@oxygen-agent/cli 1.717.11 → 1.739.0

package/dist/skills.js

@@ -2,7 +2,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { OxygenError, inferCapabilityRoute, serializeCapabilityRoute, toFailure, } from "@oxygen/shared";
+import { OxygenError, inferUserCapabilityRoute, serializeCapabilityRoute, toFailure, } from "@oxygen/shared";
 import { defaultApiUrl, loadCredentials, normalizeApiUrl } from "./credentials.js";
 import { requestOxygen } from "./http-client.js";
 import { isRecord, readOption } from "./util.js";
@@ -98,7 +98,7 @@ export async function searchAgentSkills(query, options, runtime = {}) {
     }
     const normalized = query.trim();
     const tokens = tokenizeSkillQuery(normalized);
-    const route = inferCapabilityRoute(normalized);
+    const route = inferUserCapabilityRoute(normalized);
     const requestedLimit = Number.parseInt(readOption(options.limit) ?? "5", 10);
     const limit = Number.isFinite(requestedLimit) ? Math.min(10, Math.max(1, requestedLimit)) : 5;
     const matches = index.skills

package/node_modules/@oxygen/shared/dist/axiom-field-budget.d.ts

@@ -19,6 +19,13 @@
  * under `worker_fields`. New instrumentation can then be added freely without
  * anyone having to remember that a new key can take down log shipping globally.
  *
+ * WITH ONE HOLE, found the hard way on 2026-08-15. Packing protects the dataset
+ * from the CONTENTS, not from the CONTAINER: `worker_fields` is itself a column,
+ * and a dataset with no free column cannot have it. Registering the map field on
+ * the already-full `oxygen-logs` therefore turned a slow leak into a total ingest
+ * outage — 41,372 records/day, ~60x worse than the leak it replaced. `AxiomOverflowMode`
+ * below is the escape hatch; freeing a column slot is the actual fix.
+ *
  * THE ALLOWLIST IS A LOAD-BEARING CONTRACT IN BOTH DIRECTIONS.
  *
  * - A field that a monitor, dashboard, or checked-in query reads **flat** must be
@@ -34,6 +41,39 @@
  * Both directions are asserted by `scripts/ci/log-field-budget.mjs` against the
  * real seed and dashboard JSON, so a change to either side fails loudly instead
  * of quietly blinding a monitor.
+ *
+ * THERE IS A THIRD DIRECTION, and it is the one that took production down: a
+ * name in this set that the DATASET has no column for. Allowlisted means flat by
+ * definition, so such a name cannot fall back into the map — it demands a
+ * brand-new column, and a dataset with no slot to allocate one rejects the whole
+ * ingest batch with HTTP 400. So membership here is not "a field we read flat";
+ * it is "a field we read flat AND the dataset can actually hold". The live half
+ * of `scripts/ci/log-field-budget.mjs` checks that second half against Axiom.
+ *
+ * REMOVED 2026-08-15 — `chunk_id`, `item_id`, `digest`. Prod `oxygen-logs` had no
+ * column for any of the three and no slot left to create one, so every record
+ * carrying one was rejected 400 and DROPPED. That was still ~116 ship failures
+ * per 25 minutes after the `worker_fields` map field itself had been repaired on
+ * the Axiom side, and it hit the Next.js server-error path hardest, through
+ * `digest`.
+ *
+ * The warning above — that dropping a name silently moves it into the overflow
+ * and can zero a query that reads it flat — applies to exactly this removal, so
+ * it was CHECKED rather than assumed, in both directions:
+ *
+ * - Nothing reads them FLAT. Every `aplQuery` in docs/observability/monitors.json
+ *   was parsed and all dashboard JSON grepped: zero matches for the three as flat
+ *   fields (the apparent hits are the English word "digest" in description prose).
+ * - Nothing reads them out of `worker_fields` either, so the move breaks no query
+ *   in the opposite direction.
+ *
+ * Packed, they stay queryable as `['worker_fields']['digest']` — a longer access
+ * path, the same value, still typed. `digest` matters most: it is the only join
+ * key from a browser error report back to its `next.request_error` row (see the
+ * error-shape group below), and that correlation still works through the map
+ * field. The trade is explicit and worth stating plainly: keeping them flat meant
+ * the ENTIRE record was dropped, which loses the digest anyway plus everything
+ * travelling with it. Packed is strictly better than dropped.
  */
 /**
  * Fields that stay top-level in `oxygen-logs`.
@@ -64,8 +104,67 @@ export declare const AXIOM_STABLE_FIELDS: ReadonlySet<string>;
  * ordinary flat fields and the budget is defeated silently. Create it with:
  *   POST /v2/datasets/{dataset}/mapfields  {"name": "worker_fields"}
  * `scripts/ops/axiom-mapfields.mjs` does this idempotently for every log dataset.
+ *
+ * AND IT MUST BE ABLE TO EXIST — see `AxiomOverflowMode` below. A map field still
+ * occupies ONE column slot, so registering it on an already-full dataset does not
+ * create it; Axiom rejects every ingest that carries it instead.
  */
 export declare const AXIOM_OVERFLOW_MAP_FIELD = "worker_fields";
+/**
+ * How overflow is attached to a record.
+ *
+ * `map` is correct and is the default. `message` exists because of a failure mode
+ * the map-field design did not anticipate, measured in production 2026-08-15:
+ *
+ *   {"code":400,"message":"adding 'worker_fields' to dataset fields would
+ *    exceed the column limit of 1025"}
+ *
+ * `oxygen-logs` was at 1,026 columns. A map field's CONTENTS are free, but the map
+ * field itself is still a column, and there was no slot for it. So Axiom refused to
+ * create it and rejected every batch carrying it — 19,029 rejected batches and
+ * 41,372 lost records in 24h, roughly 60x the 412-batches-per-7-days leak the map
+ * field was introduced to fix. Registering the map field on a full dataset had
+ * converted "silently absorb overflow as new columns" into "drop everything".
+ *
+ * The degraded mode restores the shape this module shipped BEFORE the map field:
+ * a JSON string in `message` under the same `worker_fields` key, so
+ * `parse_json(tostring(message)).worker_fields.x` — the access path every
+ * pre-2026-08-08 row and every legacy query already uses — keeps working.
+ *
+ * Deliberately process-level and one-way. A shipper flips it on the first
+ * column-limit rejection and every later record in that process packs the same
+ * way; nothing flips it back, because a dataset does not grow a free column while
+ * the process is running. Fresh processes start in `map` again, so the moment the
+ * dataset has headroom the next deploy silently returns to the better shape with
+ * no code change.
+ *
+ * IT IS A LAST RESORT, NOT A HOME. While degraded, every monitor reading
+ * `['worker_fields']['x']` resolves to null — the silent-blinding failure this
+ * module's header warns about. Readers that must survive both shapes coalesce
+ * them; see `docs/observability/queries.apl.md`. Losing the flat shape beats
+ * losing the record.
+ */
+export type AxiomOverflowMode = "map" | "message";
+/** The mode the next `packAxiomLogRecord` call will use. */
+export declare function getAxiomOverflowMode(): AxiomOverflowMode;
+/**
+ * Does this Axiom 400 body mean "the map field will not fit"?
+ *
+ * Matched on the stable half of Axiom's message rather than the whole string: the
+ * field name and the limit number both vary, and a shipper that only recognised
+ * `worker_fields`/`1025` verbatim would go back to dropping everything the day
+ * either changed.
+ */
+export declare function isColumnLimitRejection(body: string | null | undefined): boolean;
+/**
+ * Switches this process to `message` packing.
+ *
+ * Returns true only on the transition, so a caller can retry the rejected batch
+ * and log the degradation exactly once instead of once per batch forever.
+ */
+export declare function degradeAxiomOverflowToMessage(): boolean;
+/** Test-only: restores the default so cases cannot leak mode into each other. */
+export declare function resetAxiomOverflowMode(): void;
 /**
  * Bound on the serialized overflow, so one pathological record cannot push a whole
  * batch past Axiom's request limits. 64 KB is far above any real log line and far

package/node_modules/@oxygen/shared/dist/axiom-field-budget.js

@@ -19,6 +19,13 @@
  * under `worker_fields`. New instrumentation can then be added freely without
  * anyone having to remember that a new key can take down log shipping globally.
  *
+ * WITH ONE HOLE, found the hard way on 2026-08-15. Packing protects the dataset
+ * from the CONTENTS, not from the CONTAINER: `worker_fields` is itself a column,
+ * and a dataset with no free column cannot have it. Registering the map field on
+ * the already-full `oxygen-logs` therefore turned a slow leak into a total ingest
+ * outage — 41,372 records/day, ~60x worse than the leak it replaced. `AxiomOverflowMode`
+ * below is the escape hatch; freeing a column slot is the actual fix.
+ *
  * THE ALLOWLIST IS A LOAD-BEARING CONTRACT IN BOTH DIRECTIONS.
  *
  * - A field that a monitor, dashboard, or checked-in query reads **flat** must be
@@ -34,6 +41,39 @@
  * Both directions are asserted by `scripts/ci/log-field-budget.mjs` against the
  * real seed and dashboard JSON, so a change to either side fails loudly instead
  * of quietly blinding a monitor.
+ *
+ * THERE IS A THIRD DIRECTION, and it is the one that took production down: a
+ * name in this set that the DATASET has no column for. Allowlisted means flat by
+ * definition, so such a name cannot fall back into the map — it demands a
+ * brand-new column, and a dataset with no slot to allocate one rejects the whole
+ * ingest batch with HTTP 400. So membership here is not "a field we read flat";
+ * it is "a field we read flat AND the dataset can actually hold". The live half
+ * of `scripts/ci/log-field-budget.mjs` checks that second half against Axiom.
+ *
+ * REMOVED 2026-08-15 — `chunk_id`, `item_id`, `digest`. Prod `oxygen-logs` had no
+ * column for any of the three and no slot left to create one, so every record
+ * carrying one was rejected 400 and DROPPED. That was still ~116 ship failures
+ * per 25 minutes after the `worker_fields` map field itself had been repaired on
+ * the Axiom side, and it hit the Next.js server-error path hardest, through
+ * `digest`.
+ *
+ * The warning above — that dropping a name silently moves it into the overflow
+ * and can zero a query that reads it flat — applies to exactly this removal, so
+ * it was CHECKED rather than assumed, in both directions:
+ *
+ * - Nothing reads them FLAT. Every `aplQuery` in docs/observability/monitors.json
+ *   was parsed and all dashboard JSON grepped: zero matches for the three as flat
+ *   fields (the apparent hits are the English word "digest" in description prose).
+ * - Nothing reads them out of `worker_fields` either, so the move breaks no query
+ *   in the opposite direction.
+ *
+ * Packed, they stay queryable as `['worker_fields']['digest']` — a longer access
+ * path, the same value, still typed. `digest` matters most: it is the only join
+ * key from a browser error report back to its `next.request_error` row (see the
+ * error-shape group below), and that correlation still works through the map
+ * field. The trade is explicit and worth stating plainly: keeping them flat meant
+ * the ENTIRE record was dropped, which loses the digest anyway plus everything
+ * travelling with it. Packed is strictly better than dropped.
  */
 /**
  * Fields that stay top-level in `oxygen-logs`.
@@ -66,8 +106,9 @@ export const AXIOM_STABLE_FIELDS = new Set([
     "operation",
     "tenant_database_id",
     "run_id",
-    "chunk_id",
-    "item_id",
+    // `chunk_id` and `item_id` used to sit here. Removed 2026-08-15 because prod
+    // had no column for either and no slot to make one — see the header. They now
+    // ride in `worker_fields`, where they cost no column at all.
     "worker_id",
     "conversation_id",
     // --- Error shape (errorFields) -------------------------------------------
@@ -75,9 +116,11 @@ export const AXIOM_STABLE_FIELDS = new Set([
     "error_name",
     "error_message",
     "error_code",
-    // Next.js stamps `digest` on a serialized server error; it is the only value
-    // that joins a browser error report back to its `next.request_error` row.
-    "digest",
+    // `digest` used to sit here. Next.js stamps it on a serialized server error and
+    // it is still the only value that joins a browser error report back to its
+    // `next.request_error` row — but prod could not allocate a column for it, so a
+    // flat `digest` meant the whole record died and the join key with it. Removed
+    // 2026-08-15; the join now reads `tostring(['worker_fields']['digest'])`.
     // --- Primitive identity --------------------------------------------------
     "workflow_id",
     "workflow_run_id",
@@ -195,8 +238,51 @@ export const AXIOM_STABLE_FIELDS = new Set([
  * ordinary flat fields and the budget is defeated silently. Create it with:
  *   POST /v2/datasets/{dataset}/mapfields  {"name": "worker_fields"}
  * `scripts/ops/axiom-mapfields.mjs` does this idempotently for every log dataset.
+ *
+ * AND IT MUST BE ABLE TO EXIST — see `AxiomOverflowMode` below. A map field still
+ * occupies ONE column slot, so registering it on an already-full dataset does not
+ * create it; Axiom rejects every ingest that carries it instead.
  */
 export const AXIOM_OVERFLOW_MAP_FIELD = "worker_fields";
+/**
+ * The pre-existing column the overflow degrades into when the map field cannot be
+ * created. Owned by the Vercel drain (it is where Lane B parks the whole app JSON),
+ * which is exactly why it is safe here: it already exists on every log dataset, so
+ * writing it costs no new column on a dataset that has none left to give.
+ */
+const AXIOM_OVERFLOW_MESSAGE_FIELD = "message";
+let overflowMode = "map";
+/** The mode the next `packAxiomLogRecord` call will use. */
+export function getAxiomOverflowMode() {
+    return overflowMode;
+}
+/**
+ * Does this Axiom 400 body mean "the map field will not fit"?
+ *
+ * Matched on the stable half of Axiom's message rather than the whole string: the
+ * field name and the limit number both vary, and a shipper that only recognised
+ * `worker_fields`/`1025` verbatim would go back to dropping everything the day
+ * either changed.
+ */
+export function isColumnLimitRejection(body) {
+    return typeof body === "string" && /would exceed the column limit/i.test(body);
+}
+/**
+ * Switches this process to `message` packing.
+ *
+ * Returns true only on the transition, so a caller can retry the rejected batch
+ * and log the degradation exactly once instead of once per batch forever.
+ */
+export function degradeAxiomOverflowToMessage() {
+    if (overflowMode === "message")
+        return false;
+    overflowMode = "message";
+    return true;
+}
+/** Test-only: restores the default so cases cannot leak mode into each other. */
+export function resetAxiomOverflowMode() {
+    overflowMode = "map";
+}
 /**
  * Bound on the serialized overflow, so one pathological record cannot push a whole
  * batch past Axiom's request limits. 64 KB is far above any real log line and far
@@ -246,17 +332,26 @@ export function packAxiomLogRecord(record) {
     }
     if (Object.keys(overflow).length === 0)
         return stable;
-    // Nested under the map field as a real object — NOT stringified. Axiom stores
-    // map contents without allocating a column per key, and keeps them queryable
-    // and typed.
-    stable[AXIOM_OVERFLOW_MAP_FIELD] =
-        JSON.stringify(overflow).length <= MAX_PACKED_MESSAGE_LENGTH
-            ? overflow
-            : {
-                // Never silently truncate to nothing: the key NAMES alone are usually
-                // enough to identify which call site produced the oversized record.
-                _truncated: true,
-                _keys: Object.keys(overflow),
-            };
+    const bounded = JSON.stringify(overflow).length <= MAX_PACKED_MESSAGE_LENGTH
+        ? overflow
+        : {
+            // Never silently truncate to nothing: the key NAMES alone are usually
+            // enough to identify which call site produced the oversized record.
+            _truncated: true,
+            _keys: Object.keys(overflow),
+        };
+    if (overflowMode === "map") {
+        // Nested under the map field as a real object — NOT stringified. Axiom stores
+        // map contents without allocating a column per key, and keeps them queryable
+        // and typed.
+        stable[AXIOM_OVERFLOW_MAP_FIELD] = bounded;
+        return stable;
+    }
+    // Degraded: the map field has no column to live in. Same payload, same inner
+    // key, stringified into a column that already exists. A caller's own `message`
+    // field is not lost — it is non-allowlisted, so it is inside `bounded` already.
+    stable[AXIOM_OVERFLOW_MESSAGE_FIELD] = JSON.stringify({
+        [AXIOM_OVERFLOW_MAP_FIELD]: bounded,
+    });
     return stable;
 }

package/node_modules/@oxygen/shared/dist/cli-result.js

@@ -70,6 +70,8 @@ export function exitCodeForErrorCode(code) {
     }
     if (code === "not_found" || code.endsWith("_not_found"))
         return 4;
+    if (code.endsWith("_requires_approval"))
+        return 7;
     if (code === "timeout" || code.endsWith("_timeout"))
         return 8;
     if (code.startsWith("invalid_")

package/node_modules/@oxygen/shared/dist/crm-activity-events.d.ts

@@ -74,6 +74,26 @@ export declare const CRM_ACTIVITY_EVENT_DEFINITIONS: readonly [{
     readonly key: "signup";
     readonly label: "Signup";
     readonly group: "Signals";
+}, {
+    readonly key: "product_activated";
+    readonly label: "Product activated";
+    readonly group: "Product lifecycle";
+}, {
+    readonly key: "trial_started";
+    readonly label: "Free trial started";
+    readonly group: "Product lifecycle";
+}, {
+    readonly key: "plan_paid";
+    readonly label: "Paid plan started";
+    readonly group: "Product lifecycle";
+}, {
+    readonly key: "customer_lost";
+    readonly label: "Customer lost";
+    readonly group: "Product lifecycle";
+}, {
+    readonly key: "workspace_deleted";
+    readonly label: "Workspace deleted";
+    readonly group: "Product lifecycle";
 }, {
     readonly key: "website_visit";
     readonly label: "Website visit";

package/node_modules/@oxygen/shared/dist/crm-activity-events.js

@@ -24,6 +24,11 @@ export const CRM_ACTIVITY_EVENT_DEFINITIONS = [
     { key: "sync_pushed", label: "CRM sync pushed", group: "CRM operations" },
     { key: "sync_pulled", label: "CRM sync pulled", group: "CRM operations" },
     { key: "signup", label: "Signup", group: "Signals" },
+    { key: "product_activated", label: "Product activated", group: "Product lifecycle" },
+    { key: "trial_started", label: "Free trial started", group: "Product lifecycle" },
+    { key: "plan_paid", label: "Paid plan started", group: "Product lifecycle" },
+    { key: "customer_lost", label: "Customer lost", group: "Product lifecycle" },
+    { key: "workspace_deleted", label: "Workspace deleted", group: "Product lifecycle" },
     { key: "website_visit", label: "Website visit", group: "Signals" },
     { key: "profile_view", label: "Profile view", group: "Signals" },
     { key: "post_reaction", label: "Post reaction", group: "Signals" },

package/node_modules/@oxygen/shared/dist/future-signup-events.d.ts

@@ -0,0 +1,27 @@
+export declare const FUTURE_SIGNUP_CONTRACT_VERSION = "future_signup_crm_activation.v1";
+export declare const FUTURE_SIGNUP_ACTIVATION_TAXONOMY_VERSION = "activation_commands.v1";
+export declare const FUTURE_SIGNUP_LIFECYCLE_CONTRACT_VERSION = "future_signup_lifecycle.v1";
+export declare const FUTURE_SIGNUP_LIFECYCLE_PROJECTION_CONTRACT_VERSION = "future_signup_lifecycle_projection.v1";
+export declare const FUTURE_SIGNUP_CRM_DESTINATION = "oxygen_company_crm";
+export declare const FUTURE_SIGNUP_ACTIVATION_COMMANDS: readonly ["agent create", "crm activity log", "crm assert", "crm object add-attr", "crm object create", "crm relationships define", "crm relationships upsert", "knowledge page upsert", "publishing posts create", "sequences create", "tables create", "tables duplicate", "tables import-csv", "tables import-file", "tables import-staged", "tables import-url", "tables insert", "tables relate", "tables update", "tables upsert", "workflows apply"];
+export declare function isFutureSignupActivationCommand(command: string): boolean;
+export declare function futureSignupJourneyId(clerkUserId: string): string;
+export declare function futureSignupFactId(clerkUserId: string): string;
+export declare function futureSignupOperationFactId(operationEventId: string): string;
+export declare function futureSignupActivationFactId(clerkUserId: string): string;
+export declare function futureSignupTrialStartedFactId(stripeSubscriptionId: string): string;
+export declare function futureSignupPaidFactId(stripeInvoiceId: string): string;
+export declare function futureSignupLostFactId(stripeSubscriptionId: string, lossKind: "paid_churn" | "trial_non_conversion"): string;
+export declare function futureSignupSubscriptionEndedFactId(stripeSubscriptionId: string, terminationKind: "replaced" | "duplicate" | "unqualified"): string;
+export declare function futureSignupWorkspaceDeletedFactId(clerkOrgId: string): string;
+/** Immutable cause for membership, completeness, or Company-identity projection changes. */
+export declare function futureSignupLifecycleProjectionRefreshFactId(clerkOrgId: string, sourceEventId: string): string;
+export declare function futureSignupLifecycleProjectionFactId(sourceFactId: string): string;
+export declare function futureSignupLifecycleAggregateId(clerkOrgId: string): string;
+export declare function futureSignupLifecycleEventId(factId: string, factRevision: number): string;
+export declare function isAtOrAfterFutureSignupCutover(input: {
+    clerkUserId: string;
+    signupAt: Date;
+    cutoverAt: Date;
+    clerkUserIdTiebreaker?: string;
+}): boolean;

package/node_modules/@oxygen/shared/dist/future-signup-events.js

@@ -0,0 +1,90 @@
+export const FUTURE_SIGNUP_CONTRACT_VERSION = "future_signup_crm_activation.v1";
+export const FUTURE_SIGNUP_ACTIVATION_TAXONOMY_VERSION = "activation_commands.v1";
+export const FUTURE_SIGNUP_LIFECYCLE_CONTRACT_VERSION = "future_signup_lifecycle.v1";
+export const FUTURE_SIGNUP_LIFECYCLE_PROJECTION_CONTRACT_VERSION = "future_signup_lifecycle_projection.v1";
+export const FUTURE_SIGNUP_CRM_DESTINATION = "oxygen_company_crm";
+export const FUTURE_SIGNUP_ACTIVATION_COMMANDS = [
+    "agent create",
+    "crm activity log",
+    "crm assert",
+    "crm object add-attr",
+    "crm object create",
+    "crm relationships define",
+    "crm relationships upsert",
+    "knowledge page upsert",
+    "publishing posts create",
+    "sequences create",
+    "tables create",
+    "tables duplicate",
+    "tables import-csv",
+    "tables import-file",
+    "tables import-staged",
+    "tables import-url",
+    "tables insert",
+    "tables relate",
+    "tables update",
+    "tables upsert",
+    "workflows apply",
+];
+const ACTIVATION_COMMAND_SET = new Set(FUTURE_SIGNUP_ACTIVATION_COMMANDS);
+export function isFutureSignupActivationCommand(command) {
+    return ACTIVATION_COMMAND_SET.has(command.trim().toLowerCase());
+}
+export function futureSignupJourneyId(clerkUserId) {
+    return `future_signup:v1:clerk_user:${requiredId(clerkUserId, "clerkUserId")}`;
+}
+export function futureSignupFactId(clerkUserId) {
+    return futureSignupJourneyId(clerkUserId);
+}
+export function futureSignupOperationFactId(operationEventId) {
+    return `product_operation:v1:${requiredId(operationEventId, "operationEventId")}`;
+}
+export function futureSignupActivationFactId(clerkUserId) {
+    return `product_activated:v1:${futureSignupFactId(clerkUserId)}`;
+}
+export function futureSignupTrialStartedFactId(stripeSubscriptionId) {
+    return `future_signup_lifecycle:trial_started:v1:${requiredId(stripeSubscriptionId, "stripeSubscriptionId")}`;
+}
+export function futureSignupPaidFactId(stripeInvoiceId) {
+    return `future_signup_lifecycle:paid:v1:${requiredId(stripeInvoiceId, "stripeInvoiceId")}`;
+}
+export function futureSignupLostFactId(stripeSubscriptionId, lossKind) {
+    return `future_signup_lifecycle:lost:v1:${requiredId(stripeSubscriptionId, "stripeSubscriptionId")}:${lossKind}`;
+}
+export function futureSignupSubscriptionEndedFactId(stripeSubscriptionId, terminationKind) {
+    return `future_signup_lifecycle:subscription_ended:v1:${requiredId(stripeSubscriptionId, "stripeSubscriptionId")}:${terminationKind}`;
+}
+export function futureSignupWorkspaceDeletedFactId(clerkOrgId) {
+    return `future_signup_lifecycle:workspace_deleted:v1:${requiredId(clerkOrgId, "clerkOrgId")}`;
+}
+/** Immutable cause for membership, completeness, or Company-identity projection changes. */
+export function futureSignupLifecycleProjectionRefreshFactId(clerkOrgId, sourceEventId) {
+    return `future_signup_lifecycle:projection_refreshed:v1:${requiredId(clerkOrgId, "clerkOrgId")}:${requiredId(sourceEventId, "sourceEventId")}`;
+}
+export function futureSignupLifecycleProjectionFactId(sourceFactId) {
+    return `lifecycle_projection:v1:${requiredId(sourceFactId, "sourceFactId")}`;
+}
+export function futureSignupLifecycleAggregateId(clerkOrgId) {
+    return `lifecycle_aggregate:v1:clerk_org:${requiredId(clerkOrgId, "clerkOrgId")}`;
+}
+export function futureSignupLifecycleEventId(factId, factRevision) {
+    if (!Number.isInteger(factRevision) || factRevision < 1) {
+        throw new TypeError("factRevision must be a positive integer.");
+    }
+    return `${requiredId(factId, "factId")}:r${factRevision}`;
+}
+export function isAtOrAfterFutureSignupCutover(input) {
+    const signupMs = input.signupAt.getTime();
+    const cutoverMs = input.cutoverAt.getTime();
+    if (!Number.isFinite(signupMs) || !Number.isFinite(cutoverMs))
+        return false;
+    if (signupMs !== cutoverMs)
+        return signupMs > cutoverMs;
+    return input.clerkUserId.localeCompare(input.clerkUserIdTiebreaker ?? "") >= 0;
+}
+function requiredId(value, field) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new TypeError(`${field} is required.`);
+    return normalized;
+}