@oxygen-agent/cli 1.1011.493 → 1.1011.600

package/node_modules/@oxygen/shared/dist/first-month-offer-window.js

@@ -0,0 +1,41 @@
+/**
+ * The first-month offer's 24-hour window and the browser's record of it, with no
+ * plan catalog. The offer banner and the app shell run in the browser and import
+ * this; importing `first-month-offer.ts` there pulled the whole billing catalog
+ * into every dashboard route (+16 KB gzip) and every website page (+8 KB),
+ * which the release battery's bundle budget refused on 2026-10-03. Prices stay
+ * in `first-month-offer.ts`: a server computes the banner's headline with
+ * `firstMonthOfferHeadline()` and hands it down.
+ */
+/** How long a person has to claim the offer after first seeing it. */
+export const FIRST_MONTH_OFFER_WINDOW_MS = 24 * 60 * 60 * 1000;
+/**
+ * First-party cookie holding when this browser first saw the offer, in epoch
+ * milliseconds. Readable by the page so the countdown needs no request; signup
+ * copies it onto the workspace, after which the workspace's own record decides.
+ * Clearing it starts a new window, which the founder accepted (2026-10-02).
+ */
+export const FIRST_MONTH_OFFER_SEEN_COOKIE = "ox_first_month_offer_seen";
+/** How long the browser keeps the start, so an expired window stays expired. */
+export const FIRST_MONTH_OFFER_SEEN_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+/** When a window that started at `startedAtMs` closes. */
+export function firstMonthOfferEndsAt(startedAtMs) {
+    return startedAtMs + FIRST_MONTH_OFFER_WINDOW_MS;
+}
+/**
+ * A remembered start, or null when there is none worth trusting: not a number,
+ * in the future (beyond a minute of clock skew), or older than the cookie may
+ * live. A start the browser invented is no worse than a cleared cookie.
+ */
+export function parseFirstMonthOfferStart(raw, nowMs) {
+    if (!raw || !/^\d{10,16}$/.test(raw.trim()))
+        return null;
+    const startedAt = Number(raw.trim());
+    if (!Number.isSafeInteger(startedAt))
+        return null;
+    if (startedAt > nowMs + 60_000)
+        return null;
+    if (nowMs - startedAt > FIRST_MONTH_OFFER_SEEN_MAX_AGE_SECONDS * 1000)
+        return null;
+    return Math.min(startedAt, nowMs);
+}

package/node_modules/@oxygen/shared/dist/first-month-offer.d.ts

@@ -0,0 +1,42 @@
+import { type OxygenPlanKey } from "./billing.js";
+import { type FirstMonthOfferHeadline } from "./first-month-offer-window.js";
+export { FIRST_MONTH_OFFER_SEEN_COOKIE, FIRST_MONTH_OFFER_SEEN_MAX_AGE_SECONDS, firstMonthOfferEndsAt, parseFirstMonthOfferStart, type FirstMonthOfferHeadline, } from "./first-month-offer-window.js";
+/**
+ * The first-month offer (founder, 2026-10-02; widened 2026-10-03 to "all the
+ * plans above the $49/month plan ... from the $99/month plan upwards"): a new
+ * customer's first month of any Oxygen size from $99 up costs half its price,
+ * rounded down to the dollar, so they start on a bigger plan for less and, the
+ * hope is, keep it. $99 becomes $49, $199 $99, $499 $249, $999 $499 and $1,999
+ * $999. It is claimable for 24 hours from the first time that person sees it: a
+ * browser remembers when it first showed the offer, signup carries that start
+ * onto the new workspace, and checkout applies the discount only inside the
+ * workspace's window.
+ *
+ * This module carries the plan catalog, so the browser imports
+ * `first-month-offer-window.ts` instead and receives prices from the server.
+ * What arms the offer (Stripe coupons named by the environment) and who may
+ * claim it are server decisions.
+ */
+export declare const FIRST_MONTH_OFFER: Readonly<{
+    /** Stable machine name, written to Checkout and subscription metadata. */
+    key: "first_month_half";
+    /** The cheapest size it applies to; every dearer size qualifies too. */
+    minimumPlanKey: "oxygen_99";
+    /** How long a person has to claim it after first seeing it. */
+    windowMs: number;
+}>;
+/** The sizes the offer applies to, cheapest first: the minimum and every dearer purchasable size. */
+export declare const FIRST_MONTH_OFFER_PLAN_KEYS: readonly OxygenPlanKey[];
+/** Whether the offer applies to this size (billed monthly; checkout checks the rest). */
+export declare function firstMonthOfferAppliesTo(planKey: string): planKey is OxygenPlanKey;
+export type FirstMonthOfferPrice = {
+    planKey: OxygenPlanKey;
+    regularCents: number;
+    firstMonthCents: number;
+    /** The headline discount, rounded down so the page never claims more than it gives. */
+    percentOff: number;
+};
+/** A size's first month under the offer: half its price, rounded down to the dollar ($99 → $49, 50% off). */
+export declare function firstMonthOfferPrice(planKey?: OxygenPlanKey): FirstMonthOfferPrice;
+/** The banner's headline, computed here so the browser never loads the catalog. */
+export declare function firstMonthOfferHeadline(): FirstMonthOfferHeadline;

package/node_modules/@oxygen/shared/dist/first-month-offer.js

@@ -0,0 +1,56 @@
+import { PURCHASABLE_PLAN_KEYS, resolveBasePricingPlan } from "./billing.js";
+import { FIRST_MONTH_OFFER_WINDOW_MS } from "./first-month-offer-window.js";
+export { FIRST_MONTH_OFFER_SEEN_COOKIE, FIRST_MONTH_OFFER_SEEN_MAX_AGE_SECONDS, firstMonthOfferEndsAt, parseFirstMonthOfferStart, } from "./first-month-offer-window.js";
+/**
+ * The first-month offer (founder, 2026-10-02; widened 2026-10-03 to "all the
+ * plans above the $49/month plan ... from the $99/month plan upwards"): a new
+ * customer's first month of any Oxygen size from $99 up costs half its price,
+ * rounded down to the dollar, so they start on a bigger plan for less and, the
+ * hope is, keep it. $99 becomes $49, $199 $99, $499 $249, $999 $499 and $1,999
+ * $999. It is claimable for 24 hours from the first time that person sees it: a
+ * browser remembers when it first showed the offer, signup carries that start
+ * onto the new workspace, and checkout applies the discount only inside the
+ * workspace's window.
+ *
+ * This module carries the plan catalog, so the browser imports
+ * `first-month-offer-window.ts` instead and receives prices from the server.
+ * What arms the offer (Stripe coupons named by the environment) and who may
+ * claim it are server decisions.
+ */
+export const FIRST_MONTH_OFFER = Object.freeze({
+    /** Stable machine name, written to Checkout and subscription metadata. */
+    key: "first_month_half",
+    /** The cheapest size it applies to; every dearer size qualifies too. */
+    minimumPlanKey: "oxygen_99",
+    /** How long a person has to claim it after first seeing it. */
+    windowMs: FIRST_MONTH_OFFER_WINDOW_MS,
+});
+/** The sizes the offer applies to, cheapest first: the minimum and every dearer purchasable size. */
+export const FIRST_MONTH_OFFER_PLAN_KEYS = (() => {
+    const minimum = resolveBasePricingPlan(FIRST_MONTH_OFFER.minimumPlanKey)?.monthlyPriceCents;
+    if (!minimum)
+        throw new Error(`the first-month offer's minimum size ${FIRST_MONTH_OFFER.minimumPlanKey} has no monthly price`);
+    return PURCHASABLE_PLAN_KEYS.filter((planKey) => (resolveBasePricingPlan(planKey)?.monthlyPriceCents ?? 0) >= minimum);
+})();
+/** Whether the offer applies to this size (billed monthly; checkout checks the rest). */
+export function firstMonthOfferAppliesTo(planKey) {
+    return FIRST_MONTH_OFFER_PLAN_KEYS.includes(planKey);
+}
+/** A size's first month under the offer: half its price, rounded down to the dollar ($99 → $49, 50% off). */
+export function firstMonthOfferPrice(planKey = FIRST_MONTH_OFFER.minimumPlanKey) {
+    if (!firstMonthOfferAppliesTo(planKey))
+        throw new Error(`the first-month offer does not apply to ${planKey}`);
+    const regularCents = resolveBasePricingPlan(planKey)?.monthlyPriceCents ?? 0;
+    const firstMonthCents = Math.floor(regularCents / 200) * 100;
+    return {
+        planKey,
+        regularCents,
+        firstMonthCents,
+        percentOff: Math.floor(((regularCents - firstMonthCents) / regularCents) * 100),
+    };
+}
+/** The banner's headline, computed here so the browser never loads the catalog. */
+export function firstMonthOfferHeadline() {
+    const price = firstMonthOfferPrice();
+    return { percentOff: price.percentOff, fromCents: price.regularCents };
+}

package/node_modules/@oxygen/shared/dist/linkedin-sequences.d.ts

@@ -287,7 +287,7 @@ export type LinkedInSenderLimits = {
      * Backstop on the interactive lane: how many human-paced sends an account may
      * make in a rolling hour.
      *
-     * Mostly redundant with messages_per_day (whose maximum is 40), and that is
+     * Mostly redundant with messages_per_day (default 40, at most 200), and that is
      * deliberate — it bounds BURST SHAPE rather than volume. Volume is already
      * capped; this stops the whole daily allowance being spent in four minutes if
      * the interactive classification is ever wrong, which is the one failure mode
@@ -354,6 +354,37 @@ export type LinkedInSenderLimitKeysAreComplete = SameKeys<LinkedInSenderLimitKey
  */
 export declare const LINKEDIN_SENDER_LIMIT_DEFAULTS: LinkedInSenderLimits;
 export declare const LINKEDIN_SENDER_LIMIT_MAXIMUMS: LinkedInSenderLimits;
+/**
+ * Daily send caps above which every surface warns: the maximums before the
+ * 2026-10-02 raise. Values above them are allowed and carry a higher risk of a
+ * LinkedIn restriction.
+ */
+export declare const LINKEDIN_SENDER_LIMIT_CAUTION_LEVELS: {
+    readonly messages_per_day: 40;
+    readonly comments_per_day: 20;
+    readonly total_actions_per_day: 200;
+};
+/** The caution level of one limit, or undefined when it has none. */
+export declare function linkedInSenderLimitCautionLevel(key: keyof LinkedInSenderLimits): number | undefined;
+export type LinkedInLimitAboveCaution = {
+    limit: keyof LinkedInSenderLimits;
+    value: number;
+    caution_level: number;
+};
+/** The configured limits above their caution level, for the limits get/set responses. */
+export declare function linkedInLimitsAboveCaution(limits: Partial<LinkedInSenderLimits>): LinkedInLimitAboveCaution[];
+/** One sentence naming the limits above their caution level, or undefined when none is. */
+export declare function linkedInLimitsCautionWarning(above: readonly LinkedInLimitAboveCaution[]): string | undefined;
+/**
+ * Sender metadata key where tenant migration 0471 recorded the overrides it
+ * capped when the maximums were raised on 2026-10-02.
+ */
+export declare const LINKEDIN_LIMIT_CAUTION_RECORD_KEY = "linkedin_limit_caution_2026_10";
+/**
+ * Plain-language notes on that one-time cap, for each limit still at the value
+ * the migration wrote. Saving a new value for a limit retires its note.
+ */
+export declare function linkedInLimitCautionNotices(metadata: Record<string, unknown>, overrides: Partial<LinkedInSenderLimits>): string[];
 /**
  * LinkedIn refuses a new invitation to a member whose earlier invitation from
  * the same account was withdrawn, for about three weeks. OXYGEN records every

package/node_modules/@oxygen/shared/dist/linkedin-sequences.js

@@ -322,10 +322,16 @@ export const LINKEDIN_SENDER_LIMIT_DEFAULTS = {
     // a full page of new people.
     network_delta_reads_per_day: 4,
 };
+// Raised for inbound volume (2026-10-02, human decision in chat): a viral lead-magnet
+// post brings hundreds of requests a day, so an account may opt into up to 200
+// direct messages and 200 comments a day and 500 total actions. Defaults are
+// unchanged; each account raises its own limits. The former maximums remain the
+// caution levels below, and tenant migration 0471 caps overrides stored above them
+// before this change, so nothing goes higher without a new explicit setting.
 export const LINKEDIN_SENDER_LIMIT_MAXIMUMS = {
     invites_per_day: 30,
     invites_per_week: 150,
-    messages_per_day: 40,
+    messages_per_day: 200,
     // Lowered 40 → 25 and 150 → 100 (2026-09-26, founder decision "add missing
     // caps + tighten"): operator playbooks put InMail at ≤25/day and profile views
     // at 50-100. Stored overrides above these clamp at read time.
@@ -341,9 +347,9 @@ export const LINKEDIN_SENDER_LIMIT_MAXIMUMS = {
     likes_per_day: 50,
     // Lowered 50 → 20 (2026-09-25): public comments are the most visible automated
     // signal an account emits, and the one LinkedIn's inauthentic-engagement
-    // enforcement keys on. Stored overrides above this clamp at read time.
-    comments_per_day: 20,
-    total_actions_per_day: 200,
+    // enforcement keys on. Raised to 200 (2026-10-02, above); 20 stays the caution level.
+    comments_per_day: 200,
+    total_actions_per_day: 500,
     min_action_spacing_seconds: 3600,
     action_spacing_jitter_seconds: 1800,
     interactive_min_spacing_seconds: 3600,
@@ -366,6 +372,64 @@ export const LINKEDIN_SENDER_LIMIT_MAXIMUMS = {
     network_backfill_reads_per_day: 100,
     network_delta_reads_per_day: 20,
 };
+/**
+ * Daily send caps above which every surface warns: the maximums before the
+ * 2026-10-02 raise. Values above them are allowed and carry a higher risk of a
+ * LinkedIn restriction.
+ */
+export const LINKEDIN_SENDER_LIMIT_CAUTION_LEVELS = {
+    messages_per_day: 40,
+    comments_per_day: 20,
+    total_actions_per_day: 200,
+};
+/** The caution level of one limit, or undefined when it has none. */
+export function linkedInSenderLimitCautionLevel(key) {
+    return LINKEDIN_SENDER_LIMIT_CAUTION_LEVELS[key];
+}
+/** The configured limits above their caution level, for the limits get/set responses. */
+export function linkedInLimitsAboveCaution(limits) {
+    const above = [];
+    for (const [limit, level] of Object.entries(LINKEDIN_SENDER_LIMIT_CAUTION_LEVELS)) {
+        const value = limits[limit];
+        if (typeof value === "number" && value > level)
+            above.push({ limit, value, caution_level: level });
+    }
+    return above;
+}
+/** One sentence naming the limits above their caution level, or undefined when none is. */
+export function linkedInLimitsCautionWarning(above) {
+    if (above.length === 0)
+        return undefined;
+    const list = above.map((entry) => `${entry.limit} ${entry.value} (caution level ${entry.caution_level})`).join(", ");
+    return `Above its caution level each of these raises the risk of a LinkedIn restriction: ${list}.`;
+}
+/**
+ * Sender metadata key where tenant migration 0471 recorded the overrides it
+ * capped when the maximums were raised on 2026-10-02.
+ */
+export const LINKEDIN_LIMIT_CAUTION_RECORD_KEY = "linkedin_limit_caution_2026_10";
+/**
+ * Plain-language notes on that one-time cap, for each limit still at the value
+ * the migration wrote. Saving a new value for a limit retires its note.
+ */
+export function linkedInLimitCautionNotices(metadata, overrides) {
+    const record = metadata[LINKEDIN_LIMIT_CAUTION_RECORD_KEY];
+    if (!record || typeof record !== "object" || Array.isArray(record))
+        return [];
+    const { previous_limits: previous, limits: capped } = record;
+    const notices = [];
+    for (const [limit, level] of Object.entries(capped ?? {})) {
+        const before = previous?.[limit];
+        if (typeof level !== "number" || typeof before !== "number")
+            continue;
+        if (overrides[limit] !== level)
+            continue;
+        notices.push(`On 2 Oct 2026 OXYGEN lowered this account's saved ${limit} from ${before} to ${level} once. `
+            + `The ${before} had been saved before the 25 Sep 2026 limit change and would otherwise have come back by itself. `
+            + "Limits you save now are kept as set.");
+    }
+    return notices;
+}
 // ===== Re-invite cooldown =====
 /**
  * LinkedIn refuses a new invitation to a member whose earlier invitation from

package/node_modules/@oxygen/shared/dist/otlp-log-sink.d.ts

@@ -55,8 +55,12 @@ export type OtlpLogSinkOptions = {
     includeMessagesBelowMinLevel?: readonly string[] | undefined;
     fetch?: typeof globalThis.fetch | undefined;
 };
-/** Source alerts #13, #16, #17, #19, #43, #45, #51, #71, #73, #75–77, #87, #90, #92, #95 and #97 need these INFO events. */
-export declare const OTLP_MONITOR_INFO_EVENTS: readonly ["tenant.migrations.cron.done", "outbound_send.sent", "worker_workflow_cron_overlap_skipped", "worker_workflow_cron_enqueued", "copilot.turn.finished", "worker.queue.heartbeat", "worker.queue.ledger", "worker.queue.redis", "worker.queue.unregistered_kind", "automation_usage.reconcile_completed", "provider_health.cron_completed", "provider_balances.cron_completed", "cost_snapshot.cron_completed", "worker.egress_order_reconcile_sweep", "posthog_canary.round_trip_ok", "web.log_volume"];
+/**
+ * Source alerts #13, #16, #17, #19, #43, #45, #51, #71, #73, #75–77, #87, #90, #92, #95 and #97 need these INFO events.
+ * `worker.log_shipper.stats` is the Axiom shipper's once-a-minute loss accounting,
+ * which by design never reaches Axiom (OXP-1.6.126).
+ */
+export declare const OTLP_MONITOR_INFO_EVENTS: readonly ["tenant.migrations.cron.done", "outbound_send.sent", "worker_workflow_cron_overlap_skipped", "worker_workflow_cron_enqueued", "copilot.turn.finished", "worker.queue.heartbeat", "worker.queue.ledger", "worker.queue.redis", "worker.queue.unregistered_kind", "automation_usage.reconcile_completed", "provider_health.cron_completed", "provider_balances.cron_completed", "cost_snapshot.cron_completed", "worker.egress_order_reconcile_sweep", "posthog_canary.round_trip_ok", "web.log_volume", "worker.log_shipper.stats"];
 export type OtlpLogSinkHandle = {
     sink: LogSink;
     flush: () => Promise<void>;

package/node_modules/@oxygen/shared/dist/otlp-log-sink.js

@@ -6,7 +6,11 @@ import { sanitizeLogFields } from "./redaction.js";
 import { trace } from "@opentelemetry/api";
 import { operationalLogSnapshot } from "./operational-telemetry.js";
 import { telemetryEndpointForLog } from "./telemetry-export-observer.js";
-/** Source alerts #13, #16, #17, #19, #43, #45, #51, #71, #73, #75–77, #87, #90, #92, #95 and #97 need these INFO events. */
+/**
+ * Source alerts #13, #16, #17, #19, #43, #45, #51, #71, #73, #75–77, #87, #90, #92, #95 and #97 need these INFO events.
+ * `worker.log_shipper.stats` is the Axiom shipper's once-a-minute loss accounting,
+ * which by design never reaches Axiom (OXP-1.6.126).
+ */
 export const OTLP_MONITOR_INFO_EVENTS = [
     "tenant.migrations.cron.done",
     "outbound_send.sent",
@@ -24,6 +28,7 @@ export const OTLP_MONITOR_INFO_EVENTS = [
     "worker.egress_order_reconcile_sweep",
     "posthog_canary.round_trip_ok",
     "web.log_volume",
+    "worker.log_shipper.stats",
 ];
 const DEFAULT_BATCH_SIZE = 500;
 const DEFAULT_FLUSH_INTERVAL_MS = 2_000;

package/node_modules/@oxygen/shared/dist/pricing-sheet.d.ts

@@ -294,5 +294,16 @@ export declare const ENRICHMENT_CREDITS: {
     readonly page_scrape: 1.6;
     readonly linkedin_profile_scrape: 1;
 };
+/**
+ * What the default work-email column spends per email it finds, measured, not
+ * the single-finder list price above. 23,400 production `find_email` rows across
+ * 10 tenants (2026-08-11 to 2026-09-11) spent 2.6 credits per found email in
+ * today's units: the cheap first lane (Blitz at 1.5 credits, plus 0.225 to
+ * verify) finds most of them, and a lane that misses bills nothing. Rounded up
+ * to 3, so a plan's "about N work emails" stays below what was measured.
+ * Source and method: `.agents/skills/oxygen-enrichment-waterfall` § find_email
+ * in production.
+ */
+export declare const WORK_EMAIL_CREDITS_PER_FOUND_MEASURED = 3;
 /** Editable calculator default: blended credits per fully-enriched row. */
 export declare const ENRICHMENT_CREDITS_PER_ROW_TYPICAL = 10;

package/node_modules/@oxygen/shared/dist/pricing-sheet.js

@@ -274,5 +274,16 @@ export const ENRICHMENT_CREDITS = {
     page_scrape: 1.6, // Firecrawl, 5x of $0.0032 (repricing 2026-09, S44)
     linkedin_profile_scrape: 1, // Managed profile credit at $0.002 COGS, exactly 5x
 };
+/**
+ * What the default work-email column spends per email it finds, measured, not
+ * the single-finder list price above. 23,400 production `find_email` rows across
+ * 10 tenants (2026-08-11 to 2026-09-11) spent 2.6 credits per found email in
+ * today's units: the cheap first lane (Blitz at 1.5 credits, plus 0.225 to
+ * verify) finds most of them, and a lane that misses bills nothing. Rounded up
+ * to 3, so a plan's "about N work emails" stays below what was measured.
+ * Source and method: `.agents/skills/oxygen-enrichment-waterfall` § find_email
+ * in production.
+ */
+export const WORK_EMAIL_CREDITS_PER_FOUND_MEASURED = 3;
 /** Editable calculator default: blended credits per fully-enriched row. */
 export const ENRICHMENT_CREDITS_PER_ROW_TYPICAL = SNAPSHOT_ENRICHMENT_CREDITS_PER_ROW_TYPICAL;

package/node_modules/@oxygen/shared/dist/sql-error.js

@@ -82,7 +82,7 @@ function describeSqlError(error) {
         const message = readMessage(error);
         const drizzle = isDrizzleQueryError(error, message);
         const sqlstateCause = sqlstate ? categoryFromSqlstate(sqlstate) ?? "unknown" : "unknown";
-        const cause = sqlstateCause !== "unknown" ? sqlstateCause : causeFromErrnoOrMessage(errno, message);
+        const cause = sqlstateCause !== "unknown" ? sqlstateCause : causeFromErrnoOrMessage(errno, message, error);
         const hasSignal = Boolean(sqlstate) || Boolean(errno) || cause !== "unknown" || drizzle;
         if (!hasSignal)
             return null;
@@ -112,7 +112,15 @@ function describeSqlError(error) {
 }
 // Connection-level fallback when no SQLSTATE resolved a cause: prefer the
 // errno (set before/around the TCP+TLS handshake), then the message text.
-function causeFromErrnoOrMessage(errno, message) {
+//
+// A node-postgres pool checkout timeout ("timeout exceeded when trying to
+// connect") carries no errno, and drizzle wraps it as `Failed query: …` with the
+// pool error as `cause`, so the top-level message alone classified it `unknown`.
+// The connect-timeout text is therefore matched along the cause chain too: the
+// statement was never sent, so `transient` is exact. The broader
+// connection-terminated patterns stay top-level only — one of those can follow
+// a statement the server already applied.
+function causeFromErrnoOrMessage(errno, message, error) {
     if (errno && CONNECT_TIMEOUT_ERRNOS.has(errno))
         return "connect_timeout";
     if (errno && CONNECTION_ERRNOS.has(errno))
@@ -121,6 +129,9 @@ function causeFromErrnoOrMessage(errno, message) {
         return "connect_timeout";
     if (CONNECTION_MESSAGE.test(message))
         return "connection";
+    const nestedConnectTimeout = readCauseChain(error, (obj) => typeof obj.message === "string" && CONNECT_TIMEOUT_MESSAGE.test(obj.message) ? true : null);
+    if (nestedConnectTimeout)
+        return "connect_timeout";
     return "unknown";
 }
 /** Log-field shape (snake_case) for merging into `errorFields(error)` payloads. */

package/node_modules/@oxygen/shared/dist/stripe-price-catalog.d.ts

@@ -5,6 +5,9 @@ export type PricingPlan = PricingPlanDefinition & {
     priceIds: Record<BillingCurrency, string>;
     priceId: string;
 };
+export declare function annualMonthlyPlanPriceId(planKey: OxygenPlanKey): string;
+export declare function isAnnualMonthlyPlanPrice(priceId: string | null | undefined): boolean;
+export declare function annualMonthlyBillingAvailable(): boolean;
 export declare const PRICING_PLANS: {
     readonly free: PricingPlan;
     readonly oxygen: PricingPlan;

package/node_modules/@oxygen/shared/dist/stripe-price-catalog.js

@@ -38,6 +38,20 @@ const STRIPE_PRICE_OXYGEN_ANNUAL_IDS = {
     oxygen_999: { usd: process.env.STRIPE_PRICE_OXYGEN_999_ANNUAL_USD ?? "" },
     oxygen_1999: { usd: process.env.STRIPE_PRICE_OXYGEN_1999_ANNUAL_USD ?? "" },
 };
+const ANNUAL_MONTHLY_PRICE_IDS = Object.fromEntries(PURCHASABLE_PLAN_KEYS.map((key) => [
+    key, process.env[`STRIPE_PRICE_OXYGEN_${key.replace("oxygen_", "")}_ANNUAL_MONTHLY_USD`] ?? "",
+]));
+export function annualMonthlyPlanPriceId(planKey) {
+    return ANNUAL_MONTHLY_PRICE_IDS[planKey];
+}
+export function isAnnualMonthlyPlanPrice(priceId) {
+    return !!priceId && Object.values(ANNUAL_MONTHLY_PRICE_IDS).includes(priceId);
+}
+export function annualMonthlyBillingAvailable() {
+    return process.env.OXYGEN_ANNUAL_MONTHLY_ENABLED === "true"
+        && !!process.env.STRIPE_ANNUAL_MONTHLY_PORTAL_CONFIGURATION_ID
+        && PURCHASABLE_PLAN_KEYS.every((key) => !!annualMonthlyPlanPriceId(key));
+}
 // Grandfathered on 2026-09-19. These three stay pointed at their LIVE prices
 // (35 Starter + 2 Pro subscriptions bill against them) rather than moving into
 // the legacy CSV lists: tierFromPriceId must keep returning "starter"/"pro"/
@@ -160,7 +174,8 @@ export function tierFromPriceId(priceId) {
         return null;
     for (const planKey of PURCHASABLE_PLAN_KEYS) {
         if (Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey]).includes(priceId)
-            || Object.values(STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey]).includes(priceId)) {
+            || Object.values(STRIPE_PRICE_OXYGEN_ANNUAL_IDS[planKey]).includes(priceId)
+            || ANNUAL_MONTHLY_PRICE_IDS[planKey] === priceId) {
             return planKey;
         }
     }
@@ -197,6 +212,7 @@ export function recognizedStripePriceIdsBySelfServeTier() {
         oxygen: [
             ...PURCHASABLE_PLAN_KEYS.flatMap((planKey) => Object.values(STRIPE_PRICE_OXYGEN_IDS[planKey])),
             ...configuredAnnualPlanPriceIds(),
+            ...Object.values(ANNUAL_MONTHLY_PRICE_IDS),
             ...LEGACY_CURRENT_PLAN_PRICE_IDS.oxygen,
         ],
         starter: [

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1011.493";
+export declare const OXYGEN_BUILD_VERSION = "1.1011.600";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1011.493";
+export const OXYGEN_BUILD_VERSION = "1.1011.600";

package/node_modules/@oxygen/shared/dist/workspace-file-storage.d.ts

@@ -28,7 +28,7 @@ export declare function assertWorkspaceVisualBinary(bytes: Uint8Array, mimeType:
 export declare function workspaceFileSha256(bytes: Uint8Array): string;
 /** Opaque vault attachments are downloaded as bytes, never rendered as active content. */
 export declare function assertWorkspaceStoredFile(bytes: Uint8Array, mimeType: WorkspaceStoredFileMimeType): void;
-export declare function readWorkspaceFileObject(input: {
+type WorkspaceFileReadInput = {
     organizationId: string;
     fileId: string;
     storageKey: string;
@@ -36,6 +36,15 @@ export declare function readWorkspaceFileObject(input: {
     sha256: string;
     mimeType: WorkspaceStoredFileMimeType;
     signal?: AbortSignal;
+};
+export declare function readWorkspaceFileObject(input: WorkspaceFileReadInput): Promise<Uint8Array>;
+/**
+ * Retains only this original-byte window while verifying the entire stored SHA-256.
+ * Each window still streams the whole object; an ETag does not prove its digest.
+ */
+export declare function readWorkspaceFileObjectWindow(input: WorkspaceFileReadInput & {
+    offset: number;
+    limit: number;
 }): Promise<Uint8Array>;
 /** How long a presigned workspace-file upload stays valid. Long enough for 100 MiB on a slow link. */
 export declare const WORKSPACE_FILE_UPLOAD_PRESIGN_SECONDS = 900;
@@ -85,3 +94,4 @@ export declare function deleteWorkspaceFileObject(input: {
     fileId: string;
     storageKey: string;
 }): Promise<void>;
+export {};

package/node_modules/@oxygen/shared/dist/workspace-file-storage.js

@@ -3,6 +3,7 @@ import { createHash } from "node:crypto";
 import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { OxygenError } from "./cli-result.js";
+import { CRM_FILE_BYTES_MAX } from "./contracts/crm-file-bytes.js";
 import { resolveObjectStorageClient } from "./object-storage.js";
 export const WORKSPACE_VISUAL_SOURCE_MAX_BYTES = 1_500_000;
 export const WORKSPACE_VISUAL_BINARY_MAX_BYTES = 50 * 1024 * 1024;
@@ -74,6 +75,21 @@ export function assertWorkspaceStoredFile(bytes, mimeType) {
     assertWorkspaceVisualBinary(bytes, mimeType);
 }
 export async function readWorkspaceFileObject(input) {
+    return readVerifiedWorkspaceFileObject(input);
+}
+/**
+ * Retains only this original-byte window while verifying the entire stored SHA-256.
+ * Each window still streams the whole object; an ETag does not prove its digest.
+ */
+export async function readWorkspaceFileObjectWindow(input) {
+    if (input.mimeType !== "application/octet-stream" || !Number.isSafeInteger(input.offset)
+        || input.offset < 0 || input.offset > input.sizeBytes || !Number.isSafeInteger(input.limit)
+        || input.limit < 1 || input.limit > CRM_FILE_BYTES_MAX) {
+        throw new OxygenError("invalid_file_window", "Read an original file window of 1–2048 bytes at an offset within the file.");
+    }
+    return readVerifiedWorkspaceFileObject(input, { offset: input.offset, limit: input.limit });
+}
+async function readVerifiedWorkspaceFileObject(input, window) {
     input.signal?.throwIfAborted();
     assertWorkspaceFileObjectKey(input);
     const maximumBytes = input.mimeType === "application/octet-stream" ? WORKSPACE_OPAQUE_FILE_MAX_BYTES : WORKSPACE_VISUAL_BINARY_MAX_BYTES;
@@ -95,19 +111,29 @@ export async function readWorkspaceFileObject(input) {
         if (typeof stream[Symbol.asyncIterator] !== "function")
             throw new OxygenError("workspace_file_storage_invalid", "Stored file transport is invalid.");
         const chunks = [];
+        const digest = createHash("sha256");
         let size = 0;
+        let retained = 0;
         for await (const chunk of stream) {
             signal.throwIfAborted();
             if (!(chunk instanceof Uint8Array))
                 throw new OxygenError("workspace_file_storage_invalid", "Stored file transport is invalid.");
+            const chunkStart = size;
             size += chunk.byteLength;
             if (size > input.sizeBytes)
                 throw new OxygenError("workspace_file_integrity_failed", "Stored file exceeds its recorded size.");
-            chunks.push(Buffer.from(chunk));
+            digest.update(chunk);
+            const selected = window
+                ? chunk.subarray(Math.max(0, window.offset - chunkStart), Math.max(0, Math.min(chunk.byteLength, window.offset + window.limit - chunkStart)))
+                : chunk;
+            if (selected.byteLength > 0) {
+                chunks.push(Buffer.from(selected));
+                retained += selected.byteLength;
+            }
         }
-        const bytes = Buffer.concat(chunks, size);
+        const bytes = Buffer.concat(chunks, retained);
         signal.throwIfAborted();
-        if (size !== input.sizeBytes || workspaceFileSha256(bytes) !== input.sha256 || result.ContentType?.split(";", 1)[0]?.trim().toLowerCase() !== input.mimeType) {
+        if (size !== input.sizeBytes || digest.digest("hex") !== input.sha256 || result.ContentType?.split(";", 1)[0]?.trim().toLowerCase() !== input.mimeType) {
             throw new OxygenError("workspace_file_integrity_failed", "Stored file failed size, format or digest verification.");
         }
         assertWorkspaceStoredFile(bytes, input.mimeType);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1011.493",
+  "version": "1.1011.600",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",