@oxygen-agent/cli 1.1014.136 → 1.1014.619

package/node_modules/@oxygen/shared/dist/knowledge-bootstrap.d.ts

@@ -151,14 +151,18 @@ export type KnowledgeBootstrapMarker = {
     completed_at: string | null;
     /** `ox_runs.runs` id (source_type `system`) carrying the observable run. */
     run_id: string | null;
-    /** Managed credits actually spent, across every phase. Never exceeds the cap. */
+    /** Managed accounting total across every phase. When effect_outcome is unknown,
+     * this is a conservative bound rather than measured spend. Never exceeds the cap. */
     credits_used: number;
     /**
      * `unknown` when the pass stopped with no record of which provider calls it made: a
      * legacy attempt closed as `interrupted_without_checkpoint`. `credits_used` is then
-     * not a measurement, and nothing about what was read or spent may be claimed.
+     * not a measurement. A customer read can also qualify saved research whose
+     * current checkpoint retains an unconfirmed paid lookup.
      */
     effect_outcome?: "unknown";
+    /** Read projection only: saved research remains available despite an unconfirmed lookup. */
+    research_available?: boolean;
     /**
      * The workspace domain researched (from organizations.iconDomain). Null (stored
      * as "", the key the execution and onboarding checks compare on) for a company

package/node_modules/@oxygen/shared/dist/knowledge-seed-content.d.ts

@@ -2,14 +2,18 @@ import type { KnowledgePageType, KnowledgePageStatus } from "./knowledge-constan
 /** Monotonic scaffold cursor stored in knowledge_state.scaffold_version. Bump to ship a
  *  new wave of starter pages (tag them with a higher minScaffoldVersion).
  *  v1: the 9-page core. v2: twelve GTM stubs (voice/brand/messaging/objections, three
- *  motion playbooks + qualification, and the personas/customers/research/metrics hubs). */
+ *  motion playbooks + qualification, and the personas/customers/research/metrics hubs).
+ *  On 2026-10-12 both waves were retired for the two-page set below and the cursor stayed
+ *  at 2: it is stored per workspace and never moves backwards, so a workspace already at
+ *  2 keeps what it has, one at 1 receives nothing more, and a fresh one seeds the two
+ *  pages and records 2. The next wave is minScaffoldVersion 3. */
 export declare const KNOWLEDGE_SCAFFOLD_VERSION = 2;
 export type KnowledgeScaffoldPage = {
     /** Immutable slug; must be valid kebab grammar and NOT a reserved slug. */
     slug: string;
     type: KnowledgePageType;
     title: string;
-    /** Nav pages ship active; content stubs ship draft so they never ground AI copy. */
+    /** Seeded pages ship draft so they never ground AI copy; only the retired nav pages shipped active. */
     status: Extract<KnowledgePageStatus, "active" | "draft">;
     tags: string[];
     summary: string;
@@ -24,11 +28,17 @@ export type KnowledgeScaffoldPage = {
     researchable?: boolean;
 };
 /**
- * The 21-page starter pack. Two active nav pages first (start-here + the conventions
- * schema page), then nineteen draft stub hubs (tag `seed`) — seven from wave 1 and
- * twelve from wave 2. `positioning` seeds as a NON-canonical draft so it writes freely;
- * pinning canonical positioning stays a separate human-approved act. Wave 2 adds ZERO
- * active pages, per the binding rule at the top of this file.
+ * The 21-page starter set workspaces were seeded with until 2026-10-12, verbatim: two
+ * active nav pages (start-here + the conventions schema page), then nineteen draft stub
+ * hubs (tag `seed`) — seven from wave 1 and twelve from wave 2. No longer seeded.
+ * Workspaces created before then still hold every copy nobody edited, so readers of
+ * stored pages (the ChatGPT profile's sanitizer) are tested against these exact bodies,
+ * and any cleanup of untouched copies must compare against them rather than guess.
+ */
+export declare const RETIRED_KNOWLEDGE_SEED_PAGES: readonly KnowledgeScaffoldPage[];
+/**
+ * The starter set: the ICP and Offers documents, each a draft stub (tag `seed`) linked to
+ * the other, so a fresh workspace's graph is two connected files instead of a scaffold.
  */
 export declare const KNOWLEDGE_SEED_PAGES: readonly KnowledgeScaffoldPage[];
 /**

package/node_modules/@oxygen/shared/dist/knowledge-seed-content.js

@@ -1,8 +1,10 @@
-// Knowledge Graph starter pack (the Karpathy LLM-wiki scaffold). A fresh workspace
-// self-seeds this page set at tenant provisioning / first onboarding / `oxygen knowledge
-// seed`, so the wiki arrives alive: two active nav pages ([[start-here]] + the
-// [[conventions]] schema page) and nineteen draft stub hubs that show the shape of a
-// healthy second brain without grounding any AI copy until a human fills them.
+// Knowledge Graph starter set. A fresh workspace self-seeds these pages at tenant
+// provisioning / first onboarding / `oxygen knowledge seed`: the ICP and Offers documents,
+// as draft stubs. They are the two the onboarding conversation fills first (offer → ICP)
+// and the two every GTM motion reads. Nothing else is seeded (Tim, 2026-10-12): the
+// earlier 21-page set — a start-here guide, a conventions schema page and nineteen hub
+// stubs — read as bloat and confused new users. Agents and users create any other page
+// when there is something real to put in it.
 //
 // The seeder (tenant-db `ensureKnowledgeScaffold`) is purely additive and version-gated:
 // it creates a page only when its slug is free (never overwriting a user's edits) and
@@ -11,9 +13,8 @@
 // never rewritten by the scaffold. Bodies are the single source of truth for the starter
 // content — keep them dense and wikilinked.
 //
-// BINDING RULE — a scaffold wave adds ZERO active pages. Every content page ships
-// `status: "draft"` with `seed` in its tags; only the two nav pages are active, and they
-// are written full rather than as stubs. `retrieveWorkspaceKnowledge` selects on
+// BINDING RULE — the scaffold adds ZERO active pages. Every seeded page ships
+// `status: "draft"` with `seed` in its tags. `retrieveWorkspaceKnowledge` selects on
 // `status = 'active'` with MIN_BODY_CHARS = 80, so an ACTIVE stub is grounding material:
 // "Stub — fill me. ## Firmographics —" would be injected verbatim into a customer's cold
 // email as company knowledge. Promoting a stub to active is the user's act, never the
@@ -22,12 +23,15 @@
 // NEVER SEED `outreach-learnings`, `won-lost-learnings`, or `meeting-learnings`. tenant-db
 // `ensureLearningsPage` get-or-creates them as `active` on the first reply, deal, or
 // meeting and returns an existing row UNTOUCHED — seeding them as draft stubs would pin
-// them draft forever and silently break the learning loop's read half. They stay dashed
-// unresolved links in [[campaign-learnings]] until the loop creates them for real.
+// them draft forever and silently break the learning loop's read half.
 /** Monotonic scaffold cursor stored in knowledge_state.scaffold_version. Bump to ship a
  *  new wave of starter pages (tag them with a higher minScaffoldVersion).
  *  v1: the 9-page core. v2: twelve GTM stubs (voice/brand/messaging/objections, three
- *  motion playbooks + qualification, and the personas/customers/research/metrics hubs). */
+ *  motion playbooks + qualification, and the personas/customers/research/metrics hubs).
+ *  On 2026-10-12 both waves were retired for the two-page set below and the cursor stayed
+ *  at 2: it is stored per workspace and never moves backwards, so a workspace already at
+ *  2 keeps what it has, one at 1 receives nothing more, and a fresh one seeds the two
+ *  pages and records 2. The next wave is minScaffoldVersion 3. */
 // KNOWN LIMITATION of a create-only seeder, accepted deliberately: on a workspace
 // UPGRADED from an earlier wave, the new pages get no inbound links, because the hub that
 // would link them (start-here) already exists and the scaffold never rewrites an existing
@@ -472,13 +476,14 @@ This page holds definitions and targets — argued over once, then reused. The v
 Moving a target is a call: record it in [[decisions]] with its reversal condition. Why it moved is evidence: that goes to [[campaign-learnings]].
 `;
 /**
- * The 21-page starter pack. Two active nav pages first (start-here + the conventions
- * schema page), then nineteen draft stub hubs (tag `seed`) — seven from wave 1 and
- * twelve from wave 2. `positioning` seeds as a NON-canonical draft so it writes freely;
- * pinning canonical positioning stays a separate human-approved act. Wave 2 adds ZERO
- * active pages, per the binding rule at the top of this file.
+ * The 21-page starter set workspaces were seeded with until 2026-10-12, verbatim: two
+ * active nav pages (start-here + the conventions schema page), then nineteen draft stub
+ * hubs (tag `seed`) — seven from wave 1 and twelve from wave 2. No longer seeded.
+ * Workspaces created before then still hold every copy nobody edited, so readers of
+ * stored pages (the ChatGPT profile's sanitizer) are tested against these exact bodies,
+ * and any cleanup of untouched copies must compare against them rather than guess.
  */
-export const KNOWLEDGE_SEED_PAGES = [
+export const RETIRED_KNOWLEDGE_SEED_PAGES = [
     {
         slug: "start-here",
         type: "topic",
@@ -698,6 +703,65 @@ export const KNOWLEDGE_SEED_PAGES = [
         minScaffoldVersion: 2,
     },
 ];
+const STARTER_ICP_BODY = `# ICP — ideal customer profile
+
+> **Stub — fill me.** Replace this with real, cited content, then set \`status: active\`. No approval needed; a draft never grounds AI copy.
+
+## Firmographics
+- Company type / size / stage:
+- Industry / vertical:
+- Geography:
+
+## Buyers
+- Who signs, who champions, who uses it day to day:
+
+## Triggers (why now)
+- Signals that a fit account is in-market:
+
+## Disqualifiers (hard no)
+- Who we should NOT pursue and why:
+
+## Basis
+- Cite the deals, calls, or market data this is drawn from. What we sell them is in [[offers]].
+`;
+const STARTER_OFFERS_BODY = `# Offers
+
+> **Stub — fill me.** Replace this with real, cited content, then set \`status: active\`. No approval needed; a draft never grounds AI copy.
+
+## Offers
+For each: name, who it's for ([[icp]]), price/packaging, the outcome it delivers, and qualifying criteria.
+
+- Offer 1 —
+- Offer 2 —
+`;
+/**
+ * The starter set: the ICP and Offers documents, each a draft stub (tag `seed`) linked to
+ * the other, so a fresh workspace's graph is two connected files instead of a scaffold.
+ */
+export const KNOWLEDGE_SEED_PAGES = [
+    {
+        slug: "icp",
+        type: "strategy",
+        title: "ICP — ideal customer profile",
+        status: "draft",
+        tags: ["seed", "icp"],
+        summary: "Stub: the ideal customer profile — firmographics, buyers, triggers, and disqualifiers that define who we sell to. Fill with cited content and set active.",
+        body: STARTER_ICP_BODY,
+        minScaffoldVersion: 1,
+        researchable: true,
+    },
+    {
+        slug: "offers",
+        type: "strategy",
+        title: "Offers",
+        status: "draft",
+        tags: ["seed", "offers"],
+        summary: "Stub: what we sell — packages, pricing, and the qualifying criteria per offer. Fill with cited content and set active.",
+        body: STARTER_OFFERS_BODY,
+        minScaffoldVersion: 1,
+        researchable: true,
+    },
+];
 /**
  * Seed slugs a domain-grounded research pass could genuinely draft from the company's
  * PUBLIC web presence — what they sell, who they say they sell to, how they sound, who

package/node_modules/@oxygen/shared/dist/langfuse.js

@@ -287,6 +287,7 @@ function createOtelEmitter(env, warn, summary) {
                     let status;
                     let failureKind = "transport_failed";
                     let attempts = 0;
+                    let deliveryPhase = "request";
                     for (let attempt = 0; attempt < 3; attempt++) {
                         const remaining = LANGFUSE_EXPORT_BUDGET_MS - (Date.now() - startedAt);
                         if (remaining <= 0)
@@ -295,6 +296,7 @@ function createOtelEmitter(env, warn, summary) {
                         status = undefined;
                         const signal = AbortSignal.timeout(Math.min(LANGFUSE_EXPORT_TIMEOUT_SECONDS * 1000, remaining));
                         let response;
+                        deliveryPhase = "request";
                         try {
                             try {
                                 response = await fetch(exportUrl, { method: "POST", headers: exportHeaders, body, signal, redirect: "error" });
@@ -307,6 +309,7 @@ function createOtelEmitter(env, warn, summary) {
                                 await response.body?.cancel().catch(() => { });
                                 throw new Error("http_rejected");
                             }
+                            deliveryPhase = "acknowledgement";
                             const chunks = [];
                             let bytes = 0;
                             const reader = response.body?.getReader();
@@ -358,11 +361,12 @@ function createOtelEmitter(env, warn, summary) {
                         catch (error) {
                             failureKind = error instanceof Error ? error.message : "transport_failed";
                             const retryable = ["deadline_exceeded", "network_failed", "response_read_failed"].includes(failureKind)
-                                || (failureKind === "http_rejected" && [429, 502, 503, 504].includes(status ?? 0));
+                                // Langfuse surfaces temporary S3 upload refusals as HTTP 500.
+                                || (failureKind === "http_rejected" && [429, 500, 502, 503, 504].includes(status ?? 0));
                             if (!retryable || attempt === 2) {
                                 // Carry fixed classifications and numbers only, never an SDK or
                                 // receiver error that could quote the request/response payload.
-                                throw Object.assign(new Error(failureKind), { attempts: attempt + 1, status });
+                                throw Object.assign(new Error(failureKind), { attempts: attempt + 1, status, deliveryPhase, elapsedMs: Date.now() - startedAt });
                             }
                             const pause = 100 * (attempt + 1);
                             if (LANGFUSE_EXPORT_BUDGET_MS - (Date.now() - startedAt) <= pause)
@@ -371,7 +375,7 @@ function createOtelEmitter(env, warn, summary) {
                             await new Promise((resolve) => setTimeout(resolve, pause));
                         }
                     }
-                    throw Object.assign(new Error(failureKind), { attempts, status });
+                    throw Object.assign(new Error(failureKind), { attempts, status, deliveryPhase, elapsedMs: Date.now() - startedAt });
                 };
                 const privateExporter = {
                     export: (spans, done) => {
@@ -391,7 +395,7 @@ function createOtelEmitter(env, warn, summary) {
                             summary.maybeReport();
                             const details = error;
                             warn(error, { stage: "export", observation_count: spans.length, failure_kind: failureKind,
-                                attempts: details.attempts, http_status: details.status });
+                                attempts: details.attempts, http_status: details.status, delivery_phase: details.deliveryPhase, elapsed_ms: details.elapsedMs });
                         });
                         pendingExports.add(pending);
                         // Even an unexpected SDK callback failure must not create a rejected

package/node_modules/@oxygen/shared/dist/mailbox-egress-ownership.d.ts

@@ -1,7 +1,7 @@
 export declare const MAILBOX_EGRESS_MODE_ENV = "OXYGEN_MAILBOX_EGRESS_MODE";
 export type MailboxEgressMode = "direct" | "proxy";
 /** `proxy` only when explicitly selected; anything else keeps today's transport. */
-export declare function readMailboxEgressMode(env?: NodeJS.ProcessEnv): MailboxEgressMode;
+export declare function readMailboxEgressMode(env?: Readonly<Record<string, string | undefined>>): MailboxEgressMode;
 export type DedicatedEgressInventoryRow = {
     id: string;
     organizationId: string | null;

package/node_modules/@oxygen/shared/dist/mailbox-import.d.ts

@@ -44,7 +44,7 @@ export type MailboxImportValidationSummary = {
 };
 export type MailboxOAuthProviderReviewPlan = {
     mailboxes: number;
-    authorization_mode: "individual" | "tenant";
+    authorization_mode: "individual";
     batch_size: number;
     batches: number;
     batch_sizes: number[];
@@ -56,6 +56,7 @@ export type MailboxOAuthReviewPlan = {
     existing_grants_checked: false;
     /** Backward-compatible individual OAuth review size. */
     batch_size: number;
+    /** Address limit of the agent-only Microsoft tenant connection; no planned batch uses it. */
     tenant_batch_size: number;
     total_batches: number;
     providers: {
@@ -93,8 +94,10 @@ export declare function summarizeMailboxImportValidation(mailboxes: readonly Nor
  * authorization. This is safe during local file validation: it uses only
  * normalized provider counts, performs no directory discovery, and does not
  * claim to know whether a workspace already holds a usable grant for an address.
- * Multi-mailbox Microsoft imports recommend one tenant-admin batch; a single
- * Microsoft mailbox and all Google mailboxes retain individual OAuth.
+ * Google and Microsoft plan the same individual sign-in batches: the app connects
+ * both one way (decision 2026-10-14). The one-administrator Microsoft tenant
+ * connection is an explicit agent option (`connect-oauth --vendor oxygen
+ * --authorization-mode tenant`, up to `tenant_batch_size` addresses), never planned.
  */
 export declare function planMailboxOAuthReviews(mailboxes: readonly Pick<NormalizedMailboxImportRow, "provider">[]): MailboxOAuthReviewPlan;
 export declare function normalizeMailboxImportVendor(raw: string | null | undefined, from: string | null | undefined): string | null;

package/node_modules/@oxygen/shared/dist/mailbox-import.js

@@ -233,18 +233,17 @@ export function summarizeMailboxImportValidation(mailboxes, input) {
  * authorization. This is safe during local file validation: it uses only
  * normalized provider counts, performs no directory discovery, and does not
  * claim to know whether a workspace already holds a usable grant for an address.
- * Multi-mailbox Microsoft imports recommend one tenant-admin batch; a single
- * Microsoft mailbox and all Google mailboxes retain individual OAuth.
+ * Google and Microsoft plan the same individual sign-in batches: the app connects
+ * both one way (decision 2026-10-14). The one-administrator Microsoft tenant
+ * connection is an explicit agent option (`connect-oauth --vendor oxygen
+ * --authorization-mode tenant`, up to `tenant_batch_size` addresses), never planned.
  */
 export function planMailboxOAuthReviews(mailboxes) {
     const counts = { google: 0, microsoft: 0 };
     for (const mailbox of mailboxes)
         counts[mailbox.provider] += 1;
-    const google = planProviderOAuthReviews(counts.google, MAILBOX_OAUTH_REVIEW_BATCH_SIZE, "individual");
-    const microsoftMode = counts.microsoft > 1 ? "tenant" : "individual";
-    const microsoft = planProviderOAuthReviews(counts.microsoft, microsoftMode === "tenant"
-        ? MAILBOX_IMPORT_ROW_LIMIT
-        : MAILBOX_OAUTH_REVIEW_BATCH_SIZE, microsoftMode);
+    const google = planProviderOAuthReviews(counts.google);
+    const microsoft = planProviderOAuthReviews(counts.microsoft);
     return {
         authorization: "exact_account_oauth",
         scope: "validated_addresses",
@@ -256,7 +255,8 @@ export function planMailboxOAuthReviews(mailboxes) {
         providers: { google, microsoft },
     };
 }
-function planProviderOAuthReviews(mailboxes, batchSize, authorizationMode) {
+function planProviderOAuthReviews(mailboxes) {
+    const batchSize = MAILBOX_OAUTH_REVIEW_BATCH_SIZE;
     const fullBatches = Math.floor(mailboxes / batchSize);
     const remainder = mailboxes % batchSize;
     const batchSizes = Array.from({ length: fullBatches }, () => batchSize);
@@ -264,7 +264,7 @@ function planProviderOAuthReviews(mailboxes, batchSize, authorizationMode) {
         batchSizes.push(remainder);
     return {
         mailboxes,
-        authorization_mode: authorizationMode,
+        authorization_mode: "individual",
         batch_size: batchSize,
         batches: batchSizes.length,
         batch_sizes: batchSizes,

package/node_modules/@oxygen/shared/dist/mcp-server-info.d.ts

@@ -0,0 +1,8 @@
+export declare const OXYGEN_MCP_SERVER_NAME = "oxygen";
+export declare const OXYGEN_MCP_SERVER_TITLE = "Oxygen GTM";
+export declare const MCP_SERVER_INFO_META_KEY = "io.modelcontextprotocol/serverInfo";
+export declare const OXYGEN_MCP_SERVER_INFO: {
+    name: string;
+    version: string;
+    title: string;
+};

package/node_modules/@oxygen/shared/dist/mcp-server-info.js

@@ -0,0 +1,10 @@
+import { OXYGEN_VERSION } from "./version.js";
+// Shared by the serving MCP transport and native result-window projections.
+export const OXYGEN_MCP_SERVER_NAME = "oxygen";
+export const OXYGEN_MCP_SERVER_TITLE = "Oxygen GTM";
+export const MCP_SERVER_INFO_META_KEY = "io.modelcontextprotocol/serverInfo";
+export const OXYGEN_MCP_SERVER_INFO = {
+    name: OXYGEN_MCP_SERVER_NAME,
+    version: OXYGEN_VERSION,
+    title: OXYGEN_MCP_SERVER_TITLE,
+};

package/node_modules/@oxygen/shared/dist/object-storage.d.ts

@@ -231,3 +231,13 @@ export declare function deleteInboxAvatarObject(input: {
 export declare function deleteImportObject(input: {
     storageKey: string;
 }): Promise<void>;
+/**
+ * Delete a file a person attached in a Copilot chat, when the chat itself is
+ * deleted (an Oxygent deleted for good, ADR 0032). The organization's own
+ * prefix is required, for the reason `deleteInboxAvatarObject` gives: one bucket
+ * holds every tenant's uploads, and these keys come back out of durable state.
+ */
+export declare function deleteCopilotAttachmentObject(input: {
+    storageKey: string;
+    organizationId: string;
+}): Promise<void>;

package/node_modules/@oxygen/shared/dist/object-storage.js

@@ -464,6 +464,20 @@ export async function deleteImportObject(input) {
     const { client, config } = resolveClient();
     await client.send(new DeleteObjectCommand({ Bucket: config.bucket, Key: input.storageKey }));
 }
+/**
+ * Delete a file a person attached in a Copilot chat, when the chat itself is
+ * deleted (an Oxygent deleted for good, ADR 0032). The organization's own
+ * prefix is required, for the reason `deleteInboxAvatarObject` gives: one bucket
+ * holds every tenant's uploads, and these keys come back out of durable state.
+ */
+export async function deleteCopilotAttachmentObject(input) {
+    assertAppStorageWriteAllowed();
+    if (!isCopilotAttachmentObjectKeyForOrganization(input.storageKey, input.organizationId)) {
+        throw new OxygenError("invalid_object_key", "Refusing to delete an object outside this organization's Copilot attachments.", { details: { prefix: input.storageKey.split("/")[0] ?? "" }, exitCode: 1 });
+    }
+    const { client, config } = resolveClient();
+    await client.send(new DeleteObjectCommand({ Bucket: config.bucket, Key: input.storageKey }));
+}
 function sanitizeFileName(fileName) {
     if (!fileName)
         return "";

package/node_modules/@oxygen/shared/dist/plan-limits-view.d.ts

@@ -70,6 +70,9 @@ export type PlanLimitsWorkflowLimits = {
     run_attempt_timeout_minutes?: number;
 };
 export type PlanLimitsStorageCapacity = {
+    status?: string;
+    effective_at?: string | null;
+    target?: PlanLimitsStorageTarget | null;
     platform_guard?: {
         table_row_limit?: number;
         workspace_row_limit?: number;
@@ -179,6 +182,8 @@ export declare function planLimitsLadder(payload: PlanLimitsEnvelope): PlanLimit
  * named, so a full one is identifiable (decision F.2).
  */
 export declare function planLimitsStorageUsageLine(storage: PlanLimitsStorageCapacity | undefined): string | null;
+/** Pending capacity never supplies current headroom or an inferred date. */
+export declare function planLimitsStoragePendingLine(storage: PlanLimitsStorageCapacity | undefined): string | null;
 /** Status of the largest active Table, from the same flags CLI and MCP read. */
 export declare function planLimitsTableStatus(storage: PlanLimitsStorageCapacity | undefined): "full" | "nearly full" | null;
 /** Sending limits are the same on every plan: one row per channel. */

package/node_modules/@oxygen/shared/dist/plan-limits-view.js

@@ -180,7 +180,7 @@ export function planLimitsLadder(payload) {
         notes.push(`"→" marks a limit that changes on ${payload.pricing_schedule.effective_at.slice(0, 10)}.`);
     }
     if (bands.some(awaitingCapacityTest)) {
-        notes.push(`"${AWAITING_TEST_MARK}" rises once the rows-per-table capacity test at that plan size passes.`);
+        notes.push(`"${AWAITING_TEST_MARK}" is planned capacity, not in force. It requires a capacity test at that plan size; no activation date is set.`);
     }
     return {
         bands: bands.map((row) => ({ band: row.band ?? "", label: row.label ?? row.band ?? "", current: row.current === true })),
@@ -207,8 +207,24 @@ export function planLimitsStorageUsageLine(storage) {
         `workspace ${formatLimitCount(usage.workspace_rows)} / ${formatLimitCount(guard.workspace_row_limit)} rows`,
         `database ${formatLimitBytes(usage.workspace_database_bytes)} / ${formatLimitBytes(guard.workspace_database_limit_bytes)}`,
     ];
+    if (typeof usage.workspace_rows === "number" && typeof guard.workspace_row_limit === "number") {
+        parts.push(`${formatLimitCount(Math.max(0, guard.workspace_row_limit - usage.workspace_rows))} workspace rows remaining`);
+    }
     return `Your storage: ${parts.join(" · ")}`;
 }
+/** Pending capacity never supplies current headroom or an inferred date. */
+export function planLimitsStoragePendingLine(storage) {
+    const target = storage?.target;
+    if (!target)
+        return null;
+    if (storage.status === "awaiting_capacity_test" && typeof target.table_row_limit === "number") {
+        return `A rise to ${formatLimitCount(target.table_row_limit)} rows per Table is planned but not in force. It requires a capacity test at this plan size; no activation date is set.`;
+    }
+    if (storage.status === "scheduled" && storage.effective_at) {
+        return `From ${storage.effective_at.slice(0, 10)}: ${formatLimitCount(target.table_row_limit)} rows per Table, ${formatLimitCount(target.workspace_row_limit)} in the workspace and ${formatLimitBytes(target.workspace_database_limit_bytes)} of Table data.`;
+    }
+    return null;
+}
 /** Status of the largest active Table, from the same flags CLI and MCP read. */
 export function planLimitsTableStatus(storage) {
     if (storage?.usage?.table_limit_reached === true)

package/node_modules/@oxygen/shared/dist/pricing-sheet.d.ts

@@ -219,7 +219,7 @@ export declare const SENDING_DOMAIN_CREDITS_PER_YEAR_TYPICAL = 1250;
  * inverts its own margin: at $1.00/inbox-month the EIGHTH test in a cycle was
  * already sold at a loss. Two included tests cost $0.265 against $1.00 of
  * revenue at today's price, and everything past them bills
- * PLACEMENT_TEST_OVERAGE_CREDITS. Orgs on their own EmailGuard key (BYOK) pay 0.
+ * PLACEMENT_TEST_OVERAGE_CREDITS. Own-key tests pay the separate OXYGEN platform fee, without consuming this allowance.
  *
  * Monitoring is 100 credits per inbox-month (founder, 2026-10-07; the 2026-09
  * repricing had set 135). The extra test is the RATIFIED 66 (slice S30), whose rise

package/node_modules/@oxygen/shared/dist/pricing-sheet.js

@@ -206,7 +206,7 @@ export const SENDING_DOMAIN_CREDITS_PER_YEAR_TYPICAL = SNAPSHOT_SENDING_DOMAIN_C
  * inverts its own margin: at $1.00/inbox-month the EIGHTH test in a cycle was
  * already sold at a loss. Two included tests cost $0.265 against $1.00 of
  * revenue at today's price, and everything past them bills
- * PLACEMENT_TEST_OVERAGE_CREDITS. Orgs on their own EmailGuard key (BYOK) pay 0.
+ * PLACEMENT_TEST_OVERAGE_CREDITS. Own-key tests pay the separate OXYGEN platform fee, without consuming this allowance.
  *
  * Monitoring is 100 credits per inbox-month (founder, 2026-10-07; the 2026-09
  * repricing had set 135). The extra test is the RATIFIED 66 (slice S30), whose rise

package/node_modules/@oxygen/shared/dist/provider-selection.d.ts

@@ -0,0 +1,15 @@
+/** Staff inventory metadata; configuration is not a health or entitlement verdict. */
+export type ProductProviderRail = {
+    provider: string;
+    supplier: string;
+    uses: string[];
+    selection: "default" | "conditional" | "legacy";
+    condition: string;
+    source: string;
+    required_env: string[];
+    /** At least one alternative is required, in addition to every required_env. */
+    required_env_any?: string[];
+    key_configured: boolean;
+    economics: string;
+};
+export declare function formatProviderEnvRequirements(required: readonly string[], alternatives?: readonly string[]): string;

package/node_modules/@oxygen/shared/dist/provider-selection.js

@@ -0,0 +1,3 @@
+export function formatProviderEnvRequirements(required, alternatives = []) {
+    return [...required, ...(alternatives.length ? [`(${alternatives.join(" or ")})`] : [])].join(" + ");
+}

package/node_modules/@oxygen/shared/dist/repricing.d.ts

@@ -123,7 +123,7 @@ export declare function deliverabilitySeatCredits(): number;
 /**
  * S30 (decision 3.6; flat literal, proposal P-29): one managed placement test
  * past an inbox's included allowance, or on an inbox with no monitoring
- * subscription, 16.6 -> 66 credits. Tests on your own EmailGuard key stay 0.
+ * subscription, 16.6 -> 66 credits. Own-key calls pay the separate platform fee.
  */
 export declare const PLACEMENT_TEST_REPRICING: RepricedValue<16.6 | 66>;
 /** One managed placement test beyond the included allowance, in credits, at the price in force. */

package/node_modules/@oxygen/shared/dist/repricing.js

@@ -300,7 +300,7 @@ export function deliverabilitySeatCredits() {
 /**
  * S30 (decision 3.6; flat literal, proposal P-29): one managed placement test
  * past an inbox's included allowance, or on an inbox with no monitoring
- * subscription, 16.6 -> 66 credits. Tests on your own EmailGuard key stay 0.
+ * subscription, 16.6 -> 66 credits. Own-key calls pay the separate platform fee.
  */
 export const PLACEMENT_TEST_REPRICING = defineRepricedValue({
     key: "overage.placement_test",
@@ -308,7 +308,7 @@ export const PLACEMENT_TEST_REPRICING = defineRepricedValue({
     slice: "S30",
     decision: "3.6",
     unit: "credits_per_test",
-    description: "One managed inbox-placement test beyond an inbox's included tests. Tests on your own EmailGuard key cost 0.",
+    description: "One managed inbox-placement test beyond an inbox's included tests. Own-key calls pay the separate OXYGEN platform fee.",
     before: 16.6,
     after: SNAPSHOT_PLACEMENT_TEST_CREDITS,
 });

package/node_modules/@oxygen/shared/dist/schedule-label.d.ts

@@ -1 +1,7 @@
+/**
+ * Whether `cron` is five fields in the grammar above (`*`, `N`, `N-M`, `/step`,
+ * comma lists). A syntax check only: whether a schedule ever fires, and how
+ * often, is the Workflows scheduler's to answer (`nextCronRunAfter`).
+ */
+export declare function isCronSyntax(cron: string): boolean;
 export declare function humanizeCronSchedule(cron: string): string | null;

package/node_modules/@oxygen/shared/dist/schedule-label.js

@@ -86,6 +86,18 @@ function dayNames(days) {
         .map((day) => DAY_NAMES[day])
         .join(", ");
 }
+/**
+ * Whether `cron` is five fields in the grammar above (`*`, `N`, `N-M`, `/step`,
+ * comma lists). A syntax check only: whether a schedule ever fires, and how
+ * often, is the Workflows scheduler's to answer (`nextCronRunAfter`).
+ */
+export function isCronSyntax(cron) {
+    const fields = cron.trim().split(/\s+/);
+    if (fields.length !== 5)
+        return false;
+    const ranges = [MINUTE_RANGE, HOUR_RANGE, DAY_OF_MONTH_RANGE, MONTH_RANGE, DAY_OF_WEEK_RANGE];
+    return fields.every((field, index) => expandCronField(field, ranges[index]) !== null);
+}
 export function humanizeCronSchedule(cron) {
     const fields = cron.trim().split(/\s+/);
     if (fields.length !== 5)

package/node_modules/@oxygen/shared/dist/sequence-failures.d.ts

@@ -1,5 +1,6 @@
 export declare const SEQUENCE_FAILURE_SCHEMA_VERSION = 1;
 export declare const SEQUENCE_FAILURE_RETRY_AFTER_MAX_MS: number;
+export declare const WHATSAPP_UNCERTAIN_DELIVERY_MESSAGE = "WhatsApp delivery is uncertain. Automatic resending is blocked.";
 export declare const SEQUENCE_FAILURE_CLASSES: readonly ["capacity", "recipient", "authorization_scope", "funding", "validation", "provider", "internal", "effect_unknown", "unknown"];
 export type SequenceFailureClass = (typeof SEQUENCE_FAILURE_CLASSES)[number];
 export type SequenceFailureEffectOutcome = "not_applied" | "applied" | "unknown";

package/node_modules/@oxygen/shared/dist/sequence-failures.js

@@ -3,6 +3,7 @@ import { isProviderFundingErrorCode, isProviderRateLimitErrorCode, } from "./pro
 import { asRecordOrNull as asRecord } from "./type-guards.js";
 export const SEQUENCE_FAILURE_SCHEMA_VERSION = 1;
 export const SEQUENCE_FAILURE_RETRY_AFTER_MAX_MS = 24 * 60 * 60 * 1000;
+export const WHATSAPP_UNCERTAIN_DELIVERY_MESSAGE = "WhatsApp delivery is uncertain. Automatic resending is blocked.";
 export const SEQUENCE_FAILURE_CLASSES = [
     "capacity",
     "recipient",
@@ -122,15 +123,28 @@ export function readSequenceFailure(error, overrides = {}) {
             "provider_status",
             "providerStatus",
         ]));
-    const retryable = overrides.retryable ?? firstBoolean(records, ["retryable"]);
-    const effectOutcome = overrides.effectOutcome ?? readEffectOutcome(records);
+    let retryable = overrides.retryable ?? firstBoolean(records, ["retryable"]);
+    let effectOutcome = overrides.effectOutcome ?? readEffectOutcome(records);
     const retryAfterMs = normalizeRetryAfterMs(overrides.retryAfterMs ?? readRetryAfterMs(records));
-    const hardBounce = overrides.hardBounce ??
+    let hardBounce = overrides.hardBounce ??
         firstBoolean(records, ["hard_bounce", "hardBounce"]);
+    // Older WhatsApp clients treated every provider/* response as proof that no
+    // message was sent, including gateway failures after dispatch. Neither the
+    // HTTP response nor that stale v1 envelope makes another write safe.
+    const uncertainWhatsAppGateway = rawCode === "whatsapp_conversation_unavailable"
+        && httpStatus !== null && httpStatus >= 500 && effectOutcome !== "applied";
+    const fault = uncertainWhatsAppGateway
+        ? { code: "provider_write_ambiguous", message: WHATSAPP_UNCERTAIN_DELIVERY_MESSAGE }
+        : redacted;
+    if (uncertainWhatsAppGateway) {
+        effectOutcome = "unknown";
+        retryable = false;
+        hardBounce = false;
+    }
     const existingClass = firstString(records, ["failure_class"]);
     const existingVersion = firstNumber(records, ["failure_schema_version"]);
     const classified = classifySequenceFailure({
-        code: redacted.code,
+        code: fault.code,
         providerSubtype,
         provider,
         httpStatus,
@@ -153,8 +167,8 @@ export function readSequenceFailure(error, overrides = {}) {
     return {
         failure_schema_version: SEQUENCE_FAILURE_SCHEMA_VERSION,
         failure_class: failureClass,
-        code: redacted.code,
-        message: redacted.message,
+        code: fault.code,
+        message: fault.message,
         ...(provider ? { provider } : {}),
         ...(operation ? { operation } : {}),
         ...(providerSubtype ? { provider_subtype: providerSubtype } : {}),