@oxygen-agent/cli 1.1011.493 → 1.1011.607

package/node_modules/@oxygen/shared/dist/contracts/sender-limits.js

@@ -4,7 +4,7 @@
  * the route accepts; the route's own validators (working-hours rules, warm-up
  * date parsing) still run after the contract.
  */
-import { LINKEDIN_SENDER_LIMIT_DEFAULTS, LINKEDIN_SENDER_LIMIT_KEYS, LINKEDIN_SENDER_LIMIT_MAXIMUMS, } from "../linkedin-sequences.js";
+import { LINKEDIN_SENDER_LIMIT_DEFAULTS, LINKEDIN_SENDER_LIMIT_KEYS, LINKEDIN_SENDER_LIMIT_MAXIMUMS, linkedInSenderLimitCautionLevel, } from "../linkedin-sequences.js";
 import { arr, bool, enumOf, int, nullable, obj, str } from "./schema.js";
 /** Short MCP-facing notes; the CLI carries its own longer help per flag. */
 const LIMIT_NOTES = {
@@ -18,6 +18,7 @@ const LIMIT_NOTES = {
     sales_nav_search_results_per_day: "Result rows.",
     api_reads_per_day: "Other API reads.",
     total_reads_per_day: "All reads.",
+    min_action_spacing_seconds: "Floor; campaigns spread each day's limit over working hours (20 invites in 07:00-22:00: 30-45 min apart).",
     interactive_min_spacing_seconds: "Human Unibox send spacing.",
     interactive_spacing_jitter_seconds: "Jitter on that spacing.",
     interactive_sends_per_hour: "Hourly human send cap.",
@@ -30,11 +31,12 @@ const LIMIT_NOTES = {
 function limit(key) {
     const max = LINKEDIN_SENDER_LIMIT_MAXIMUMS[key];
     const note = LIMIT_NOTES[key];
+    const caution = linkedInSenderLimitCautionLevel(key);
     return int({
         minimum: 0,
         maximum: max,
         clamp: true,
-        description: `Max ${max} (default ${LINKEDIN_SENDER_LIMIT_DEFAULTS[key]}).${note ? ` ${note}` : ""}`,
+        description: `Max ${max} (default ${LINKEDIN_SENDER_LIMIT_DEFAULTS[key]}).${note ? ` ${note}` : ""}${caution === undefined ? "" : ` Above ${caution} raises the risk of a LinkedIn restriction.`}`,
     });
 }
 export const SENDER_LIMITS_CONTRACT = obj(Object.fromEntries(LINKEDIN_SENDER_LIMIT_KEYS.map((key) => [key, limit(key)])), { description: "Per-account caps for sends and reads. Values above the maximum are clamped server-side." });
@@ -44,7 +46,7 @@ export const SENDER_WORKING_HOURS_CONTRACT = obj({
     days: arr(int({ minimum: 1, maximum: 7 }), { description: "ISO weekdays, 1=Mon." }),
     start: str({ description: "HH:MM, e.g. 09:00." }),
     end: str({ description: "HH:MM, after start." }),
-}, { description: "When LinkedIn actions may run (default 07:00-22:00 daily); work outside waits. Omitted fields keep their value." });
+}, { description: "When LinkedIn actions may run (default 07:00-22:00 daily); campaigns spread each day's limit across them, starting at a different time each day. Work outside waits. Omitted fields keep their value." });
 export const SENDER_WARMUP_CONTRACT = obj({
     enabled: bool({ description: "true = start/restart the ramp at day 0; false = disable warm-up (account becomes warm)." }),
     start_date: nullable(str({
@@ -74,13 +76,13 @@ export const SENDER_LIMITS_SET_OPERATION = {
     contract: SENDER_LIMITS_PATCH_CONTRACT,
     cli: {
         path: ["senders", "limits", "set"],
-        summary: "Adjust per-account action limits and working hours. LinkedIn actions only run inside the account's working hours (default 07:00-22:00 every day, in the account's timezone); work due outside them is deferred to the next window, not failed. Set them with --timezone, --working-days, --working-hours-start and --working-hours-end; flags you omit keep their current value. A sequence's sending schedule (sequences update --schedule-*, or --linkedin-* for LinkedIn alone) can narrow the window for its LinkedIn steps, never widen it; email steps follow the sequence's email send window instead. Every limit flag shows its default and hard maximum; values above the maximum are clamped, and higher caps raise the risk of a LinkedIn restriction. Each action has its own cap (InMails per day and per rolling 30 days, profile views, profile lookups, endorsements, invitation withdrawals, posts), and every send except posts also counts toward --total-actions-per-day. Daily send caps run at half on Saturday and Sunday in the account's timezone unless --weekend-full-volume is set. A withdrawn invitation cannot be re-sent to the same person for 21 days. Own-feed posts and your own Unibox replies ignore working hours. A refused action names its reason (outside_working_hours defers it; linkedin_rate_limited names the limit and resets_at). Changing limits is free. <id> accepts a sender account id, connection id, or Unipile account id.",
+        summary: "Adjust per-account action limits and working hours. LinkedIn actions only run inside the account's working hours (default 07:00-22:00 every day, in the account's timezone); work due outside them is deferred to the next window, not failed. Set them with --timezone, --working-days, --working-hours-start and --working-hours-end; flags you omit keep their current value. A sequence's sending schedule (sequences update --schedule-*, or --linkedin-* for LinkedIn alone) can narrow the window for its LinkedIn steps, never widen it; email steps follow the sequence's email send window instead. Every limit flag shows its default and hard maximum; values above the maximum are clamped, and higher caps raise the risk of a LinkedIn restriction. Each action has its own cap (InMails per day and per rolling 30 days, profile views, profile lookups, endorsements, invitation withdrawals, posts), and every send except posts also counts toward --total-actions-per-day. Daily send caps run at half on Saturday and Sunday in the account's timezone unless --weekend-full-volume is set. A withdrawn invitation cannot be re-sent to the same person for 21 days. Own-feed posts and your own Unibox replies ignore working hours. A refused action names its reason (outside_working_hours defers it; linkedin_rate_limited names the limit and resets_at). Caps saved before 25 Sep 2026 above 40 messages, 20 comments or 200 total actions were lowered to those levels once on 2 Oct 2026 (old values in sender metadata linkedin_limit_caution_2026_10); limits you save now are kept as set. Raising caps to answer a post's commenters: read `oxygen skills get oxygen-linkedin-marketing --file guides/safe-limits-doctrine.md` first. Changing limits is free. <id> accepts a sender account id, connection id, or Unipile account id.",
         argument: { name: "id", description: "Sender account id, connection id, or Unipile account id." },
     },
     mcp: {
         name: "oxygen_senders_limits_set",
         title: "Oxygen: Set LinkedIn Account Limits",
-        description: "Updates per-account daily limits for sends (invites/messages/InMails) AND reads (relations lists, message history, searches, profile views), working hours, and the warm-up ramp (enable/disable/anchor). Values are clamped to safe maximums to protect the LinkedIn account. LinkedIn actions run only inside working hours.",
+        description: "Updates per-account daily limits for sends (invites/messages/InMails) AND reads (relations lists, message history, searches, profile views), working hours, and the warm-up ramp (enable/disable/anchor). Values are clamped to hard maximums; above the caution levels restriction risk rises. LinkedIn actions run only inside working hours.",
         pack: "deliverability",
     },
     mutates: true,

package/node_modules/@oxygen/shared/dist/contracts/sequence-list.d.ts

@@ -0,0 +1,3 @@
+export declare const SEQUENCE_LIST_PROJECTION_CONTRACT: import("./schema.js").ContractObject<{
+    readonly omit: import("./schema.js").StringProperty;
+}, never>;

package/node_modules/@oxygen/shared/dist/contracts/sequence-list.js

@@ -0,0 +1,8 @@
+/** The optional warning projection for GET /api/cli/sequences.
+ * Other list filters retain their existing contracts. Unknown CSV values are
+ * ignored by the API; absence retains the normal warning reads and results.
+ */
+import { obj, str } from "./schema.js";
+export const SEQUENCE_LIST_PROJECTION_CONTRACT = obj({
+    omit: str({ description: "warnings: skip warnings and their extra reads." }),
+});

package/node_modules/@oxygen/shared/dist/contracts/stored-read-window.d.ts

@@ -0,0 +1,17 @@
+/** Optional representations of an already-authorized stored native read. */
+export declare const STORED_READ_WINDOW_FIELDS: {
+    readonly projection: {
+        type: "string";
+        enum: readonly ("full" | "summary" | "value")[];
+        description?: string;
+    };
+    readonly path: import("./schema.js").StringProperty;
+    readonly value_cursor: import("./schema.js").StringProperty;
+    readonly max_chars: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+};

package/node_modules/@oxygen/shared/dist/contracts/stored-read-window.js

@@ -0,0 +1,8 @@
+import { enumOf, int, str } from "./schema.js";
+/** Optional representations of an already-authorized stored native read. */
+export const STORED_READ_WINDOW_FIELDS = {
+    projection: enumOf(["summary", "full", "value"], { description: "summary: metadata without long values; full: complete rows; value: lossless JSON fragments for one exact selection. Omit for legacy output." }),
+    path: str({ maxLength: 1024, description: "value: JSON Pointer into the public native result; empty selects the whole result." }),
+    value_cursor: str({ minLength: 1, maxLength: 2000, description: "value: previous next_value_cursor with identical selection and path. Changed source refuses continuation." }),
+    max_chars: int({ minimum: 1000, maximum: 40000, description: "Opt-in complete receipt limit. MCP caps external at 10000, built-in at 4000. Oversize values remain accessible with value windows." }),
+};

package/node_modules/@oxygen/shared/dist/contracts/table-feed-read.d.ts

@@ -0,0 +1,67 @@
+import { type Infer } from "./schema.js";
+export declare const TABLE_FEED_LIST_MAX_LIMIT = 200;
+export declare const TABLE_FEED_LIST_DEFAULT_LIMIT = 50;
+export declare const TABLE_FEED_LIST_LIMIT_PROPERTY: {
+    type: "integer";
+    description?: string;
+    minimum?: number;
+    maximum?: number;
+    "x-clamp"?: true;
+};
+/** Representation controls only; existing feed selection/coercion remains native. */
+export declare const TABLE_FEED_LIST_WINDOW_CONTRACT: import("./schema.js").ContractObject<{
+    readonly projection: {
+        readonly type: "string";
+        readonly enum: readonly ["summary", "full"];
+        readonly description: "summary: metadata without long settings; full: complete feeds. Omit for legacy output.";
+    };
+    readonly offset: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly max_chars: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+}, never>;
+export declare const TABLE_FEED_GET_WINDOW_CONTRACT: import("./schema.js").ContractObject<{
+    readonly projection: {
+        type: "string";
+        enum: readonly ("full" | "summary" | "value")[];
+        description?: string;
+    };
+    readonly path: import("./schema.js").StringProperty;
+    readonly value_cursor: import("./schema.js").StringProperty;
+    readonly max_chars: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+}, never>;
+export type TableFeedListWindow = Infer<typeof TABLE_FEED_LIST_WINDOW_CONTRACT>;
+export type TableFeedGetWindow = Infer<typeof TABLE_FEED_GET_WINDOW_CONTRACT>;
+/** MCP keeps executable constraints; guidance appears once on each owner. */
+export declare function tableFeedWindowProperties(contract: typeof TABLE_FEED_GET_WINDOW_CONTRACT | typeof TABLE_FEED_LIST_WINDOW_CONTRACT): {
+    [k: string]: {
+        type: "string";
+        enum?: readonly string[];
+        minLength?: number;
+        maxLength?: number;
+    } | {
+        type: "integer";
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    } | {
+        type: "string";
+        enum: readonly ("full" | "summary" | "value")[];
+    };
+};

package/node_modules/@oxygen/shared/dist/contracts/table-feed-read.js

@@ -0,0 +1,19 @@
+import { int, obj } from "./schema.js";
+import { STORED_READ_WINDOW_FIELDS } from "./stored-read-window.js";
+export const TABLE_FEED_LIST_MAX_LIMIT = 200;
+export const TABLE_FEED_LIST_DEFAULT_LIMIT = 50;
+export const TABLE_FEED_LIST_LIMIT_PROPERTY = int({ minimum: 1, maximum: TABLE_FEED_LIST_MAX_LIMIT, description: "Maximum feeds. Defaults to 50." });
+/** Representation controls only; existing feed selection/coercion remains native. */
+export const TABLE_FEED_LIST_WINDOW_CONTRACT = obj({
+    projection: { ...STORED_READ_WINDOW_FIELDS.projection, enum: ["summary", "full"], description: "summary: metadata without long settings; full: complete feeds. Omit for legacy output." },
+    offset: int({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER - 200, description: "Live ordered queue offset; resume with next_offset and identical filters. No snapshot/global total is claimed." }),
+    max_chars: STORED_READ_WINDOW_FIELDS.max_chars,
+});
+export const TABLE_FEED_GET_WINDOW_CONTRACT = obj(STORED_READ_WINDOW_FIELDS);
+/** MCP keeps executable constraints; guidance appears once on each owner. */
+export function tableFeedWindowProperties(contract) {
+    return Object.fromEntries(Object.entries(contract.properties).map(([key, property]) => {
+        const { description: _description, ...schema } = property;
+        return [key, schema];
+    }));
+}

package/node_modules/@oxygen/shared/dist/contracts/table-row-read.d.ts

@@ -0,0 +1,30 @@
+/** Representation controls for the existing exact-row read. Constraints stay
+ * shared with the native signer; each hint appears once in the selected schema. */
+export declare const TABLE_ROW_READ_WINDOW_FIELDS: {
+    readonly projection: {
+        readonly type: "string";
+        readonly enum: readonly ["full", "value"];
+        readonly description: "value: lossless JSON fragments; full: complete result. Omit for legacy.";
+    };
+    readonly path: {
+        readonly type: "string";
+        readonly enum?: readonly string[];
+        readonly minLength?: number;
+        readonly maxLength?: number;
+        readonly description: "JSON Pointer; empty=root.";
+    };
+    readonly value_cursor: {
+        readonly type: "string";
+        readonly enum?: readonly string[];
+        readonly minLength?: number;
+        readonly maxLength?: number;
+        readonly description: "Resume with identical selection/path.";
+    };
+    readonly max_chars: {
+        readonly type: "integer";
+        readonly minimum?: number;
+        readonly maximum?: number;
+        readonly "x-clamp"?: true;
+        readonly description: "Receipt cap; MCP 10000, built-in 4000.";
+    };
+};

package/node_modules/@oxygen/shared/dist/contracts/table-row-read.js

@@ -0,0 +1,9 @@
+import { STORED_READ_WINDOW_FIELDS } from "./stored-read-window.js";
+/** Representation controls for the existing exact-row read. Constraints stay
+ * shared with the native signer; each hint appears once in the selected schema. */
+export const TABLE_ROW_READ_WINDOW_FIELDS = {
+    projection: { ...STORED_READ_WINDOW_FIELDS.projection, enum: ["full", "value"], description: "value: lossless JSON fragments; full: complete result. Omit for legacy." },
+    path: { ...STORED_READ_WINDOW_FIELDS.path, description: "JSON Pointer; empty=root." },
+    value_cursor: { ...STORED_READ_WINDOW_FIELDS.value_cursor, description: "Resume with identical selection/path." },
+    max_chars: { ...STORED_READ_WINDOW_FIELDS.max_chars, description: "Receipt cap; MCP 10000, built-in 4000." },
+};

package/node_modules/@oxygen/shared/dist/contracts/whatsapp-reads.d.ts

@@ -0,0 +1,111 @@
+export declare const WHATSAPP_ACCOUNT_STATUSES: readonly ["active", "paused", "disconnected", "restricted", "credentials_required"];
+export declare const WHATSAPP_ACCOUNTS_READ_CONTRACT: import("./schema.js").ContractObject<{
+    readonly projection: {
+        type: "string";
+        enum: readonly ("full" | "summary" | "value")[];
+        description?: string;
+    };
+    readonly path: import("./schema.js").StringProperty;
+    readonly value_cursor: import("./schema.js").StringProperty;
+    readonly max_chars: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly status: {
+        type: "string";
+        enum: readonly ("active" | "credentials_required" | "disconnected" | "paused" | "restricted")[];
+        description?: string;
+    };
+    readonly include_usage: import("./schema.js").BooleanProperty;
+    readonly include_disconnected: import("./schema.js").BooleanProperty;
+    readonly tag: import("./schema.js").StringProperty;
+    readonly account_id: import("./schema.js").StringProperty;
+    readonly limit: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly offset: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+}, never>;
+export declare const WHATSAPP_DRAFT_STATUSES: readonly ["queued", "edited", "approved", "sent", "rejected"];
+export declare const WHATSAPP_DRAFTS_READ_CONTRACT: import("./schema.js").ContractObject<{
+    readonly projection: {
+        type: "string";
+        enum: readonly ("full" | "summary" | "value")[];
+        description?: string;
+    };
+    readonly path: import("./schema.js").StringProperty;
+    readonly value_cursor: import("./schema.js").StringProperty;
+    readonly max_chars: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly status: import("./schema.js").StringProperty;
+    readonly conversation: import("./schema.js").StringProperty;
+    readonly conversation_id: import("./schema.js").StringProperty;
+    readonly limit: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly offset: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly draft_id: import("./schema.js").StringProperty;
+}, never>;
+export declare const WHATSAPP_DRAFTS_MCP_CONTRACT: import("./schema.js").ContractObject<{
+    readonly projection: {
+        type: "string";
+        enum: readonly ("full" | "summary" | "value")[];
+        description?: string;
+    };
+    readonly path: import("./schema.js").StringProperty;
+    readonly value_cursor: import("./schema.js").StringProperty;
+    readonly max_chars: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly status: import("./schema.js").StringProperty;
+    readonly conversation: import("./schema.js").StringProperty;
+    readonly conversation_id: import("./schema.js").StringProperty;
+    readonly offset: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+    readonly draft_id: import("./schema.js").StringProperty;
+    readonly limit: {
+        type: "integer";
+        description?: string;
+        minimum?: number;
+        maximum?: number;
+        "x-clamp"?: true;
+    };
+}, never>;
+/** Preserve native canonical/alias precedence, including a canonical blank. */
+export declare function whatsappReadQueryParams(input: Record<string, unknown>): URLSearchParams;

package/node_modules/@oxygen/shared/dist/contracts/whatsapp-reads.js

@@ -0,0 +1,33 @@
+import { bool, enumOf, int, obj, str } from "./schema.js";
+import { STORED_READ_WINDOW_FIELDS } from "./stored-read-window.js";
+export const WHATSAPP_ACCOUNT_STATUSES = ["active", "paused", "disconnected", "restricted", "credentials_required"];
+export const WHATSAPP_ACCOUNTS_READ_CONTRACT = obj({
+    status: enumOf(WHATSAPP_ACCOUNT_STATUSES, { description: "Exact sender status; takes precedence over include_disconnected." }),
+    include_usage: bool({ description: "Stored usage counts; default true." }),
+    include_disconnected: bool({ description: "Include retained disconnected accounts; default false. Presence is not send readiness." }),
+    tag: str({ description: "Comma-separated workspace tags, ANY-match." }),
+    account_id: str({ description: "Exact connection id from this filtered account list." }),
+    limit: int({ minimum: 1, maximum: 200 }),
+    offset: int({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER, description: "Matching account offset; live changes can shift pages." }),
+    ...STORED_READ_WINDOW_FIELDS,
+});
+export const WHATSAPP_DRAFT_STATUSES = ["queued", "edited", "approved", "sent", "rejected"];
+export const WHATSAPP_DRAFTS_READ_CONTRACT = obj({
+    status: str({ description: `CSV current statuses: ${WHATSAPP_DRAFT_STATUSES.join(",")}; default queued,edited. No transition audit.` }),
+    conversation: str({ description: "Legacy local WhatsApp conversation UUID alias." }),
+    conversation_id: str({ description: "Local WhatsApp conversation UUID; takes precedence over conversation. Retired native refs remain valid." }),
+    // Existing CLI accepts any positive integer; native owner clamps to 200.
+    // Retain that admission while the already-stricter MCP schema stays bounded.
+    limit: int({ minimum: 1, description: "Default 50; native maximum 200." }),
+    offset: int({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER, description: "Matching agent draft offset; live changes can shift pages." }),
+    draft_id: str({ description: "Exact eligible agent draft UUID under the same status/conversation filters." }),
+    ...STORED_READ_WINDOW_FIELDS,
+});
+export const WHATSAPP_DRAFTS_MCP_CONTRACT = obj({
+    ...WHATSAPP_DRAFTS_READ_CONTRACT.properties,
+    limit: int({ minimum: 1, maximum: 200 }),
+});
+/** Preserve native canonical/alias precedence, including a canonical blank. */
+export function whatsappReadQueryParams(input) {
+    return new URLSearchParams(Object.entries(input).filter(([, value]) => value !== undefined && value !== null).map(([key, value]) => [key, String(value)]));
+}

package/node_modules/@oxygen/shared/dist/contracts/workspace-pages.d.ts

@@ -1,9 +1,10 @@
 /**
- * `POST /api/cli/settings/pages`: the web app's sidebar pages a workspace hides
- * for every member (Settings → Customise; Philipp, 2026-09-30). Presentation
- * only: a hidden page leaves the sidebar and the ⌘K palette, and stays
- * reachable by URL and deep-link. Admins and owners change it; every member
- * reads it through `GET` on the same route.
+ * `POST /api/cli/settings/pages`: the web app's sidebar pages one person hides
+ * for themselves in one workspace (Settings → Customise). Per user and per
+ * workspace since Philipp's 2026-10-02 decision; it was workspace-wide before.
+ * Presentation only: a hidden page leaves that person's sidebar and ⌘K palette,
+ * and stays reachable by URL and deep-link. Every member reads and changes their
+ * own list through `GET` and `POST` on the same route, never anyone else's.
  */
 import type { OperationSpec } from "./operations.js";
 import { type Infer } from "./schema.js";

package/node_modules/@oxygen/shared/dist/contracts/workspace-pages.js

@@ -4,7 +4,7 @@ export const WORKSPACE_PAGES_UPDATE_CONTRACT = obj({
     hide: arr(pageRef, {
         minItems: 1,
         maxItems: 100,
-        description: "Pages to hide for everyone, each by its path (/unibox) or name (Unibox) from the page list. Hiding a section hides its sub-pages.",
+        description: "Pages to hide from your own sidebar, each by its path (/unibox) or name (Unibox) from the page list. Hiding a section hides its sub-pages.",
     }),
     show: arr(pageRef, {
         minItems: 1,
@@ -23,8 +23,8 @@ export const WORKSPACE_PAGES_GET_OPERATION = {
     method: "GET",
     contract: obj({}),
     generated: { cli: false, mcp: false },
-    cli: { path: ["settings", "pages", "list"], summary: "Page visibility in the web app's sidebar navigation menu (Settings → Customise): hidden_pages, whether you may customize it (can_change: admins and owners), then every page (path, name, section, parent) with hidden (hidden itself) and visible (shown in the sidebar; false under a hidden section). Read-only, 0 credits." },
-    mcp: { name: "oxygen_settings_pages_get", title: "Oxygen: List Sidebar Pages", description: "Lists the OXYGEN web app's sidebar navigation pages (Settings → Customise) with whether this workspace hides each one for everyone, and can_change (admins and owners). Free. Change with oxygen_settings_pages_update.", pack: "workspace" },
+    cli: { path: ["settings", "pages", "list"], summary: "Page visibility in your own sidebar navigation menu in this workspace (Settings → Customise; only you see your choices): hidden_pages, then every page (path, name, section, parent) with hidden (you hid it) and visible (shown in your sidebar; false under a hidden section). Read-only, 0 credits." },
+    mcp: { name: "oxygen_settings_pages_get", title: "Oxygen: List Sidebar Pages", description: "Lists the OXYGEN web app's sidebar navigation pages (Settings → Customise) with which ones you hid from your own sidebar in this workspace; only you see your choices. Free. Change with oxygen_settings_pages_update.", pack: "workspace" },
     mutates: false,
     spends: false,
 };
@@ -36,12 +36,12 @@ export const WORKSPACE_PAGES_UPDATE_OPERATION = {
     generated: { cli: false, mcp: false },
     cli: {
         path: ["settings", "pages", "set"],
-        summary: "Hide or show pages in the web app's sidebar navigation menu for everyone in this workspace (Settings → Customise): --hide Unibox,Publishing, --show Unibox, --show-all. Name pages by path or name from `settings pages list`; hiding a section hides its sub-pages. Nothing is deleted and hidden pages stay reachable by URL. Admins and owners only; free.",
+        summary: "Hide or show pages in your own sidebar navigation menu in this workspace (Settings → Customise): --hide Unibox,Publishing, --show Unibox, --show-all. Only your sidebar changes; teammates keep theirs. Name pages by path or name from `settings pages list`; hiding a section hides its sub-pages. Nothing is deleted and hidden pages stay reachable by URL. Free.",
     },
     mcp: {
         name: "oxygen_settings_pages_update",
         title: "Oxygen: Hide or Show Sidebar Pages",
-        description: "Hides or shows pages in the OXYGEN web app's sidebar navigation for everyone in this workspace (Settings → Customise). hide/show take page paths or names from oxygen_settings_pages_get; show_all shows every page again. Nothing is deleted and hidden pages stay reachable by URL. Admins and owners only. Free.",
+        description: "Hides or shows pages in your own OXYGEN sidebar navigation in this workspace (Settings → Customise); teammates' sidebars do not change. hide/show take page paths or names from oxygen_settings_pages_get; show_all shows every page again. Nothing is deleted and hidden pages stay reachable by URL. Free.",
         pack: "workspace",
     },
     mutates: true,

package/node_modules/@oxygen/shared/dist/copilot-playbooks.d.ts

@@ -1,4 +1,5 @@
-export type CopilotPlaybookSlug = "tam-sourcing" | "linkedin-content-strategy" | "inbound-led-outbound" | "signal-based-outbound";
+import { COPILOT_PLAYBOOKS_GENERATED } from "./copilot-playbooks.generated.js";
+export type CopilotPlaybookSlug = (typeof COPILOT_PLAYBOOKS_GENERATED)[number]["slug"];
 export type CopilotPlaybook = {
     /**
      * The skill slug the Copilot loads through its `skills` tool, and the
@@ -7,6 +8,8 @@ export type CopilotPlaybook = {
     slug: CopilotPlaybookSlug;
     /** Customer-facing name, exactly as it is spoken in the composer prompt and shown on the Home chip. */
     title: string;
+    /** The featured catalog recipe that carries this play: its kit, prerequisites and approval gates. */
+    recipeSlug: string;
 };
 export declare const COPILOT_PLAYBOOKS: readonly CopilotPlaybook[];
 /**

package/node_modules/@oxygen/shared/dist/copilot-playbooks.generated.d.ts

@@ -0,0 +1,17 @@
+export declare const COPILOT_PLAYBOOKS_GENERATED: readonly [{
+    readonly slug: "tam-sourcing";
+    readonly title: "TAM sourcing";
+    readonly recipeSlug: "icp-to-account-map";
+}, {
+    readonly slug: "linkedin-content-strategy";
+    readonly title: "LinkedIn content strategy";
+    readonly recipeSlug: "founder-posting-system";
+}, {
+    readonly slug: "inbound-led-outbound";
+    readonly title: "Inbound-led outbound";
+    readonly recipeSlug: "inbound-led-outbound";
+}, {
+    readonly slug: "signal-based-outbound";
+    readonly title: "Signal-based outbound";
+    readonly recipeSlug: "daily-warm-lead-queue";
+}];

package/node_modules/@oxygen/shared/dist/copilot-playbooks.generated.js

@@ -0,0 +1,26 @@
+// GENERATED by apps/web/scripts/generate-copilot-playbooks.ts from the recipe
+// catalog (featured recipes: `featured_order`, `label`, `playbook` in
+// apps/web/src/agent-skills/oxygen-recipes/recipes).
+// Do not edit by hand — run `npm run skills:metadata -w @oxygen/web`.
+export const COPILOT_PLAYBOOKS_GENERATED = [
+    {
+        slug: "tam-sourcing",
+        title: "TAM sourcing",
+        recipeSlug: "icp-to-account-map",
+    },
+    {
+        slug: "linkedin-content-strategy",
+        title: "LinkedIn content strategy",
+        recipeSlug: "founder-posting-system",
+    },
+    {
+        slug: "inbound-led-outbound",
+        title: "Inbound-led outbound",
+        recipeSlug: "inbound-led-outbound",
+    },
+    {
+        slug: "signal-based-outbound",
+        title: "Signal-based outbound",
+        recipeSlug: "daily-warm-lead-queue",
+    },
+];

package/node_modules/@oxygen/shared/dist/copilot-playbooks.js

@@ -1,35 +1,5 @@
-// The four end-to-end GTM playbooks the Workspace Copilot can run, as pure,
-// client-safe data. One canonical copy is read by three consumers: the Home
-// cards (which pre-write the prompt below into the composer), the Copilot's
-// system prompt (which maps the spoken title back to the skill slug the model
-// loads through its `skills` tool), and the apps/web gate that checks every slug
-// here has a served playbook file with a matching frontmatter `name`.
-//
-// A playbook is the operator contract for one whole motion — stages, owners,
-// exact commands, caps, approval gates, stop conditions, learning loop — served
-// as a product skill (`apps/web/src/agent-skills/oxygen-playbooks/playbooks/`).
-// Loading one is never permission to spend or send: every gate inside it still
-// fires. Founder decision 2026-09-16: Home offers exactly these four, above the
-// composer as compact glass chips (title only), and a chip writes the sentence
-// into the box rather than starting a session, so there stays exactly one door.
-export const COPILOT_PLAYBOOKS = [
-    {
-        slug: "tam-sourcing",
-        title: "TAM sourcing",
-    },
-    {
-        slug: "linkedin-content-strategy",
-        title: "LinkedIn content strategy",
-    },
-    {
-        slug: "inbound-led-outbound",
-        title: "Inbound-led outbound",
-    },
-    {
-        slug: "signal-based-outbound",
-        title: "Signal-based outbound",
-    },
-];
+import { COPILOT_PLAYBOOKS_GENERATED } from "./copilot-playbooks.generated.js";
+export const COPILOT_PLAYBOOKS = COPILOT_PLAYBOOKS_GENERATED;
 /**
  * The sentence a Home card writes into the composer. It names the skill the way
  * a person would say it, and the Copilot's prompt maps that title back to the

package/node_modules/@oxygen/shared/dist/feature-gates.d.ts

@@ -76,6 +76,11 @@ export type FeatureGateResolution = {
  *   (`packages/shared/src/repricing.ts`). A remotely flippable value would let
  *   a mis-click move every customer's prices; it changes only through Doppler,
  *   with explicit human approval.
+ * - OXYGEN_FIRST_MONTH_OFFER_COUPON — (b). Names the Stripe coupon that takes
+ *   $50 off a new customer's first $99 month (`apps/web/src/lib/billing/
+ *   first-month-offer.ts`, founder decision 2026-10-02). A remotely flippable
+ *   value would let a mis-click discount every eligible checkout or withdraw an
+ *   offer a visitor is counting down to; it changes only through Doppler.
  * - OXYGEN_CREDIT_GATE_ENABLED — (b). Lets a connect through on the balance
  *   instead of a sending seat (`packages/shared/src/credit-gate.ts`). A wrong
  *   "on" while commitments do not bill every connectable kind would admit

package/node_modules/@oxygen/shared/dist/feature-gates.js

@@ -67,6 +67,11 @@
  *   (`packages/shared/src/repricing.ts`). A remotely flippable value would let
  *   a mis-click move every customer's prices; it changes only through Doppler,
  *   with explicit human approval.
+ * - OXYGEN_FIRST_MONTH_OFFER_COUPON — (b). Names the Stripe coupon that takes
+ *   $50 off a new customer's first $99 month (`apps/web/src/lib/billing/
+ *   first-month-offer.ts`, founder decision 2026-10-02). A remotely flippable
+ *   value would let a mis-click discount every eligible checkout or withdraw an
+ *   offer a visitor is counting down to; it changes only through Doppler.
  * - OXYGEN_CREDIT_GATE_ENABLED — (b). Lets a connect through on the balance
  *   instead of a sending seat (`packages/shared/src/credit-gate.ts`). A wrong
  *   "on" while commitments do not bill every connectable kind would admit
@@ -91,6 +96,7 @@ export const NEVER_FLAGGABLE = [
     "OXYGEN_TRIGGER_DEFAULT_CAPS",
     "OXYGEN_BYOK_DAILY_CAPS",
     "OXYGEN_REPRICING_2026_09_EFFECTIVE_AT",
+    "OXYGEN_FIRST_MONTH_OFFER_COUPON",
     "OXYGEN_CREDIT_GATE_ENABLED",
     "OXYGEN_MCP_EVENTS_ENABLED",
 ];

package/node_modules/@oxygen/shared/dist/first-month-offer-window.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The first-month offer's 24-hour window and the browser's record of it, with no
+ * plan catalog. The offer banner and the app shell run in the browser and import
+ * this; importing `first-month-offer.ts` there pulled the whole billing catalog
+ * into every dashboard route (+16 KB gzip) and every website page (+8 KB),
+ * which the release battery's bundle budget refused on 2026-10-03. Prices stay
+ * in `first-month-offer.ts`: a server computes the banner's headline with
+ * `firstMonthOfferHeadline()` and hands it down.
+ */
+/** How long a person has to claim the offer after first seeing it. */
+export declare const FIRST_MONTH_OFFER_WINDOW_MS: number;
+/**
+ * First-party cookie holding when this browser first saw the offer, in epoch
+ * milliseconds. Readable by the page so the countdown needs no request; signup
+ * copies it onto the workspace, after which the workspace's own record decides.
+ * Clearing it starts a new window, which the founder accepted (2026-10-02).
+ */
+export declare const FIRST_MONTH_OFFER_SEEN_COOKIE = "ox_first_month_offer_seen";
+/** How long the browser keeps the start, so an expired window stays expired. */
+export declare const FIRST_MONTH_OFFER_SEEN_MAX_AGE_SECONDS: number;
+/** What the banner says: "50% off your first month on every plan from $99". */
+export type FirstMonthOfferHeadline = {
+    percentOff: number;
+    /** The cheapest size the offer covers, at its regular monthly price. */
+    fromCents: number;
+};
+/** When a window that started at `startedAtMs` closes. */
+export declare function firstMonthOfferEndsAt(startedAtMs: number): number;
+/**
+ * A remembered start, or null when there is none worth trusting: not a number,
+ * in the future (beyond a minute of clock skew), or older than the cookie may
+ * live. A start the browser invented is no worse than a cleared cookie.
+ */
+export declare function parseFirstMonthOfferStart(raw: string | null | undefined, nowMs: number): number | null;