@oxygen-agent/cli 1.750.4 → 1.782.1

package/node_modules/@oxygen/shared/dist/provider-funding-errors.js

@@ -0,0 +1,81 @@
+/**
+ * One vocabulary for "the provider refused because of money".
+ *
+ * A provider 402 has reached customers wearing four different costumes:
+ *   - `provider_credits_exhausted`        (tool runner, managed pool)
+ *   - `connection_credits_exhausted`      (tool runner, BYOK connection)
+ *   - `provider_insufficient_credits`     (enrichment column runner + waterfall)
+ *   - `provider_credit_exhausted`         (worker lane exclusion, singular)
+ * plus `provider_plan_limit` for the adjacent "your plan does not include this"
+ * refusal, which is also a money problem and also not retryable.
+ *
+ * Only the first two were known to the run-bottleneck classifier. The others
+ * fell through to a `/rate|limit|429/` test — which `provider_plan_limit`
+ * matches on the substring "limit" — or to the deferral branch, so a hard 402
+ * surfaced to the customer as `bottlenecks: [provider_rate_limit]`. That reads
+ * as "wait and retry": a partner agency spent hours lowering concurrency against
+ * an account that was simply out of credits, and the real 402 was only visible
+ * through a different command.
+ *
+ * The distinction that matters operationally: a rate limit clears by waiting, a
+ * funding failure never does. Anything that decides "should the customer wait?"
+ * must ask this predicate, not a regex over the code string.
+ */
+/** Codes meaning the provider refused for funding/entitlement reasons. Never retryable by waiting. */
+export const PROVIDER_FUNDING_ERROR_CODES = [
+    "provider_credits_exhausted",
+    "provider_credits_exhausted_deferred",
+    "connection_credits_exhausted",
+    "provider_insufficient_credits",
+    "provider_credit_exhausted",
+    "provider_plan_limit",
+    "blocked_provider_funding",
+];
+const FUNDING_CODE_SET = new Set(PROVIDER_FUNDING_ERROR_CODES);
+/**
+ * True when the code means "this failed over money", in any of its spellings.
+ *
+ * Matches on the exact code first, then falls back to a narrow shape test so a
+ * provider-specific variant (`peopledatalabs_credits_exhausted`) is still
+ * classified as funding rather than silently treated as retryable. Deliberately
+ * does NOT match on "limit" alone — `rate_limit_exceeded` is a real rate limit.
+ */
+export function isProviderFundingErrorCode(code) {
+    if (!code)
+        return false;
+    const normalized = code.trim().toLowerCase();
+    if (!normalized)
+        return false;
+    if (FUNDING_CODE_SET.has(normalized))
+        return true;
+    if (/_credits?_exhausted(_deferred)?$/.test(normalized))
+        return true;
+    if (/insufficient_credits?$/.test(normalized))
+        return true;
+    if (/^blocked_provider_funding/.test(normalized))
+        return true;
+    return /(?:payment_required|plan_limit|quota_exceeded)$/.test(normalized);
+}
+/**
+ * True for a genuine rate limit — one that clears by waiting.
+ *
+ * A funding failure always wins: `provider_plan_limit` contains "limit" and
+ * would otherwise read as retryable.
+ */
+export function isProviderRateLimitErrorCode(code) {
+    if (!code)
+        return false;
+    if (isProviderFundingErrorCode(code))
+        return false;
+    return /rate|limit|429|capacity_deferred/i.test(code);
+}
+/** The customer-facing next step for a funding refusal, by credential ownership. */
+export function providerFundingNextStep(credentialMode) {
+    if (credentialMode === "byok") {
+        return "Top up or upgrade the provider account behind your connected key, then retry. Waiting will not clear this.";
+    }
+    if (credentialMode === "managed") {
+        return "This is OXYGEN's managed provider account, not your credit balance — contact support. Waiting will not clear this; route the run to another provider in the meantime.";
+    }
+    return "Check the provider account's balance and plan entitlement, then retry. Waiting will not clear this.";
+}

package/node_modules/@oxygen/shared/dist/publishing-limits.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Broadcast character caps, in one place.
+ *
+ * These were defined three times — the web composer, the tenant-db lint, and an
+ * implicit `maxLength` on the MCP tool schema — and the MCP copy had drifted to
+ * 20,000. An X Premium account may post 25,000 characters, so a post between the
+ * two numbers was rejected by OXYGEN's own schema before X ever saw it, with an
+ * error that blamed the length rather than our stale constant. A customer hit
+ * exactly that after we told them the Premium cap was supported.
+ *
+ * `PUBLISHING_CONTENT_MAX_CHARS` is the outermost bound any surface should
+ * enforce: it must be >= the largest per-channel cap, because per-channel
+ * validation is where a too-long post gets an accurate, channel-specific error.
+ */
+/** X free tier. */
+export declare const X_FREE_MAX_CHARS = 280;
+/** X Premium. The largest single-post cap across every supported channel. */
+export declare const X_PREMIUM_MAX_CHARS = 25000;
+/**
+ * Outermost content bound for any publishing surface (CLI/MCP schema, API).
+ * Never set a surface's cap below this — let the per-channel lint produce the
+ * specific error instead of a generic schema rejection.
+ */
+export declare const PUBLISHING_CONTENT_MAX_CHARS = 25000;

package/node_modules/@oxygen/shared/dist/publishing-limits.js

@@ -0,0 +1,24 @@
+/**
+ * Broadcast character caps, in one place.
+ *
+ * These were defined three times — the web composer, the tenant-db lint, and an
+ * implicit `maxLength` on the MCP tool schema — and the MCP copy had drifted to
+ * 20,000. An X Premium account may post 25,000 characters, so a post between the
+ * two numbers was rejected by OXYGEN's own schema before X ever saw it, with an
+ * error that blamed the length rather than our stale constant. A customer hit
+ * exactly that after we told them the Premium cap was supported.
+ *
+ * `PUBLISHING_CONTENT_MAX_CHARS` is the outermost bound any surface should
+ * enforce: it must be >= the largest per-channel cap, because per-channel
+ * validation is where a too-long post gets an accurate, channel-specific error.
+ */
+/** X free tier. */
+export const X_FREE_MAX_CHARS = 280;
+/** X Premium. The largest single-post cap across every supported channel. */
+export const X_PREMIUM_MAX_CHARS = 25_000;
+/**
+ * Outermost content bound for any publishing surface (CLI/MCP schema, API).
+ * Never set a surface's cap below this — let the per-channel lint produce the
+ * specific error instead of a generic schema rejection.
+ */
+export const PUBLISHING_CONTENT_MAX_CHARS = X_PREMIUM_MAX_CHARS;

package/node_modules/@oxygen/shared/dist/spend-safety.d.ts

@@ -54,13 +54,34 @@ export declare function resolveByokProviderDailyCapEnforcementMode(configured?:
 /**
  * Implicit org-level DAILY budget guard, evaluated only when the org has no
  * explicit org-scope daily budget policy and the plan has finite positive
- * monthly credits. Warn when one rolling day spends past WARN_PCT of the
- * monthly grant; hard-block at BLOCK_PCT (a loop burning a whole month in a
- * day is near-certainly runaway — this also protects large top-up balances).
- * Setting any explicit org-daily policy fully suppresses the implicit pair.
+ * monthly credits. Expressed as a MULTIPLE of the plan's monthly grant spent in
+ * one UTC day: warn past WARN_MULTIPLE, hard-block at BLOCK_MULTIPLE. Setting
+ * any explicit org-daily policy fully suppresses the implicit pair.
+ *
+ * This is a runaway-loop backstop, NOT a spend ceiling. The available balance is
+ * the real bound on what a workspace can spend, and legitimate single-day work
+ * routinely exceeds a month's grant: standing up cold-email infrastructure
+ * (a managed domain plus three warmed inboxes is ~31k credits, so a full sending
+ * estate is hundreds of thousands in an afternoon) and large enrichment bursts
+ * funded by a top-up are both deliberate purchases, not loops. Raised 20x on
+ * 2026-08-17 for exactly that reason — at the previous 1x the guard refused a
+ * customer who had already paid for the credits, and the refusal was invisible
+ * on every surface. 20x still stops an unattended loop within hours.
+ */
+export declare const DEFAULT_ORG_DAILY_SPEND_WARN_MULTIPLE = 5;
+export declare const DEFAULT_ORG_DAILY_SPEND_BLOCK_MULTIPLE = 20;
+/** Resolved credit thresholds of the implicit org-daily guard for one plan. */
+export type OrgDailySpendGuard = {
+    warnCredits: number;
+    blockCredits: number;
+};
+/**
+ * Resolve the implicit guard's thresholds from a plan's monthly grant. `null`
+ * means the guard is suppressed because the plan has no finite positive grant to
+ * scale from (free at 0, enterprise/custom at null) — the single place that
+ * decision is made, so enforcement and the read surfaces cannot drift apart.
  */
-export declare const DEFAULT_ORG_DAILY_SPEND_WARN_PCT = 0.25;
-export declare const DEFAULT_ORG_DAILY_SPEND_BLOCK_PCT = 1;
+export declare function resolveOrgDailySpendGuard(monthlyCredits: number | null | undefined): OrgDailySpendGuard | null;
 export declare function resolveDefaultTriggerRunCreditCeiling(tier: PlanTier): number | null;
 export declare function resolveDefaultAutoRunBatchCreditCeiling(tier: PlanTier): number | null;
 export declare function resolveDefaultByokColumnRunMaxRows(tier: PlanTier): number | null;

package/node_modules/@oxygen/shared/dist/spend-safety.js

@@ -71,13 +71,41 @@ export function resolveByokProviderDailyCapEnforcementMode(configured = process.
 /**
  * Implicit org-level DAILY budget guard, evaluated only when the org has no
  * explicit org-scope daily budget policy and the plan has finite positive
- * monthly credits. Warn when one rolling day spends past WARN_PCT of the
- * monthly grant; hard-block at BLOCK_PCT (a loop burning a whole month in a
- * day is near-certainly runaway — this also protects large top-up balances).
- * Setting any explicit org-daily policy fully suppresses the implicit pair.
+ * monthly credits. Expressed as a MULTIPLE of the plan's monthly grant spent in
+ * one UTC day: warn past WARN_MULTIPLE, hard-block at BLOCK_MULTIPLE. Setting
+ * any explicit org-daily policy fully suppresses the implicit pair.
+ *
+ * This is a runaway-loop backstop, NOT a spend ceiling. The available balance is
+ * the real bound on what a workspace can spend, and legitimate single-day work
+ * routinely exceeds a month's grant: standing up cold-email infrastructure
+ * (a managed domain plus three warmed inboxes is ~31k credits, so a full sending
+ * estate is hundreds of thousands in an afternoon) and large enrichment bursts
+ * funded by a top-up are both deliberate purchases, not loops. Raised 20x on
+ * 2026-08-17 for exactly that reason — at the previous 1x the guard refused a
+ * customer who had already paid for the credits, and the refusal was invisible
+ * on every surface. 20x still stops an unattended loop within hours.
  */
-export const DEFAULT_ORG_DAILY_SPEND_WARN_PCT = 0.25;
-export const DEFAULT_ORG_DAILY_SPEND_BLOCK_PCT = 1;
+export const DEFAULT_ORG_DAILY_SPEND_WARN_MULTIPLE = 5;
+export const DEFAULT_ORG_DAILY_SPEND_BLOCK_MULTIPLE = 20;
+/**
+ * Resolve the implicit guard's thresholds from a plan's monthly grant. `null`
+ * means the guard is suppressed because the plan has no finite positive grant to
+ * scale from (free at 0, enterprise/custom at null) — the single place that
+ * decision is made, so enforcement and the read surfaces cannot drift apart.
+ */
+export function resolveOrgDailySpendGuard(monthlyCredits) {
+    if (typeof monthlyCredits !== "number" || !Number.isFinite(monthlyCredits) || monthlyCredits <= 0) {
+        return null;
+    }
+    return {
+        warnCredits: roundCredits(monthlyCredits * DEFAULT_ORG_DAILY_SPEND_WARN_MULTIPLE),
+        blockCredits: roundCredits(monthlyCredits * DEFAULT_ORG_DAILY_SPEND_BLOCK_MULTIPLE),
+    };
+}
+/** Credits carry 3 decimals everywhere (control-DB numeric(18,3)). */
+function roundCredits(value) {
+    return Math.round(value * 1000) / 1000;
+}
 export function resolveDefaultTriggerRunCreditCeiling(tier) {
     return DEFAULT_TRIGGER_RUN_CREDIT_CEILING[tier];
 }

package/node_modules/@oxygen/shared/dist/table-capacity.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Plan-independent infrastructure envelope for durable Workspace Tables.
+ * Plans do not sell different storage entitlements; every workspace gets the
+ * same safety boundary and plans continue to differ through operation/rate and
+ * credit limits.
+ */
+export declare const WORKSPACE_TABLE_CAPACITY: Readonly<{
+    tableRowLimit: 3000000;
+    workspaceRowLimit: 25000000;
+    workspaceDatabaseWarningBytes: number;
+    workspaceDatabaseLimitBytes: number;
+}>;
+export declare const WORKSPACE_TABLE_DATABASE_STORAGE_SCOPE: "postgres_workspace_tables_heap_indexes_toast";

package/node_modules/@oxygen/shared/dist/table-capacity.js

@@ -0,0 +1,14 @@
+const GIB = 1024 ** 3;
+/**
+ * Plan-independent infrastructure envelope for durable Workspace Tables.
+ * Plans do not sell different storage entitlements; every workspace gets the
+ * same safety boundary and plans continue to differ through operation/rate and
+ * credit limits.
+ */
+export const WORKSPACE_TABLE_CAPACITY = Object.freeze({
+    tableRowLimit: 3_000_000,
+    workspaceRowLimit: 25_000_000,
+    workspaceDatabaseWarningBytes: 20 * GIB,
+    workspaceDatabaseLimitBytes: 30 * GIB,
+});
+export const WORKSPACE_TABLE_DATABASE_STORAGE_SCOPE = "postgres_workspace_tables_heap_indexes_toast";

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,4 +1,4 @@
-export declare const OXYGEN_VERSION = "1.750.4";
+export declare const OXYGEN_VERSION = "1.782.1";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
 export declare const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.750.4";
+export const OXYGEN_VERSION = "1.782.1";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:
@@ -26,8 +26,11 @@ export const OXYGEN_VERSION = "1.750.4";
 // (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and
 // removed the old /api/cli/linkedin/* routes — older CLIs would 404.
 export const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
-// Per-surface floor for the whitelabel/managed-inbox purchase path, enforced only
-// by /api/cli/managed-inboxes/subscribe.
+// Per-surface floor for the whitelabel/managed-inbox purchase path, enforced by
+// BOTH paid inbox routes: /api/cli/managed-inboxes/subscribe and
+// /api/cli/managed-inboxes/[domain]/mailboxes. (The comment used to say subscribe
+// only; the expansion route has enforced it too since it shipped, and three
+// separate reads of this file have since reasoned from the wrong half.)
 //
 // 1.326.2: Pricing Model 2.0 (2026-07-14) moved whitelabel inbox subscribe from the
 // USD Stripe rail back to Oxygen credits: the preview now returns

package/node_modules/@oxygen/shared/package.json

@@ -61,6 +61,11 @@
       "import": "./dist/object-storage.js",
       "default": "./dist/object-storage.js"
     },
+    "./person-name": {
+      "types": "./dist/person-name.d.ts",
+      "import": "./dist/person-name.js",
+      "default": "./dist/person-name.js"
+    },
     "./select-options": {
       "types": "./dist/select-options.d.ts",
       "import": "./dist/select-options.js",
@@ -145,6 +150,11 @@
       "types": "./dist/schedule-label.d.ts",
       "import": "./dist/schedule-label.js",
       "default": "./dist/schedule-label.js"
+    },
+    "./publishing-limits": {
+      "types": "./dist/publishing-limits.d.ts",
+      "import": "./dist/publishing-limits.js",
+      "default": "./dist/publishing-limits.js"
     }
   },
   "dependencies": {}

package/node_modules/@oxygen/workflows/dist/graph/diff.d.ts

@@ -0,0 +1,33 @@
+import type { WorkflowGraphManifest } from "./types.js";
+/**
+ * What changed between the revision currently serving triggers and the one about
+ * to replace it.
+ *
+ * Publishing is the moment a workflow stops being a draft and starts acting on
+ * the world, and until now the author approved it having been shown a credit cap
+ * and nothing else. "Approve this" is not a review if the thing being approved
+ * is invisible. This is the comparison that makes the review honest.
+ *
+ * Canvas position is deliberately NOT a change. `ui` carries x/y, so dragging a
+ * node two pixels would otherwise report the graph as modified and train the
+ * author to skim a diff that cries wolf — which is worse than no diff, because
+ * it looks like diligence.
+ */
+export type WorkflowGraphNodeChange = {
+    nodeId: string;
+    /** The author's own step name, which is what the canvas shows. */
+    label: string;
+    change: "added" | "removed" | "modified";
+    /** For a modified node, the top-level fields that actually differ. */
+    changedFields?: string[];
+};
+export type WorkflowGraphDiff = {
+    triggerChanged: boolean;
+    inputSchemaChanged: boolean;
+    nodes: WorkflowGraphNodeChange[];
+    edgesAdded: number;
+    edgesRemoved: number;
+    /** True when nothing semantic differs — a re-publish of the same graph. */
+    unchanged: boolean;
+};
+export declare function diffWorkflowGraphManifests(before: WorkflowGraphManifest, after: WorkflowGraphManifest): WorkflowGraphDiff;

package/node_modules/@oxygen/workflows/dist/graph/diff.js

@@ -0,0 +1,75 @@
+function label(node) {
+    return node.name?.trim() || node.id;
+}
+/** Everything about a node except where it sits on the canvas. */
+function semanticNode(node) {
+    const { ui: _ui, ...rest } = node;
+    return rest;
+}
+function stable(value) {
+    if (value === undefined)
+        return "undefined";
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value) ?? "null";
+    if (Array.isArray(value))
+        return `[${value.map(stable).join(",")}]`;
+    const entries = Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));
+    return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stable(entry)}`).join(",")}}`;
+}
+function changedFields(before, after) {
+    const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
+    return [...keys]
+        .filter((key) => stable(before[key]) !== stable(after[key]))
+        .sort();
+}
+function edgeKey(edge) {
+    return `${edge.source}->${edge.target}#${edge.source_handle ?? ""}`;
+}
+export function diffWorkflowGraphManifests(before, after) {
+    const beforeNodes = new Map(before.nodes.map((node) => [node.id, node]));
+    const afterNodes = new Map(after.nodes.map((node) => [node.id, node]));
+    const changes = [];
+    // Reported in the AFTER graph's order so the review reads like the canvas the
+    // author is looking at; removals are appended, since they have no position in it.
+    for (const node of after.nodes) {
+        const previous = beforeNodes.get(node.id);
+        if (!previous) {
+            changes.push({ nodeId: node.id, label: label(node), change: "added" });
+            continue;
+        }
+        const fields = changedFields(semanticNode(previous), semanticNode(node));
+        if (fields.length > 0) {
+            changes.push({
+                nodeId: node.id,
+                label: label(node),
+                change: "modified",
+                changedFields: fields,
+            });
+        }
+    }
+    for (const node of before.nodes) {
+        if (!afterNodes.has(node.id)) {
+            changes.push({ nodeId: node.id, label: label(node), change: "removed" });
+        }
+    }
+    const beforeEdges = new Set(before.edges.map(edgeKey));
+    const afterEdges = new Set(after.edges.map(edgeKey));
+    const edgesAdded = [...afterEdges].filter((key) => !beforeEdges.has(key)).length;
+    const edgesRemoved = [...beforeEdges].filter((key) => !afterEdges.has(key)).length;
+    const triggerChanged = stable(before.trigger) !== stable(after.trigger);
+    const inputSchemaChanged = stable(before.input_schema) !== stable(after.input_schema);
+    return {
+        triggerChanged,
+        inputSchemaChanged,
+        nodes: changes,
+        edgesAdded,
+        edgesRemoved,
+        unchanged: !triggerChanged
+            && !inputSchemaChanged
+            && changes.length === 0
+            && edgesAdded === 0
+            && edgesRemoved === 0,
+    };
+}

package/node_modules/@oxygen/workflows/dist/graph/expression.js

@@ -24,12 +24,28 @@ export class WorkflowValueCoercionError extends Error {
         this.name = "WorkflowValueCoercionError";
     }
 }
+/**
+ * Build the JSON that would satisfy an unresolved `trigger.input.*` path.
+ *
+ * The product already knows the exact dotted path it could not resolve, so
+ * printing only the path makes the reader reconstruct by hand what the error
+ * could have handed them. Only `trigger.input.*` is answerable this way — a
+ * `steps.*` ref is produced by an earlier node, not by the caller, so no input
+ * would fix it and suggesting one would send the reader down a dead end.
+ */
+function unresolvedRefRemedy(path) {
+    const parts = path.split(".");
+    if (parts.length < 3 || parts[0] !== "trigger" || parts[1] !== "input")
+        return "";
+    const skeleton = parts.slice(2).reduceRight((inner, key) => ({ [key]: inner }), "…");
+    return ` Supply it with --input-json '${JSON.stringify(skeleton)}'.`;
+}
 /** A direct mapping named data the run does not carry; sending undefined is never intentional. */
 export class WorkflowValueRefUnresolvedError extends Error {
     path;
     code = "workflow_value_ref_unresolved";
     constructor(path) {
-        super(`Mapped field '${path}' did not resolve in this run.`);
+        super(`Mapped field '${path}' did not resolve in this run.${unresolvedRefRemedy(path)}`);
         this.path = path;
         this.name = "WorkflowValueRefUnresolvedError";
     }

package/node_modules/@oxygen/workflows/dist/graph/index.d.ts

@@ -14,6 +14,7 @@
  */
 export * from "./types.js";
 export * from "./topology.js";
+export * from "./diff.js";
 export * from "./expression.js";
 export * from "./params.js";
 export * from "./remap.js";

package/node_modules/@oxygen/workflows/dist/graph/index.js

@@ -14,6 +14,7 @@
  */
 export * from "./types.js";
 export * from "./topology.js";
+export * from "./diff.js";
 export * from "./expression.js";
 export * from "./params.js";
 export * from "./remap.js";

package/node_modules/@oxygen/workflows/dist/graph/lint.js

@@ -24,7 +24,6 @@ const NODE_KINDS = new Set([
     "wait",
     "approval",
     "code",
-    "workflow",
 ]);
 const MERGE_STRATEGIES = new Set(["append", "first", "wait_all"]);
 const STEP_EFFECTS = new Set(["none", "external_read", "external_write"]);
@@ -334,19 +333,6 @@ node, path, add, scope, options) {
         case "code":
             lintCodeNode(node, path, add, scope, options);
             return;
-        case "workflow":
-            if (!isNonEmptyString(node.workflow_id)) {
-                add(`${path}.workflow_id`, "invalid_workflow_ref", "Workflow node workflow_id is required.");
-            }
-            validateValueRefRecord(node.input, `${path}.input`, add, scope);
-            // Authoring-time refusal, not just a runtime one. A sub-workflow needs its
-            // own durable run, lease, spend ceiling and cancellation semantics, none of
-            // which exist yet — so the worker rejects the node terminally. Without this
-            // rule a user could save the graph, arm a cron trigger on it, and discover
-            // the refusal at 03:00 on every delivery instead of at `workflows apply`.
-            // Remove BOTH refusals together when child runs ship.
-            add(`${path}.kind`, "unsupported_node_kind", "Sub-workflow nodes cannot run yet. Inline the child workflow's nodes for now.");
-            return;
         default:
             return;
     }
@@ -886,6 +872,15 @@ function lintLoopNode(node, path, add, scope) {
     if (node.concurrency !== undefined && !isPositiveInteger(node.concurrency)) {
         add(`${path}.concurrency`, "invalid_loop_target", "Loop concurrency must be a positive integer.");
     }
+    else if (typeof node.concurrency === "number" && node.concurrency > 1) {
+        // First-release runtime cut (founder-approved 2026-08-17). The worker runs
+        // loop bodies sequentially and always has; `concurrency` was accepted and
+        // then ignored, which is the worst of both — the author reads a promise of
+        // parallelism, the run delivers none, and nothing says so. Refusing is the
+        // honest contract until parallel bodies can interleave lease renewal, spend
+        // accounting and per-iteration rows without getting the money wrong.
+        add(`${path}.concurrency`, "invalid_loop_target", "Loop bodies run one item at a time. Remove concurrency, or set it to 1.");
+    }
 }
 function lintSetNode(node, path, add, scope) {
     const fields = asArray(node.fields);
@@ -932,19 +927,31 @@ function lintApprovalNode(node, path, add, scope) {
 function lintWaitNode(node, path, add, scope) {
     const hasDuration = node.duration_seconds !== undefined;
     const hasUntil = node.until !== undefined;
-    if (hasDuration === hasUntil) {
-        add(path, "invalid_wait", "Wait node requires exactly one of duration_seconds or until.");
+    // First-release runtime cut (founder-approved 2026-08-17): duration waits only.
+    //
+    // `until` never did what its name promises. The worker re-evaluates it on a
+    // poll against the run's IMMUTABLE input, so it can only ever become true if it
+    // was already true — it cannot observe an event, a table write, or anything
+    // that happens after the run started. Offering it advertises a transition
+    // source that does not exist. Event-driven waits come back when there is a
+    // subscription behind them; until then a graph that needs one uses an approval
+    // node or a trigger.
+    //
+    // Existing revisions carrying `until` keep executing unchanged — this refuses
+    // the SAVE, not the historical run.
+    if (hasUntil) {
+        add(`${path}.until`, "invalid_wait", "Wait until is not available. Use a duration wait, or an approval node to pause for a decision.");
         return;
     }
-    if (hasDuration) {
-        if (typeof node.duration_seconds !== "number"
-            || !Number.isFinite(node.duration_seconds)
-            || node.duration_seconds <= 0) {
-            add(`${path}.duration_seconds`, "invalid_wait", "Wait duration_seconds must be a positive number.");
-        }
+    if (!hasDuration) {
+        add(path, "invalid_wait", "Wait node requires duration_seconds.");
         return;
     }
-    validateValueRef(node.until, `${path}.until`, add, scope);
+    if (typeof node.duration_seconds !== "number"
+        || !Number.isFinite(node.duration_seconds)
+        || node.duration_seconds <= 0) {
+        add(`${path}.duration_seconds`, "invalid_wait", "Wait duration_seconds must be a positive number.");
+    }
 }
 function isPositiveInteger(value) {
     return typeof value === "number" && Number.isInteger(value) && value > 0;
@@ -1092,11 +1099,6 @@ function graphNodeValueRefs(node, path) {
                 ref,
                 path: `${path}.configuration.${name}`,
             }));
-        case "workflow":
-            return Object.entries(node.input).map(([name, ref]) => ({
-                ref,
-                path: `${path}.input.${name}`,
-            }));
         default:
             return [];
     }

package/node_modules/@oxygen/workflows/dist/graph/manifest-schema.d.ts

@@ -204,7 +204,7 @@ export declare const workflowGraphManifestSchema: {
                         readonly type: "string";
                     };
                     readonly kind: {
-                        readonly enum: readonly ["trigger", "tool", "filter", "switch", "loop", "merge", "set", "wait", "approval", "code", "workflow"];
+                        readonly enum: readonly ["trigger", "tool", "filter", "switch", "loop", "merge", "set", "wait", "approval", "code"];
                     };
                     readonly ui: {
                         readonly type: "object";
@@ -994,7 +994,7 @@ export declare const portableWorkflowDefinitionSchema: {
                                 readonly type: "string";
                             };
                             readonly kind: {
-                                readonly enum: readonly ["trigger", "tool", "filter", "switch", "loop", "merge", "set", "wait", "approval", "code", "workflow"];
+                                readonly enum: readonly ["trigger", "tool", "filter", "switch", "loop", "merge", "set", "wait", "approval", "code"];
                             };
                             readonly ui: {
                                 readonly type: "object";

package/node_modules/@oxygen/workflows/dist/graph/manifest-schema.js

@@ -156,7 +156,7 @@ const nodeSchema = {
         name: { type: "string" },
         description: { type: "string" },
         kind: {
-            enum: ["trigger", "tool", "filter", "switch", "loop", "merge", "set", "wait", "approval", "code", "workflow"],
+            enum: ["trigger", "tool", "filter", "switch", "loop", "merge", "set", "wait", "approval", "code"],
         },
         ui: {
             type: "object",

package/node_modules/@oxygen/workflows/dist/graph/remap.js

@@ -185,11 +185,6 @@ export function remapNodeRefs(node, ids) {
             return node.until === undefined
                 ? node
                 : { ...node, until: remapValueRef(node.until, ids) };
-        case "workflow":
-            return {
-                ...node,
-                input: Object.fromEntries(Object.entries(node.input).map(([key, ref]) => [key, remapValueRef(ref, ids)])),
-            };
         // Missed when this module was first written, because the kind list was typed
         // from memory instead of read off the WorkflowGraphNode union — so a
         // duplicated approval node kept pointing at the original, silently, which is

package/node_modules/@oxygen/workflows/dist/graph/topology.d.ts

@@ -52,6 +52,33 @@ export declare function topologicalOrder(graph: WorkflowGraphManifest): string[]
  * execution order and the existing topological analysis.
  */
 export declare function dominatingNodeIds(graph: WorkflowGraphManifest, targetNodeId: string): Set<string>;
+export type WorkflowGraphNodeTestPlanIssueCode = "workflow_test_target_not_found" | "workflow_test_target_is_trigger" | "workflow_test_target_disabled" | "workflow_test_target_unreachable";
+export type WorkflowGraphNodeTestPlan = {
+    targetNodeId: string;
+    /** Original manifest order, suitable for a durable receipt and UI highlight. */
+    nodeIds: string[];
+    /** Transient execution view; the immutable run manifest remains unchanged. */
+    manifest: WorkflowGraphManifest;
+};
+export type WorkflowGraphNodeTestPlanResult = {
+    ok: true;
+    plan: WorkflowGraphNodeTestPlan;
+} | {
+    ok: false;
+    code: WorkflowGraphNodeTestPlanIssueCode;
+    message: string;
+};
+/**
+ * Plan a safe selected-node test over the canonical graph.
+ *
+ * The slice contains the target and every possible predecessor, not every node
+ * that happens to appear earlier in topological order. Legal loop back-edges are
+ * ignored while finding predecessors so selecting a node halfway through a loop
+ * does not accidentally pull later body nodes into the test. Conversely, when a
+ * completed loop is upstream of the target (or is itself the target), its whole
+ * body is required because the loop's output includes those executions.
+ */
+export declare function planWorkflowGraphNodeTest(graph: WorkflowGraphManifest, targetNodeId: string): WorkflowGraphNodeTestPlanResult;
 /**
  * Illegal cycles: one entry per strongly connected component that still contains
  * a cycle once legal loop back-edges are removed.