@oxygen-agent/cli 1.1011.326 → 1.1011.440

package/node_modules/@oxygen/shared/dist/decision-ledger.js

@@ -0,0 +1,20 @@
+import { DECISION_LEDGER_ENTRIES } from "./decision-ledger.generated.js";
+export { parseDecisionLedger } from "./decision-ledger-parser.js";
+const DECISIONS_BY_ID = new Map(DECISION_LEDGER_ENTRIES.map((entry) => [entry.id, entry]));
+/**
+ * The ledger entry for a decision id. An exact id wins ("D34a" is its own
+ * decision); otherwise an answer-option suffix resolves to its base decision
+ * ("D19a" and "D19(a)" are D19's option (a)).
+ */
+export function getDecision(id) {
+    const key = id.trim();
+    const exact = DECISIONS_BY_ID.get(key);
+    if (exact)
+        return exact;
+    const base = /^(D\d+)(?:[a-z]|\([a-z]\))$/.exec(key)?.[1];
+    return base ? DECISIONS_BY_ID.get(base) ?? null : null;
+}
+/** Every ledger entry, sorted by decision id. */
+export function listDecisions() {
+    return DECISION_LEDGER_ENTRIES;
+}

package/node_modules/@oxygen/shared/dist/email-campaign-ramp.d.ts

@@ -0,0 +1,104 @@
+/**
+ * The standard ramp, by completed sending days: 5 a day through 2, 10 through 5,
+ * 20 through 8, then the configured cap. `maxAgeDays` keeps its historical name;
+ * its input is completed sending days, not mailbox age.
+ */
+export declare const WARMUP_RAMP_DAILY_CAPS: readonly [{
+    readonly maxAgeDays: 2;
+    readonly cap: 5;
+}, {
+    readonly maxAgeDays: 5;
+    readonly cap: 10;
+}, {
+    readonly maxAgeDays: 8;
+    readonly cap: 20;
+}];
+/**
+ * A custom ramp. `cap`, when present, is a permanent ceiling for this inbox (it
+ * never climbs past it, even when the daily cap is higher); absent, the ramp
+ * climbs until it reaches the inbox's configured daily cap.
+ */
+export type MailboxCustomRampConfig = {
+    start_per_day: number;
+    increase_every_days: number;
+    step: number;
+    cap?: number;
+};
+/** The ramp switched off: the configured daily cap applies from the first sending day. */
+export type MailboxRampOffConfig = {
+    enabled: false;
+};
+export type MailboxRampConfig = MailboxCustomRampConfig | MailboxRampOffConfig;
+export declare const MAILBOX_RAMP_MODES: readonly ["standard", "custom", "off"];
+export type MailboxRampMode = (typeof MAILBOX_RAMP_MODES)[number];
+export declare function isMailboxRampOff(config: MailboxRampConfig | null | undefined): config is MailboxRampOffConfig;
+export declare function mailboxRampMode(config: MailboxRampConfig | null | undefined): MailboxRampMode;
+/** The custom knobs, or null for the standard ramp and for a ramp switched off. */
+export declare function customMailboxRamp(config: MailboxRampConfig | null | undefined): MailboxCustomRampConfig | null;
+export type MailboxRampConfigParse = {
+    ok: true;
+    config: MailboxRampConfig | null;
+} | {
+    ok: false;
+    field: string | null;
+    message: string;
+};
+/**
+ * The one validator for a ramp_config write, shared by the API route (400) and
+ * the tenant write (OxygenError). null/undefined selects the standard ramp.
+ * `{enabled: false}` turns the ramp off and takes no other field. Otherwise
+ * start_per_day, increase_every_days (>= 1) and step are required non-negative
+ * integers, and cap is an optional non-negative integer.
+ */
+export declare function parseMailboxRampConfig(value: unknown): MailboxRampConfigParse;
+/**
+ * Encode a validated public config for rolling web/worker deployments. The
+ * snapshot is the configured cap in force, taken under the mailbox's row lock.
+ * New readers discard it; it is never a permanent custom ceiling. Cap edits
+ * must refresh it, including Off's fixed start, so old warm-up targets cannot
+ * retain a higher value after the mailbox's daily cap is lowered.
+ */
+export declare function serializeMailboxRampConfig(config: MailboxRampConfig | null, configuredDailyCap: number): Record<string, unknown> | null;
+/** Non-throwing read of stored ramp_config; private compatibility fields never reach public readbacks. */
+export declare function readMailboxRampConfig(value: unknown): MailboxRampConfig | null;
+/** Refresh only a synthetic compatibility ceiling; explicit caps and malformed legacy rows stay intact. */
+export declare function refreshMailboxRampConfigDailyCap(value: unknown, configuredDailyCap: number): unknown;
+/** The standard ramp's ceiling after `sendingDays` completed sending days; null once past its tiers. */
+export declare function warmupRampDailyCap(sendingDays: number): number | null;
+/**
+ * A custom ramp's ceiling after `sendingDays` completed sending days: start_per_day
+ * plus one `step` per completed `increase_every_days` window, held to `cap` when
+ * one is set. A (defensively) zero interval never climbs instead of dividing by zero.
+ */
+export declare function rampConfigDailyCap(config: MailboxCustomRampConfig, sendingDays: number): number;
+/** The campaign ramp's ceiling in any mode; null when the ramp does not hold the inbox back. */
+export declare function campaignRampDailyCap(config: MailboxRampConfig | null | undefined, sendingDays: number): number | null;
+/** One level of the schedule: from this 1-based sending day the inbox may send `perDay`. */
+export type CampaignRampStep = {
+    fromSendingDay: number;
+    perDay: number;
+};
+export type CampaignRampSchedule = {
+    mode: MailboxRampMode;
+    /** Every level the inbox passes through, ending at the most it will ever send a day. */
+    steps: CampaignRampStep[];
+    /** The 1-based sending day on which the inbox first sends its full daily cap; null if it never does. */
+    fullCapOnSendingDay: number | null;
+    /** True when `steps` stopped early at `maxSteps`. */
+    truncated: boolean;
+};
+/**
+ * The 1-based sending day on which the ramp first lets the inbox send its full
+ * daily cap: 1 when the ramp is off or already at the cap, null when it never
+ * gets there (a custom cap below the daily cap, or no increase).
+ */
+export declare function campaignRampFullCapSendingDay(config: MailboxRampConfig | null | undefined, dailyCap: number): number | null;
+/**
+ * The day-by-day plan a ramp produces against a daily cap, as distinct levels.
+ * Standard against 25: 5 (day 1), 10 (day 4), 20 (day 7), 25 (day 10). A custom
+ * ramp whose own cap sits below the daily cap ends at that cap and never reports
+ * a full-cap day. `maxSteps` bounds a very gentle custom ramp (1 a day, +1 a day).
+ */
+export declare function campaignRampSchedule(config: MailboxRampConfig | null | undefined, dailyCap: number, options?: {
+    maxSteps?: number;
+}): CampaignRampSchedule;

package/node_modules/@oxygen/shared/dist/email-campaign-ramp.js

@@ -0,0 +1,250 @@
+// Per-mailbox campaign ramp-up: how much campaign email an inbox may send on each
+// of its first sending days before its configured daily cap applies. A sending
+// day is a completed UTC day on which the mailbox had an accepted campaign send
+// (`campaignSendingDays`), so idle days and import age never advance it.
+//
+// Three modes, one stored column (`email_mailboxes.ramp_config`):
+//   - standard (null)      5 / 10 / 20 a day over the first nine sending days,
+//                          then the configured cap.
+//   - custom               start_per_day, plus `step` every `increase_every_days`
+//                          sending days, until the configured cap. An optional
+//                          `cap` is a permanent ceiling below the daily cap.
+//   - off ({enabled:false}) the configured cap from the first sending day, for
+//                          an inbox that already has sending history elsewhere.
+//
+// Pure and browser-safe: the send claim, every API readback and the web preview
+// compute the same numbers from these functions.
+/**
+ * The standard ramp, by completed sending days: 5 a day through 2, 10 through 5,
+ * 20 through 8, then the configured cap. `maxAgeDays` keeps its historical name;
+ * its input is completed sending days, not mailbox age.
+ */
+export const WARMUP_RAMP_DAILY_CAPS = [
+    { maxAgeDays: 2, cap: 5 },
+    { maxAgeDays: 5, cap: 10 },
+    { maxAgeDays: 8, cap: 20 },
+];
+export const MAILBOX_RAMP_MODES = ["standard", "custom", "off"];
+export function isMailboxRampOff(config) {
+    return Boolean(config) && config.enabled === false;
+}
+export function mailboxRampMode(config) {
+    if (!config)
+        return "standard";
+    return isMailboxRampOff(config) ? "off" : "custom";
+}
+/** The custom knobs, or null for the standard ramp and for a ramp switched off. */
+export function customMailboxRamp(config) {
+    return config && !isMailboxRampOff(config) ? config : null;
+}
+const CUSTOM_REQUIRED_FIELDS = ["start_per_day", "increase_every_days", "step"];
+function isNonNegativeInteger(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+/**
+ * The one validator for a ramp_config write, shared by the API route (400) and
+ * the tenant write (OxygenError). null/undefined selects the standard ramp.
+ * `{enabled: false}` turns the ramp off and takes no other field. Otherwise
+ * start_per_day, increase_every_days (>= 1) and step are required non-negative
+ * integers, and cap is an optional non-negative integer.
+ */
+export function parseMailboxRampConfig(value) {
+    if (value === undefined || value === null)
+        return { ok: true, config: null };
+    if (typeof value !== "object" || Array.isArray(value)) {
+        return { ok: false, field: null, message: "ramp_config must be an object, or null for the standard ramp." };
+    }
+    const record = value;
+    if (record.enabled !== undefined && typeof record.enabled !== "boolean") {
+        return { ok: false, field: "enabled", message: "ramp_config.enabled must be true or false." };
+    }
+    if (record.enabled === false) {
+        const extra = Object.keys(record).filter((key) => key !== "enabled" && record[key] !== undefined);
+        if (extra.length > 0) {
+            return {
+                ok: false,
+                field: extra[0] ?? null,
+                message: "ramp_config {enabled: false} turns the ramp off; send it without other fields.",
+            };
+        }
+        return { ok: true, config: { enabled: false } };
+    }
+    const config = {};
+    for (const field of CUSTOM_REQUIRED_FIELDS) {
+        const raw = record[field];
+        if (!isNonNegativeInteger(raw)) {
+            return { ok: false, field, message: `ramp_config.${field} must be a non-negative integer.` };
+        }
+        config[field] = raw;
+    }
+    if (config.increase_every_days < 1) {
+        return { ok: false, field: "increase_every_days", message: "ramp_config.increase_every_days must be at least 1." };
+    }
+    if (record.cap !== undefined && record.cap !== null) {
+        if (!isNonNegativeInteger(record.cap)) {
+            return { ok: false, field: "cap", message: "ramp_config.cap must be a non-negative integer, or omitted to climb to the daily cap." };
+        }
+        config.cap = record.cap;
+    }
+    return { ok: true, config };
+}
+// Private persistence only. Previous workers require all four custom knobs and
+// otherwise read a row as the standard ramp (which can exceed a new 0/1-day
+// custom start). Keep them a bounded, valid ramp until they have rolled too.
+const STORAGE_MARKER = "__oxygen_ramp_compat";
+const STORED_FIELDS = new Set([...CUSTOM_REQUIRED_FIELDS, "cap", STORAGE_MARKER]);
+/**
+ * Encode a validated public config for rolling web/worker deployments. The
+ * snapshot is the configured cap in force, taken under the mailbox's row lock.
+ * New readers discard it; it is never a permanent custom ceiling. Cap edits
+ * must refresh it, including Off's fixed start, so old warm-up targets cannot
+ * retain a higher value after the mailbox's daily cap is lowered.
+ */
+export function serializeMailboxRampConfig(config, configuredDailyCap) {
+    if (!config)
+        return null;
+    const cap = wholeDailyCap(configuredDailyCap);
+    if (isMailboxRampOff(config)) {
+        return { start_per_day: cap, increase_every_days: 1, step: 0, cap, [STORAGE_MARKER]: "off-v1" };
+    }
+    if (config.cap !== undefined)
+        return { ...config };
+    return { ...config, cap, [STORAGE_MARKER]: "uncapped-v1" };
+}
+/** Non-throwing read of stored ramp_config; private compatibility fields never reach public readbacks. */
+export function readMailboxRampConfig(value) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        const record = value;
+        if (Object.hasOwn(record, STORAGE_MARKER)) {
+            if (Object.keys(record).some((key) => !STORED_FIELDS.has(key)))
+                return null;
+            const legacy = parseMailboxRampConfig(record);
+            if (!legacy.ok || !legacy.config || isMailboxRampOff(legacy.config)
+                || !isNonNegativeInteger(record.cap))
+                return null;
+            if (record[STORAGE_MARKER] === "off-v1") {
+                return legacy.config.start_per_day === record.cap && legacy.config.step === 0
+                    && legacy.config.increase_every_days === 1 ? { enabled: false } : null;
+            }
+            if (record[STORAGE_MARKER] !== "uncapped-v1")
+                return null;
+            const { cap: _snapshot, ...custom } = legacy.config;
+            return custom;
+        }
+    }
+    const parsed = parseMailboxRampConfig(value);
+    return parsed.ok ? parsed.config : null;
+}
+/** Refresh only a synthetic compatibility ceiling; explicit caps and malformed legacy rows stay intact. */
+export function refreshMailboxRampConfigDailyCap(value, configuredDailyCap) {
+    const config = readMailboxRampConfig(value);
+    return config && (isMailboxRampOff(config) || config.cap === undefined)
+        ? serializeMailboxRampConfig(config, configuredDailyCap) : value;
+}
+function wholeSendingDays(sendingDays) {
+    return Number.isFinite(sendingDays) && sendingDays > 0 ? Math.floor(sendingDays) : 0;
+}
+/** The standard ramp's ceiling after `sendingDays` completed sending days; null once past its tiers. */
+export function warmupRampDailyCap(sendingDays) {
+    const days = wholeSendingDays(sendingDays);
+    for (const tier of WARMUP_RAMP_DAILY_CAPS) {
+        if (days <= tier.maxAgeDays)
+            return tier.cap;
+    }
+    return null;
+}
+/**
+ * A custom ramp's ceiling after `sendingDays` completed sending days: start_per_day
+ * plus one `step` per completed `increase_every_days` window, held to `cap` when
+ * one is set. A (defensively) zero interval never climbs instead of dividing by zero.
+ */
+export function rampConfigDailyCap(config, sendingDays) {
+    const days = wholeSendingDays(sendingDays);
+    const periods = config.increase_every_days >= 1 ? Math.floor(days / config.increase_every_days) : 0;
+    const value = config.start_per_day + config.step * periods;
+    const ceiling = typeof config.cap === "number" ? Math.min(value, config.cap) : value;
+    return Math.max(0, ceiling);
+}
+/** The campaign ramp's ceiling in any mode; null when the ramp does not hold the inbox back. */
+export function campaignRampDailyCap(config, sendingDays) {
+    if (isMailboxRampOff(config))
+        return null;
+    const custom = customMailboxRamp(config);
+    return custom ? rampConfigDailyCap(custom, sendingDays) : warmupRampDailyCap(sendingDays);
+}
+/** Completed sending days at which the standard ramp changes level. */
+const STANDARD_RAMP_BOUNDARIES = [0, ...WARMUP_RAMP_DAILY_CAPS.map((tier) => tier.maxAgeDays + 1)];
+function wholeDailyCap(dailyCap) {
+    return Number.isFinite(dailyCap) && dailyCap > 0 ? Math.floor(dailyCap) : 0;
+}
+/**
+ * The 1-based sending day on which the ramp first lets the inbox send its full
+ * daily cap: 1 when the ramp is off or already at the cap, null when it never
+ * gets there (a custom cap below the daily cap, or no increase).
+ */
+export function campaignRampFullCapSendingDay(config, dailyCap) {
+    const cap = wholeDailyCap(dailyCap);
+    if (cap === 0 || isMailboxRampOff(config))
+        return 1;
+    const custom = customMailboxRamp(config);
+    if (!custom) {
+        for (const sendingDays of STANDARD_RAMP_BOUNDARIES) {
+            const ramp = warmupRampDailyCap(sendingDays);
+            if (ramp === null || ramp >= cap)
+                return sendingDays + 1;
+        }
+        return null;
+    }
+    if (typeof custom.cap === "number" && custom.cap < cap)
+        return null;
+    if (custom.start_per_day >= cap)
+        return 1;
+    if (custom.step <= 0)
+        return null;
+    const periods = Math.ceil((cap - custom.start_per_day) / custom.step);
+    return periods * Math.max(1, custom.increase_every_days) + 1;
+}
+/**
+ * The day-by-day plan a ramp produces against a daily cap, as distinct levels.
+ * Standard against 25: 5 (day 1), 10 (day 4), 20 (day 7), 25 (day 10). A custom
+ * ramp whose own cap sits below the daily cap ends at that cap and never reports
+ * a full-cap day. `maxSteps` bounds a very gentle custom ramp (1 a day, +1 a day).
+ */
+export function campaignRampSchedule(config, dailyCap, options = {}) {
+    const mode = mailboxRampMode(config);
+    const cap = wholeDailyCap(dailyCap);
+    const maxSteps = Math.max(2, Math.floor(options.maxSteps ?? 60));
+    const steps = [];
+    // Levels change only at a tier boundary (standard) or a period boundary
+    // (custom), so visiting those boundaries visits every distinct level.
+    const visit = (sendingDays) => {
+        const ramp = campaignRampDailyCap(config, sendingDays);
+        const perDay = ramp === null ? cap : Math.min(cap, ramp);
+        if (steps[steps.length - 1]?.perDay === perDay)
+            return;
+        steps.push({ fromSendingDay: sendingDays + 1, perDay });
+    };
+    const custom = customMailboxRamp(config);
+    let truncated = false;
+    if (mode === "off") {
+        visit(0);
+    }
+    else if (!custom) {
+        for (const sendingDays of STANDARD_RAMP_BOUNDARIES)
+            visit(sendingDays);
+    }
+    else {
+        const ceiling = typeof custom.cap === "number" ? Math.min(cap, custom.cap) : cap;
+        const every = Math.max(1, custom.increase_every_days);
+        for (let period = 0;; period += 1) {
+            visit(period * every);
+            if ((steps[steps.length - 1]?.perDay ?? 0) >= ceiling || custom.step <= 0)
+                break;
+            if (steps.length >= maxSteps) {
+                truncated = true;
+                break;
+            }
+        }
+    }
+    return { mode, steps, fullCapOnSendingDay: campaignRampFullCapSendingDay(config, cap), truncated };
+}

package/node_modules/@oxygen/shared/dist/mcp-event-contract.d.ts

@@ -16,12 +16,18 @@ export type McpReplyClassification = (typeof MCP_REPLY_CLASSIFICATIONS)[number];
 export declare const MCP_REPLY_CHANNELS: readonly ["email", "linkedin", "whatsapp"];
 /** How an enrollment ended: the Sequencer's own terminal statuses. */
 export declare const MCP_ENROLLMENT_OUTCOMES: readonly ["completed", "replied", "stopped", "failed", "excluded"];
-/** The run ledgers `run_outcome_analytics` reads (`SettledRunKind` in @oxygen/tenant-db). */
-export declare const MCP_RUN_KINDS: readonly ["workflow", "table_action", "table_ingestion", "agent", "copilot_turn"];
+/**
+ * The durable-run ledgers `run_outcome_analytics` reads (`SettledRunKind` in
+ * @oxygen/tenant-db), without Workspace Copilot turns: a turn is attended and
+ * private to its member, the own-action guard already drops a subscriber's own
+ * turns, and delivering other members' turns would expose private activity
+ * with deep links the subscriber may not be able to open.
+ */
+export declare const MCP_RUN_KINDS: readonly ["workflow", "table_action", "table_ingestion", "agent"];
 export type McpRunKind = (typeof MCP_RUN_KINDS)[number];
 /**
  * Every terminal status those ledgers write, with one spelling of cancel:
- * Workflow and Table runs write `canceled`, Agent runs and Copilot turns `cancelled`.
+ * Workflow and Table runs write `canceled`, Agent runs `cancelled`.
  */
 export declare const MCP_RUN_STATUSES: readonly ["completed", "completed_with_errors", "failed", "canceled", "budget_exhausted", "effect_unknown"];
 export type McpRunStatus = (typeof MCP_RUN_STATUSES)[number];
@@ -285,7 +291,7 @@ declare const RECORD_STAGE_CHANGED_PAYLOAD: ContractObject<{
 declare const RUN_SETTLED_PAYLOAD: ContractObject<{
     readonly kind: {
         type: "string";
-        enum: readonly ("agent" | "copilot_turn" | "table_action" | "table_ingestion" | "workflow")[];
+        enum: readonly ("agent" | "table_action" | "table_ingestion" | "workflow")[];
         description?: string;
     };
     readonly status: {
@@ -574,9 +580,6 @@ export type McpRunSettledSource = McpRunSettledCommon & ({
 } | {
     kind: "agent";
     agentSlug: string;
-} | {
-    kind: "copilot_turn";
-    copilotSessionId: string;
 });
 /** A settled run as `run.settled`. Its producer is OXP-11.5.21. */
 export declare function projectRunSettledEvent(source: McpRunSettledSource, context?: McpEventLinkOptions): McpRunSettledPayload;

package/node_modules/@oxygen/shared/dist/mcp-event-contract.js

@@ -59,11 +59,17 @@ const REPLY_LABELS_DELIVERED_AS_IS = new Set([
 export const MCP_REPLY_CHANNELS = ["email", "linkedin", "whatsapp"];
 /** How an enrollment ended: the Sequencer's own terminal statuses. */
 export const MCP_ENROLLMENT_OUTCOMES = SEQUENCE_TERMINAL_STATUSES;
-/** The run ledgers `run_outcome_analytics` reads (`SettledRunKind` in @oxygen/tenant-db). */
-export const MCP_RUN_KINDS = ["workflow", "table_action", "table_ingestion", "agent", "copilot_turn"];
+/**
+ * The durable-run ledgers `run_outcome_analytics` reads (`SettledRunKind` in
+ * @oxygen/tenant-db), without Workspace Copilot turns: a turn is attended and
+ * private to its member, the own-action guard already drops a subscriber's own
+ * turns, and delivering other members' turns would expose private activity
+ * with deep links the subscriber may not be able to open.
+ */
+export const MCP_RUN_KINDS = ["workflow", "table_action", "table_ingestion", "agent"];
 /**
  * Every terminal status those ledgers write, with one spelling of cancel:
- * Workflow and Table runs write `canceled`, Agent runs and Copilot turns `cancelled`.
+ * Workflow and Table runs write `canceled`, Agent runs `cancelled`.
  */
 export const MCP_RUN_STATUSES = [
     "completed",
@@ -160,7 +166,7 @@ const RUN_SETTLED_INPUT = obj({
 });
 const RUN_SETTLED_PAYLOAD = payloadObject({
     kind: enumOf(MCP_RUN_KINDS, {
-        description: "What ran: a Workflow run, a Table action run, a Table import (`table_ingestion`), an Agent run or a Workspace Copilot turn.",
+        description: "What ran: a Workflow run, a Table action run, a Table import (`table_ingestion`) or an Agent run.",
     }),
     status: enumOf(MCP_RUN_STATUSES, {
         description: "How it ended. An Agent run can also end `budget_exhausted` or `effect_unknown`.",
@@ -189,7 +195,7 @@ export const MCP_EVENT_DEFINITIONS = [
     eventDefinition("enrollment.ended", "A lead's enrollment in an OXYGEN Sequence ended: the lead replied, every step was sent, the enrollment was stopped or excluded, or sending failed.", ENROLLMENT_ENDED_INPUT, ENROLLMENT_ENDED_PAYLOAD),
     eventDefinition("meeting.completed", "OXYGEN's Meeting Notetaker finished processing a recorded meeting; its transcript and meeting note are ready in OXYGEN.", MEETING_COMPLETED_INPUT, MEETING_COMPLETED_PAYLOAD),
     eventDefinition("record.stage_changed", "A CRM record's stage changed in OXYGEN, such as a person's lead stage, a company's account stage or a deal's pipeline stage.", RECORD_STAGE_CHANGED_INPUT, RECORD_STAGE_CHANGED_PAYLOAD),
-    eventDefinition("run.settled", "A run in OXYGEN reached its final status: a Workflow run, a Table action run or import, an Agent run, or a Workspace Copilot turn.", RUN_SETTLED_INPUT, RUN_SETTLED_PAYLOAD),
+    eventDefinition("run.settled", "A run in OXYGEN reached its final status: a Workflow run, a Table action run or import, or an Agent run.", RUN_SETTLED_INPUT, RUN_SETTLED_PAYLOAD),
     eventDefinition("approval.requested", "A Workflow run or an Agent run in OXYGEN paused and is waiting for a person to approve its next step.", APPROVAL_REQUESTED_INPUT, APPROVAL_REQUESTED_PAYLOAD),
 ];
 const DEFINITIONS_BY_NAME = new Map(MCP_EVENT_DEFINITIONS.map((entry) => [entry.name, entry]));
@@ -574,8 +580,6 @@ function runPath(source) {
             return `/tables/${encodeURIComponent(source.tableId)}/ingestions/${encodeURIComponent(source.runId)}`;
         case "agent":
             return agentRunPath(source.agentSlug, source.runId);
-        case "copilot_turn":
-            return `/copilot/${encodeURIComponent(source.copilotSessionId)}`;
     }
 }
 // Every catalogue projection first proves the row is that event, so a reader

package/node_modules/@oxygen/shared/dist/mcp-table-widget.d.ts

@@ -0,0 +1,50 @@
+export declare const TABLE_WIDGET_NAME = "oxygen.table";
+/** A run filling the Table, shown as progress until it reaches a terminal state. */
+export type TableWidgetRun = {
+    kind: "ingestion" | "column_run";
+    id: string;
+    status: string;
+    terminal: boolean;
+    /** Settled / total work items in this run (chunks for an ingestion), not Table rows. */
+    rowsDone?: number | null;
+    rowsTarget?: number | null;
+    creditsUsed?: number | null;
+    creditsCap?: number | null;
+};
+export type TableWidgetGridPage = {
+    /** SerializedWorkspaceColumn[] from the web grid serializer. */
+    columns: unknown[];
+    /** SerializedWorkspaceTableRow[] from the web grid serializer. */
+    rows: unknown[];
+    cellStates?: Record<string, Record<string, unknown>> | null;
+    rowCount?: number | null;
+    hasMore?: boolean;
+    nextCursor?: string | null;
+    /**
+     * SerializedWorkspaceColumnStats[], the grid's column stats: what it
+     * collapses as empty, its header fill lines and run bars. Only a first page
+     * carries them, and only when they answered in time.
+     */
+    columnStats?: unknown[] | null;
+    /**
+     * An empty first page's fill state, the body of GET
+     * /api/tables/<id>/fill-progress: rows still being written, a failed fill,
+     * or neither.
+     */
+    fillProgress?: Record<string, unknown> | null;
+};
+export type TableWidgetPayload = {
+    version: 1;
+    /** "table": rows of a saved Table. "preview": sample rows of a search that saved nothing yet. */
+    source: "table" | "preview";
+    title: string;
+    /** The counts line under the title, e.g. "1,840 matches · 0 credits". */
+    summary?: string | null;
+    /** The Table these rows belong to; absent for a preview. Paging and live progress read it. */
+    tableId?: string | null;
+    webUrl?: string | null;
+    grid: TableWidgetGridPage;
+    run?: TableWidgetRun | null;
+};
+/** The payload inside a tool result, or null when the result carries none (a refusal, a filter list). */
+export declare function readTableWidgetPayload(result: unknown): TableWidgetPayload | null;

package/node_modules/@oxygen/shared/dist/mcp-table-widget.js

@@ -0,0 +1,24 @@
+// What an MCP tool hands the OXYGEN Table widget. The tool puts it in its
+// result's `_meta["oxygen/widget"].data`; MCP Apps hosts pass result `_meta` to
+// the widget and not to the model, so the grid page the widget draws costs the
+// model no context. The widget renders the page with the web grid's own
+// components, so `grid` carries the web grid's serialization unchanged
+// (columns, rows, cell states as GET /api/tables/<id>/rows returns them).
+export const TABLE_WIDGET_NAME = "oxygen.table";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The payload inside a tool result, or null when the result carries none (a refusal, a filter list). */
+export function readTableWidgetPayload(result) {
+    if (!isRecord(result) || !isRecord(result._meta))
+        return null;
+    const widget = result._meta["oxygen/widget"];
+    if (!isRecord(widget) || widget.name !== TABLE_WIDGET_NAME || !isRecord(widget.data))
+        return null;
+    const data = widget.data;
+    if (data.version !== 1 || typeof data.title !== "string" || !isRecord(data.grid))
+        return null;
+    if (!Array.isArray(data.grid.columns) || !Array.isArray(data.grid.rows))
+        return null;
+    return data;
+}

package/node_modules/@oxygen/shared/dist/plan-band.d.ts

@@ -84,6 +84,14 @@ export type PlanSpendResolution = {
  * is never clamped by this.
  */
 export declare function resolveDefaultTriggerRunCreditCeilingForPlan(resolution: PlanSpendResolution, options?: RepricingOptions): number | null;
+/**
+ * The default rolling 24-hour credit ceiling of one connected app (an MCP OAuth
+ * connection such as ChatGPT) while it holds MCP event subscriptions (ADR 0030
+ * §11, decision D3): the trigger default above, so the two cannot drift.
+ * Enterprise has no trigger default and uses the largest rung's, the way Agent
+ * run defaults do; a connection is never uncapped by default.
+ */
+export declare function resolveDefaultConnectionCreditCeilingForPlan(resolution: PlanSpendResolution, options?: RepricingOptions): number;
 /** The same default for one standing or webhook table auto-run batch. */
 export declare function resolveDefaultAutoRunBatchCreditCeilingForPlan(resolution: PlanSpendResolution, options?: RepricingOptions): number | null;
 /**

package/node_modules/@oxygen/shared/dist/plan-band.js

@@ -183,6 +183,18 @@ function resolveDeliveryCreditCeiling(resolution, preRepricingTable, options) {
 export function resolveDefaultTriggerRunCreditCeilingForPlan(resolution, options = {}) {
     return resolveDeliveryCreditCeiling(resolution, DEFAULT_TRIGGER_RUN_CREDIT_CEILING, options);
 }
+/**
+ * The default rolling 24-hour credit ceiling of one connected app (an MCP OAuth
+ * connection such as ChatGPT) while it holds MCP event subscriptions (ADR 0030
+ * §11, decision D3): the trigger default above, so the two cannot drift.
+ * Enterprise has no trigger default and uses the largest rung's, the way Agent
+ * run defaults do; a connection is never uncapped by default.
+ */
+export function resolveDefaultConnectionCreditCeilingForPlan(resolution, options = {}) {
+    return resolveDefaultTriggerRunCreditCeilingForPlan(resolution, options)
+        ?? resolveDefaultTriggerRunCreditCeilingForPlan(bandSpendResolution("1999"), options)
+        ?? 0;
+}
 /** The same default for one standing or webhook table auto-run batch. */
 export function resolveDefaultAutoRunBatchCreditCeilingForPlan(resolution, options = {}) {
     return resolveDeliveryCreditCeiling(resolution, DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING, options);

package/node_modules/@oxygen/shared/dist/plan-limits.d.ts

@@ -1,4 +1,5 @@
 import { type RepricingOptions } from "./repricing.js";
+export { CONNECTION_CEILING_ABOVE_DEFAULT_APPROVAL_KIND } from "./connection-approval.js";
 /**
  * The five enforcement rungs of the per-plan limits ladder. Every PlanTier maps
  * onto exactly one rung: "free" doubles as the unentitled fallback (no live
@@ -844,6 +845,25 @@ export declare function assertAgentRunCeilingApproval(input: {
 }): {
     aboveDefault: boolean;
 };
+/**
+ * The same approval posture for a connected app's rolling 24-hour credit
+ * ceiling (ADR 0030 §11): at or under the default (the plan-sized trigger
+ * default) nothing more to approve; above it only with the explicit
+ * above-default approval, whose flag and refusal shape match the Agent run and
+ * trigger ceilings; above the platform maximum never. `defaultCredits` is the
+ * lowest default among the workspaces the app can spend in, so the approval
+ * covers every one of them.
+ */
+export declare function assertConnectionCreditCeilingApproval(input: {
+    creditCeiling: number;
+    defaultCredits: number;
+    approveAboveDefault: boolean;
+    appName: string;
+    /** The workspace whose default is the one compared, named in the refusal. */
+    workspaceName?: string;
+}): {
+    aboveDefault: boolean;
+};
 /**
  * The ceilings one run is held to, for the worker and every budget check that
  * reads a run's authority. A run with a recorded above-default approval is