@oxygen-agent/cli 1.1011.326 → 1.1011.440

package/node_modules/@oxygen/shared/dist/connection-approval.d.ts

@@ -0,0 +1,2 @@
+/** Shared refusal discriminator; safe to import without the plan/pricing catalog. */
+export declare const CONNECTION_CEILING_ABOVE_DEFAULT_APPROVAL_KIND = "connection_ceiling_above_default";

package/node_modules/@oxygen/shared/dist/connection-approval.js

@@ -0,0 +1,2 @@
+/** Shared refusal discriminator; safe to import without the plan/pricing catalog. */
+export const CONNECTION_CEILING_ABOVE_DEFAULT_APPROVAL_KIND = "connection_ceiling_above_default";

package/node_modules/@oxygen/shared/dist/contracts/browser-operations.d.ts

@@ -0,0 +1,2 @@
+import type { OperationSpec } from "./operations.js";
+export declare const BROWSER_OPERATIONS: readonly OperationSpec[];

package/node_modules/@oxygen/shared/dist/contracts/browser-operations.js

@@ -0,0 +1,110 @@
+/** Browser resource operations, using the same scoped handlers on every surface. */
+import { arr, bool, enumOf, int, nullable, num, obj, str } from "./schema.js";
+const text = (description) => str(description ? { description } : {});
+const json = { type: "object", additionalProperties: true };
+const strings = () => arr(str());
+const objects = () => arr(json);
+const dataType = () => enumOf(["text", "numeric", "boolean", "jsonb", "timestamptz"]);
+const selection = obj({
+    mode: enumOf(["all", "limit", "row_ids", "filter", "all_matching"]),
+    limit: int({ minimum: 1 }), row_ids: strings(), filters: objects(),
+    filter: text("Serialized browser filter tree."), search: text(), sort: text(), crm_object: text(),
+    range: obj({ offset: int({ minimum: 0 }), limit: int({ minimum: 1 }) }, { required: ["offset", "limit"] }),
+}, { required: ["mode"] });
+const actions = arr(obj({ type: enumOf(["tool_column"]), column: text(), definition: json }, { required: ["column"] }));
+const viewFields = { name: text(), view_type: text(), config: json, group_by: text(), is_default: bool(), position: int({ minimum: 0 }) };
+const crmLinks = arr(obj({ object: text(), row_id: text(), role: text() }, { required: ["object", "row_id"] }));
+function operation(id, route, method, cli, mcp, pack, summary, fields = {}, required = [], options = {}) {
+    return {
+        id, route, method, parameters: [...route.matchAll(/\{(\w+)\}/g)].map((match) => match[1]),
+        contract: obj(fields, { required }),
+        cli: { path: cli.split(" "), summary },
+        mcp: { name: mcp, title: `Oxygen: ${cli}`, description: summary, pack },
+        mutates: method !== "GET", spends: false, ...options,
+    };
+}
+const table = "/api/cli/tables/{table}";
+const column = `${table}/columns/{column}`;
+const run = `${table}/runs/{run}`;
+const upload = { content_base64: text(), file_name: text(), content_type: text(), intent: enumOf(["preview", "import"]), format: enumOf(["csv", "json", "xlsx"]), sheet: text(), table: text(), create_name: text(), project: text(), upsert_key: text(), source_key_map: json };
+const multipart = { contentField: "content_base64", nameField: "file_name", typeField: "content_type", fileField: "file" };
+// Both surfaces already register these exact canonical actions under their established names.
+const nativeCli = { generated: { cli: false, mcp: false } };
+export const BROWSER_OPERATIONS = [
+    operation("tables.resource.export_csv", `${table}/export/csv`, "GET", "tables export-csv", "oxygen_table_export_csv", "tables", "Download every row in the exact filtered Table view as streamed CSV. CLI writes --output; MCP returns an authenticated download resource link. Unsupported live lookup filters fail before download; rows and bytes are not capped or truncated.", { f: text("Serialized filter tree."), s: text("Serialized sort state."), q: text(), fields: text("Comma-separated exact column keys.") }, [], { binary: { stream: true, resourceParameter: "table" } }),
+    operation("billing.allowance.view", "/api/cli/billing/allowance/view", "GET", "billing allowance view", "oxygen_billing_allowance_view", "billing", "Read the complete current-cycle allowance view, including billing-owner display and partner-bonus eligibility."),
+    operation("billing.commitments.view", "/api/cli/billing/commitments/view", "GET", "billing commitments view", "oxygen_billing_commitments_view", "billing", "Read the complete fixed-credit commitment view and linked billing-owner display, without enumerating a child's sibling resources."),
+    operation("billing.invoices.view", "/api/cli/billing/invoices/view", "GET", "billing invoices view", "oxygen_billing_invoices_view", "billing", "Read the browser invoice-history projection, including exact native timestamps, amounts and signed Stripe invoice links."),
+    operation("billing.summary", "/api/cli/billing/summary", "GET", "billing summary", "oxygen_billing_summary", "billing", "Read the complete non-writing wallet, plan, seat-capacity and billing-owner summary."),
+    operation("billing.usage.view", "/api/cli/billing/usage/view", "GET", "billing usage view", "oxygen_billing_usage_view", "billing", "Read the full selected-window credit-spend view, including permitted linked workspace rollups.", { days: enumOf(["7", "30", "90"]), workspace: text() }),
+    operation("integrations.managed_endpoints", "/api/cli/integrations/composio/endpoints", "GET", "integrations managed-endpoints", "oxygen_integration_managed_endpoints", "integrations", "Read a managed integration's full action catalog and parameter schemas.", { integration_id: text() }, ["integration_id"]),
+    operation("integrations.openrouter_models", "/api/cli/integrations/openrouter/models", "GET", "integrations openrouter-models", "oxygen_openrouter_models", "integrations", "Read model and pricing metadata using this workspace's connected OpenRouter account; credentials are never returned."),
+    operation("integrations.status", "/api/cli/integrations/status", "GET", "integrations status", "oxygen_integration_status", "integrations", "Read active connection counts, sender connection state and the workspace's usable BYOK plan entitlement."),
+    operation("pricing.customer_credit_prices", "/api/cli/pricing/customer-credit-prices", "GET", "pricing customer-credit-prices", "oxygen_customer_credit_prices", "workspace", "Read the customer credit-price catalog, quantity decisions and price provenance used by the Table picker."),
+    operation("sequences.contacts.rows", "/api/cli/sequences/{sequence}/contacts/rows", "GET", "sequences contacts rows", "oxygen_sequence_contacts_rows", "sequences", "Read the full contact grid projection with exact contact-state filter and native synthetic status columns.", { contact_state: enumOf(["all", "not_contacted", "contacted", "connected", "replied", "positive_reply"]), limit: int({ minimum: 1, maximum: 2000 }), cursor: text(), offset: int({ minimum: 0 }), f: text(), s: text() }),
+    operation("sequences.leads.rows", "/api/cli/sequences/{sequence}/leads/rows", "GET", "sequences leads rows", "oxygen_sequence_leads_rows", "sequences", "Read the complete enrolled-lead grid projection, including sequence status, step, action and failure columns.", { limit: int({ minimum: 1, maximum: 2000 }), cursor: text(), offset: int({ minimum: 0 }), f: text(), s: text() }),
+    operation("unibox.metadata", "/api/cli/unibox/metadata", "GET", "unibox metadata", "oxygen_unibox_metadata", "inbox", "Read the complete authenticated inbox account, filter and tag metadata."),
+    operation("workflows.observed_output", "/api/cli/workflows/{workflow}/observed-output", "GET", "workflows observed-output", "oxygen_workflow_observed_output", "workflows", "Inspect observed output paths and bounded samples from an exact run or recent matching workflow revision.", { run_id: text(), source_hash: text() }),
+    operation("workflows.run.events", "/api/cli/workflows/{workflow}/runs/{run}/events", "GET", "workflows runs events", "oxygen_workflow_run_events", "workflows", "Read the exact Workflow run's bounded event history and whether it is still active.", { limit: int({ minimum: 1, maximum: 1000 }) }),
+    operation("workflows.run.step_statuses", "/api/cli/workflows/{workflow}/runs/{run}/step-statuses", "GET", "workflows runs step-statuses", "oxygen_workflow_run_step_statuses", "workflows", "Read the current Workflow run status and every step status for immediate execution readback."),
+    operation("workflows.tool_output_paths", "/api/cli/workflows/tool-output-paths", "GET", "workflows tool-output-paths", "oxygen_workflow_tool_output_paths", "workflows", "Discover bounded workspace-observed tool output paths and run/revision provenance, without exposing provider values.", { tool_id: strings() }, ["tool_id"], { repeatedQueryFields: ["tool_id"] }),
+    operation("tables.resource.edit", table, "PATCH", "tables edit", "oxygen_table_resource_edit", "tables", "Rename a Table or move it to a workspace project; returns the saved Table.", { name: text(), project_id: text() }),
+    operation("tables.resource.archive", table, "DELETE", "tables archive", "oxygen_tables_archive", "tables", "Archive a Table indefinitely without dropping its physical data or scheduling a purge.", {}, [], nativeCli),
+    operation("tables.resource.duplicate", `${table}/duplicate`, "POST", "tables duplicate", "oxygen_tables_duplicate", "tables", "Duplicate a Table with its columns and optionally its row values.", { name: text(), include_rows: bool() }, [], nativeCli),
+    operation("tables.resource.activity", `${table}/activity`, "GET", "tables changes", "oxygen_table_resource_activity", "tables", "Read a Table's bounded activity history.", { limit: int({ minimum: 1 }) }),
+    operation("tables.resource.column_stats", `${table}/column-stats`, "GET", "tables column-stats", "oxygen_table_column_stats", "tables", "Read per-column completion and provider statistics; large Tables use labeled samples."),
+    operation("tables.resource.fill_progress", `${table}/fill-progress`, "GET", "tables fill-progress", "oxygen_table_fill_progress", "tables", "Read hosted Table fill progress and any actionable ingestion failure."),
+    operation("tables.resource.kind_estimates", "/api/cli/tables/column-kind-estimates", "GET", "columns kind-estimates", "oxygen_column_kind_estimates", "tables", "Read managed credit estimates for available Table column kinds."),
+    operation("tables.resource.columns.create", `${table}/columns`, "POST", "columns create", "oxygen_table_column_create", "tables", "Create a Table column at an optional zero-based position.", { column: obj({ label: text(), key: text(), kind: text(), data_type: dataType(), semantic_type: text(), definition: json }, { required: ["label"] }), position: int({ minimum: 0 }) }, ["column"]),
+    operation("tables.resource.columns.edit", column, "PATCH", "columns edit", "oxygen_table_column_edit", "tables", "Save a column's label, type, order or definition. Returns downstream reference warnings rather than silently discarding them.", { label: text(), semantic_type: nullable(text()), definition: json, definition_unset: strings(), data_type: dataType(), position: int({ minimum: 0 }) }),
+    operation("tables.resource.columns.archive", `${column}/archive`, "POST", "columns archive", "oxygen_columns_archive", "tables", "Archive a Table column indefinitely while preserving its stored values.", {}, [], nativeCli),
+    operation("tables.resource.columns.duplicate", `${column}/duplicate`, "POST", "columns duplicate", "oxygen_table_column_duplicate", "tables", "Duplicate a Table column and its definition with an optional new label.", { label: text() }),
+    operation("tables.resource.columns.materialize", `${column}/materialize`, "POST", "columns materialize", "oxygen_columns_materialize", "tables", "Materialize JSON paths into existing or newly created companion columns.", { preset: enumOf(["work_email"]), mappings: arr(obj({ source_path: text(), target_column: text(), label: text(), data_type: dataType(), semantic_type: text() }, { required: ["source_path", "target_column"] })), create_if_missing: bool(), overwrite_existing: bool() }, [], nativeCli),
+    operation("tables.resource.columns.retype", `${column}/retype`, "POST", "columns retype", "oxygen_columns_retype", "tables", "Preview or apply a manual column's stored-value type conversion.", { data_type: dataType(), dry_run: bool() }, ["data_type"], nativeCli),
+    operation("tables.resource.columns.run", `${column}/run`, "POST", "columns execute", "oxygen_table_column_execute", "runs", "Run one column over an exact row or bounded selection. Paid execution requires approval and a max_credits ceiling; uncertain prior effects need explicit resolution approval.", { row_id: text(), force: bool(), limit: int({ minimum: 1 }), full_table_mode: enumOf(["missing", "force"]), max_credits: num({ minimum: 0 }), max_concurrency: int({ minimum: 1 }), connection_id: text(), approved: bool(), approved_effect_unknown: bool() }, [], { spends: true }),
+    operation("tables.resource.columns.web_search_mode", `${table}/columns/{column_ref}/web-search-mode`, "POST", "columns web-search-mode", "oxygen_table_column_web_search_mode", "tables", "Convert a web-search column between agent, AI or keyword modes. Conversion requires confirm=true; mode plus column seeds an AI or keyword replacement.", { to: enumOf(["agent", "ai", "keyword"]), confirm: bool(), mode: enumOf(["ai", "keyword"]), column: json, prompt: text() }),
+    operation("tables.resource.action_columns", `${table}/action-columns`, "POST", "columns provider-action", "oxygen_table_provider_action_column", "tables", "Preview or create a provider action column; creating it does not execute provider actions.", { provider: text(), label: text(), key: text(), operations: strings(), dry_run: bool() }, ["provider"]),
+    operation("tables.resource.rows.page", `${table}/rows`, "GET", "tables rows page", "oxygen_table_rows_page", "tables", "Read a Table row page with the same filter, sort, counts and CRM relationship projection as the grid.", { limit: int({ minimum: 1 }), cursor: text(), offset: int({ minimum: 0 }), f: text("Serialized filter tree."), s: text("Serialized sort state."), q: text(), count: enumOf(["exact", "estimate", "registry", "skip"]), crm_object: text() }),
+    operation("tables.resource.rows.insert", `${table}/rows`, "POST", "tables rows insert", "oxygen_table_rows_insert", "tables", "Insert Table row values and return the committed rows plus any existing automatic run or dedupe grant.", { rows: objects(), values: json }),
+    operation("tables.resource.rows.get", `${table}/rows/{row}`, "GET", "tables rows inspect", "oxygen_table_row_inspect", "tables", "Read one Table row; hydrate_relations=1 includes CRM relationship display values. The optional field list narrows cell hydration to exact column keys.", { hydrate_relations: enumOf(["1"]), field: strings() }, [], { repeatedQueryFields: ["field"] }),
+    operation("tables.resource.rows.edit", `${table}/rows/{row}`, "PATCH", "tables rows edit", "oxygen_table_row_edit", "tables", "Patch one row's values and return the committed row.", { values: json }, ["values"]),
+    operation("tables.resource.rows.delete", `${table}/rows/{row}`, "DELETE", "tables rows remove", "oxygen_table_row_remove", "tables", "Remove one row from a workspace Table."),
+    operation("tables.resource.rows.bulk_delete", `${table}/rows/delete`, "POST", "tables rows remove-selection", "oxygen_table_rows_remove_selection", "tables", "Remove exact row ids or the same all-matching filtered selection used by the browser.", { row_ids: strings(), selection }),
+    operation("tables.resource.rows.ids", `${table}/rows/ids`, "GET", "tables rows range-ids", "oxygen_table_rows_range_ids", "tables", "Resolve a bounded row range into exact ids, preserving the current filter, search, sort and CRM scope.", { offset: int({ minimum: 0 }), limit: int({ minimum: 1 }), filter: text(), search: text(), sort: text(), crm_object: text() }, ["offset", "limit"]),
+    operation("tables.resource.relationships.get", `${table}/records/{row}/relationships`, "GET", "tables rows relationships", "oxygen_table_row_relationships", "crm", "Read a CRM-backed Table row's relationship links and available targets."),
+    operation("tables.resource.relationships.set", `${table}/records/{row}/relationships`, "POST", "tables rows relationship-set", "oxygen_table_row_relationship_set", "crm", "Set one CRM-backed Table row's relationship and return the saved links.", { relationship: text(), target_row_id: text() }, ["relationship", "target_row_id"]),
+    operation("tables.resource.views.list", `${table}/views`, "GET", "tables views list", "oxygen_tables_views_list", "tables", "List saved Table views and their complete display configuration.", {}, [], nativeCli),
+    operation("tables.resource.views.create", `${table}/views`, "POST", "tables views create", "oxygen_tables_views_create", "tables", "Create a saved Table view; group_by configures the same kanban grouping as the browser.", viewFields, ["name"], nativeCli),
+    operation("tables.resource.views.edit", `${table}/views/{view}`, "PATCH", "tables views update", "oxygen_tables_views_update", "tables", "Edit a saved view's name, type, configuration, grouping, order or default status.", viewFields, [], nativeCli),
+    operation("tables.resource.views.delete", `${table}/views/{view}`, "DELETE", "tables views delete", "oxygen_tables_views_delete", "tables", "Delete one saved Table view.", {}, [], nativeCli),
+    operation("tables.resource.runs.list", `${table}/runs`, "GET", "tables runs history", "oxygen_table_runs_history", "runs", "Read this Table's durable run history and progress.", { status: enumOf(["all", "active", "queued", "running", "paused", "completed", "completed_with_errors", "failed", "canceling", "canceled"]), limit: int({ minimum: 1 }) }),
+    operation("tables.resource.runs.start", `${table}/runs`, "POST", "tables runs start", "oxygen_table_resource_run_start", "runs", "Start selected Table actions using the browser's exact row-selection contract. Paid runs require an approved max_credits ceiling.", { actions, selection, max_credits: num({ minimum: 0 }), max_concurrency: int({ minimum: 1 }), force: bool(), approved: bool() }, ["actions"], { spends: true }),
+    operation("tables.resource.runs.estimate", `${table}/runs/estimate`, "POST", "tables runs preview", "oxygen_table_resource_run_preview", "runs", "Preview selected Table action costs and provider availability, including draft column definitions; starts no run.", { actions, selection }, ["actions"], { mutates: false }),
+    operation("tables.resource.runs.cancel", `${run}/cancel`, "POST", "tables runs stop", "oxygen_table_resource_run_stop", "runs", "Cancel one durable Table run; never repeats external provider effects."),
+    operation("tables.resource.runs.pause", `${run}/pause`, "POST", "tables runs pause", "oxygen_table_resource_run_pause", "runs", "Pause one durable Table run without discarding its approved scope."),
+    operation("tables.resource.runs.resume", `${run}/resume`, "POST", "tables runs resume", "oxygen_table_resource_run_resume", "runs", "Resume a paused Table run within its existing approved scope and credit ceiling."),
+    operation("tables.resource.runs.retry", `${run}/retry-failed`, "POST", "tables runs retry", "oxygen_table_resource_run_retry", "runs", "Retry failed cells within a Table run's approved scope. Uncertain external effects require approved_effect_unknown=true.", { approved_effect_unknown: bool() }, [], { spends: true }),
+    operation("tables.resource.runs.provider_summary", `${run}/provider-summary`, "GET", "tables runs provider-summary", "oxygen_table_resource_run_provider_summary", "runs", "Read a Table run's provider outcomes, fulfilled rows, costs and timing."),
+    operation("tables.resource.ingestions.cancel", `${table}/ingestions/{ingestion_run}/cancel`, "POST", "tables ingestion stop", "oxygen_table_resource_ingestion_stop", "runs", "Cancel this Table's active hosted ingestion run."),
+    operation("tables.resource.ingestions.retry", `${table}/ingestions/{ingestion_run}/retry-failed`, "POST", "tables ingestion retry", "oxygen_table_resource_ingestion_retry", "runs", "Retry failed items in this Table's hosted ingestion run."),
+    operation("tables.resource.import", "/api/cli/tables/import", "POST", "tables upload", "oxygen_table_resource_upload", "tables", "Preview or import small uploaded CSV, JSON or XLSX bytes through the exact browser import contract. Preview writes no rows.", upload, ["content_base64", "file_name"], { multipart }),
+    operation("billing.activate", "/api/cli/billing/activate", "POST", "billing activate", "oxygen_billing_activate", "billing", "Activate a trial subscription now and charge its saved payment method; administrator approval is required. An optional tier reprices the active trial in the same call.", { approved: bool(), tier: text() }, ["approved"], { spends: true }),
+    operation("billing.checkout", "/api/cli/billing/checkout", "POST", "billing checkout", "oxygen_billing_checkout", "billing", "Open the same hosted plan checkout as the browser; the returned URL carries the payment approval step.", { plan: text(), interval: enumOf(["month", "year"]), currency: text(), trial: bool(), return_to: text(), source: text(), blocked: text() }, ["plan"]),
+    operation("billing.portal", "/api/cli/billing/portal", "POST", "billing portal", "oxygen_billing_portal", "billing", "Create the workspace's authenticated Stripe billing-portal URL; requires workspace administrator authorization.", { returnUrl: text() }),
+    operation("billing.ownership.get", "/api/cli/billing/ownership", "GET", "billing ownership get", "oxygen_billing_ownership_get", "billing", "Read the active workspace's shared billing owner, candidate owners and credit cap."),
+    operation("billing.ownership.set", "/api/cli/billing/ownership", "POST", "billing ownership set", "oxygen_billing_ownership_set", "billing", "Set the billing owner and optional monthly credit cap using the browser's administrator and workspace eligibility checks.", { billing_owner_organization_id: text(), monthly_credit_cap: nullable(num({ minimum: 0 })) }, ["billing_owner_organization_id"]),
+    operation("billing.ownership.clear", "/api/cli/billing/ownership", "DELETE", "billing ownership clear", "oxygen_billing_ownership_clear", "billing", "Restore this workspace's own billing ownership after the same administrator checks as the browser."),
+    operation("integrations.default", "/api/cli/integrations/default", "POST", "integrations default", "oxygen_integration_default_set", "integrations", "Set the default active integration connection within this workspace.", { integration_id: text(), connection_id: text() }, ["integration_id", "connection_id"]),
+    operation("integrations.cloudflare", "/api/cli/integrations/cloudflare/connect", "POST", "integrations cloudflare-connect", "oxygen_cloudflare_connect", "integrations", "Verify a Cloudflare token, choose an account when required, and save the encrypted connection. account_id is optional for initial account discovery; no credential is returned.", { api_key: text(), account_id: text() }, ["api_key"]),
+    operation("integrations.github.start", "/api/cli/integrations/github/start", "POST", "integrations github-start", "oxygen_github_connection_start", "integrations", "Create the authenticated GitHub authorization URL for this workspace.", { return_to: text() }),
+    operation("integrations.hubspot.start", "/api/cli/integrations/hubspot/start", "POST", "integrations hubspot-start", "oxygen_hubspot_connection_start", "integrations", "Create the authenticated HubSpot authorization URL for this workspace.", { return_to: text() }),
+    operation("integrations.connection.test", "/api/cli/integrations/{integration}/test", "POST", "integrations connection-test", "oxygen_integration_connection_test", "integrations", "Test one workspace integration connection and save its health without changing its default or returning credentials.", { connection_id: text() }),
+    operation("workflows.resource.status", "/api/cli/workflows/{workflow}/status", "POST", "workflows status-set", "oxygen_workflow_resource_status_set", "workflows", "Enable or disable a Workflow and record an optional reason. Enabling paid recurring execution requires standing approval and max_credits; CRM-sync workflows use their paired lifecycle instead.", { status: enumOf(["active", "disabled"]), approved: bool(), max_credits: num({ minimum: 0 }), reason: str({ maxLength: 500 }) }, ["status"], { spends: true }),
+    operation("notetaker.desktop_upload", "/api/cli/notetaker/desktop-upload", "POST", "notetaker desktop-upload", "oxygen_notetaker_desktop_upload_prepare", "crm", "Prepare an approved desktop meeting recording and its scoped upload URL. Upload and completion remain separate steps.", { approved: bool(), title: text(), max_minutes: int({ minimum: 1 }), crm_links: crmLinks }, ["approved"]),
+    operation("notetaker.calendar.connect", "/api/cli/notetaker/calendar", "POST", "notetaker calendar connect", "oxygen_notetaker_calendar_connect", "crm", "Create the OAuth authorization URL for a Google Calendar or Outlook notetaker connection.", { integration_id: enumOf(["google_calendar", "outlook"]) }, ["integration_id"], { defaults: { action: "connect" } }),
+    operation("notetaker.calendar.sync", "/api/cli/notetaker/calendar", "POST", "notetaker calendar sync", "oxygen_notetaker_calendar_sync", "crm", "Synchronize upcoming Google Calendar or Outlook meeting events into this workspace's notetaker calendar.", { integration_id: enumOf(["google_calendar", "outlook"]), connection_id: text(), days_ahead: int({ minimum: 1 }) }, ["integration_id"], { defaults: { action: "sync" } }),
+    operation("notetaker.calendar.schedule", "/api/cli/notetaker/calendar", "POST", "notetaker calendar schedule", "oxygen_notetaker_calendar_schedule", "crm", "Schedule recording for an existing calendar event after approval; an external CLI or MCP caller must supply an explicit max_credits ceiling.", { event_id: text(), approved: bool(), max_credits: num({ minimum: 0 }) }, ["event_id", "approved"], { defaults: { action: "schedule" }, spends: true }),
+    operation("notetaker.note.edit", "/api/cli/notetaker/sessions/{session}/note", "PATCH", "notetaker notes edit", "oxygen_notetaker_note_edit", "crm", "Save the markdown note for one meeting session and return the committed note.", { markdown: text() }, ["markdown"]),
+    operation("orgs.create", "/api/cli/orgs/create", "POST", "orgs create", "oxygen_workspace_create", "workspace", "Create a workspace for the authenticated person's account and begin native company setup. Workspace API keys cannot create personal workspaces.", { name: text(), company_domain: text("Company website or domain, or its LinkedIn company page URL when it has no website."), linkedin_profile_url: text("Creator's LinkedIn profile URL, separate from the company's page.") }, ["name", "company_domain"]),
+    operation("onboarding.complete", "/api/cli/onboarding/complete", "POST", "onboarding complete", "oxygen_onboarding_complete", "workspace", "Complete the active workspace's onboarding step and record its discovery-source choices. The other choice requires source_other.", { sources: arr(enumOf(["linkedin_content", "linkedin_dm", "linkedin_ads", "youtube", "google", "email", "word_of_mouth", "referral", "event", "other"])), source_other: text(), redirect_url: text() }, ["sources"]),
+];

package/node_modules/@oxygen/shared/dist/contracts/connectors.d.ts

@@ -2,12 +2,14 @@
  * `PATCH /api/cli/connectors/{connection}`: the settings one connected app
  * (an MCP OAuth client such as ChatGPT, Claude or Codex) keeps for itself.
  *
- * Today that is its default workspace: the workspace the app works in without
- * asking. It is the same per-connection choice `oxygen_orgs_select` makes from
- * inside the app, so either surface changes one setting and the latest choice
- * wins. The contract is the extension point for later per-connection settings
- * (a per-connection credit ceiling is planned, OXP-11.5.23): add the field here
- * and the route, the CLI flags and the MCP tool follow.
+ * Its default workspace: the workspace the app works in without asking. It is
+ * the same per-connection choice `oxygen_orgs_select` makes from inside the
+ * app, so either surface changes one setting and the latest choice wins.
+ *
+ * Its credit ceiling (ADR 0030 §11, OXP-11.5.23): the most credits the app may
+ * spend in any rolling 24 hours while it holds MCP event subscriptions. null
+ * restores the plan default; a value above that default needs
+ * approve_above_default, the posture Agent run and trigger ceilings use.
  */
 import type { OperationSpec } from "./operations.js";
 import { type Infer } from "./schema.js";
@@ -16,8 +18,32 @@ export declare const CONNECTOR_UPDATE_CONTRACT: import("./schema.js").ContractOb
         oneOf: [import("./schema.js").StringProperty, import("./schema.js").NullProperty];
         description?: string;
     };
+    readonly credit_ceiling: {
+        oneOf: [{
+            type: "integer";
+            description?: string;
+            minimum?: number;
+            maximum?: number;
+            "x-clamp"?: true;
+        }, import("./schema.js").NullProperty];
+        description?: string;
+    };
+    readonly approve_above_default: import("./schema.js").BooleanProperty;
 }, never>;
 export type ConnectorUpdate = Infer<typeof CONNECTOR_UPDATE_CONTRACT>;
 /** The route's path value for "the app making this request". */
 export declare const CURRENT_CONNECTOR_REF = "current";
 export declare const CONNECTOR_UPDATE_OPERATION: OperationSpec<typeof CONNECTOR_UPDATE_CONTRACT>;
+/**
+ * `POST /api/cli/connectors/{connection}/events/revoke`: stop one connected
+ * app's MCP event subscription, or every live one it holds (ADR 0030 §10;
+ * OXP-11.5.22). Destructive and lasting: the app cannot renew a subscription
+ * revoked here. The events/* protocol methods the app itself calls stay outside
+ * this contract; they are host-driven.
+ */
+export declare const CONNECTOR_EVENTS_REVOKE_CONTRACT: import("./schema.js").ContractObject<{
+    readonly subscription: import("./schema.js").StringProperty;
+    readonly workspace: import("./schema.js").StringProperty;
+}, "subscription">;
+export type ConnectorEventsRevoke = Infer<typeof CONNECTOR_EVENTS_REVOKE_CONTRACT>;
+export declare const CONNECTOR_EVENTS_REVOKE_OPERATION: OperationSpec<typeof CONNECTOR_EVENTS_REVOKE_CONTRACT>;

package/node_modules/@oxygen/shared/dist/contracts/connectors.js

@@ -1,10 +1,19 @@
-import { nullable, obj, str } from "./schema.js";
+import { AGENT_RUN_APPROVED_CEILING_MAX_CREDITS } from "../plan-limits.js";
+import { bool, int, nullable, obj, str } from "./schema.js";
 export const CONNECTOR_UPDATE_CONTRACT = obj({
     default_workspace: nullable(str({
         minLength: 1,
         maxLength: 200,
         description: "Workspace id, slug or exact name (you must be a member). null = ask each time.",
     })),
+    credit_ceiling: nullable(int({
+        minimum: 0,
+        maximum: AGENT_RUN_APPROVED_CEILING_MAX_CREDITS,
+        description: "Most credits the app may spend in any 24 hours while it holds event subscriptions. null = the plan default.",
+    })),
+    approve_above_default: bool({
+        description: "Approve a credit_ceiling above the plan default.",
+    }),
 });
 const inferMatchesRoute = true;
 void inferMatchesRoute;
@@ -17,7 +26,7 @@ export const CONNECTOR_UPDATE_OPERATION = {
     contract: CONNECTOR_UPDATE_CONTRACT,
     cli: {
         path: ["connectors", "set"],
-        summary: "Set the default workspace of one connected app (ChatGPT, Claude, Codex or another app connected to OXYGEN with OAuth), so that app works there without asking. Only that app changes; your other apps and this CLI keep their own workspace. It is the same setting the app changes when you pick a workspace inside it, so the latest choice wins. --clear-default-workspace makes the app ask again. Free; `connectors list` shows your apps and each one's current default.",
+        summary: "Change one connected app's settings (ChatGPT, Claude, Codex or another app connected to OXYGEN with OAuth); only that app changes. --default-workspace: where it works without asking (the same setting the app changes when you pick a workspace inside it; latest wins; --clear-default-workspace makes it ask again). --credit-ceiling: the most credits it may spend in any 24 hours while it holds event subscriptions (--clear-credit-ceiling restores the plan default; above the default also needs --approve-above-default). Free; `connectors list` shows each app's current settings.",
         argument: {
             name: "connection",
             description: "The app's id from `connectors list`, or its name (e.g. ChatGPT) when you have one app of that name.",
@@ -25,8 +34,51 @@ export const CONNECTOR_UPDATE_OPERATION = {
     },
     mcp: {
         name: "oxygen_connector_update",
-        title: "Oxygen: Set Connected App Workspace",
-        description: "Sets the default workspace of one connected app (ChatGPT, Claude, Codex…), leaving your other apps unchanged. Same setting as picking a workspace inside that app; latest wins. connection: id or name from oxygen_connector_list, or \"current\" for this app. Free.",
+        title: "Oxygen: Change Connected App Settings",
+        description: "Changes one connected app's settings (ChatGPT, Claude, Codex…), leaving your other apps unchanged: default_workspace (same setting as picking a workspace inside that app; latest wins) and credit_ceiling (most credits it may spend in 24 hours while it holds event subscriptions; above the plan default also needs approve_above_default). connection: id or name from oxygen_connector_list, or \"current\" for this app. Free.",
+        pack: "workspace",
+    },
+    mutates: true,
+    spends: false,
+};
+/**
+ * `POST /api/cli/connectors/{connection}/events/revoke`: stop one connected
+ * app's MCP event subscription, or every live one it holds (ADR 0030 §10;
+ * OXP-11.5.22). Destructive and lasting: the app cannot renew a subscription
+ * revoked here. The events/* protocol methods the app itself calls stay outside
+ * this contract; they are host-driven.
+ */
+export const CONNECTOR_EVENTS_REVOKE_CONTRACT = obj({
+    subscription: str({
+        minLength: 1,
+        maxLength: 200,
+        description: "The subscription id from the app's event subscriptions, or \"all\" for every live one.",
+    }),
+    workspace: str({
+        minLength: 1,
+        maxLength: 200,
+        description: "Only in this workspace (id, slug or exact name). Omit for all your workspaces.",
+    }),
+}, { required: ["subscription"] });
+const revokeInferMatchesRoute = true;
+void revokeInferMatchesRoute;
+export const CONNECTOR_EVENTS_REVOKE_OPERATION = {
+    id: "connectors.events.revoke",
+    route: "/api/cli/connectors/{connection}/events/revoke",
+    method: "POST",
+    contract: CONNECTOR_EVENTS_REVOKE_CONTRACT,
+    cli: {
+        path: ["connectors", "events", "revoke"],
+        summary: "Stop OXYGEN sending events to one connected app: revoke one of its event subscriptions (--subscription <id>) or every live one (--subscription all), optionally only in one --workspace. Lasting: the app cannot renew a subscription revoked here, and nothing else about the app changes. Free; `connectors events get <app>` shows what it is subscribed to first.",
+        argument: {
+            name: "connection",
+            description: "The app's id from `connectors list`, or its name (e.g. ChatGPT) when you have one app of that name.",
+        },
+    },
+    mcp: {
+        name: "oxygen_connector_events_revoke",
+        title: "Oxygen: Revoke Connected App Event Subscriptions",
+        description: "Destructive: stops OXYGEN sending events to one connected app (ChatGPT…) by revoking one event subscription, or \"all\" of its live ones, optionally in one workspace. The app cannot renew a revoked subscription; nothing else about it changes. Read first with oxygen_connector_events_get. Free.",
         pack: "workspace",
     },
     mutates: true,

package/node_modules/@oxygen/shared/dist/contracts/crm-attributes.d.ts

@@ -0,0 +1,4 @@
+import type { ObjectProperty } from "./schema.js";
+/** Custom CRM column writes accept both canonical snake_case and legacy aliases. */
+export declare const CRM_CUSTOM_COLUMN_SCHEMA: ObjectProperty;
+export declare const CRM_CUSTOM_IDENTITY_SCHEMA: ObjectProperty;

package/node_modules/@oxygen/shared/dist/contracts/crm-attributes.js

@@ -0,0 +1,39 @@
+/** Custom CRM column writes accept both canonical snake_case and legacy aliases. */
+export const CRM_CUSTOM_COLUMN_SCHEMA = {
+    type: "object",
+    properties: {
+        key: { type: "string" }, label: { type: "string" },
+        data_type: { type: "string", enum: ["text", "numeric", "boolean", "jsonb", "timestamptz"] },
+        dataType: { type: "string", enum: ["text", "numeric", "boolean", "jsonb", "timestamptz"] },
+        semantic_type: { type: "string" }, semanticType: { type: "string" },
+        kind: { type: "string" }, attribute_kind: { type: "string" }, attributeKind: { type: "string" },
+        option_model_type: { type: "string" }, optionModelType: { type: "string" },
+        is_required: { type: "boolean" }, isRequired: { type: "boolean" },
+        is_unique: { type: "boolean" }, isUnique: { type: "boolean" },
+        is_multivalue: { type: "boolean" }, isMultivalue: { type: "boolean" },
+        is_record_label: { type: "boolean" }, isRecordLabel: { type: "boolean" },
+        is_record_image: { type: "boolean" }, isRecordImage: { type: "boolean" },
+        kanban_candidate: { type: "boolean" }, kanbanCandidate: { type: "boolean" },
+        display_order: { type: "number" }, displayOrder: { type: "number" },
+        options: { type: "array", items: { type: "object", additionalProperties: true } },
+        definition: { type: "object", additionalProperties: true },
+        attribute_metadata: { type: "object", additionalProperties: true },
+        attributeMetadata: { type: "object", additionalProperties: true },
+    },
+    required: ["key", "label"],
+    additionalProperties: false,
+};
+export const CRM_CUSTOM_IDENTITY_SCHEMA = {
+    type: "object",
+    properties: {
+        column_key: { type: "string" }, columnKey: { type: "string" },
+        normalization: { type: "string", enum: ["email_v1", "domain_v1", "linkedin_url_v1", "exact_text_v1", "uuid_v1"] },
+        slug: { type: "string" }, display_name: { type: "string" }, displayName: { type: "string" },
+        identity_type: { type: "string" }, identityType: { type: "string" },
+        is_primary: { type: "boolean" }, isPrimary: { type: "boolean" },
+        is_required_for_assert: { type: "boolean" }, isRequiredForAssert: { type: "boolean" },
+        priority: { type: "number" },
+    },
+    required: ["normalization"],
+    additionalProperties: false,
+};

package/node_modules/@oxygen/shared/dist/contracts/crm-enrichment-read.d.ts

@@ -0,0 +1,21 @@
+/** Read selectors only; action=backfill is a separate governed operation. */
+export declare const CRM_ENRICHMENT_READ_CONTRACT: import("./schema.js").ContractObject<{
+    readonly object: import("./schema.js").StringProperty;
+    readonly backfill: import("./schema.js").BooleanProperty;
+    readonly projection: {
+        type: "string";
+        enum: readonly ("full" | "summary" | "value")[];
+        description?: string;
+    };
+    readonly path: import("./schema.js").StringProperty;
+    readonly cursor: import("./schema.js").StringProperty;
+    readonly max_chars: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+}, never>;
+/** Preserve the shipped HTTP literals, including whitespace/case and 0. */
+export declare function includeCrmEnrichmentBackfillCounts(value: string | null): boolean;

package/node_modules/@oxygen/shared/dist/contracts/crm-enrichment-read.js

@@ -0,0 +1,15 @@
+import { bool, enumOf, int, obj, str } from "./schema.js";
+/** Read selectors only; action=backfill is a separate governed operation. */
+export const CRM_ENRICHMENT_READ_CONTRACT = obj({
+    object: str({ minLength: 1, maxLength: 120, description: "CRM object slug (companies, people, deals)." }),
+    backfill: bool({ description: "list without object: include stored historical backlog counts (default true). false skips the scans; object reads ignore it. Never runs enrichment." }),
+    projection: enumOf(["summary", "full", "value"], { description: "summary: standing configuration without long arrays. full: legacy data. value: lossless JSON of path, continued with next_cursor. Omit for legacy output." }),
+    path: str({ maxLength: 1024, description: "value: JSON Pointer into the selected native result; empty selects everything. Examples /objects/0/auto_run or /presets." }),
+    cursor: str({ minLength: 1, maxLength: 2000, description: "value: previous next_cursor with unchanged object, backfill, path and projection. Refuses changed source." }),
+    max_chars: int({ minimum: 1000, maximum: 40000, description: "Opt-in complete receipt window. MCP caps external at 10000 and built-in at 4000. Use value to recover oversized fields." }),
+});
+/** Preserve the shipped HTTP literals, including whitespace/case and 0. */
+export function includeCrmEnrichmentBackfillCounts(value) {
+    const normalized = value?.trim().toLowerCase();
+    return normalized !== "0" && normalized !== "false";
+}

package/node_modules/@oxygen/shared/dist/contracts/crm-support.d.ts

@@ -0,0 +1,117 @@
+export declare const CRM_NOTE_BODY_MAX_CHARS = 20000;
+export declare const CRM_NOTE_TITLE_MAX_CHARS = 300;
+export declare const CRM_FILE_LABEL_MAX_CHARS = 300;
+export declare const CRM_NOTE_EDIT_CONTRACT: import("./schema.js").ContractObject<{
+    readonly body: import("./schema.js").StringProperty;
+    readonly title: {
+        oneOf: [import("./schema.js").StringProperty, import("./schema.js").NullProperty];
+        description?: string;
+    };
+    readonly pinned: import("./schema.js").BooleanProperty;
+}, never>;
+export declare const CRM_FILE_ATTACH_CONTRACT: import("./schema.js").ContractObject<{
+    readonly name: import("./schema.js").StringProperty;
+    readonly content_base64: import("./schema.js").StringProperty;
+    readonly label: {
+        oneOf: [import("./schema.js").StringProperty, import("./schema.js").NullProperty];
+        description?: string;
+    };
+}, "content_base64" | "name">;
+export declare const CRM_FILE_PREPARE_CONTRACT: import("./schema.js").ContractObject<{
+    readonly name: import("./schema.js").StringProperty;
+    readonly byte_length: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly sha256: import("./schema.js").StringProperty;
+}, "byte_length" | "name" | "sha256">;
+export declare const CRM_FILE_COMPLETE_CONTRACT: import("./schema.js").ContractObject<{
+    readonly label: {
+        oneOf: [import("./schema.js").StringProperty, import("./schema.js").NullProperty];
+        description?: string;
+    };
+}, never>;
+export declare const CRM_PHOTOS_CONTRACT: import("./schema.js").ContractObject<{
+    readonly mode: {
+        type: "string";
+        enum: readonly ("dry_run" | "live")[];
+        description?: string;
+    };
+    readonly live: import("./schema.js").BooleanProperty;
+    readonly limit: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+}, never>;
+export declare const CRM_OBJECTS_QUERY_CONTRACT: import("./schema.js").ContractObject<{
+    readonly projection: {
+        type: "string";
+        enum: readonly ("compact" | "full")[];
+        description?: string;
+    };
+    readonly cursor: import("./schema.js").StringProperty;
+    readonly limit: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly max_chars: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+}, never>;
+export declare const CRM_CONNECTIONS_QUERY_CONTRACT: import("./schema.js").ContractObject<{
+    readonly projection: {
+        type: "string";
+        enum: readonly ("compact" | "full")[];
+        description?: string;
+    };
+    readonly max_chars: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly conversation_limit: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly sequence_limit: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+}, never>;
+export declare const CRM_TASKS_QUERY_CONTRACT: import("./schema.js").ContractObject<{
+    readonly status: {
+        type: "string";
+        enum: readonly ("all" | "cancelled" | "completed" | "open")[];
+        description?: string;
+    };
+    readonly assignee: import("./schema.js").StringProperty;
+    readonly limit: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly cursor: import("./schema.js").StringProperty;
+}, never>;

package/node_modules/@oxygen/shared/dist/contracts/crm-support.js

@@ -0,0 +1,43 @@
+import { bool, enumOf, int, nullable, obj, str } from "./schema.js";
+export const CRM_NOTE_BODY_MAX_CHARS = 20_000;
+export const CRM_NOTE_TITLE_MAX_CHARS = 300;
+export const CRM_FILE_LABEL_MAX_CHARS = 300;
+export const CRM_NOTE_EDIT_CONTRACT = obj({
+    body: str({ minLength: 1, maxLength: CRM_NOTE_BODY_MAX_CHARS, description: "Replacement Markdown text." }),
+    title: nullable(str({ maxLength: CRM_NOTE_TITLE_MAX_CHARS, description: "Replacement title; null or empty clears." })),
+    pinned: bool({ description: "Whether the note is pinned; false unpins." }),
+});
+export const CRM_FILE_ATTACH_CONTRACT = obj({
+    name: str({ minLength: 1, description: "Original filename." }),
+    content_base64: str({ minLength: 1, description: "Inline bytes; entire JSON request must fit 2 MB. Larger files use upload prepare/complete." }),
+    label: nullable(str({ maxLength: CRM_FILE_LABEL_MAX_CHARS, description: "Optional record-local label." })),
+}, { required: ["name", "content_base64"] });
+export const CRM_FILE_PREPARE_CONTRACT = obj({
+    name: str({ minLength: 1, description: "Original filename." }),
+    byte_length: int({ minimum: 0, maximum: 100 * 1024 * 1024, description: "Exact byte length; maximum 100 MiB." }),
+    sha256: str({ minLength: 64, maxLength: 64, description: "Hex SHA-256 of the exact bytes to PUT." }),
+}, { required: ["name", "byte_length", "sha256"] });
+export const CRM_FILE_COMPLETE_CONTRACT = obj({ label: nullable(str({ maxLength: CRM_FILE_LABEL_MAX_CHARS, description: "Optional record-local label." })) });
+export const CRM_PHOTOS_CONTRACT = obj({
+    mode: enumOf(["dry_run", "live"], { description: "Default dry_run. Inspect preview before live." }),
+    live: bool({ description: "Shortcut for mode=live; conflicts with mode=dry_run." }),
+    limit: int({ minimum: 1, maximum: 10_000, description: "Rows scanned; default 2000." }),
+});
+export const CRM_OBJECTS_QUERY_CONTRACT = obj({
+    projection: enumOf(["compact", "full"], { description: "compact lists names and table/identity bindings; full includes all field configuration. HTTP default full." }),
+    cursor: str({ maxLength: 2000, description: "Previous next_cursor; bound to projection." }),
+    limit: int({ minimum: 1, maximum: 100, description: "Objects in one batch; default 20 for bounded reads." }),
+    max_chars: int({ minimum: 2000, maximum: 40_000, description: "Complete response window; oversized objects refuse without advancing." }),
+});
+export const CRM_CONNECTIONS_QUERY_CONTRACT = obj({
+    projection: enumOf(["compact", "full"], { description: "Compact returns identifiers and short communication previews. HTTP default full." }),
+    max_chars: int({ minimum: 2000, maximum: 40_000, description: "Complete recent-window response; hasMore includes omitted links." }),
+    conversation_limit: int({ minimum: 1, maximum: 100, description: "Most recent conversation links; server maximum 100." }),
+    sequence_limit: int({ minimum: 1, maximum: 100, description: "Most recent sequence links; server maximum 100." }),
+});
+export const CRM_TASKS_QUERY_CONTRACT = obj({
+    status: enumOf(["open", "completed", "cancelled", "all"], { description: "Workspace default open; record default all. all omits the API filter." }),
+    assignee: str({ description: "Workspace scope only: member email, user id, or me." }),
+    limit: int({ minimum: 1, maximum: 200, description: "Maximum tasks; default 50." }),
+    cursor: str({ minLength: 1, maxLength: 500, description: "Previous nextCursor." }),
+});

package/node_modules/@oxygen/shared/dist/contracts/customer-operations.d.ts

@@ -0,0 +1,2 @@
+import type { OperationSpec } from "./operations.js";
+export declare const CUSTOMER_OPERATIONS: readonly OperationSpec[];