@oxygen-agent/cli 1.177.1 → 1.184.3

package/node_modules/@oxygen/shared/dist/signup-lead-webhook.js

@@ -0,0 +1,78 @@
+import { createHmac } from "node:crypto";
+// Shared transport contract for the signup-lead webhook. Both the request-time
+// direct emitter (apps/web/src/lib/signup-lead-webhook.ts) and the durable
+// worker retry queue (apps/worker/src/signup-lead-delivery-queue.ts) build the
+// same HMAC signature, Oxygen table/workflow secret headers, timeout, and
+// target classification. This module is the single source of truth so the two
+// paths cannot drift when the webhook auth/header contract changes (OXY-679).
+/** Request timeout shared by the direct emit and the durable worker retry. */
+export const SIGNUP_LEAD_WEBHOOK_TIMEOUT_MS = 10_000;
+/** True for the canonical Oxygen apex domain and its subdomains only. */
+export function isOxygenHostname(hostname) {
+    return (hostname === "oxygen-agent.com" || hostname.endsWith(".oxygen-agent.com"));
+}
+/**
+ * Classify a webhook target URL so the caller can decide whether to attach the
+ * internal table/workflow secret. Only genuine oxygen-agent.com hosts receive
+ * internal secrets; external hosts with Oxygen-looking paths are "external" and
+ * must never be trusted with the internal webhook secret.
+ */
+export function classifySignupLeadWebhookTarget(value) {
+    const target = typeof value === "string" ? value.trim() : "";
+    if (!target)
+        return "missing";
+    try {
+        const url = new URL(target);
+        if (!isOxygenHostname(url.hostname))
+            return "external";
+        if (url.pathname.startsWith("/api/webhooks/tables/")) {
+            return "oxygen_table_webhook";
+        }
+        if (url.pathname.startsWith("/api/webhooks/workflows/")) {
+            return "oxygen_workflow_webhook";
+        }
+        return "oxygen_internal";
+    }
+    catch {
+        return "invalid_url";
+    }
+}
+/** HMAC-SHA256 hex digest of the request body keyed by the webhook secret. */
+export function signSignupLeadWebhookBody(secret, body) {
+    return createHmac("sha256", secret).update(body).digest("hex");
+}
+/**
+ * Build the complete header set for a signup-lead webhook request. Produces
+ * identical output for the request-time emit and the durable worker retry so
+ * the two transports stay in lockstep. Header values fall back to safe defaults
+ * for the worker's untyped (DB-sourced) payload; for the web emitter's typed
+ * payload the fallbacks are no-ops.
+ */
+export function buildSignupLeadWebhookHeaders(input) {
+    const { webhookUrl, payload, body, secret } = input;
+    const now = input.now ?? new Date();
+    const headers = {
+        "content-type": "application/json",
+        "x-event-id": headerString(payload.event_id) ?? "",
+        "x-event-type": headerString(payload.type) ?? "signup_lead.event",
+        "x-event-time": headerString(payload.occurred_at) ?? now.toISOString(),
+        "x-oxygen-signup-source": headerString(payload.source) ?? "clerk",
+    };
+    if (secret) {
+        headers["x-oxygen-webhook-signature"] =
+            `sha256=${signSignupLeadWebhookBody(secret, body)}`;
+        headers["x-oxygen-webhook-signature-algorithm"] = "hmac-sha256";
+        headers["x-oxygen-webhook-signature-timestamp"] = String(Math.floor(now.getTime() / 1000));
+        const target = classifySignupLeadWebhookTarget(webhookUrl);
+        if (target === "oxygen_table_webhook") {
+            headers["x-oxygen-table-webhook-secret"] = secret;
+        }
+        else if (target === "oxygen_workflow_webhook") {
+            headers["x-oxygen-workflow-secret"] = secret;
+        }
+    }
+    return headers;
+}
+function headerString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}

package/node_modules/@oxygen/shared/dist/sql-error.d.ts

@@ -33,5 +33,17 @@ export declare function sqlErrorFields(error: unknown): Record<string, unknown>;
  * the generic error serializers would otherwise emit those values verbatim.
  */
 export declare function redactSqlParameters(text: string): string;
+/**
+ * True when the error is a Postgres serialization failure (40001) or deadlock
+ * (40P01) — the two "the transaction was aborted as a concurrency victim, retry
+ * the whole transaction" outcomes. Postgres aborts exactly one transaction in
+ * such a conflict and lets the other commit, so re-running the victim's
+ * transaction almost always succeeds once the winner has committed. Callers use
+ * this both to drive a bounded transaction retry and to surface a typed,
+ * retryable error (instead of an opaque unexpected_error) when retries are
+ * exhausted. Reuses the same SQLSTATE classifier as the telemetry helpers so the
+ * 40001/40P01 knowledge lives in one place. Never throws.
+ */
+export declare function isRetryableConcurrencyError(error: unknown): boolean;
 /** Telemetry-attribute shape (dotted keys) for span error attribution. */
 export declare function sqlErrorTelemetryAttributes(error: unknown): Record<string, unknown>;

package/node_modules/@oxygen/shared/dist/sql-error.js

@@ -146,6 +146,21 @@ export function redactSqlParameters(text) {
         return text;
     return text.replace(/\n[ \t]*params[ \t]*:[\s\S]*?(?=\n[ \t]*at\s|$)/i, "");
 }
+/**
+ * True when the error is a Postgres serialization failure (40001) or deadlock
+ * (40P01) — the two "the transaction was aborted as a concurrency victim, retry
+ * the whole transaction" outcomes. Postgres aborts exactly one transaction in
+ * such a conflict and lets the other commit, so re-running the victim's
+ * transaction almost always succeeds once the winner has committed. Callers use
+ * this both to drive a bounded transaction retry and to surface a typed,
+ * retryable error (instead of an opaque unexpected_error) when retries are
+ * exhausted. Reuses the same SQLSTATE classifier as the telemetry helpers so the
+ * 40001/40P01 knowledge lives in one place. Never throws.
+ */
+export function isRetryableConcurrencyError(error) {
+    const cause = describeSqlError(error)?.cause;
+    return cause === "serialization" || cause === "deadlock";
+}
 /** Telemetry-attribute shape (dotted keys) for span error attribution. */
 export function sqlErrorTelemetryAttributes(error) {
     const attribution = describeSqlError(error);

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const OXYGEN_VERSION = "1.177.1";
-export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.154.0";
+export declare const OXYGEN_VERSION = "1.184.3";
+export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,6 +1,8 @@
-export const OXYGEN_VERSION = "1.177.1";
+export const OXYGEN_VERSION = "1.184.3";
 // Bump this only when deployed CLI/API contracts require a newer CLI.
+// 1.181.0: paid table action runs and background columns run require
+// approved=true in addition to max_credits; older CLIs cannot send the flag.
 // 1.154.0: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
 // (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and
 // removed the old /api/cli/linkedin/* routes — older CLIs would 404.
-export const OXYGEN_MINIMUM_CLI_VERSION = "1.154.0";
+export const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -67,6 +67,7 @@ export type WorkflowToolStepManifest = {
     effect: WorkflowStepEffect;
     mode?: WorkflowMode;
     payload_source: string;
+    max_credits?: number;
 };
 export type WorkflowBranchStepManifest = {
     kind: "branch";
@@ -121,6 +122,7 @@ export type WorkflowManifest = {
     trigger?: WorkflowTriggerManifest;
     input_schema?: JsonSchema;
     steps: WorkflowStepManifest[];
+    max_credits?: number;
     source_hash: string;
     compiler_version: string;
     created_at: string;
@@ -139,6 +141,7 @@ export type RecipeManifest = {
     bundle_format: "esm";
     tools_used: string[];
     visual_plan?: RecipeVisualPlanManifest;
+    max_credits?: number;
     source_hash: string;
     compiler_version: typeof DURABLE_RECIPE_COMPILER_VERSION;
     created_at: string;
@@ -219,6 +222,7 @@ export type WorkflowDefinition = {
     specification?: string;
     trigger?: WorkflowTriggerDefinition;
     inputSchema?: JsonSchema;
+    maxCredits?: number;
     steps: WorkflowStepDefinition[];
 };
 export type WorkflowTriggerDefinition = WorkflowTriggerManifest;
@@ -237,6 +241,7 @@ export type WorkflowToolStepDefinition = {
     tool: string;
     effect?: WorkflowStepEffect;
     mode?: WorkflowMode;
+    maxCredits?: number;
     payload: WorkflowFunction;
 };
 export type WorkflowBranchStepDefinition = {
@@ -270,6 +275,7 @@ export declare function defineWorkflow(input: {
     specification?: string;
     trigger?: WorkflowTriggerDefinition;
     inputSchema?: JsonSchema;
+    maxCredits?: number;
     steps: WorkflowStepDefinition[];
 }): WorkflowDefinition;
 export declare function apiTrigger(input?: {
@@ -310,8 +316,22 @@ export declare function toolStep(input: {
     tool: string;
     effect?: WorkflowStepEffect;
     mode?: WorkflowMode;
+    maxCredits?: number;
     payload: WorkflowFunction;
 }): WorkflowToolStepDefinition;
+/**
+ * Conditional step. `condition` is evaluated; control then flows by mode:
+ *
+ * - then only (no `else`, no `join`) — GUARD: truthy continues to `then` (steps
+ *   between the branch and `then` are skipped); falsy skips straight to the end
+ *   of the workflow (no step after the branch runs) and the run completes.
+ * - then + else (no `join`) — skip-until-target jump to `then`/`else`; from the
+ *   chosen target, the remaining steps run sequentially through the end.
+ * - then + else + join — real if/else: the non-chosen arm is skipped and `join`
+ *   is the convergence point where shared downstream work resumes.
+ *
+ * All targets must be ids of later steps (branches are forward-only).
+ */
 export declare function branchStep(input: {
     id: string;
     description?: string;
@@ -339,6 +359,7 @@ export declare function buildRecipeManifest(input: {
     bundle: string;
     toolsUsed: string[];
     visualPlan?: RecipeVisualPlanManifest;
+    maxCredits?: number;
     sourceHash?: string;
     createdAt?: Date;
 }): RecipeManifest;
@@ -804,6 +825,7 @@ export declare function getWorkflowSchema(subject?: "apply" | "call" | "event" |
         };
     };
 };
+export declare function computeWorkflowPlanHash(input: Record<string, unknown>): string;
 export declare const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
 export declare function readWorkflowRunMaxCredits(metadata: Record<string, unknown> | null | undefined): number | null;
 export declare function readManagedToolRunCredits(output: unknown): number;

package/node_modules/@oxygen/workflows/dist/index.js

@@ -8,6 +8,9 @@ export const BLUEPRINT_COMPILER_VERSION = "oxygen-blueprints-v1";
 export const MAX_RECIPE_BUNDLE_BYTES = 2_000_000;
 export const MAX_BLUEPRINT_BYTES = 4_000_000;
 export const DEFAULT_WORKFLOW_CRON_TIMEZONE = "UTC";
+// Step ids that must not be used: they collide with JavaScript object internals
+// when the runtime assembles ctx.steps, so their outputs would be silently lost.
+const RESERVED_STEP_IDS = new Set(["__proto__", "constructor", "prototype"]);
 // Compatibility and determinism lint only. The Vercel sandbox process,
 // denied network policy, and runtime global guards are the security boundary.
 const UNSAFE_RECIPE_BUNDLE_PATTERNS = [
@@ -18,7 +21,11 @@ const UNSAFE_RECIPE_BUNDLE_PATTERNS = [
     { token: "XMLHttpRequest", pattern: /\bXMLHttpRequest\b/ }, // skipcq: SCT-A000
     { token: "WebSocket", pattern: /\bWebSocket\b/ },
     { token: "EventSource", pattern: /\bEventSource\b/ }, // skipcq: SCT-A000
-    { token: "require", pattern: /\brequire\b/ },
+    // Block CommonJS require(...) but allow a `.require` method access (the
+    // ctx.approvals.require() durable-approval API). A real global require is a
+    // bare identifier; any X.require on a dangerous global (globalThis/process/…)
+    // is already caught by that global's own rule above.
+    { token: "require", pattern: /(?<!\.)\brequire\b/ },
     { token: "dynamic import", pattern: /\bimport(?:\s|\/\*[\s\S]*?\*\/)*\(/ }, // skipcq: SCT-A000
     { token: "node module import", pattern: /\b(?:node:)?(?:fs|child_process|net|tls|http|https|dns|dgram|worker_threads)\b/ }, // skipcq: SCT-A000
     { token: "eval", pattern: /\beval\b/ },
@@ -44,6 +51,7 @@ export function defineWorkflow(input) {
         ...(input.specification ? { specification: input.specification } : {}),
         ...(input.trigger ? { trigger: input.trigger } : {}),
         ...(input.inputSchema ? { inputSchema: input.inputSchema } : {}),
+        ...(input.maxCredits != null ? { maxCredits: input.maxCredits } : {}),
         steps: input.steps,
     };
 }
@@ -85,18 +93,37 @@ export function eventTrigger(input) {
         ...(input.status ? { status: input.status } : {}),
     };
 }
+// Lookahead window for the next cron run. Must exceed the largest gap a *valid*
+// schedule can have, or legitimate sparse crons get falsely rejected: the worst
+// case is "Feb 29" across a century boundary (e.g. 2096 → 2104, an ~8-year gap,
+// since 2100 is not a leap year). The day-skipping scan below keeps even this
+// wide window cheap (~one zonedDateParts call per non-matching day).
+const MAX_CRON_LOOKAHEAD_DAYS = 366 * 8 + 2;
 export function nextCronRunAfter(input) {
     const schedule = parseCronSchedule(input.cron);
     const timezone = input.timezone?.trim() || DEFAULT_WORKFLOW_CRON_TIMEZONE;
     let candidate = roundUpToNextMinute(input.after ?? new Date());
-    const deadline = candidate.getTime() + 370 * 24 * 60 * 60 * 1000;
+    const deadline = candidate.getTime() + MAX_CRON_LOOKAHEAD_DAYS * 24 * 60 * 60 * 1000;
     while (candidate.getTime() <= deadline) {
-        if (matchesCronSchedule(schedule, zonedDateParts(candidate, timezone))) {
+        const parts = zonedDateParts(candidate, timezone);
+        if (matchesCronSchedule(schedule, parts)) {
             return candidate;
         }
-        candidate = new Date(candidate.getTime() + 60_000);
+        // If the calendar date itself can't match, no minute that day matches —
+        // jump to the next day instead of scanning all 1440 minutes. This keeps
+        // sparse schedules (e.g. "0 9 29 2 *") and unsatisfiable ones fast over the
+        // multi-year window. The big jump always lands at ~00:00 of the next day,
+        // so a subsequently matching date is scanned from its start (no missed
+        // earlier minutes).
+        if (!matchesCronDate(schedule, parts)) {
+            const minutesToNextDay = Math.max(1, 24 * 60 - (parts.hour * 60 + parts.minute));
+            candidate = new Date(candidate.getTime() + minutesToNextDay * 60_000);
+        }
+        else {
+            candidate = new Date(candidate.getTime() + 60_000);
+        }
     }
-    throw new Error("Cron expression has no matching run time in the next 370 days.");
+    throw new Error(`Cron expression has no matching run time in the next ${MAX_CRON_LOOKAHEAD_DAYS} days.`);
 }
 export function transformStep(input) {
     return {
@@ -116,9 +143,23 @@ export function toolStep(input) {
         tool: input.tool,
         ...(input.effect ? { effect: input.effect } : {}),
         ...(input.mode ? { mode: input.mode } : {}),
+        ...(input.maxCredits != null ? { maxCredits: input.maxCredits } : {}),
         payload: input.payload,
     };
 }
+/**
+ * Conditional step. `condition` is evaluated; control then flows by mode:
+ *
+ * - then only (no `else`, no `join`) — GUARD: truthy continues to `then` (steps
+ *   between the branch and `then` are skipped); falsy skips straight to the end
+ *   of the workflow (no step after the branch runs) and the run completes.
+ * - then + else (no `join`) — skip-until-target jump to `then`/`else`; from the
+ *   chosen target, the remaining steps run sequentially through the end.
+ * - then + else + join — real if/else: the non-chosen arm is skipped and `join`
+ *   is the convergence point where shared downstream work resumes.
+ *
+ * All targets must be ids of later steps (branches are forward-only).
+ */
 export function branchStep(input) {
     return {
         __oxygen_workflow_step: true,
@@ -161,6 +202,7 @@ definition, options = {}) {
         ...(definition.specification ? { specification: definition.specification } : {}),
         ...(definition.trigger ? { trigger: definition.trigger } : {}),
         ...(definition.inputSchema ? { input_schema: definition.inputSchema } : {}),
+        ...(definition.maxCredits != null ? { max_credits: definition.maxCredits } : {}),
         steps: definition.steps.map((step) => {
             if (step.kind === "transform") {
                 return {
@@ -188,6 +230,7 @@ definition, options = {}) {
                 tool: step.tool,
                 effect: step.effect ?? "external_read",
                 ...(step.mode ? { mode: step.mode } : {}),
+                ...(step.maxCredits != null ? { max_credits: step.maxCredits } : {}),
                 payload_source: serializeWorkflowFunction(step.payload, `steps.${step.id}.payload`),
             };
         }),
@@ -218,12 +261,23 @@ export function buildRecipeManifest(input) {
         bundle_format: "esm",
         tools_used: Array.from(new Set((input.toolsUsed ?? []).filter(Boolean))).sort(),
         ...(input.visualPlan ? { visual_plan: input.visualPlan } : {}),
+        ...(input.maxCredits != null ? { max_credits: input.maxCredits } : {}),
         source_hash: sourceHash,
         compiler_version: DURABLE_RECIPE_COMPILER_VERSION,
         created_at: (input.createdAt ?? new Date()).toISOString(),
     };
     return manifest;
 }
+// Shared positive-finite validator for the optional per-run / per-step
+// max_credits caps (Gap 2). `undefined` is valid (no cap); anything else must be
+// a positive finite number, or lint rejects the manifest.
+function validateOptionalMaxCredits(value, path, add) {
+    if (value === undefined)
+        return;
+    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+        add(path, "invalid_max_credits", "max_credits must be a positive number.");
+    }
+}
 export function lintWorkflowManifest(// skipcq: JS-R1005
 value, options = {}) {
     if (isRecord(value)
@@ -255,6 +309,7 @@ value, options = {}) {
     }
     if (value.trigger !== undefined)
         validateTrigger(value.trigger, "$.trigger", add);
+    validateOptionalMaxCredits(value.max_credits, "$.max_credits", add);
     if (!Array.isArray(value.steps) || value.steps.length === 0) {
         add("$.steps", "missing_steps", "At least one workflow step is required.");
     }
@@ -278,6 +333,15 @@ value, options = {}) {
             if (!isNonEmptyString(step.id)) {
                 add(`${path}.id`, "invalid_step_id", "Step id is required.");
             }
+            else if (RESERVED_STEP_IDS.has(step.id)) {
+                // Step ids become keys on the ctx.steps object the runtime assembles.
+                // "__proto__" / "constructor" / "prototype" collide with JavaScript
+                // object internals: assigning ctx.steps["__proto__"] = output hits the
+                // prototype setter, so the output is silently dropped from step outputs
+                // and unreadable downstream while the run still reports success. Reject
+                // at authoring time instead of letting that data loss happen at runtime.
+                add(`${path}.id`, "reserved_step_id", `Step id '${step.id}' is reserved (it collides with a JavaScript object key and would be dropped from step outputs). Choose another id.`);
+            }
             else if (ids.has(step.id)) {
                 add(`${path}.id`, "duplicate_step_id", `Step id '${step.id}' is duplicated.`);
             }
@@ -320,6 +384,7 @@ value, options = {}) {
                     && step.mode !== "smoke_test") {
                     add(`${path}.mode`, "invalid_step_mode", "Step mode is invalid.");
                 }
+                validateOptionalMaxCredits(step.max_credits, `${path}.max_credits`, add);
                 return;
             }
             if (step.kind === "branch") {
@@ -390,6 +455,7 @@ value, options = {}) {
     if (value.bundle_format !== "esm") {
         add("$.bundle_format", "invalid_bundle_format", "Recipe bundle_format must be 'esm'.");
     }
+    validateOptionalMaxCredits(value.max_credits, "$.max_credits", add);
     if (value.runtime !== "durable") {
         add("$.runtime", "invalid_recipe_runtime", "Durable recipe manifests must set runtime to durable.");
     }
@@ -802,25 +868,52 @@ export async function runPureWorkflowFunction(input) {
     sandbox.setImmediate = undefined;
     sandbox.queueMicrotask = undefined;
     sandbox.WebAssembly = undefined;
-    const script = new vm.Script(`"use strict";\n`
-        + `const __oxygen_context = JSON.parse(__oxygen_context_json);\n`
+    const script = new vm.Script('"use strict";\n'
+        + 'const __oxygen_context = JSON.parse(__oxygen_context_json);\n'
         + `const __oxygen_fn = (${input.source});\n`
-        + `__oxygen_fn(__oxygen_context);`);
+        + '__oxygen_fn(__oxygen_context);');
     // Disable dynamic code generation in the sandboxed context. Combined with
     // the JSON re-parse above, this means every prototype-walk path to
     // Function — direct, via context.constructor.constructor, or any other
     // reachable Function instance — throws EvalError when called with source.
-    const result = script.runInNewContext(sandbox, {
-        timeout: timeoutMs,
-        contextCodeGeneration: {
-            strings: false,
-            wasm: false,
-        },
-    });
-    const resolved = isPromiseLike(result)
-        ? await withTimeout(result, timeoutMs)
-        : result;
-    return enforceJsonOutput(resolved, maxOutputBytes);
+    try {
+        const result = script.runInNewContext(sandbox, {
+            timeout: timeoutMs,
+            contextCodeGeneration: {
+                strings: false,
+                wasm: false,
+            },
+        });
+        const resolved = isPromiseLike(result)
+            ? await withTimeout(result, timeoutMs)
+            : result;
+        return enforceJsonOutput(resolved, maxOutputBytes);
+    }
+    catch (error) {
+        throw normalizeSandboxThrow(error);
+    }
+}
+// A throw from inside the vm sandbox is constructed with the sandbox realm's
+// Error, so `error instanceof Error` is false in the host worker — and
+// serializeOxygenError then drops the message and reports a generic
+// "Workflow run failed.", leaving a failing transform/branch undebuggable.
+// Reconstruct a host-realm Error preserving the user's message/name. Host-realm
+// throws (vm timeout, enforceJsonOutput's workflow_output_too_large) already
+// pass instanceof and are returned unchanged.
+function normalizeSandboxThrow(error) {
+    if (error instanceof Error)
+        return error;
+    if (error && typeof error === "object") {
+        const record = error;
+        const message = typeof record.message === "string" && record.message
+            ? record.message
+            : "Workflow function threw.";
+        const normalized = new Error(message);
+        if (typeof record.name === "string" && record.name)
+            normalized.name = record.name;
+        return normalized;
+    }
+    return new Error(typeof error === "string" && error ? error : "Workflow function threw a non-error value.");
 }
 export const workflowApplySchema = {
     $schema: "https://json-schema.org/draft/2020-12/schema",
@@ -1077,6 +1170,19 @@ value, path, add) {
                 add(`${path}.cron`, "invalid_cron", error instanceof Error ? error.message : "Cron expression is invalid.");
             }
         }
+        // Validate the timezone here so an unknown zone fails lint with a typed
+        // issue, rather than passing lint and blowing up at apply time (the
+        // scheduler's Intl.DateTimeFormat throws on an unknown zone). null/empty
+        // are allowed — the scheduler falls back to UTC.
+        const { timezone } = value;
+        if (timezone !== undefined && timezone !== null) {
+            if (typeof timezone !== "string") {
+                add(`${path}.timezone`, "invalid_timezone", "Cron trigger timezone must be a string IANA timezone.");
+            }
+            else if (timezone.trim() && !isValidTimeZone(timezone.trim())) {
+                add(`${path}.timezone`, "invalid_timezone", `Unknown timezone '${timezone}'. Use an IANA timezone such as 'America/New_York' or 'UTC'.`);
+            }
+        }
         return;
     }
     if (value.type === "event") {
@@ -1272,11 +1378,9 @@ function normalizeDaysOfWeek(values) {
     }
     return normalized;
 }
-function matchesCronSchedule(schedule, parts) {
-    if (!schedule.minutes.has(parts.minute))
-        return false;
-    if (!schedule.hours.has(parts.hour))
-        return false;
+// Date-only match (month + day-of-month/day-of-week), excluding hour/minute.
+// Lets nextCronRunAfter skip whole non-matching days in one jump.
+function matchesCronDate(schedule, parts) {
     if (!schedule.months.has(parts.month))
         return false;
     const dayOfMonthMatches = schedule.daysOfMonth.has(parts.dayOfMonth);
@@ -1286,6 +1390,13 @@ function matchesCronSchedule(schedule, parts) {
     }
     return dayOfMonthMatches && dayOfWeekMatches;
 }
+function matchesCronSchedule(schedule, parts) {
+    if (!schedule.minutes.has(parts.minute))
+        return false;
+    if (!schedule.hours.has(parts.hour))
+        return false;
+    return matchesCronDate(schedule, parts);
+}
 function roundUpToNextMinute(value) {
     const result = new Date(value.getTime());
     result.setUTCSeconds(0, 0);
@@ -1309,6 +1420,17 @@ function zonedDateParts(date, timezone) {
         dayOfWeek: weekdayToNumber(parts.get("weekday") ?? ""),
     };
 }
+function isValidTimeZone(timezone) {
+    try {
+        // Throws RangeError for an unknown IANA zone; same mechanism the scheduler
+        // uses, so lint accepts exactly the zones the runtime can resolve.
+        new Intl.DateTimeFormat("en-US", { timeZone: timezone });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function getZonedFormatter(timezone) {
     const cached = zonedFormatters.get(timezone);
     if (cached)
@@ -1349,6 +1471,25 @@ function weekdayToNumber(value) {
 function hashWorkflowSource(source) {
     return createHash("sha256").update(source).digest("hex");
 }
+// Deterministic plan hash (Gap 4): binds an approval decision to the exact
+// reviewed plan + cost so it cannot be replayed against a changed plan. The
+// durable mid-run approval gate (recipe-context) hashes its relevant fields
+// through this; binding the imperative `workflows call` admission path the same
+// way is a flagged follow-up. Canonical (sorted-key) JSON keeps the hash stable
+// regardless of key order or undefined fields.
+export function computeWorkflowPlanHash(input) {
+    return hashWorkflowSource(canonicalJsonStringify(input));
+}
+function canonicalJsonStringify(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "null";
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJsonStringify).join(",")}]`;
+    const entries = Object.entries(value)
+        .filter(([, entryValue]) => entryValue !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([key, entryValue]) => `${JSON.stringify(key)}:${canonicalJsonStringify(entryValue)}`).join(",")}}`;
+}
 function workflowJsonReplacer(_key, value) {
     return typeof value === "function" ? Function.prototype.toString.call(value) : value;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.177.1",
+  "version": "1.184.3",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",