name.")
         .requiredOption("--slug <slug>", "Unique slug for the sequence.")
         .requiredOption("--steps-file <path>", "Path to a JSON file: { \"steps\": [...] }. LinkedIn steps (visit_profile | invite | wait_for_connection | message | inmail | follow | like_post | comment_post | withdraw_invite), email steps (email_send | email_enroll | email_move | email_stop), WhatsApp (whatsapp_message), human call tasks (call_task), connected-CRM tasks (crm_task; channel crm; exact identity record_mappings + explicit create/update policy + record_links + dynamic task property_mappings/associations), and control steps (wait | wait_for_signal | branch | stop), each with an `id`. Copy templates support {{column}} interpolation from the lead's row, {{column|fallback}} inline fallbacks, deterministic spintax — {{RANDOM|a|b|c}} or industry-standard bare {Hi|Hey|Hello}, nestable like {Would {Tuesday|Thursday} work|next week?} — and {% if column %}…{% endif %} conditionals; a bare {…} region is spintax only when it contains a top-level |, so literal braces (CSS/JSON) pass through. Native email sends (email_send) also expose three reserved sender variables from the sending mailbox: {{sender_name}} (mailbox display name), {{sender_first_name}} (its first word), and {{sender_email}} (the from address); a row column of the same name WINS on collision, and a missing display name renders empty. comment_post takes text_template and/or ai_prompt — a KG-grounded comment generated at send time (a paid AI call) that falls back to text_template if generation fails. A `branch` routes on signals (then/else) or the legacy connection_accepted/already_connected/open_profile sugar (then_id/else_id). A signal condition can also branch on the LEAD'S DATA: a data leaf { has_column: \"email\" } is true when that row_values column has a non-empty value (add present:false for \"missing\") — e.g. route leads that have an email down an email arm and the rest down a LinkedIn arm. MINIMAL EMAIL STEP SHAPE: { \"id\": \"s1\", \"channel\": \"email\", \"kind\": \"email_send\", \"subject_template\": \"...\", \"body_template\": \"...\" } — body_template is REQUIRED on email_send; subject_template is OPTIONAL and is the one control that decides threading: give a step its own subject and it goes out as a NEW email, omit it and the step continues the lead's previous email in the same thread, going out as \"Re: <the previous email's subject>\" (what the retired email_reply kind used to be — still accepted on input, rewritten into this shape, and reported under `warnings` in the response). The FIRST email step of a sequence must carry a subject, since it has no earlier thread to continue. MINIMAL WHATSAPP STEP SHAPE: { \"id\": \"s1\", \"channel\": \"whatsapp\", \"kind\": \"whatsapp_message\", \"template\": \"Hi {{first_name|there}} …\" } — template is REQUIRED, and a live WhatsApp start also needs the sequence's --whatsapp-cold-initiate opt-in. A/B tests use an explicit `variants` array of copy partials on the step (up to 25 alternates, a–z; spintax varies wording INSIDE one variant and is not A/B-tracked). For the complete replay-safe crm_task upsert mapping shape, install/read the oxygen-sequencer skill.")
@@ -15606,7 +15670,7 @@ Examples:
     }))
         .addCommand(new Command("update")
         .description("Update a sequence. Journey structure/channels/email binding are draft-only so revised scope receives a fresh launch approval; a started sequence may only re-time waits it already has (clear a delay by zeroing it, never by deleting the step — enrollments track position by index); sender pools can change while draft or paused; launch caps change through `sequences start` after first start. Name, throttles, tags, the default-off visible unsubscribe footer, and open/click tracking toggles remain editable as allowed by the server. Pass only the fields you want to change.")
-        .addHelpText("after", "\nEmail From: email_send.sender_mailbox_id chooses one exact inbox from a selected sender profile for that step. Omit it to use the lead's assigned inbox. Sender changes need a new subject_template and thread.\n")
+        .addHelpText("after", "\nSenders: email_send.sender_mailbox_id sends one email from an exact inbox of a selected sender; a LinkedIn step's sender_profile_id sends it from a selected person (invite, message, inmail and withdraw_invite share one or none). Omit both to use the lead's assigned person. An email whose From changes needs its own subject_template.\n")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--name <name>", "New human-readable sequence name.")
         .option("--steps-file <path>", "Draft only: path to a JSON file: { \"steps\": [...] } replacing the journey. Copy supports {{column}} interpolation; native email steps also expose {{sender_name}} / {{sender_first_name}} / {{sender_email}} from the sending mailbox (a same-named row column wins). A `branch` can also route on the lead's data with a data leaf { has_column: \"email\" } (true when that row_values column is non-empty; present:false for \"missing\").")
@@ -17609,7 +17673,7 @@ Examples:
         });
     }))
         .addCommand(new Command("connect-oauth")
-        .description("Connect Google/Microsoft mailboxes to OXYGEN native send. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). For Microsoft's built-in roles, tenant mode requires a Global Administrator or Privileged Role Administrator because it requests the Microsoft Graph application Mail.Send and Mail.Read permissions; Application Administrator and Cloud Application Administrator cannot consent to Microsoft Graph application roles. Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. For non-managed Microsoft mailboxes, native-send approval does not authorize OXYGEN Warm-up: every mailbox still needs its own `mailboxes warmup microsoft` Outlook consent before standalone enrollment. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options. All paths cost 0 Oxygen credits.")
+        .description("Connect Google/Microsoft mailboxes to OXYGEN native send. Authorization costs 0 credits; once connected, each own mailbox reserves 100 credits per month when the repricing credit commitments are active, including warm-up. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). For Microsoft's built-in roles, tenant mode requires a Global Administrator or Privileged Role Administrator because it requests the Microsoft Graph application Mail.Send and Mail.Read permissions; Application Administrator and Cloud Application Administrator cannot consent to Microsoft Graph application roles. Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. For non-managed Microsoft mailboxes, native-send approval does not authorize OXYGEN Warm-up: every mailbox still needs its own `mailboxes warmup microsoft` Outlook consent before standalone enrollment. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options.")
         .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .option("--provider <provider>", "Mailbox provider to provision: google or microsoft.")
         .option("--vendor <vendor>", "Authorization path: oxygen for imported/manual mailboxes, zapmail (default), or inboxkit.")
@@ -17793,7 +17857,7 @@ Examples:
         });
     }))
         .addCommand(new Command("warmup")
-        .description("OXYGEN Warm-up for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. It costs 100 credits per warming inbox per month ($1), or nothing once it is included in your own mailbox's 100-credit monthly connection (2026-09 repricing); the preview shows which applies. Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warm-up add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Google reuses the InboxKit-held credential only during activation and never stores or returns it; Microsoft/Azure uses exact native export. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off for Microsoft/Azure because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warm-up blocks either handoff so one mailbox cannot warm twice. OXYGEN Warm-up never owns campaign dispatch: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down there with `warmup disable`; they are never silently moved to the current managed rail.")
+        .description("OXYGEN Warm-up for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. It costs 100 credits per warming inbox per month ($1), or nothing once it is included in your own mailbox's 100-credit monthly connection (2026-09 repricing); the preview shows which applies. Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warm-up add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Google reuses the InboxKit-held credential only during activation and never stores or returns it; Microsoft/Azure uses exact native export. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off for Microsoft/Azure because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warm-up blocks either handoff so one mailbox cannot warm twice. OXYGEN Warm-up never owns campaign dispatch: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down there with `warmup disable`; they are never silently moved to the current managed rail. When worker recovery is enforcing (the unset default), existing active paid OXYGEN Warm-up seats get bounded automatic recovery: Google uses usable stored credential authority, Microsoft OAuth or tenant-consent seats get a credential-free vendor reactivation, and stalled dispatch or DNS readiness is rechecked. An explicit shadow/off rollout observes candidates without automatic repair writes. Correct bad DNS records yourself; an active unpaused paid seat needs no manual resume after that correction. OXYGEN never invents consent, resumes a human or safety pause, starts a new paid enrollment, or blindly repeats an ambiguous provider write. Check `warmup status` and `mailboxes list` for the exact next action.")
         .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
         .addCommand(new Command("enable")
         .description("Optional provider warm-up defaults to 1/day, +1/day, max 10/day (dedicated-tenant profiles stay stricter); see `mailboxes warmup config` for the effective plan and unsupported OXYGEN Warm-up reply-rate control. This is separate from the 5/10/20 campaign ramp. STANDALONE ENROLLMENT: enroll BYOK/imported mailboxes, a managed order that opted out, or mailboxes being added to warmup later. Fresh managed InboxKit Google/Microsoft/Azure orders whose approved quote included warmup activate automatically after provisioning and do not need this command. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is handed off, enrolled, or billed. The price is 100 credits per warming mailbox-month, or 0 once warm-up is included in the mailbox's 100-credit monthly connection (2026-09 repricing; the preview's included_in_connection says which, and its max_credits is then 0); the preview returns the exact first-cycle ceiling. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Eligible managed Google targets use the InboxKit-held credential just in time without storing or returning it; Microsoft/Azure targets use native InboxKit Sequencer export with exact UIDs and auto-export off. Any non-cancelled InboxKit warmup must be cancelled before either handoff (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. OXYGEN Warm-up retains no campaign authority — OXYGEN Sequences own enrollment and dispatch. New enrollments only ever land on the managed OXYGEN rail; the retired TrulyInbox rail is refused here and only accepts teardown.")
@@ -18011,7 +18075,7 @@ Examples:
         });
     }))
         .addCommand(new Command("reconnect")
-        .description("Push the mailbox's CURRENT credential to its warmup provider, for an inbox that is already enrolled. This is how you recover a warmup enrollment whose app password was rotated or revoked (the provider reporting 'Username and Password not accepted'): re-import the new credential with `mailboxes import`, then run this. It costs 0 credits and leaves your warmup subscription and its renewal date exactly as they are — you do NOT need to disable and re-enable warmup, which would charge a second month. The provider cannot change a stored password in place, so the inbox's warmup history restarts from day 1. Targets the whole pool unless --mailboxes is given.")
+        .description("Manual repair for an existing live paid seat when worker recovery is shadow/off, exhausted, or needs a new credential: push the mailbox's CURRENT credential to its warmup provider. Use this when a new app password is needed because the old one was rotated or revoked (the provider reporting 'Username and Password not accepted'): re-import the new credential with `mailboxes import`, then run this. It costs 0 credits and leaves your warmup subscription and its renewal date exactly as they are — you do NOT need to disable and re-enable warmup, which would charge a second month. The provider cannot change a stored password in place, so the inbox's warmup history restarts from day 1. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -18026,7 +18090,7 @@ Examples:
         });
     }))
         .addCommand(new Command("reactivate")
-        .description("Make the warm-up provider re-run the connection check it abandoned on an inbox it has DISABLED, without touching your credential, your subscription, or the ramp day. Use this when warmup status reports an inbox stopped by the provider and `warmup reconnect` refuses it — which is what happens to a Microsoft inbox connected by OAuth or tenant consent, because there is no password to re-push. 0 credits: the subscription, its renewal date, and the ramp day all stay exactly as they are, so it is the free alternative to disable + re-enable (which bills another warm-up month AND restarts the ramp at day 1). Only inboxes with a live warm-up subscription are eligible. IMPORTANT: this forces the provider to re-check; a forced pass is NOT proof the connection works. Confirm recovery from a rising send count with `oxygen mailboxes warmup status` after the provider's next batch, which is hours away, not minutes. Targets the whole pool unless --mailboxes is given.")
+        .description("Manual reactivation of an existing live paid seat: ask the warm-up provider to re-run the connection check on an inbox it has DISABLED, without touching the credential, subscription, or ramp day. When worker recovery is enforcing, OXYGEN first tries this vendor reactivation automatically for a Microsoft OAuth or tenant-consent seat, without a password or new browser consent. Use this command while recovery is staged in shadow/off, or if `warmup status` still asks you to reactivate after bounded attempts; `warmup reconnect` cannot re-push a password for that consent seat. 0 credits: the subscription, its renewal date, and the ramp day all stay exactly as they are, so it is the free alternative to disable + re-enable (which bills another warm-up month AND restarts the ramp at day 1). Only inboxes with a live warm-up subscription are eligible. IMPORTANT: this forces the provider to re-check; a forced pass is NOT proof the connection works. Confirm recovery from a rising send count with `oxygen mailboxes warmup status` after the provider's next batch, which is hours away, not minutes. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -18846,7 +18910,7 @@ Run completion:
         });
     }))
         .addCommand(new Command("get")
-        .description("Get one workflow automation.")
+        .description("Get one workflow automation, including any cron slowdown to your plan's minimum interval.")
         .argument("<workflow>", "Workflow id, slug, or name.")
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
@@ -20991,7 +21055,11 @@ const RESEARCH_MODES = new Set(["strict", "estimate"]);
  */
 function applyResearchColumnConfig(definition, options) {
     const existing = isRecord(definition.webSearch) ? definition.webSearch : {};
-    const webSearch = { ...existing, enabled: true };
+    // Supply the required default only when absent. Preserving an explicit false
+    // lets the server reject it instead of silently turning paid web access on.
+    const webSearch = { ...existing };
+    if (!Object.hasOwn(webSearch, "enabled"))
+        webSearch.enabled = true;
     const queryTemplate = readOption(options.researchQuery);
     if (queryTemplate)
         webSearch.queryTemplate = queryTemplate;

package/node_modules/@oxygen/cli-ugc/dist/commands.js

@@ -306,13 +306,13 @@ export function registerUgcCommands(program, { request: requestOxygen, handle })
                 {
                     name: "brief",
                     kind: "string",
-                    description: "Short creator brief (up to 1,200 characters): what the product is, who it is for, key facts and the call to action. Drafts are grounded in it.",
+                    description: "Short creator brief (up to 1,200 characters): what the product is, who it is for, key facts and the call to action. Drafts are grounded in it; share longer guidance as a wiki page with --knowledge-slugs.",
                     required: false,
                 },
                 {
                     name: "description",
                     kind: "string",
-                    description: "Program description.",
+                    description: "Internal note for your team: creators never see it and drafts do not use it. Put what creators need in the brief.",
                     required: false,
                 },
                 {
@@ -330,7 +330,7 @@ export function registerUgcCommands(program, { request: requestOxygen, handle })
                 {
                     name: "posting_target",
                     kind: "posting_target",
-                    description: "Posts each creator should publish by default: <n>/month, <n>/week or <n>/total (n 1–100), or none to clear. One creator's own deal: creators set-target.",
+                    description: "Posts each creator should publish by default: <n>/month, <n>/week or <n>/total (n 1–100), or none to clear (2 every two weeks is 1/week). One creator's own deal: creators set-target.",
                     required: false,
                 },
                 {
@@ -373,7 +373,7 @@ export function registerUgcCommands(program, { request: requestOxygen, handle })
                 {
                     name: "description",
                     kind: "string",
-                    description: "Program description.",
+                    description: "Internal note for your team: creators never see it and drafts do not use it. Put what creators need in the brief.",
                     required: false,
                 },
                 {
@@ -391,7 +391,7 @@ export function registerUgcCommands(program, { request: requestOxygen, handle })
                 {
                     name: "posting_target",
                     kind: "posting_target",
-                    description: "Posts each creator should publish by default: <n>/month, <n>/week or <n>/total (n 1–100), or none to clear. One creator's own deal: creators set-target.",
+                    description: "Posts each creator should publish by default: <n>/month, <n>/week or <n>/total (n 1–100), or none to clear (2 every two weeks is 1/week). One creator's own deal: creators set-target.",
                     required: false,
                 },
                 {

package/node_modules/@oxygen/cli-ugc/dist/field-parser.js

@@ -10,9 +10,24 @@ export function parsePostingTarget(value) {
     const match = /^(\d{1,3})\s*\/\s*(week|month|total)$/.exec(text);
     const count = match ? Number(match[1]) : 0;
     if (!match || count < 1 || count > 100)
-        throw new UgcUsageError("--posting-target must be <n>/month, <n>/total or <n>/week with n from 1 to 100, or none.");
+        throw new UgcUsageError(`--posting-target must be <n>/month, <n>/total or <n>/week with n from 1 to 100, or none.${twoWeekRate(text)}`);
     return { count, period: match[2] };
 }
+/**
+ * A two-week rhythm has no period of its own, so name the rate that matches the
+ * count typed. "Every two weeks: 1/week or 2/month" read as two equal choices,
+ * and a 2026-09-29 blind run set 2/month for 2/fortnight: half the rate.
+ */
+function twoWeekRate(text) {
+    const fortnight = /^(\d{1,3})\s*\/\s*(?:fortnight|2\s*weeks?|two\s*weeks?|bi-?weekly)$/.exec(text);
+    const n = fortnight ? Number(fortnight[1]) : 0;
+    if (n < 1)
+        return "";
+    const monthly = Math.round((n * 52) / 24);
+    return n % 2 === 0
+        ? ` ${n} every two weeks is ${n / 2}/week (counted per calendar week) or about ${monthly}/month.`
+        : ` ${n} every two weeks has no whole weekly count; about ${monthly}/month is the closest rate.`;
+}
 /** A JSON array of emails, or emails separated by commas, semicolons or whitespace. */
 export function parseEmailList(value) {
     const text = value.trim();

package/node_modules/@oxygen/shared/dist/capability-discovery.js

@@ -654,6 +654,21 @@ function normalizeIntent(query) {
  * posts, with the AI filter applied, before a table exists.
  */
 const LINKEDIN_KEYWORD_POST_COMMAND = 'oxygen signals search preview --family linkedin_posts --keywords "<any of>" --all-keywords "<all of>" --exclude-keywords "<none of>" --ai-filter "<posts to keep>" --json';
+/**
+ * Running (or joining) a creator program is UGC, which lives on the Publishing
+ * card. Checked before the LinkedIn keyword-post rule: "a creator program where
+ * LinkedIn creators post about my product" is not a keyword search (2026-09-29
+ * baselines routed it to Signals, and "creator program" to post tools).
+ */
+function isUgcProgramIntent(query) {
+    return /\b(ugc|user[- ]generated content|creator programs?|ambassador programs?|brand ambassadors?)\b/.test(query)
+        || /\b(invite|recruit|onboard|sponsor)\w*\b.{0,30}\bcreators?\b/.test(query)
+        || /\bcreators?\b.{0,40}\bpost\w*\b.{0,20}\babout (my|our)\b/.test(query);
+}
+/** The creator's side of a program: find one, apply, or accept an invitation. */
+function isUgcCreatorSideIntent(query) {
+    return /\b(join|apply|applying|find|discover|browse|accept)\w*\b.{0,30}\b(creator|ugc|ambassador) programs?\b/.test(query);
+}
 function isLinkedInKeywordPostIntent(query) {
     return /\blinkedin\b/.test(query)
         && /\b(posts?|posting)\b/.test(query)
@@ -720,6 +735,8 @@ function isOpenLinkedInRequestsIntent(query) {
 function explicitCapabilityIntent(query) {
     if (/\b(infographic|graphic designer|render html|carousel pages|visual design|gtm flow image)\b/.test(query))
         return ROUTE_BY_ID.get("visual-rendering") ?? null;
+    if (isUgcProgramIntent(query) || isUgcCreatorSideIntent(query))
+        return ROUTE_BY_PRIMITIVE.get("publishing") ?? null;
     if (isOwnLinkedInNetworkIntent(query) || isOpenLinkedInRequestsIntent(query))
         return ROUTE_BY_ID.get("connected-linkedin") ?? null;
     if (isCompanyPageFollowersIntent(query))
@@ -955,6 +972,19 @@ function isLocalBusinessIntent(query) {
     return /\b(local business(?:es)?|google maps|maps listings?|storefronts?|near me|(?:dental|medical|law|veterinary) (?:practices?|offices?|clinics?)|dentists?|restaurants?|cafes?|coffee shops?|gyms?|salons?|plumbers?|electricians?|contractors?|hvac|auto repair|real estate agents?|businesses (?:in|near|around) [a-z])\b/.test(query);
 }
 function recommendationsFor(card, query) {
+    if (card.primitive === "publishing" && isUgcCreatorSideIntent(query)) {
+        return {
+            tools: ["oxygen_ugc_get", "oxygen_ugc_application_create", "oxygen_ugc_invite_accept"],
+            commands: ["ugc programs discover", "ugc programs apply", "ugc creators accept"],
+        };
+    }
+    if (card.primitive === "publishing" && isUgcProgramIntent(query)) {
+        return {
+            tools: ["oxygen_ugc_program_create", "oxygen_ugc_invite_create", "oxygen_ugc_get"],
+            commands: ["ugc programs create", "ugc creators invite", "ugc programs list"],
+            exactCommand: "oxygen ugc programs create --product-url <your product site> --json",
+        };
+    }
     if (card.id === "sourcing-and-provider-tools" && isCompanyUrlRecoveryIntent(query)) {
         return {
             tools: ["oxygen_companies_search_plan", "oxygen_companies_search_run"],

package/node_modules/@oxygen/shared/dist/linkedin-quota-denial.d.ts

@@ -17,6 +17,8 @@
 import { OxygenError } from "./cli-result.js";
 /** Was this thrown error the quota chokepoint refusing the call? */
 export declare function isLinkedInQuotaDenial(error: unknown): error is OxygenError;
+/** Quota messages include sender display names; log only the typed code. */
+export declare function linkedInQuotaSafeErrorFields(error: unknown): Record<string, unknown>;
 /**
  * When a quota-denied caller may try again — the denial's own `resets_at` when it
  * carries a usable one, else a flat hour. Null for anything that is NOT a quota

package/node_modules/@oxygen/shared/dist/linkedin-quota-denial.js

@@ -15,6 +15,7 @@
  * until its budget resets rather than re-denied on every tenant tick.
  */
 import { OxygenError } from "./cli-result.js";
+import { errorFields } from "./log.js";
 import { isRecord } from "./type-guards.js";
 // The codes a denial is raised with. Each is a "come back later" signal, not a
 // broken caller: a daily cap / closed active window that reopens on its own clock,
@@ -37,6 +38,10 @@ const QUOTA_FALLBACK_BACKOFF_MS = 60 * 60 * 1000;
 export function isLinkedInQuotaDenial(error) {
     return error instanceof OxygenError && QUOTA_DENIED_CODES.has(error.code);
 }
+/** Quota messages include sender display names; log only the typed code. */
+export function linkedInQuotaSafeErrorFields(error) {
+    return isLinkedInQuotaDenial(error) ? { error_code: error.code } : errorFields(error);
+}
 /**
  * When a quota-denied caller may try again — the denial's own `resets_at` when it
  * carries a usable one, else a flat hour. Null for anything that is NOT a quota

package/node_modules/@oxygen/shared/dist/plan-band.d.ts

@@ -14,6 +14,13 @@ import { type WorkspaceTableCapacityStatus } from "./table-capacity.js";
  */
 export type PlanBand = "free" | "49" | "99" | "199" | "499" | "999" | "1999";
 export declare const PLAN_BAND_ORDER: readonly PlanBand[];
+/** Whether a larger plan actually raises either storage limit in force. */
+export declare function largerPlanStorageRelief(band: PlanBand, options?: RepricingOptions): {
+    tableRows: boolean;
+    workspace: boolean;
+};
+/** A database refusal carries its enforced cap, but no billing-plan identity. */
+export declare function anyPlanRaisesTableRowLimit(enforcedLimitRows: number, workspaceLimitRows?: number, options?: RepricingOptions): boolean;
 /** The limits rung each band enforces at today. */
 export declare const PLAN_BAND_LIMITS_TIER: Readonly<Record<PlanBand, LimitsTier>>;
 /**

package/node_modules/@oxygen/shared/dist/plan-band.js

@@ -12,6 +12,30 @@ export const PLAN_BAND_ORDER = [
     "999",
     "1999",
 ];
+/** Whether a larger plan actually raises either storage limit in force. */
+export function largerPlanStorageRelief(band, options = {}) {
+    const current = resolveWorkspaceTableCapacity(band, options);
+    const larger = PLAN_BAND_ORDER.slice(PLAN_BAND_ORDER.indexOf(band) + 1)
+        .map((next) => resolveWorkspaceTableCapacity(next, options));
+    return {
+        tableRows: larger.some((next) => next.tableRowLimit > current.tableRowLimit),
+        workspace: larger.some((next) => next.workspaceRowLimit > current.workspaceRowLimit
+            || next.workspaceDatabaseLimitBytes > current.workspaceDatabaseLimitBytes),
+    };
+}
+/** A database refusal carries its enforced cap, but no billing-plan identity. */
+export function anyPlanRaisesTableRowLimit(enforcedLimitRows, workspaceLimitRows, options = {}) {
+    if (workspaceLimitRows !== undefined) {
+        const matchingBand = PLAN_BAND_ORDER.find((band) => {
+            const capacity = resolveWorkspaceTableCapacity(band, options);
+            return capacity.tableRowLimit === enforcedLimitRows
+                && capacity.workspaceRowLimit === workspaceLimitRows;
+        });
+        // A mismatched pair is drift, not evidence that buying a new plan helps.
+        return matchingBand ? largerPlanStorageRelief(matchingBand, options).tableRows : false;
+    }
+    return PLAN_BAND_ORDER.some((band) => resolveWorkspaceTableCapacity(band, options).tableRowLimit > enforcedLimitRows);
+}
 /** The limits rung each band enforces at today. */
 export const PLAN_BAND_LIMITS_TIER = Object.freeze({
     free: "free",

package/node_modules/@oxygen/shared/dist/sequences.d.ts

@@ -451,12 +451,23 @@ export type SequenceAutoOptimizeConfig = {
 };
 export declare const SEQUENCE_STEP_KINDS: readonly ["visit_profile", "invite", "wait_for_connection", "message", "inmail", "follow", "like_post", "comment_post", "withdraw_invite", "email_send", "email_reply", "email_enroll", "email_move", "email_stop", "whatsapp_message", "call_task", "crm_task", "wait", "wait_for_signal", "branch", "stop"];
 export type SequenceStepKind = (typeof SEQUENCE_STEP_KINDS)[number];
+/**
+ * Advanced: the sender profile (person) whose LinkedIn account sends this step.
+ * Omitted = the lead's assigned person. LinkedIn lets one of the workspace's
+ * accounts hold a conversation with a lead, so the relationship steps
+ * (invite, message, inmail, withdraw_invite) must all name the same person or
+ * none: that person then owns every lead's LinkedIn thread. Light touches
+ * (visit_profile, follow, like_post, comment_post) may each name anyone.
+ */
+export type SequenceLinkedInStepSender = {
+    sender_profile_id?: string;
+};
 export type SequenceLinkedInVisitProfileStep = {
     id: string;
     channel: "linkedin";
     kind: "visit_profile";
-};
-export type SequenceLinkedInInviteStep = {
+} & SequenceLinkedInStepSender;
+export type SequenceLinkedInInviteStep = SequenceLinkedInStepSender & {
     id: string;
     channel: "linkedin";
     kind: "invite";
@@ -475,7 +486,7 @@ export type SequenceLinkedInAttachment = {
     url: string;
     name?: string;
 };
-export type SequenceLinkedInMessageStep = {
+export type SequenceLinkedInMessageStep = SequenceLinkedInStepSender & {
     id: string;
     channel: "linkedin";
     kind: "message";
@@ -489,7 +500,7 @@ export type SequenceLinkedInMessageStep = {
     /** Files attached to the message (≤ a few, fetched at dispatch). */
     attachments?: SequenceLinkedInAttachment[];
 };
-export type SequenceLinkedInInMailStep = {
+export type SequenceLinkedInInMailStep = SequenceLinkedInStepSender & {
     id: string;
     channel: "linkedin";
     kind: "inmail";
@@ -507,8 +518,8 @@ export type SequenceLinkedInFollowStep = {
     id: string;
     channel: "linkedin";
     kind: "follow";
-};
-export type SequenceLinkedInLikePostStep = {
+} & SequenceLinkedInStepSender;
+export type SequenceLinkedInLikePostStep = SequenceLinkedInStepSender & {
     id: string;
     channel: "linkedin";
     kind: "like_post";
@@ -516,7 +527,7 @@ export type SequenceLinkedInLikePostStep = {
     post_recency_days?: number;
     on_no_post?: "stop";
 };
-export type SequenceLinkedInCommentPostStep = {
+export type SequenceLinkedInCommentPostStep = SequenceLinkedInStepSender & {
     id: string;
     channel: "linkedin";
     kind: "comment_post";
@@ -529,7 +540,7 @@ export type SequenceLinkedInWithdrawInviteStep = {
     id: string;
     channel: "linkedin";
     kind: "withdraw_invite";
-};
+} & SequenceLinkedInStepSender;
 export type SequenceEmailEnrollStep = {
     id: string;
     channel: "email";
@@ -1004,6 +1015,27 @@ export declare function sequenceSenderThreadConflicts(steps: readonly SequenceSt
     stepId: string;
     message: string;
 }[];
+/** LinkedIn kinds that open or continue a conversation, so bind the lead to one account. */
+export declare const LINKEDIN_RELATIONSHIP_STEP_KINDS: Set<string>;
+/** LinkedIn light touches: they bind nothing, so each may come from any selected person. */
+export declare const LINKEDIN_LIGHT_TOUCH_STEP_KINDS: Set<string>;
+/**
+ * The person who owns every lead's LinkedIn conversation in this journey, when
+ * the relationship steps name one (null = each lead's assigned person). Only
+ * meaningful once sequenceLinkedInOwnerConflicts is empty.
+ */
+export declare function sequenceLinkedInOwnerProfileId(steps: readonly SequenceStep[]): string | null;
+/**
+ * Relationship steps that disagree about who sends them. LinkedIn lets one of
+ * the workspace's accounts hold a conversation with a lead (and OXYGEN binds
+ * the lead to the first account that invites or messages it), so a connection
+ * request from one person followed by a message from another would be refused.
+ */
+export declare function sequenceLinkedInOwnerConflicts(steps: readonly SequenceStep[]): {
+    index: number;
+    stepId: string;
+    message: string;
+}[];
 export declare function sequenceStepsMissingCopy(steps: readonly SequenceStep[]): SequenceMissingCopy[];
 /**
  * Validate + normalize a raw sequence definition. Assigns stable ids to steps

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -1059,6 +1059,57 @@ export function sequenceSenderThreadConflicts(steps) {
     });
     return conflicts;
 }
+/** LinkedIn kinds that open or continue a conversation, so bind the lead to one account. */
+export const LINKEDIN_RELATIONSHIP_STEP_KINDS = new Set(["invite", "message", "inmail", "withdraw_invite"]);
+/** LinkedIn light touches: they bind nothing, so each may come from any selected person. */
+export const LINKEDIN_LIGHT_TOUCH_STEP_KINDS = new Set(["visit_profile", "follow", "like_post", "comment_post"]);
+const LINKEDIN_SENDER_STEP_KINDS = new Set([...LINKEDIN_RELATIONSHIP_STEP_KINDS, ...LINKEDIN_LIGHT_TOUCH_STEP_KINDS]);
+function normalizeLinkedInStepSender(value, path, issues) {
+    if (value === undefined || value === null || value === "")
+        return {};
+    if (typeof value !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value.trim())) {
+        issues.push({ path, message: "must be a sender profile id." });
+        return {};
+    }
+    return { sender_profile_id: value.trim() };
+}
+function stepSenderProfileId(step) {
+    return "sender_profile_id" in step && typeof step.sender_profile_id === "string" ? step.sender_profile_id : undefined;
+}
+/**
+ * The person who owns every lead's LinkedIn conversation in this journey, when
+ * the relationship steps name one (null = each lead's assigned person). Only
+ * meaningful once sequenceLinkedInOwnerConflicts is empty.
+ */
+export function sequenceLinkedInOwnerProfileId(steps) {
+    for (const step of steps) {
+        if (!LINKEDIN_RELATIONSHIP_STEP_KINDS.has(step.kind))
+            continue;
+        const owner = stepSenderProfileId(step);
+        if (owner)
+            return owner;
+    }
+    return null;
+}
+/**
+ * Relationship steps that disagree about who sends them. LinkedIn lets one of
+ * the workspace's accounts hold a conversation with a lead (and OXYGEN binds
+ * the lead to the first account that invites or messages it), so a connection
+ * request from one person followed by a message from another would be refused.
+ */
+export function sequenceLinkedInOwnerConflicts(steps) {
+    const relationship = steps
+        .map((step, index) => ({ step, index }))
+        .filter(({ step }) => LINKEDIN_RELATIONSHIP_STEP_KINDS.has(step.kind));
+    const owners = new Set(relationship.map(({ step }) => stepSenderProfileId(step) ?? ""));
+    if (owners.size <= 1)
+        return [];
+    return relationship.map(({ step, index }) => ({
+        index,
+        stepId: step.id,
+        message: `step '${step.id}': every LinkedIn connection, message and InMail step must come from the same person (or all from the lead's own). LinkedIn lets one of your accounts hold a conversation with a lead.`,
+    }));
+}
 export function sequenceStepsMissingCopy(steps) {
     const missing = [];
     const check = (step, field, value) => {
@@ -1204,6 +1255,9 @@ export function validateSequenceDefinition(input, options = {}) {
         for (const conflict of sequenceSenderThreadConflicts(normalized)) {
             issues.push({ path: `steps[${conflict.index}].subject_template`, message: conflict.message });
         }
+        for (const conflict of sequenceLinkedInOwnerConflicts(normalized)) {
+            issues.push({ path: `steps[${conflict.index}].sender_profile_id`, message: conflict.message });
+        }
     }
     if (issues.length > 0) {
         throw new OxygenError("invalid_sequence", `Sequence definition is invalid: ${issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`, { details: { issues }, exitCode: 1 });
@@ -1328,14 +1382,17 @@ raw, index, options, issues) {
     if (channel && options.allowedChannels && !options.allowedChannels.includes(channel)) {
         issues.push({ path: `${path}.channel`, message: `channel '${channel}' is not enabled for this sequence.` });
     }
+    const linkedInSender = LINKEDIN_SENDER_STEP_KINDS.has(stepKind)
+        ? normalizeLinkedInStepSender(raw.sender_profile_id, `${path}.sender_profile_id`, issues)
+        : {};
     switch (stepKind) {
         case "visit_profile":
-            return { id, channel: "linkedin", kind: "visit_profile" };
+            return { id, channel: "linkedin", kind: "visit_profile", ...linkedInSender };
         case "invite": {
             const note = optionalTemplate(raw.note_template, `${path}.note_template`, MAX_NOTE_LENGTH, issues);
             return note !== undefined
-                ? { id, channel: "linkedin", kind: "invite", note_template: note }
-                : { id, channel: "linkedin", kind: "invite" };
+                ? { id, channel: "linkedin", kind: "invite", note_template: note, ...linkedInSender }
+                : { id, channel: "linkedin", kind: "invite", ...linkedInSender };
         }
         case "wait_for_connection": {
             const timeoutDays = raw.timeout_days === undefined || raw.timeout_days === null
@@ -1355,7 +1412,7 @@ raw, index, options, issues) {
             const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             const attachments = normalizeLinkedInAttachments(raw.attachments, `${path}.attachments`, issues);
             return {
-                id, channel: "linkedin", kind: "message", template: template ?? "",
+                id, channel: "linkedin", kind: "message", template: template ?? "", ...linkedInSender,
                 ...(variants ? { variants: variants } : {}),
                 ...(autoOptimize ? { auto_optimize: autoOptimize } : {}),
                 ...(attachments ? { attachments } : {}),
@@ -1367,7 +1424,7 @@ raw, index, options, issues) {
             const variants = normalizeVariants(raw.variants, `${path}.variants`, ["subject_template", "template"], issues, options.draft === true);
             const autoOptimize = normalizeAutoOptimize(raw.auto_optimize, `${path}.auto_optimize`, variants, options, issues);
             return {
-                id, channel: "linkedin", kind: "inmail", subject_template: subject ?? "", template: template ?? "",
+                id, channel: "linkedin", kind: "inmail", subject_template: subject ?? "", template: template ?? "", ...linkedInSender,
                 ...(variants ? { variants: variants } : {}),
                 ...(autoOptimize ? { auto_optimize: autoOptimize } : {}),
             };
@@ -1592,7 +1649,7 @@ raw, index, options, issues) {
             };
         }
         case "follow":
-            return { id, channel: "linkedin", kind: "follow" };
+            return { id, channel: "linkedin", kind: "follow", ...linkedInSender };
         case "like_post": {
             const reaction = typeof raw.reaction === "string" && LINKEDIN_POST_REACTION_SET.has(raw.reaction)
                 ? raw.reaction
@@ -1602,7 +1659,7 @@ raw, index, options, issues) {
             }
             const recency = optionalPostRecencyDays(raw.post_recency_days, `${path}.post_recency_days`, issues);
             return {
-                id, channel: "linkedin", kind: "like_post",
+                id, channel: "linkedin", kind: "like_post", ...linkedInSender,
                 ...(reaction ? { reaction: reaction } : {}),
                 ...(recency !== undefined ? { post_recency_days: recency } : {}),
                 ...(raw.on_no_post === "stop" ? { on_no_post: "stop" } : {}),
@@ -1622,7 +1679,7 @@ raw, index, options, issues) {
             }
             const recency = optionalPostRecencyDays(raw.post_recency_days, `${path}.post_recency_days`, issues);
             return {
-                id, channel: "linkedin", kind: "comment_post",
+                id, channel: "linkedin", kind: "comment_post", ...linkedInSender,
                 ...(hasText ? { text_template: textTemplate } : {}),
                 ...(hasPrompt ? { ai_prompt: aiPrompt } : {}),
                 ...(recency !== undefined ? { post_recency_days: recency } : {}),
@@ -1630,7 +1687,7 @@ raw, index, options, issues) {
             };
         }
         case "withdraw_invite":
-            return { id, channel: "linkedin", kind: "withdraw_invite" };
+            return { id, channel: "linkedin", kind: "withdraw_invite", ...linkedInSender };
         case "stop":
             return { id, kind: "stop" };
         default:

package/node_modules/@oxygen/shared/dist/signup-lead-payload.d.ts

@@ -15,6 +15,7 @@ export type SignupLeadWebhookInput = {
         email?: string | null;
         firstName?: string | null;
         lastName?: string | null;
+        phone?: string | null;
         createdAt?: Date | string | number | null | undefined;
         /** A profile URL the provider already knows for this person; the consent-recorded creator URL still wins at enqueue. */
         linkedinUrl?: string | null;

package/node_modules/@oxygen/shared/dist/signup-lead-payload.js

@@ -33,6 +33,7 @@ export function buildSignupLeadWebhookPayload(input) {
     const email = normalizeString(input.user?.email)?.toLowerCase() ?? null;
     const firstName = normalizeString(input.user?.firstName);
     const lastName = normalizeString(input.user?.lastName);
+    const phone = normalizeString(input.user?.phone);
     const fullName = normalizeString([firstName, lastName].filter(Boolean).join(" "));
     const clerkOrgId = normalizeString(input.organization?.clerkOrgId);
     const companyName = normalizeString(input.organization?.name);
@@ -51,6 +52,7 @@ export function buildSignupLeadWebhookPayload(input) {
         email,
         first_name: firstName,
         last_name: lastName,
+        phone,
         full_name: fullName,
         created_at: normalizeDate(input.user?.createdAt),
         linkedin_url: normalizeString(input.user?.linkedinUrl) ?? undefined,
@@ -118,6 +120,7 @@ export function buildSignupLeadWebhookPayload(input) {
         email,
         first_name: firstName,
         last_name: lastName,
+        phone,
         full_name: fullName,
         company_name: companyName,
         company_domain: companyDomain,

package/node_modules/@oxygen/shared/dist/table-capacity.d.ts

@@ -37,9 +37,8 @@ export declare const PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST: readonly PlanB
  * - A limit that tightens (free, $49, $99) is a scheduled 2026-09 repricing value
  *   (`storage.<band>.*` in `REPRICING_2026_09_SCHEDULE`): today's envelope until
  *   the effective-date switch, the ratified ladder from it on.
- * - A band awaiting the rows-per-Table capacity test has its ladder workspace
- *   totals and keeps today's rows per Table, except on the self-hosted dev
- *   deployment, where the test runs.
+ * - A band awaiting a passing rows-per-Table capacity test has its ladder
+ *   workspace totals and keeps today's rows per Table everywhere.
  * - Every other band is already at its ladder value.
  */
 export declare function resolveWorkspaceTableCapacity(band: PlanBand, options?: RepricingOptions): WorkspaceTableCapacityLimits;

package/node_modules/@oxygen/shared/dist/table-capacity.js

@@ -50,18 +50,13 @@ export const PLAN_BAND_TABLE_CAPACITY_TARGETS = Object.freeze({
  */
 export const PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST = Object.freeze(["999", "1999"]);
 /**
- * The capacity test itself runs on the self-hosted dev deployment, which
- * therefore applies the awaiting bands' full ladder: a 10,000,000-row Table
- * cannot be measured behind a 3,000,000-row limit. Every other deployment,
- * production included, keeps the list above. The exact selector is compared
- * (not `resolveDeployEnv`, which throws on a typo) so a malformed value keeps
- * the production answer instead of failing a limits read.
+ * The dev capacity test has finished without meeting the latency and export
+ * requirements (decision F.9). Hold the same 3M limit in every environment;
+ * the earlier dev-only 5M/10M override made limits reads promise a capacity
+ * that the founder held after that test.
  */
-function awaitsTableRowCapacityTest(band, options) {
-    if (!PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST.includes(band))
-        return false;
-    const env = options.env ?? process.env;
-    return env.OXYGEN_DEPLOY_ENV?.trim().toLowerCase() !== "selfhost-dev";
+function awaitsTableRowCapacityTest(band) {
+    return PLAN_BANDS_AWAITING_TABLE_ROW_CAPACITY_TEST.includes(band);
 }
 const STORAGE_FIELDS = [
     ["tableRowLimit", "table_row_limit"],
@@ -75,14 +70,13 @@ const STORAGE_FIELDS = [
  * - A limit that tightens (free, $49, $99) is a scheduled 2026-09 repricing value
  *   (`storage.<band>.*` in `REPRICING_2026_09_SCHEDULE`): today's envelope until
  *   the effective-date switch, the ratified ladder from it on.
- * - A band awaiting the rows-per-Table capacity test has its ladder workspace
- *   totals and keeps today's rows per Table, except on the self-hosted dev
- *   deployment, where the test runs.
+ * - A band awaiting a passing rows-per-Table capacity test has its ladder
+ *   workspace totals and keeps today's rows per Table everywhere.
  * - Every other band is already at its ladder value.
  */
 export function resolveWorkspaceTableCapacity(band, options = {}) {
     const target = PLAN_BAND_TABLE_CAPACITY_TARGETS[band];
-    if (awaitsTableRowCapacityTest(band, options)) {
+    if (awaitsTableRowCapacityTest(band)) {
         return Object.freeze({ ...target, tableRowLimit: WORKSPACE_TABLE_CAPACITY.tableRowLimit });
     }
     const resolved = { ...target };
@@ -95,7 +89,7 @@ export function resolveWorkspaceTableCapacity(band, options = {}) {
     return Object.freeze(resolved);
 }
 export function describeWorkspaceTableCapacityStatus(band, options = {}) {
-    if (awaitsTableRowCapacityTest(band, options)) {
+    if (awaitsTableRowCapacityTest(band)) {
         return { status: "awaiting_capacity_test", effectiveAt: null, target: PLAN_BAND_TABLE_CAPACITY_TARGETS[band] };
     }
     const state = readRepricingSwitch(options);

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1011.21";
+export declare const OXYGEN_BUILD_VERSION = "1.1011.95";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1011.21";
+export const OXYGEN_BUILD_VERSION = "1.1011.95";

package/node_modules/@oxygen/shared/dist/workspace-file-storage.d.ts

@@ -79,3 +79,9 @@ export declare function putWorkspaceFileObject(input: {
     sizeBytes: number;
     sha256: string;
 }>;
+/** Delete only an object key already proven to belong to this workspace file. */
+export declare function deleteWorkspaceFileObject(input: {
+    organizationId: string;
+    fileId: string;
+    storageKey: string;
+}): Promise<void>;

package/node_modules/@oxygen/shared/dist/workspace-file-storage.js

@@ -1,6 +1,6 @@
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
-import { GetObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3";
+import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { OxygenError } from "./cli-result.js";
 import { resolveObjectStorageClient } from "./object-storage.js";
@@ -171,3 +171,11 @@ export async function putWorkspaceFileObject(input) {
     await readWorkspaceFileObject({ ...input, storageKey, sizeBytes: bytes.byteLength, sha256 });
     return { storageKey, sizeBytes: bytes.byteLength, sha256 };
 }
+/** Delete only an object key already proven to belong to this workspace file. */
+export async function deleteWorkspaceFileObject(input) {
+    assertWorkspaceFileObjectKey(input);
+    const { client, bucket } = resolveObjectStorageClient();
+    await client.send(new DeleteObjectCommand({ Bucket: bucket, Key: input.storageKey }), {
+        abortSignal: AbortSignal.timeout(STORAGE_TIMEOUT_MS),
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1011.21",
+  "version": "1.1011.95",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",