@oxygen-agent/cli 1.365.3 → 1.575.19

package/node_modules/@oxygen/workflows/dist/index.js

@@ -1,6 +1,16 @@
 import { createHash } from "node:crypto";
 import * as vm from "node:vm"; // skipcq: JS-C1003
+import { isWorkflowGraphManifest } from "./graph/types.js";
 export * from "./usage-estimate.js";
+// Pure event-dispatch semantics, shared by the apps/web and apps/worker event
+// dispatchers so the filter gate, idempotency rule, and delivery verdict cannot
+// drift between the two processes that fan the same event out.
+export * from "./event-dispatch.js";
+// oxygen-workflows-v2. The graph barrel is browser-safe on its own (importable as
+// "@oxygen/workflows/graph"); the linter is not — it reuses the v1 pure-function
+// scanner below — so it is re-exported here, from the node entry point only.
+export * from "./graph/index.js";
+export * from "./graph/lint.js";
 export const WORKFLOW_MANIFEST_VERSION = 1;
 export const WORKFLOW_COMPILER_VERSION = "oxygen-workflows-v1";
 export const DURABLE_RECIPE_COMPILER_VERSION = "oxygen-recipes-v2";
@@ -198,8 +208,15 @@ export function isRecipeManifest(value) {
         && value.manifest_version === WORKFLOW_MANIFEST_VERSION
         && value.compiler_version === DURABLE_RECIPE_COMPILER_VERSION;
 }
+/**
+ * Every manifest shape the platform can store and run: v1 hosted steps, durable
+ * recipes, and oxygen-workflows-v2 graphs. This is the gate `workflows apply`
+ * and the CLI loader route through, so a shape listed here must already have a
+ * linter and a worker execution path — accepting a manifest we cannot run would
+ * cut a revision that fails at run time instead of at authoring time.
+ */
 export function isAnyWorkflowManifest(value) {
-    return isWorkflowManifest(value) || isRecipeManifest(value);
+    return isWorkflowManifest(value) || isRecipeManifest(value) || isWorkflowGraphManifest(value);
 }
 export function compileWorkflowDefinition(// skipcq: JS-R1005 -- compiler validates workflow metadata, trigger, steps, branch targets, and defaults together.
 definition, options = {}) {
@@ -284,7 +301,9 @@ export function buildRecipeManifest(input) {
 // Shared positive-finite validator for the optional per-run / per-step
 // max_credits caps (Gap 2). `undefined` is valid (no cap); anything else must be
 // a positive finite number, or lint rejects the manifest.
-function validateOptionalMaxCredits(value, path, add) {
+// Exported for ./graph/lint.ts so the v2 graph linter enforces the same rule as
+// v1 rather than a second copy of it. Not part of the product surface.
+export function validateOptionalMaxCredits(value, path, add) {
     if (value === undefined)
         return;
     if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
@@ -391,6 +410,30 @@ value, options = {}) {
                     && step.effect !== "external_write") {
                     add(`${path}.effect`, "invalid_step_effect", "Step effect is invalid.");
                 }
+                else if (isNonEmptyString(step.tool)) {
+                    // No resolver: skip the canonical cross-check rather than refuse.
+                    //
+                    // This function is reached by compileWorkflowDefinition, which the CLI
+                    // calls locally — and the CLI deliberately cannot classify effects,
+                    // because that is exactly the dependency removed from this package.
+                    // Refusing here would make `oxygen workflows` unable to compile any
+                    // manifest containing a tool step.
+                    //
+                    // Skipping is safe because this check is a CONVENIENCE, not the gate:
+                    // apply and the worker runtime both resolve the effect canonically and
+                    // both REFUSE what they cannot classify. The divergence v1.513.2 fixed
+                    // was lint disagreeing with apply, and that is addressed by the server
+                    // lint path always injecting resolveWorkflowToolEffect (see
+                    // apps/web/src/lib/workflows.ts lintHostedWorkflowManifest) — not by a
+                    // default inside this package.
+                    const resolveEffect = options.resolveToolEffect;
+                    if (resolveEffect) {
+                        const canonicalEffect = resolveEffect(step.tool);
+                        if (canonicalEffect !== null && step.effect !== canonicalEffect) {
+                            add(`${path}.effect`, "tool_effect_mismatch", `Tool '${step.tool}' has canonical effect '${canonicalEffect}', not '${String(step.effect)}'.`);
+                        }
+                    }
+                }
                 if (step.mode !== undefined
                     && step.mode !== "dry_run"
                     && step.mode !== "live"
@@ -473,9 +516,6 @@ value, options = {}) {
         add("$.runtime", "invalid_recipe_runtime", "Durable recipe manifests must set runtime to durable.");
     }
     if (Array.isArray(value.tools_used)) {
-        if (value.tools_used.length === 0) {
-            add("$.tools_used", "missing_recipe_tools", "Durable recipes must declare at least one allowed tool.");
-        }
         value.tools_used.forEach((toolId, index) => {
             if (typeof toolId !== "string" || !toolId.trim()) {
                 add(`$.tools_used.${index}`, "invalid_tool_id", "Recipe tools_used entries must be non-empty strings.");
@@ -492,7 +532,7 @@ value, options = {}) {
         add("$.tools_used", "invalid_tools_used", "Recipe tools_used must be an array of tool ids.");
     }
     else {
-        add("$.tools_used", "missing_recipe_tools", "Durable recipes must declare at least one allowed tool.");
+        add("$.tools_used", "missing_recipe_tools", "Durable recipe manifests must declare tools_used (use [] for pure recipes).");
     }
     const declaredTools = Array.isArray(value.tools_used)
         ? new Set(value.tools_used.filter((toolId) => typeof toolId === "string" && toolId.trim().length > 0))
@@ -556,7 +596,7 @@ function validateRecipeVisualPlan(value, path, declaredTools, add) {
             if (!isNonEmptyString(step.tool)) {
                 add(`${stepPath}.tool`, "missing_visual_plan_tool", "Recipe visual_plan tool step requires a tool id.");
             }
-            else if (declaredTools.size > 0 && !declaredTools.has(step.tool)) {
+            else if (!declaredTools.has(step.tool)) {
                 add(`${stepPath}.tool`, "visual_plan_tool_not_declared", `Recipe visual_plan tool '${step.tool}' must be present in tools_used.`);
             }
             if (step.effect !== undefined
@@ -935,6 +975,15 @@ export const workflowApplySchema = {
     additionalProperties: false,
     properties: {
         manifest: { $ref: "#/$defs/manifest" },
+        approved: {
+            type: "boolean",
+            description: "Standing tool authorization for this exact autonomous revision.",
+        },
+        max_credits: {
+            type: "number",
+            exclusiveMinimum: 0,
+            description: "Hard credit ceiling for each autonomous delivery.",
+        },
     },
     required: ["manifest"],
     $defs: {
@@ -1153,7 +1202,8 @@ function validateOptionalIdempotencyKeyPath(value, path, label, add) {
         add(`${path}.idempotency_key_path`, "invalid_idempotency_key_path", `${label} idempotency path is invalid.`);
     }
 }
-function validateTrigger(// skipcq: JS-R1005
+// Exported for ./graph/lint.ts — see validateOptionalMaxCredits above.
+export function validateTrigger(// skipcq: JS-R1005
 value, path, add) {
     if (!isRecord(value)) {
         add(path, "invalid_trigger", "Workflow trigger must be an object.");
@@ -1266,7 +1316,11 @@ function validateBranchTarget(target, path, fieldLabel, branchIndex, idToIndex,
         add(path, "branch_back_jump", `Branch ${fieldLabel} must reference a step that comes after the branch in declared order.`);
     }
 }
-function validatePureFunctionSource(source, path, add) {
+// Exported for ./graph/lint.ts — see validateOptionalMaxCredits above. v2 `code`
+// nodes are the v2 spelling of a v1 transform step and must clear the identical
+// purity scan; the graph linter re-labels the issues it raises as
+// `unsafe_code_source`.
+export function validatePureFunctionSource(source, path, add) {
     if (!source.trim()) {
         add(path, "empty_function_source", "Workflow function source cannot be empty.");
         return;
@@ -1386,7 +1440,9 @@ function validateRecipeBundleSafety(source, path, add) {
         }
     }
 }
-function isWorkflowToolRejected(toolId) {
+// Exported for ./graph/lint.ts — see validateOptionalMaxCredits above. One deny
+// list, enforced identically for v1 tool steps and v2 tool nodes.
+export function isWorkflowToolRejected(toolId) {
     return toolId === "run_javascript" || toolId === "custom_http";
 }
 const CRON_FIELD_LIMITS = [
@@ -1654,13 +1710,123 @@ export function readWorkflowRunMaxCredits(metadata) {
         return null;
     return parsed;
 }
+export const WORKFLOW_STANDING_AUTHORIZATION_METADATA_KEY = "standing_authorization";
+export const WORKFLOW_STANDING_AUTHORIZATION_POLICY_METADATA_KEY = "standing_authorization_policy";
+export const WORKFLOW_STANDING_AUTHORIZATION_POLICY_REVISION_BOUND_V1 = "revision_bound_v1";
+export const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_ERROR_CODE = "workflow_standing_authorization_required";
+export const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_MESSAGE = "This autonomous workflow can call tools and needs standing authorization for its current revision. Re-enable it with approved=true; pass a positive max_credits per delivery or omit it to use the plan default.";
+export function isAutonomousWorkflowTriggerType(value) {
+    return value === "cron" || value === "webhook" || value === "event";
+}
+/**
+ * Whether this manifest can cross into a tool at runtime. Hosted workflows are
+ * explicit in `steps`; oxygen-workflows-v2 graphs are explicit in `nodes`;
+ * durable recipes declare the complete allowlist in `tools_used`. Keeping this
+ * predicate structural means legacy revisions can be checked before execution
+ * without trusting trigger metadata.
+ *
+ * The v2 branch is load-bearing, not cosmetic: this predicate is the ONLY input
+ * to workflowRequiresStandingAuthorization, so a graph it does not recognise arms
+ * a cron / webhook / event trigger with no standing authorization and therefore
+ * no per-delivery credit ceiling. A `workflow` (sub-graph) node counts as well —
+ * a child run can invoke tools of its own, and the gate must fail closed.
+ */
+export function workflowManifestCanInvokeTool(manifest) {
+    if (!isRecord(manifest))
+        return false;
+    // EVERY shape is checked and the results OR'd — deliberately not a chain of
+    // early returns dispatching on which field is present.
+    //
+    // The chain was a bypass: `tools_used` was tested first and returned from that
+    // branch, so a v2 graph manifest carrying an extra `tools_used: []` never
+    // reached the `nodes` check and reported "cannot invoke a tool". That is this
+    // predicate's ONLY input, so apply then skipped the standing-authorization gate
+    // for a cron-triggered graph full of tool nodes, left the trigger unmarked so
+    // the fire-time check was fooled too, and resolved a delivery cap of null — no
+    // ceiling at all. The graph linter accepts the extra key, so nothing else
+    // objected either.
+    //
+    // A manifest that carries a tool node CAN invoke a tool no matter what other
+    // fields it also carries, so the honest form is a union that fails closed.
+    const viaRecipe = Array.isArray(manifest.tools_used)
+        && manifest.tools_used.some((toolId) => isNonEmptyString(toolId));
+    const viaGraph = Array.isArray(manifest.nodes)
+        && manifest.nodes.some((node) => isRecord(node) && (node.kind === "tool" || node.kind === "workflow"));
+    const viaSteps = Array.isArray(manifest.steps)
+        && manifest.steps.some((step) => isRecord(step) && step.kind === "tool");
+    return viaRecipe || viaGraph || viaSteps;
+}
+/** The single apply/enable/runtime gate for standing autonomous authority. */
+export function workflowRequiresStandingAuthorization(manifest, triggerType) {
+    const manifestTriggerType = isRecord(manifest)
+        && isRecord(manifest.trigger)
+        ? manifest.trigger.type
+        : "api";
+    return isAutonomousWorkflowTriggerType(triggerType ?? manifestTriggerType)
+        && workflowManifestCanInvokeTool(manifest);
+}
+/**
+ * Runtime enforcement marker for triggers created or explicitly re-armed after
+ * revision-bound standing authority shipped. Legacy active triggers have no
+ * marker and stay runnable during the default-ceiling compatibility rollout;
+ * every new/re-armed tool trigger carries this marker and fails closed if its
+ * matching authorization is missing or stale.
+ */
+export function workflowStandingAuthorizationPolicyIsEnforced(metadata, triggerDefaultCapsMode) {
+    return triggerDefaultCapsMode === "enforce"
+        || (isRecord(metadata)
+            && metadata[WORKFLOW_STANDING_AUTHORIZATION_POLICY_METADATA_KEY]
+                === WORKFLOW_STANDING_AUTHORIZATION_POLICY_REVISION_BOUND_V1);
+}
+/**
+ * Read the standing authority for one autonomous trigger revision. A null
+ * result is fail-closed for policy-marked triggers. Legacy active rows
+ * are distinguished by the separate policy marker so they can continue under
+ * the fire-time default-ceiling compatibility rollout.
+ */
+export function readWorkflowStandingAuthorization(metadata, revisionId) {
+    if (!isRecord(metadata))
+        return null;
+    const raw = metadata[WORKFLOW_STANDING_AUTHORIZATION_METADATA_KEY];
+    if (!isRecord(raw) || raw.approved !== true)
+        return null;
+    const maxCredits = typeof raw.max_credits === "number"
+        ? raw.max_credits
+        : Number(raw.max_credits);
+    const capPolicy = raw.cap_policy === "plan_default"
+        ? "plan_default"
+        : raw.cap_policy === "explicit" || raw.cap_policy === undefined
+            ? "explicit"
+            : null;
+    const authorizedAt = typeof raw.authorized_at === "string" ? raw.authorized_at.trim() : "";
+    const authorizedByActorId = typeof raw.authorized_by_actor_id === "string"
+        ? raw.authorized_by_actor_id.trim()
+        : "";
+    if (!capPolicy
+        || (capPolicy === "explicit" && (!Number.isFinite(maxCredits) || maxCredits <= 0))
+        || raw.revision_id !== revisionId
+        || !authorizedByActorId
+        || !authorizedAt
+        || Number.isNaN(Date.parse(authorizedAt))) {
+        return null;
+    }
+    const base = {
+        approved: true,
+        revisionId,
+        authorizedByActorId,
+        authorizedAt,
+    };
+    return capPolicy === "explicit"
+        ? { ...base, capPolicy, maxCredits }
+        : { ...base, capPolicy, maxCredits: null };
+}
 // Approval labels the run's enqueue route already collected SYNCHRONOUS human
 // approval for (a CLI/MCP `approved=true` gate before the run was created), and
 // recorded in run metadata as `preapproved_labels`. A live ctx.approvals.require()
 // call whose `label` is in this set is honored immediately by both recipe
-// executors instead of parking on a durable decision row (local) or failing
-// closed with approval_requires_local_executor (sandbox). Every other label
-// still goes through the full durable gate, and the max_credits spend cap is
+// executors instead of creating and parking on a durable decision row. Every
+// other label goes through the same host-mediated durable gate under both local
+// and sandbox executors, and the max_credits spend cap is
 // enforced separately per paid tool step, so a pre-approved label never widens
 // spend. Only trusted server code (the enqueue route) sets this — it is read
 // from run metadata, never from user-suppliable workflow input.

package/node_modules/@oxygen/workflows/dist/tool-effects.d.ts

@@ -0,0 +1 @@
+export type CanonicalWorkflowToolEffect = "external_read" | "external_write";

package/node_modules/@oxygen/workflows/dist/tool-effects.js

@@ -0,0 +1,19 @@
+// The TYPE of the one answer to "what does this workflow tool do — read or write?"
+//
+// The RESOLVER that produces it lives in @oxygen/tools
+// (resolveWorkflowToolEffect / isWorkflowToolStaticallyKnown), deliberately NOT here.
+//
+// v1.513.2 put the resolver in this package, which forced @oxygen/workflows to depend
+// on @oxygen/tools and @oxygen/mcp-server. This package is imported by the CLI for
+// manifest compile/assert helpers and is bundled into the browser, so one line of
+// resolver dragged tools -> providers -> control-db into both. That single edge broke
+// four things: node:async_hooks reaching a client chunk (fixed v1.517.0), the worker
+// Docker build order (v1.525.1), the CLI tarball's workspace vendoring, and — through
+// the transitive closure — an attempt to ship `pg` inside the customer CLI.
+//
+// So @oxygen/workflows now depends on @oxygen/formula alone, and every caller that
+// needs classification passes a resolver in. The safety property v1.513.2 was written
+// to guarantee ("a caller who forgets gets the correct resolver, not silence") is now
+// enforced by the COMPILER instead of a default: resolveToolEffect is required, so
+// forgetting it does not typecheck.
+export {};

package/node_modules/@oxygen/workflows/dist/usage-estimate.js

@@ -6,20 +6,30 @@
 // @oxygen/integrations automation-usage.ts), and retried attempts bill again.
 // Surfaces must present these numbers as minimums; observed run history is the
 // honest projection (projectObservedAutomationUsage below).
+import { loopBodyNodeIds } from "./graph/topology.js";
+import { isWorkflowGraphManifest, workflowGraphNodeKindBills, MAX_WORKFLOW_LOOP_ITERATIONS, } from "./graph/types.js";
 const ROW_FANOUT_TOOL_IDS = new Set(["oxygen.rows_upsert"]);
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 // Tolerant of raw DB json (the scheduler feeds unvalidated manifest rows):
-// steps-array manifests count 1 per step; everything else is treated as a
-// recipe shape (1 + max(visual checkpoints, declared tools)). Byte-compatible
-// with the two prior copies in workflow-scheduler.ts and the web page.
+// steps-array manifests count 1 per step; oxygen-workflows-v2 graphs count
+// their billable nodes (see estimateWorkflowGraphActionsFloor); everything else
+// is treated as a recipe shape (1 + max(visual checkpoints, declared tools)).
+// The v1 branches stay byte-compatible with the two prior copies in
+// workflow-scheduler.ts and the web page.
 export function estimateWorkflowRunAutomationActionsFloor(manifest) {
     if (!isRecord(manifest))
         return 1;
     const steps = Array.isArray(manifest.steps) ? manifest.steps : null;
     if (steps)
         return Math.max(1, steps.length);
+    // Must precede the recipe fallback: a v2 manifest carries neither `steps` nor
+    // `visual_plan`/`tools_used`, so without this branch every graph — five tool
+    // nodes or five hundred — fell through and estimated as exactly 1 action.
+    const graph = readWorkflowGraph(manifest);
+    if (graph)
+        return estimateWorkflowGraphActionsFloor(graph);
     const visualPlan = isRecord(manifest.visual_plan) ? manifest.visual_plan : null;
     const visualSteps = Array.isArray(visualPlan?.steps) ? visualPlan.steps : [];
     const checkpointCount = visualSteps.filter((step) => isRecord(step) && (step.kind !== "branch" || typeof step.checkpoint_id === "string")).length;
@@ -27,8 +37,27 @@ export function estimateWorkflowRunAutomationActionsFloor(manifest) {
     return 1 + Math.max(checkpointCount, toolsUsed.length, 0);
 }
 function manifestIsRecipeShaped(manifest) {
+    // A v2 graph has no `steps` array either, but it is the opposite of a recipe:
+    // every node that can bill is declared in the manifest.
+    if (isWorkflowGraphManifest(manifest))
+        return false;
     return isRecord(manifest) && !Array.isArray(manifest.steps);
 }
+/**
+ * Whether the floor can be exceeded by orders of magnitude at run time. True for
+ * recipe manifests (arbitrary code, unknowable checkpoints) and for a v2 graph
+ * containing an enabled loop with no declared `max_iterations` — that loop
+ * iterates once per element of a collection that only exists at run time, so the
+ * single pass the floor assumes is a lower bound and nothing more.
+ */
+function manifestHasDynamicRuntimeActions(manifest) {
+    if (manifestIsRecipeShaped(manifest))
+        return true;
+    const graph = readWorkflowGraph(manifest);
+    if (!graph)
+        return false;
+    return graph.nodes.some((node) => node.kind === "loop" && !node.disabled && declaredLoopIterations(node.maxIterations) === null);
+}
 function manifestWritesRowsPerRun(manifest) {
     if (!isRecord(manifest))
         return false;
@@ -36,9 +65,111 @@ function manifestWritesRowsPerRun(manifest) {
     if (steps) {
         return steps.some((step) => isRecord(step) && step.kind === "tool" && typeof step.tool === "string" && ROW_FANOUT_TOOL_IDS.has(step.tool));
     }
+    const graph = readWorkflowGraph(manifest);
+    if (graph) {
+        return graph.nodes.some((node) => node.kind === "tool" && typeof node.tool === "string" && ROW_FANOUT_TOOL_IDS.has(node.tool));
+    }
     const toolsUsed = Array.isArray(manifest.tools_used) ? manifest.tools_used : [];
     return toolsUsed.some((tool) => typeof tool === "string" && ROW_FANOUT_TOOL_IDS.has(tool));
 }
+function readWorkflowGraph(manifest) {
+    if (!isWorkflowGraphManifest(manifest))
+        return null;
+    const nodes = [];
+    for (const raw of manifest.nodes) {
+        if (!isRecord(raw))
+            continue;
+        if (typeof raw.id !== "string" || !raw.id || typeof raw.kind !== "string")
+            continue;
+        nodes.push({
+            id: raw.id,
+            kind: raw.kind,
+            disabled: raw.disabled === true,
+            tool: raw.tool,
+            maxIterations: raw.max_iterations,
+        });
+    }
+    const edges = manifest.edges.flatMap((raw) => {
+        if (!isRecord(raw) || typeof raw.source !== "string" || typeof raw.target !== "string")
+            return [];
+        return [{
+                id: typeof raw.id === "string" ? raw.id : `${raw.source}->${raw.target}`,
+                source: raw.source,
+                target: raw.target,
+                ...(typeof raw.source_handle === "string" ? { source_handle: raw.source_handle } : {}),
+            }];
+    });
+    return {
+        nodes,
+        // Cast: the traversal only ever reads the two node fields kept here, and
+        // giving it the raw (possibly malformed) nodes is what this sanitizing pass
+        // exists to prevent.
+        topology: {
+            ...manifest,
+            nodes: nodes.map((node) => ({ id: node.id, kind: node.kind })),
+            edges,
+        },
+    };
+}
+/**
+ * A declared, usable iteration cap, or null when the loop is unbounded.
+ *
+ * Clamped to MAX_WORKFLOW_LOOP_ITERATIONS because that is what the interpreter
+ * actually runs: a manifest declaring 50,000 iterations executes 1,000, and
+ * pricing the un-clamped number would make a cron cadence "impossible" over work
+ * that can never happen. The linter refuses an over-ceiling cap at authoring
+ * time; this clamp is what keeps an older or hand-written manifest honest.
+ */
+function declaredLoopIterations(value) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value <= 0)
+        return null;
+    return Math.min(value, MAX_WORKFLOW_LOOP_ITERATIONS);
+}
+/**
+ * One action per billable node, multiplied by the iteration cap of every loop
+ * whose body contains it (nested loops compound, which is why the multipliers
+ * are collected per node rather than per loop).
+ *
+ * A loop with no declared `max_iterations` counts as a single pass. The count is
+ * a FLOOR, and one pass is the smallest a real run can have — over-counting an
+ * unknown collection would turn the billing gate into a guess. The unknowable
+ * remainder is reported through `dynamicRuntimeActions` instead.
+ *
+ * Disabled nodes are skipped, and so is the body of a disabled loop: a loop that
+ * never runs never enters its body. Both exclusions only ever move the estimate
+ * down, which is the safe direction for a lower bound.
+ */
+function estimateWorkflowGraphActionsFloor(graph) {
+    const multipliers = new Map();
+    const skipped = new Set();
+    for (const node of graph.nodes) {
+        if (node.kind !== "loop")
+            continue;
+        const body = loopBodyNodeIds(graph.topology, node.id);
+        if (node.disabled) {
+            for (const bodyNodeId of body)
+                skipped.add(bodyNodeId);
+            continue;
+        }
+        const iterations = declaredLoopIterations(node.maxIterations);
+        if (iterations === null || iterations === 1)
+            continue;
+        for (const bodyNodeId of body) {
+            multipliers.set(bodyNodeId, (multipliers.get(bodyNodeId) ?? 1) * iterations);
+        }
+    }
+    let floor = 0;
+    for (const node of graph.nodes) {
+        if (node.disabled || skipped.has(node.id))
+            continue;
+        if (!workflowGraphNodeKindBills(node.kind))
+            continue;
+        floor += multipliers.get(node.id) ?? 1;
+    }
+    // Nested caps multiply, and two large ones overflow Number's exact range;
+    // clamping keeps every downstream product (runs x floor) a finite number.
+    return Math.max(1, Math.min(floor, Number.MAX_SAFE_INTEGER));
+}
 export function estimateWorkflowAutomationUsage(manifest, cron) {
     if (!isRecord(manifest))
         return null;
@@ -48,7 +179,7 @@ export function estimateWorkflowAutomationUsage(manifest, cron) {
         actionsPerRunFloor,
         scheduledRunsPer30Days,
         scheduledActionsPer30DaysFloor: scheduledRunsPer30Days === null ? null : scheduledRunsPer30Days * actionsPerRunFloor,
-        dynamicRuntimeActions: manifestIsRecipeShaped(manifest),
+        dynamicRuntimeActions: manifestHasDynamicRuntimeActions(manifest),
         perRowFanout: manifestWritesRowsPerRun(manifest),
     };
 }

package/node_modules/@oxygen/workflows/package.json

@@ -9,6 +9,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./graph": {
+      "types": "./dist/graph/index.d.ts",
+      "import": "./dist/graph/index.js"
     }
   },
   "dependencies": {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.365.3",
+  "version": "1.575.19",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",
@@ -32,18 +32,23 @@
     "README.md"
   ],
   "dependencies": {
+    "@aws-sdk/client-s3": "3.1050.0",
+    "@aws-sdk/s3-request-presigner": "3.1050.0",
     "@opentelemetry/api": "1.9.1",
     "commander": "14.0.3",
     "esbuild": "0.27.7",
+    "langfuse": "3.38.20",
     "read-excel-file": "6.0.3",
     "typescript": "6.0.3",
+    "@oxygen/formula": "0.0.0",
+    "@oxygen/recipe-sdk": "0.0.0",
     "@oxygen/shared": "0.0.0",
-    "@oxygen/workflows": "0.0.0",
-    "@oxygen/recipe-sdk": "0.0.0"
+    "@oxygen/workflows": "0.0.0"
   },
   "bundledDependencies": [
+    "@oxygen/formula",
+    "@oxygen/recipe-sdk",
     "@oxygen/shared",
-    "@oxygen/workflows",
-    "@oxygen/recipe-sdk"
+    "@oxygen/workflows"
   ]
 }