@oxygen-agent/cli 1.846.6 → 1.851.1

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.846.6
+Version: 1.851.1

package/dist/help.js

@@ -17,10 +17,7 @@ const HELP_GROUPS = [
             "api-keys",
             "whoami",
             "status",
-            // The prescribed play's progress + next step. It belongs beside `status`
-            // rather than in "Other commands", because "what do I do next" is a
-            // getting-started question and this is the only surface that answers it.
-            "activation",
+            "home",
             "orgs",
             "commands",
             "skills",
@@ -142,12 +139,9 @@ export function applyOxygenHelp(program, binaryName) {
         `  2. ${binaryName} skills install --json      load the skills that teach the GTM loops (automatic after login)`,
         `  3. ${binaryName} context resolve --json     load workspace context before operating primitives`,
         `  4. ${binaryName} capabilities search "<goal>" --json   route the goal, then hydrate one exact command`,
-        // A fresh workspace's first question is "what do I actually run", and the
-        // answer is a prescribed play — not a capability search over 70 command
-        // groups. `activation` names the step this workspace is on right now.
-        `  5. ${binaryName} recipes list --stage day-1 --json    the prescribed day-1 play; ${binaryName} activation shows where you are in it`,
+        `  5. ${binaryName} recipes list --json       choose a play from the Recipe catalog for your goal`,
         `  Provider inventory: ${binaryName} tools search <brand> --json, then ${binaryName} tools search --provider <provider-id> --all --json (Blitz uses blitzapi).`,
-        `  Recurring monitors: use a shareable Blueprint; start with ${binaryName} blueprints list --json.`,
+        `  Installable systems and recurring monitors: ${binaryName} blueprints list --json.`,
         "  Docs: https://oxygen-agent.com/docs",
         "",
         "Conventions:",

package/dist/index.js

@@ -9,7 +9,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, CommanderError, Option } from "commander";
 import { applyOxygenHelp } from "./help.js";
 import { buildCommandManifest, getCommandManifestEntry, searchCommandManifest, suggestCommandNames, } from "./command-manifest.js";
-import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferUserCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
+import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS, COLLAB_GATE_PROSE, COLLAB_SUBJECT_KINDS, COLLAB_SUBJECT_KINDS_PROSE, COLLAB_SUBJECT_LABELS, COLLAB_SUBJECT_PROSE, GATE_KIND_SUBJECTS, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, SUBJECT_PATH_FORMS_PROSE, formatSubjectPath, exitCodeForOxygenError, parseSubjectPath, parseSubjectRef, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_CAPABILITY_ROUTES, OXYGEN_VERSION, OxygenError, getCapabilityRouteMatch, inferUserCapabilityRoute, parseKnowledgePageMarkdown, PLAN_LIMITS, serializeCapabilityRoute, sleep, success, TABLE_IMPORT_ROW_LIMIT, TAG_KINDS_PROSE, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { TAG_COLORS } from "@oxygen/shared/select-options";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, parseXlsxWorkbookBuffer, } from "@oxygen/shared/file-import";
 import { MAILBOX_IMPORT_FILE_MAX_BYTES as SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES, MAILBOX_IMPORT_ROW_LIMIT as SHARED_MAILBOX_IMPORT_ROW_LIMIT, normalizeMailboxImportFile as normalizeSharedMailboxImportFile, normalizeMailboxImportVendor as normalizeSharedMailboxImportVendor, normalizeMailboxWorkbookRows, parseMailboxImportText, summarizeMailboxImportValidation as summarizeSharedMailboxImportValidation, } from "@oxygen/shared/mailbox-import";
@@ -250,8 +250,9 @@ const LARGE_IMPORT_BACKGROUND_ROW_THRESHOLD = 500;
 const SAFE_IMPORT_WRITE_BATCH_SIZE = 500;
 // The only numbers on `tables import --help` used to be --batch-size (a
 // per-request chunk) and the background threshold, so users read 500 as a
-// per-file cap. Echo the real PLAN_LIMITS ceilings instead of restating them.
-const IMPORT_FILE_LIMIT_HELP = `Per-file limit: ${formatImportFileLimit("free")} on the free plan, ${formatImportFileLimit("starter")} on paid plans.`;
+// per-file cap. Echo the shared row ceiling and the tiered byte ceilings instead
+// of restating either as a chunk-size constraint.
+const IMPORT_FILE_LIMIT_HELP = `Per-file row limit: ${TABLE_IMPORT_ROW_LIMIT.toLocaleString("en-US")} rows on every plan. File-size limit: ${formatImportFileSizeLimit("free")} on free, ${formatImportFileSizeLimit("starter")} on paid plans.`;
 const TABLE_ACTION_RUN_WAIT_DEFAULT_TIMEOUT_SECONDS = 600;
 const TABLE_ACTION_RUN_WAIT_DEFAULT_INTERVAL_SECONDS = 5;
 // Single-row paid runs are auto-backgrounded server-side; the CLI waits this
@@ -2613,7 +2614,7 @@ export function createProgram() {
     });
     program
         .command("home")
-        .description("Your workspace standup: what happened since you last looked, what needs you, a year of workspace activity, and — under `activation` — the one prescribed step to take next. Read-only, 0 credits. The same composition the web Home renders, so a terminal-first operator is not sent to the browser for a status check.")
+        .description("Your workspace standup: what happened since you last looked, what needs you, and a year of workspace activity. Read-only, 0 credits. The same neutral composition the web Home renders, so a terminal-first operator is not sent to the browser for a status check.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("home standup", options, readHomeStandup);
@@ -2623,7 +2624,9 @@ export function createProgram() {
     // is the exact name discovery routes to (it is a gatewayCommand of the
     // onboarding-and-copilot capability route). Both call the one read.
     const activationCommand = program
-        .command("activation")
+        .command("activation", { hidden: true })
+        // Backward-compatible exact invocation only. The fixed play is no longer a
+        // first-touch CLI surface; users choose motions in Recipes or Blueprints.
         .description(ACTIVATION_DESCRIPTION)
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -8391,6 +8394,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing commitments", options, () => requestOxygen("/api/cli/billing/commitments"));
+    }))
+        .addCommand(new Command("invoices")
+        .description("List every invoice Stripe has issued for this workspace, newest first, each with a direct PDF link. Covers ALL charges, not just the plan — sending seats, managed inboxes, and credit top-ups appear here too, which is why this works on the free tier: a workspace with no plan can still be a paying customer. A workspace billed through another organization sees an empty list and shared_billing=true; switch to the billing owner to read its invoices. pdf_url and hosted_url are Stripe's own links. Read-only, 0 Oxygen credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("billing invoices", options, () => requestOxygen("/api/cli/billing/invoices"));
     }))
         .addCommand(new Command("allowance")
         .description("Show this billing cycle's credit pool as one breakdown: fixed spend, flexible spend, credits committed to the next renewal, and what is free to spend — the numbers behind the bar on the credit-usage page. The parts always sum to the total. fixed_spent_credits is what has ALREADY been charged this cycle, NOT your monthly run-rate — for the forward figure billed at the next renewal see `billing commitments`, which is normally much larger. reserved_credits is in-flight spend already carved out of free_to_spend_credits, so treat free_to_spend as the ceiling and free_to_spend minus reserved as what is genuinely uncommitted. Every segment carries region=fixed|flexible. Read-only, 0 Oxygen credits.")
@@ -10305,10 +10314,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("senders checkpoints", options, () => requestOxygen("/api/cli/senders/checkpoints"));
     }))
         .addCommand(new Command("connect")
-        .description("Get a Unipile hosted-auth URL to connect a new LinkedIn account (or reconnect with --reconnect). New accounts require --country (the owner's normal LinkedIn login country) and default to syncing only conversations OXYGEN starts; use --inbox-scope all to opt into the full LinkedIn inbox. Use --count for bulk onboarding. Links are shareable and valid for 10 minutes.")
+        .description("Get a Unipile hosted-auth URL to connect a new LinkedIn account (or reconnect with --reconnect). New accounts require --country (the owner's normal LinkedIn login country) and default to syncing only conversations OXYGEN starts; use --inbox-scope all to opt into the full LinkedIn inbox. Use --cookie-auth and --custom-proxy to expose those inputs inside Unipile's hosted wizard; their secrets never pass through OXYGEN. Use --count for bulk onboarding. Links are shareable and valid for 10 minutes.")
         .option("--reconnect <connection_id>", "Reconnect an existing connection instead of creating a new one. Accepts a connection id.")
         .option("--country <code>", "Required for new accounts: ISO 3166-1 alpha-2 code for the account owner's normal LinkedIn login country (for example DE or US).")
         .option("--sales-nav", "Request Classic + Sales Navigator access during Unipile hosted authentication.")
+        .option("--cookie-auth", "Offer LinkedIn cookie authentication in Unipile's hosted wizard. The account owner enters li_at/li_a there; OXYGEN never receives them.")
+        .option("--custom-proxy", "Let the account owner enter a custom proxy in Unipile's hosted wizard. OXYGEN never receives the proxy credentials.")
         .option("--count <n>", "Mint N hosted-auth links in one call for bulk onboarding (1-25, default 1). Every link uses the same --country; use separate calls for different login countries. Ignored when reconnecting.")
         .option("--inbox-scope <scope>", "LinkedIn inbox privacy for new accounts: oxygen_initiated (default) or all. Reconnect preserves the existing account setting.")
         .option("--json", "Print a JSON envelope.")
@@ -10324,6 +10335,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     ...(reconnect ? { reconnect_connection_id: reconnect } : {}),
                     ...(country ? { country } : {}),
                     ...(options.salesNav ? { sales_nav: true } : {}),
+                    ...(options.cookieAuth ? { cookie_auth: true } : {}),
+                    ...(options.customProxy ? { custom_proxy: true } : {}),
                     ...(count ? { count } : {}),
                     ...(inboxScope ? { inbox_sync_scope: inboxScope } : {}),
                 },
@@ -12342,7 +12355,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }
     }))
         .addCommand(new Command("update")
-        .description("Update a sequence. Journey structure/channels/email binding are draft-only so revised scope receives a fresh launch approval; a started sequence still accepts a definition that changes nothing but its wait steps (the delays between steps, including the one before step 1); sender pools can change while draft or paused; launch caps change through `sequences start` after first start. Name, throttles, tags, and open/click tracking toggles remain editable as allowed by the server. Pass only the fields you want to change.")
+        .description("Update a sequence. Journey structure/channels/email binding are draft-only so revised scope receives a fresh launch approval; a started sequence may only re-time waits it already has (clear a delay by zeroing it, never by deleting the step — enrollments track position by index); sender pools can change while draft or paused; launch caps change through `sequences start` after first start. Name, throttles, tags, and open/click tracking toggles remain editable as allowed by the server. Pass only the fields you want to change.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--name <name>", "New human-readable sequence name.")
         .option("--steps-file <path>", "Draft only: path to a JSON file: { \"steps\": [...] } replacing the journey. Copy supports {{column}} interpolation; native email steps also expose {{sender_name}} / {{sender_first_name}} / {{sender_email}} from the sending mailbox (a same-named row column wins). A `branch` can also route on the lead's data with a data leaf { has_column: \"email\" } (true when that row_values column is non-empty; present:false for \"missing\").")
@@ -14064,6 +14077,62 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
+    }))
+        .addCommand(new Command("profile")
+        .description("Pin the SENDING ARCHITECTURE a domain is run as, which every inbox on it inherits: `standard` (a few mailboxes on a real business tenant, each climbing to a real number), `dedicated_tenant` (infrastructure tenant, volume from breadth, per-inbox number stays small), or `entry` (first-touch inboxes that need presence, not volume). What you state is the DOMAIN's daily budget; OXYGEN divides it by how many inboxes share that domain, so adding an inbox lowers the others instead of raising the domain's total — the thing a flat per-mailbox cap cannot do. A profile is a CEILING: it never raises a cap above what you configured, and the strictest of {configured cap, per-sequence override, age ramp, profile share} still wins. 0 credits, no provider call. Without --approved this previews the before/after per domain. Omit every selector and profile to list the available profiles.")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailboxes\n")
+        // NOT --profile: the program declares a GLOBAL --profile (the stored
+        // CLI credential profile), and Commander resolves the value to that
+        // one, so the subcommand's copy silently reads empty. --type is also
+        // the word an operator uses for this ("a specific warm-up type").
+        .option("--type <name>", "Warm-up type to pin: standard, dedicated_tenant, or entry.")
+        .option("--domains <list>", "Comma-separated domains to bind. Every inbox on them inherits the profile.")
+        .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to override individually — the exception path, not the bulk path.")
+        .option("--all", "Bind every domain that currently holds a mailbox.")
+        .option("--cold-send-per-day <n>", "Override the profile's DOMAIN budget for cold sends per day (not a per-inbox number).")
+        .option("--warmup-per-day <n>", "Override the profile's DOMAIN budget for warm-up emails per day (not a per-inbox number).")
+        .option("--clear", "Remove the profile, restoring inference and the age ramp alone.")
+        .option("--approved", "Apply the previewed change.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("mailboxes warmup profile", options, () => {
+            const domains = readCsvOption(options.domains);
+            const mailboxes = readCsvOption(options.mailboxes);
+            const all = options.all === true;
+            const clear = options.clear === true;
+            const profile = readOption(options.type);
+            // No selector and no profile is the discovery call: show what
+            // the profiles ARE rather than erroring on a missing flag.
+            if (!all && domains.length === 0 && mailboxes.length === 0 && !profile && !clear) {
+                return requestOxygen("/api/cli/mailboxes/warmup-profile");
+            }
+            if (!profile && !clear) {
+                throw new OxygenError("invalid_request", "Name a --type to pin, or pass --clear to remove one.", { exitCode: 2 });
+            }
+            const coldSend = readOption(options.coldSendPerDay);
+            const warmupPerDay = readOption(options.warmupPerDay);
+            if ((coldSend === null) !== (warmupPerDay === null)) {
+                throw new OxygenError("invalid_request", "A budget override needs BOTH --cold-send-per-day and --warmup-per-day; they are separate budgets and defaulting one silently would misstate the domain's ceiling.", { exitCode: 2 });
+            }
+            return requestOxygen("/api/cli/mailboxes/warmup-profile", {
+                method: "POST",
+                body: {
+                    profile: clear ? null : profile,
+                    ...(coldSend !== null && warmupPerDay !== null
+                        ? {
+                            budget: {
+                                cold_send_per_day: Number(coldSend),
+                                warmup_per_day: Number(warmupPerDay),
+                            },
+                        }
+                        : {}),
+                    ...(domains.length > 0 ? { domains } : {}),
+                    ...(mailboxes.length > 0 ? { mailboxes } : {}),
+                    ...(all ? { all: true } : {}),
+                    ...(options.approved === true ? { approved: true } : {}),
+                },
+            });
+        });
     }))
         .addCommand(new Command("pause")
         .description("Pause warmup at the rail that actually enrolled each mailbox — OXYGEN Warm-up for current enrollments, TrulyInbox for inboxes still warming there. A mailbox left on a rail Oxygen no longer drives reports unsupported instead of being retargeted, so the reply never claims a pause that did not happen. Targets the whole pool unless --mailboxes is given.")
@@ -19287,10 +19356,10 @@ function readRecord(value, key) {
 function tableWebUrl(tableIdOrSlug) {
     return `https://oxygen-agent.com/tables/${encodeURIComponent(tableIdOrSlug)}`;
 }
-function formatImportFileLimit(tier) {
+function formatImportFileSizeLimit(tier) {
     const limits = PLAN_LIMITS[tier].import;
     const megabytes = Math.round(limits.maxFileBytes / (1024 * 1024));
-    return `${limits.maxRowsPerFile.toLocaleString("en-US")} rows / ${megabytes} MB`;
+    return `${megabytes} MB`;
 }
 // A backgrounded import returns as soon as the file is staged, with counts.rows
 // still 0 while the worker loads. With no follow-up command in the envelope that
@@ -19748,50 +19817,9 @@ async function handleUpdateAction(options) {
         emitCliFailure("update", error);
     }
 }
-/**
- * `oxygen home`: the standup PLUS the prescribed play's next step.
- *
- * Two reads, because the web Home already composes exactly these two — its RSC calls
- * the standup composition and `readActivationState` side by side (apps/web/src/lib/
- * activation/state.ts) — and a terminal-first operator must not be the one surface
- * shown a standup with no next move. Both legs are existing read-only `/api/cli/*`
- * contracts, so neither surface knows anything the other cannot ask for.
- *
- * The activation leg is allSettled and never fatal: a standup that read fine must not
- * be thrown away because the play read failed. When it does fail the leg is NAMED in
- * `degraded` rather than dropped silently — an absent next step has to read as "we
- * could not tell", never as "there is nothing to do".
- */
+/** `oxygen home`: the same outcome-neutral standup rendered by web Home. */
 async function readHomeStandup() {
-    const [standup, activation] = await Promise.allSettled([
-        requestOxygen("/api/cli/home/standup"),
-        requestOxygen("/api/cli/activation/state"),
-    ]);
-    if (standup.status === "rejected")
-        throw standup.reason;
-    const data = standup.value;
-    if (activation.status === "fulfilled") {
-        return {
-            ...data,
-            // The play's progress and its single next step; `oxygen activation` prints the
-            // per-step detail this deliberately leaves out.
-            activation: {
-                play: activation.value.play ?? null,
-                next_step: activation.value.next_step ?? null,
-                safety: activation.value.safety ?? null,
-                degraded: activation.value.degraded ?? [],
-                full_state: "oxygen activation --json",
-            },
-        };
-    }
-    return {
-        ...data,
-        activation: null,
-        degraded: [
-            ...(Array.isArray(data.degraded) ? data.degraded : []),
-            "activation",
-        ],
-    };
+    return requestOxygen("/api/cli/home/standup");
 }
 function buildApiKeyCreateBody(options) {
     const body = {};

package/node_modules/@oxygen/shared/dist/billing.d.ts

@@ -112,9 +112,10 @@ export declare function resolveCreditTopupPack(id: string | null | undefined): C
 export declare const TRIAL_PERIOD_DAYS = 7;
 export declare const TRIAL_CREDIT_GRANT = 20000;
 /**
- * Free-tier entry (founder-ratified 2026-08-16, grant shape settled 2026-08-17).
+ * Free-tier entry (founder-ratified 2026-08-16; grant collapsed to a single
+ * 10,000-credit signup grant 2026-08-26).
  *
- * Two ONE-TIME grants and no monthly trickle. The free tier's *surface* is
+ * ONE grant, at signup, and no monthly trickle. The free tier's *surface* is
  * unmetered — CRM, Tables, Workflows, Knowledge, Agents, Copilot, Sequence
  * authoring cost nothing marginal, so they are not rationed — and credits meter
  * only real per-call spend. That is why `BASE_PRICING_PLANS.free` still carries
@@ -122,21 +123,20 @@ export declare const TRIAL_CREDIT_GRANT = 20000;
  * allowance exists), not a missing value, and null still means "never claw back
  * a leftover balance".
  *
- * The split exists for a specific reason. Granting only on CLI/MCP activation
- * would ship a Workspace Copilot with no funds for exactly the users who chose
- * the in-product path — the default Copilot session budget is 5,000 credits, so
- * the signup grant is precisely one session. The activation half is the pull
- * toward the agent-native surface, and rewards the same action the Company KPI
- * scorecard already counts as activation.
+ * WHY THE SPLIT WENT AWAY. It used to be 5,000 at signup plus 5,000 on first
+ * CLI/MCP activation, to pull people toward the agent-native surface. Two things
+ * killed it. The marketing page advertises "10,000 credits", so a user who
+ * signed up and never touched the CLI saw half of what was promised — the page
+ * was writing a cheque the product did not honour. And the activation half
+ * needed its own idempotency key, its own trigger definition, and its own
+ * explanation, for a nudge that was never measured. One grant is honest and is
+ * one code path.
  *
- * Ceiling is therefore 10,000 credits ($10) per billing-owner organization,
- * ever. Neither grant is minted for a churned or downgraded workspace, and no
- * other path re-mints either one — not downgrade, churn, re-subscribe, or
- * billing-owner re-link. Top-ups stay purchasable on free, which is what keeps
+ * Neither churn nor downgrade nor re-subscribe nor billing-owner re-link ever
+ * mints it a second time. Top-ups stay purchasable on free, which is what keeps
  * the metered surface open-ended rather than capped at the grant.
  */
-export declare const FREE_SIGNUP_GRANT_CREDITS = 5000;
-export declare const FREE_ACTIVATION_GRANT_CREDITS = 5000;
+export declare const FREE_SIGNUP_GRANT_CREDITS = 10000;
 export declare const FREE_TIER_GRANTS_ENABLED_ENV_VAR = "OXYGEN_FREE_TIER_GRANTS_ENABLED";
 /**
  * Fail-closed rollout switch for the free-tier grants, matching the staged

package/node_modules/@oxygen/shared/dist/billing.js

@@ -166,9 +166,10 @@ export function resolveCreditTopupPack(id) {
 export const TRIAL_PERIOD_DAYS = 7;
 export const TRIAL_CREDIT_GRANT = 20_000;
 /**
- * Free-tier entry (founder-ratified 2026-08-16, grant shape settled 2026-08-17).
+ * Free-tier entry (founder-ratified 2026-08-16; grant collapsed to a single
+ * 10,000-credit signup grant 2026-08-26).
  *
- * Two ONE-TIME grants and no monthly trickle. The free tier's *surface* is
+ * ONE grant, at signup, and no monthly trickle. The free tier's *surface* is
  * unmetered — CRM, Tables, Workflows, Knowledge, Agents, Copilot, Sequence
  * authoring cost nothing marginal, so they are not rationed — and credits meter
  * only real per-call spend. That is why `BASE_PRICING_PLANS.free` still carries
@@ -176,21 +177,20 @@ export const TRIAL_CREDIT_GRANT = 20_000;
  * allowance exists), not a missing value, and null still means "never claw back
  * a leftover balance".
  *
- * The split exists for a specific reason. Granting only on CLI/MCP activation
- * would ship a Workspace Copilot with no funds for exactly the users who chose
- * the in-product path — the default Copilot session budget is 5,000 credits, so
- * the signup grant is precisely one session. The activation half is the pull
- * toward the agent-native surface, and rewards the same action the Company KPI
- * scorecard already counts as activation.
+ * WHY THE SPLIT WENT AWAY. It used to be 5,000 at signup plus 5,000 on first
+ * CLI/MCP activation, to pull people toward the agent-native surface. Two things
+ * killed it. The marketing page advertises "10,000 credits", so a user who
+ * signed up and never touched the CLI saw half of what was promised — the page
+ * was writing a cheque the product did not honour. And the activation half
+ * needed its own idempotency key, its own trigger definition, and its own
+ * explanation, for a nudge that was never measured. One grant is honest and is
+ * one code path.
  *
- * Ceiling is therefore 10,000 credits ($10) per billing-owner organization,
- * ever. Neither grant is minted for a churned or downgraded workspace, and no
- * other path re-mints either one — not downgrade, churn, re-subscribe, or
- * billing-owner re-link. Top-ups stay purchasable on free, which is what keeps
+ * Neither churn nor downgrade nor re-subscribe nor billing-owner re-link ever
+ * mints it a second time. Top-ups stay purchasable on free, which is what keeps
  * the metered surface open-ended rather than capped at the grant.
  */
-export const FREE_SIGNUP_GRANT_CREDITS = 5_000;
-export const FREE_ACTIVATION_GRANT_CREDITS = 5_000;
+export const FREE_SIGNUP_GRANT_CREDITS = 10_000;
 export const FREE_TIER_GRANTS_ENABLED_ENV_VAR = "OXYGEN_FREE_TIER_GRANTS_ENABLED";
 /**
  * Fail-closed rollout switch for the free-tier grants, matching the staged
@@ -248,10 +248,9 @@ export const BASE_PRICING_PLANS = {
     //
     // `free` now serves TWO populations and deliberately does not distinguish
     // them here: a newly signed-up workspace and a voluntarily churned one get the
-    // same capability set. Only the grants differ — a newcomer draws
-    // FREE_SIGNUP_GRANT_CREDITS (and FREE_ACTIVATION_GRANT_CREDITS on first
-    // CLI/MCP activation), a returner draws neither and keeps whatever balance it
-    // already had. Anything branching on `plan.tier === "free"` must be read under
+    // same capability set. Only the grant differs — a newcomer draws
+    // FREE_SIGNUP_GRANT_CREDITS, a returner draws nothing and keeps whatever
+    // balance it already had. Anything branching on `plan.tier === "free"` must be read under
     // BOTH meanings: code written when this could only mean "churned org that can
     // spend nothing" now also applies to a funded newcomer.
     //

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -8,6 +8,8 @@ export * from "./capability-discovery.js";
 export * from "./user-capability-routing.js";
 export * from "./plan-capabilities.js";
 export * from "./plan-limits.js";
+export * from "./sending-seats.js";
+export * from "./sending-seat-capacity.js";
 export * from "./plain-support-events.js";
 export * from "./provider-funding-errors.js";
 export * from "./publishing-limits.js";

package/node_modules/@oxygen/shared/dist/index.js

@@ -8,6 +8,8 @@ export * from "./capability-discovery.js";
 export * from "./user-capability-routing.js";
 export * from "./plan-capabilities.js";
 export * from "./plan-limits.js";
+export * from "./sending-seats.js";
+export * from "./sending-seat-capacity.js";
 export * from "./plain-support-events.js";
 export * from "./provider-funding-errors.js";
 export * from "./publishing-limits.js";

package/node_modules/@oxygen/shared/dist/plan-limits.d.ts

@@ -70,6 +70,13 @@ export type PlanLimits = {
         maxActionsPerRun: number;
     };
 };
+/**
+ * One platform-wide Table import ceiling. A file can fill an empty physical
+ * Table exactly to its retained-row capacity on every plan; imports into a
+ * non-empty Table remain subject to that Table's remaining capacity and the
+ * workspace-wide capacity envelope.
+ */
+export declare const TABLE_IMPORT_ROW_LIMIT: 3000000;
 export { VERCEL_REQUEST_BODY_LIMIT_BYTES } from "./import-limits.js";
 /**
  * The per-rung limit matrix. `ai_live` deliberately equals `tool_live` at every
@@ -165,7 +172,7 @@ export declare const PLAN_LIMITS: {
             };
         };
         readonly import: {
-            readonly maxRowsPerFile: 250000;
+            readonly maxRowsPerFile: 3000000;
             readonly maxFileBytes: number;
             readonly maxDirectCsvBodyBytes: 10000000;
         };
@@ -275,7 +282,7 @@ export declare const PLAN_LIMITS: {
             };
         };
         readonly import: {
-            readonly maxRowsPerFile: 1000000;
+            readonly maxRowsPerFile: 3000000;
             readonly maxFileBytes: number;
             readonly maxDirectCsvBodyBytes: 10000000;
         };
@@ -385,7 +392,7 @@ export declare const PLAN_LIMITS: {
             };
         };
         readonly import: {
-            readonly maxRowsPerFile: 1000000;
+            readonly maxRowsPerFile: 3000000;
             readonly maxFileBytes: number;
             readonly maxDirectCsvBodyBytes: 10000000;
         };
@@ -495,7 +502,7 @@ export declare const PLAN_LIMITS: {
             };
         };
         readonly import: {
-            readonly maxRowsPerFile: 1000000;
+            readonly maxRowsPerFile: 3000000;
             readonly maxFileBytes: number;
             readonly maxDirectCsvBodyBytes: 10000000;
         };
@@ -605,7 +612,7 @@ export declare const PLAN_LIMITS: {
             };
         };
         readonly import: {
-            readonly maxRowsPerFile: 1000000;
+            readonly maxRowsPerFile: 3000000;
             readonly maxFileBytes: number;
             readonly maxDirectCsvBodyBytes: 10000000;
         };

package/node_modules/@oxygen/shared/dist/plan-limits.js

@@ -1,4 +1,5 @@
 import { resolveBasePricingPlan } from "./billing.js";
+import { WORKSPACE_TABLE_CAPACITY } from "./table-capacity.js";
 export const LIMITS_TIER_ORDER = [
     "free",
     "starter",
@@ -9,6 +10,13 @@ export const LIMITS_TIER_ORDER = [
 const HOUR = 60 * 60;
 const DAY = 24 * HOUR;
 const MIB = 1024 * 1024;
+/**
+ * One platform-wide Table import ceiling. A file can fill an empty physical
+ * Table exactly to its retained-row capacity on every plan; imports into a
+ * non-empty Table remain subject to that Table's remaining capacity and the
+ * workspace-wide capacity envelope.
+ */
+export const TABLE_IMPORT_ROW_LIMIT = WORKSPACE_TABLE_CAPACITY.tableRowLimit;
 // The platform request-body ceiling belongs to the same question as the import
 // ceilings below ("how big can an import be"), but it must stay importable from a
 // browser bundle, so it is defined in ./import-limits and re-exported here.
@@ -38,13 +46,7 @@ export const PLAN_LIMITS = {
             import: { requestsPerMinute: 10, orgRequests: { limit: 100, windowSeconds: HOUR } },
         },
         import: {
-            // Raised from 50k/25MiB in v1.717.0, when the web import modal moved onto
-            // the staged upload path. The old ceiling was set when every import had to
-            // squeeze through a request body; now the bytes go straight to object
-            // storage and the worker streams them, so the limit can describe what a
-            // trial workspace should be allowed to load rather than what the transport
-            // could survive.
-            maxRowsPerFile: 250_000,
+            maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
             maxFileBytes: 100 * MIB,
             maxDirectCsvBodyBytes: 10_000_000,
         },
@@ -93,7 +95,7 @@ export const PLAN_LIMITS = {
             import: { requestsPerMinute: 30, orgRequests: { limit: 500, windowSeconds: HOUR } },
         },
         import: {
-            maxRowsPerFile: 1_000_000,
+            maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
             maxFileBytes: 250 * MIB,
             maxDirectCsvBodyBytes: 10_000_000,
         },
@@ -126,7 +128,7 @@ export const PLAN_LIMITS = {
             import: { requestsPerMinute: 60, orgRequests: { limit: 1_000, windowSeconds: HOUR } },
         },
         import: {
-            maxRowsPerFile: 1_000_000,
+            maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
             maxFileBytes: 250 * MIB,
             maxDirectCsvBodyBytes: 10_000_000,
         },
@@ -159,7 +161,7 @@ export const PLAN_LIMITS = {
             import: { requestsPerMinute: 120, orgRequests: { limit: 2_000, windowSeconds: HOUR } },
         },
         import: {
-            maxRowsPerFile: 1_000_000,
+            maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
             maxFileBytes: 250 * MIB,
             maxDirectCsvBodyBytes: 10_000_000,
         },
@@ -192,7 +194,7 @@ export const PLAN_LIMITS = {
             import: { requestsPerMinute: 240, orgRequests: { limit: 5_000, windowSeconds: HOUR } },
         },
         import: {
-            maxRowsPerFile: 1_000_000,
+            maxRowsPerFile: TABLE_IMPORT_ROW_LIMIT,
             maxFileBytes: 250 * MIB,
             maxDirectCsvBodyBytes: 10_000_000,
         },

package/node_modules/@oxygen/shared/dist/pricing-snapshot.generated.d.ts

@@ -28,6 +28,13 @@ export declare const DELIVERABILITY_INCLUDED_TESTS_PER_INBOX = 2;
 export declare const PLACEMENT_TEST_OVERAGE_CREDITS = 166;
 /** Representative, not billed: a typical .com at MANAGED_DOMAIN_MARKUP. */
 export declare const MANAGED_DOMAIN_CREDITS_PER_YEAR_TYPICAL = 13050;
+export declare const SENDING_SEAT_USD_CENTS: {
+    readonly linkedin: 3000;
+    readonly whatsapp: 3000;
+    readonly phone_number: 1000;
+    readonly email_sender: 100;
+};
+export type SendingSeatKey = keyof typeof SENDING_SEAT_USD_CENTS;
 export declare const VOICE_NUMBER_CREDITS_PER_MONTH = 5000;
 export declare const VOICE_CREDITS_PER_MINUTE = 90;
 export declare const VOICE_CREDITS_PER_AMD_CALL = 38;

package/node_modules/@oxygen/shared/dist/pricing-snapshot.generated.js

@@ -45,6 +45,21 @@ export const DELIVERABILITY_INCLUDED_TESTS_PER_INBOX = 2;
 export const PLACEMENT_TEST_OVERAGE_CREDITS = 166;
 /** Representative, not billed: a typical .com at MANAGED_DOMAIN_MARKUP. */
 export const MANAGED_DOMAIN_CREDITS_PER_YEAR_TYPICAL = 13_050;
+// --- sending seats (USD, Stripe-billed) --------------------------------------
+//
+// The seat model (OXP-15). These are DOLLARS, not credits, and they do not
+// replace the credit-denominated seat charges above — an organization
+// grandfathered at the cutover keeps paying those. See the seed for why both
+// exist at once.
+//
+// Stripe's Price object is what actually charges the card; these are what the
+// product quotes and what the margin gate checks against vendor COGS.
+export const SENDING_SEAT_USD_CENTS = {
+    linkedin: 3_000,
+    whatsapp: 3_000,
+    phone_number: 1_000,
+    email_sender: 100,
+};
 // --- voice ------------------------------------------------------------------
 export const VOICE_NUMBER_CREDITS_PER_MONTH = 5_000;
 export const VOICE_CREDITS_PER_MINUTE = 90;

package/node_modules/@oxygen/shared/dist/sending-seat-capacity.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Does this workspace have room to connect one more sender of a given kind?
+ *
+ * Pure arithmetic, deliberately. The rule that decides whether a customer can
+ * send is the single most consequential branch in the billing model, and it has
+ * to be readable and exhaustively testable without a database, a Stripe account,
+ * or a webhook.
+ *
+ * THE RULE. Capacity comes from two places and they ADD:
+ *
+ *   capacity  = purchased (Stripe seats) + legacy (grandfathered entitlement)
+ *   available = capacity - allocated (senders already connected)
+ *
+ * GRANDFATHERING IS AN ENTITLEMENT, NOT A BYPASS. A legacy organization is not
+ * one that skips this function; it is one that arrives here holding a legacy
+ * grant which SATISFIES the check. Written the other way — an `if (isLegacy)
+ * return true` somewhere upstream — the most important gate in the billing model
+ * would carry a permanent exemption that no query can enumerate and that stops
+ * being applied correctly the moment the gate changes. Here, the gate always
+ * runs, and "why was this allowed" always has an answer.
+ *
+ * UNLIMITED IS REPRESENTABLE. `legacy: null` means unlimited for that kind. It
+ * exists because whether grandfathered organizations keep their cutover count or
+ * get unlimited capacity is a business decision that belongs in data, not in a
+ * code branch — so the answer can change with an UPDATE rather than a release.
+ */
+export type SendingSeatHolding = {
+    /** Seats bought through Stripe. Stripe's item quantity is the truth. */
+    readonly purchased: number;
+    /** Grandfathered capacity. null means unlimited; 0 means none. */
+    readonly legacy: number | null;
+    /** Senders of this kind currently connected. */
+    readonly allocated: number;
+};
+export type SendingSeatCapacity = {
+    readonly allowed: boolean;
+    /** Remaining capacity, or null when the holding is unlimited. */
+    readonly available: number | null;
+    /** Total capacity, or null when unlimited. */
+    readonly capacity: number | null;
+    readonly allocated: number;
+    /**
+     * Which grant covers the NEXT connection — the answer to "why am I allowed to
+     * do this", which a support conversation always eventually needs.
+     */
+    readonly coveredBy: "legacy_entitlement" | "purchased_seat" | "none";
+};
+export declare function resolveSendingSeatCapacity(holding: SendingSeatHolding): SendingSeatCapacity;
+/**
+ * May this organization reduce its purchased seats to `nextPurchased`?
+ *
+ * Refused when it would strand a connected sender. Never reduce-then-orphan: an
+ * orphaned sender is a customer still paying a provider for something OXYGEN has
+ * quietly stopped honouring, and they find out when messages stop arriving.
+ *
+ * Returns the number that must be disconnected first, so the refusal can say
+ * what to actually do rather than only saying no.
+ */
+export declare function seatReductionShortfall(holding: SendingSeatHolding, nextPurchased: number): number;

package/node_modules/@oxygen/shared/dist/sending-seat-capacity.js

@@ -0,0 +1,87 @@
+/**
+ * Does this workspace have room to connect one more sender of a given kind?
+ *
+ * Pure arithmetic, deliberately. The rule that decides whether a customer can
+ * send is the single most consequential branch in the billing model, and it has
+ * to be readable and exhaustively testable without a database, a Stripe account,
+ * or a webhook.
+ *
+ * THE RULE. Capacity comes from two places and they ADD:
+ *
+ *   capacity  = purchased (Stripe seats) + legacy (grandfathered entitlement)
+ *   available = capacity - allocated (senders already connected)
+ *
+ * GRANDFATHERING IS AN ENTITLEMENT, NOT A BYPASS. A legacy organization is not
+ * one that skips this function; it is one that arrives here holding a legacy
+ * grant which SATISFIES the check. Written the other way — an `if (isLegacy)
+ * return true` somewhere upstream — the most important gate in the billing model
+ * would carry a permanent exemption that no query can enumerate and that stops
+ * being applied correctly the moment the gate changes. Here, the gate always
+ * runs, and "why was this allowed" always has an answer.
+ *
+ * UNLIMITED IS REPRESENTABLE. `legacy: null` means unlimited for that kind. It
+ * exists because whether grandfathered organizations keep their cutover count or
+ * get unlimited capacity is a business decision that belongs in data, not in a
+ * code branch — so the answer can change with an UPDATE rather than a release.
+ */
+function assertCount(label, value) {
+    if (!Number.isInteger(value) || value < 0) {
+        throw new Error(`${label} must be a non-negative integer, got ${value}`);
+    }
+}
+export function resolveSendingSeatCapacity(holding) {
+    assertCount("purchased", holding.purchased);
+    assertCount("allocated", holding.allocated);
+    if (holding.legacy !== null)
+        assertCount("legacy", holding.legacy);
+    // Unlimited legacy short-circuits: no arithmetic can exhaust it, and
+    // representing it as a very large number would eventually be compared,
+    // subtracted, or displayed, and would then be wrong in a way nobody catches.
+    if (holding.legacy === null) {
+        return {
+            allowed: true,
+            available: null,
+            capacity: null,
+            allocated: holding.allocated,
+            coveredBy: "legacy_entitlement",
+        };
+    }
+    const capacity = holding.purchased + holding.legacy;
+    // Floors at 0 rather than going negative. Allocated CAN exceed capacity — a
+    // grandfathered org whose entitlement is later reduced, or a seat cancelled
+    // while senders stay connected — and a negative "available" would read as a
+    // debt the customer can pay off by disconnecting, which is not what it means.
+    const available = Math.max(0, capacity - holding.allocated);
+    return {
+        allowed: available > 0,
+        available,
+        capacity,
+        allocated: holding.allocated,
+        // Legacy capacity is consumed FIRST. Any other order would bill a
+        // grandfathered customer for a seat while their free entitlement sat unused.
+        coveredBy: available === 0
+            ? "none"
+            : holding.allocated < holding.legacy
+                ? "legacy_entitlement"
+                : "purchased_seat",
+    };
+}
+/**
+ * May this organization reduce its purchased seats to `nextPurchased`?
+ *
+ * Refused when it would strand a connected sender. Never reduce-then-orphan: an
+ * orphaned sender is a customer still paying a provider for something OXYGEN has
+ * quietly stopped honouring, and they find out when messages stop arriving.
+ *
+ * Returns the number that must be disconnected first, so the refusal can say
+ * what to actually do rather than only saying no.
+ */
+export function seatReductionShortfall(holding, nextPurchased) {
+    assertCount("nextPurchased", nextPurchased);
+    // Unlimited legacy capacity means purchased seats are not load-bearing and
+    // dropping them can never strand anything.
+    if (holding.legacy === null)
+        return 0;
+    const nextCapacity = nextPurchased + holding.legacy;
+    return Math.max(0, holding.allocated - nextCapacity);
+}

package/node_modules/@oxygen/shared/dist/sending-seats.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Sending seats: the recurring USD subscription a workspace holds in order to
+ * connect a sender (OXP-15, founder-ratified 2026-08-25).
+ *
+ * WHAT A SEAT IS. Capacity, not usage. One seat entitles one connected sender of
+ * that kind — a LinkedIn account, a WhatsApp number, a phone number, or an email
+ * mailbox. Sends themselves stay free: the seat is the whole price for the
+ * channel, which is why LINKEDIN_ACTION_CREDITS is all zeroes. Buying a seat is
+ * therefore buying the right to keep something connected for a month, and the
+ * count a customer needs is simply the number of senders they intend to run.
+ *
+ * WHY THIS IS NOT THE CREDIT MODEL. Until the seat cutover the same charge was
+ * debited from the credit balance monthly (`seat.linkedin_account` = 10,000
+ * credits). That coupled two unrelated things: a fixed monthly cost that we owe
+ * a vendor whether or not the customer does anything, and a variable enrichment
+ * budget the customer chooses how to spend. A workspace that ran a big
+ * enrichment could not send, and a workspace that only sent looked like it was
+ * consuming a plan it never used. Seats put the fixed cost on a card and leave
+ * credits for the variable part.
+ *
+ * BOTH MODELS ARE LIVE AT ONCE, ON PURPOSE. Organizations that existed at the
+ * cutover are grandfathered and keep paying in credits. Nothing about their bill
+ * changes. See `SENDING_SEAT_LEGACY_CHARGE_KEYS` for the exact correspondence,
+ * and note the direction of the rule: a legacy organization is not one that
+ * "skips the seat check", it is one that holds a legacy entitlement which
+ * SATISFIES the seat check. The gate always runs.
+ */
+import { SENDING_SEAT_USD_CENTS, type SendingSeatKey } from "./pricing-snapshot.generated.js";
+export { SENDING_SEAT_USD_CENTS };
+export type { SendingSeatKey };
+export declare const SENDING_SEAT_KEYS: readonly ["linkedin", "whatsapp", "phone_number", "email_sender"];
+export type SendingSeatDefinition = {
+    readonly key: SendingSeatKey;
+    /** Singular, sentence-case, as it appears on the billing row. */
+    readonly label: string;
+    readonly pluralLabel: string;
+    readonly monthlyPriceCents: number;
+    /** What holding one lets the customer connect. */
+    readonly entitles: string;
+    /**
+     * The credit-denominated charge this seat replaces for organizations onboarded
+     * after the cutover. null where no credit equivalent ever existed.
+     */
+    readonly legacyChargeKey: string | null;
+    /** Doppler-held Stripe Price ID env var; Stripe is what actually charges. */
+    readonly stripePriceEnvVar: string;
+};
+export declare const SENDING_SEAT_CATALOG: {
+    readonly [K in SendingSeatKey]: SendingSeatDefinition;
+};
+export declare const SENDING_SEAT_LEGACY_CHARGE_KEYS: readonly string[];
+export declare function isSendingSeatKey(value: unknown): value is SendingSeatKey;
+export declare function sendingSeatMonthlyPriceCents(key: SendingSeatKey): number;
+/**
+ * Price for `quantity` seats of one kind, in USD cents.
+ *
+ * Deliberately linear with no volume break. A tier boundary here would have to
+ * be mirrored into Stripe's Price object to be real, and a discount that exists
+ * in our quote but not on the invoice is a support ticket, not a discount.
+ */
+export declare function sendingSeatSubtotalCents(key: SendingSeatKey, quantity: number): number;
+/** "$30.00" — seat prices are whole cents, so this never rounds. */
+export declare function formatSeatPrice(cents: number): string;

package/node_modules/@oxygen/shared/dist/sending-seats.js

@@ -0,0 +1,101 @@
+/**
+ * Sending seats: the recurring USD subscription a workspace holds in order to
+ * connect a sender (OXP-15, founder-ratified 2026-08-25).
+ *
+ * WHAT A SEAT IS. Capacity, not usage. One seat entitles one connected sender of
+ * that kind — a LinkedIn account, a WhatsApp number, a phone number, or an email
+ * mailbox. Sends themselves stay free: the seat is the whole price for the
+ * channel, which is why LINKEDIN_ACTION_CREDITS is all zeroes. Buying a seat is
+ * therefore buying the right to keep something connected for a month, and the
+ * count a customer needs is simply the number of senders they intend to run.
+ *
+ * WHY THIS IS NOT THE CREDIT MODEL. Until the seat cutover the same charge was
+ * debited from the credit balance monthly (`seat.linkedin_account` = 10,000
+ * credits). That coupled two unrelated things: a fixed monthly cost that we owe
+ * a vendor whether or not the customer does anything, and a variable enrichment
+ * budget the customer chooses how to spend. A workspace that ran a big
+ * enrichment could not send, and a workspace that only sent looked like it was
+ * consuming a plan it never used. Seats put the fixed cost on a card and leave
+ * credits for the variable part.
+ *
+ * BOTH MODELS ARE LIVE AT ONCE, ON PURPOSE. Organizations that existed at the
+ * cutover are grandfathered and keep paying in credits. Nothing about their bill
+ * changes. See `SENDING_SEAT_LEGACY_CHARGE_KEYS` for the exact correspondence,
+ * and note the direction of the rule: a legacy organization is not one that
+ * "skips the seat check", it is one that holds a legacy entitlement which
+ * SATISFIES the seat check. The gate always runs.
+ */
+import { SENDING_SEAT_USD_CENTS, } from "./pricing-snapshot.generated.js";
+export { SENDING_SEAT_USD_CENTS };
+export const SENDING_SEAT_KEYS = [
+    "linkedin",
+    "whatsapp",
+    "phone_number",
+    "email_sender",
+];
+export const SENDING_SEAT_CATALOG = {
+    linkedin: {
+        key: "linkedin",
+        label: "LinkedIn seat",
+        pluralLabel: "LinkedIn seats",
+        monthlyPriceCents: SENDING_SEAT_USD_CENTS.linkedin,
+        entitles: "one connected LinkedIn account",
+        legacyChargeKey: "seat.linkedin_account",
+        stripePriceEnvVar: "STRIPE_PRICE_SEAT_LINKEDIN_USD",
+    },
+    whatsapp: {
+        key: "whatsapp",
+        label: "WhatsApp seat",
+        pluralLabel: "WhatsApp seats",
+        monthlyPriceCents: SENDING_SEAT_USD_CENTS.whatsapp,
+        entitles: "one connected WhatsApp number",
+        legacyChargeKey: "seat.whatsapp_account",
+        stripePriceEnvVar: "STRIPE_PRICE_SEAT_WHATSAPP_USD",
+    },
+    phone_number: {
+        key: "phone_number",
+        label: "Phone number",
+        pluralLabel: "Phone numbers",
+        monthlyPriceCents: SENDING_SEAT_USD_CENTS.phone_number,
+        entitles: "one rented phone number",
+        // Voice numbers were their own credit commitment rather than a seat charge.
+        legacyChargeKey: null,
+        stripePriceEnvVar: "STRIPE_PRICE_SEAT_PHONE_USD",
+    },
+    email_sender: {
+        key: "email_sender",
+        label: "Email sender",
+        pluralLabel: "Email senders",
+        monthlyPriceCents: SENDING_SEAT_USD_CENTS.email_sender,
+        entitles: "one connected sending mailbox, warm-up included",
+        legacyChargeKey: "commitment.sending_mailbox",
+        stripePriceEnvVar: "STRIPE_PRICE_SEAT_EMAIL_USD",
+    },
+};
+export const SENDING_SEAT_LEGACY_CHARGE_KEYS = SENDING_SEAT_KEYS
+    .map((key) => SENDING_SEAT_CATALOG[key].legacyChargeKey)
+    .filter((chargeKey) => chargeKey !== null);
+export function isSendingSeatKey(value) {
+    return typeof value === "string"
+        && SENDING_SEAT_KEYS.includes(value);
+}
+export function sendingSeatMonthlyPriceCents(key) {
+    return SENDING_SEAT_CATALOG[key].monthlyPriceCents;
+}
+/**
+ * Price for `quantity` seats of one kind, in USD cents.
+ *
+ * Deliberately linear with no volume break. A tier boundary here would have to
+ * be mirrored into Stripe's Price object to be real, and a discount that exists
+ * in our quote but not on the invoice is a support ticket, not a discount.
+ */
+export function sendingSeatSubtotalCents(key, quantity) {
+    if (!Number.isInteger(quantity) || quantity < 0) {
+        throw new Error(`seat quantity must be a non-negative integer, got ${quantity}`);
+    }
+    return SENDING_SEAT_CATALOG[key].monthlyPriceCents * quantity;
+}
+/** "$30.00" — seat prices are whole cents, so this never rounds. */
+export function formatSeatPrice(cents) {
+    return `$${(cents / 100).toFixed(2)}`;
+}

package/node_modules/@oxygen/shared/dist/sequences.d.ts

@@ -776,6 +776,17 @@ export type ValidateSequenceOptions = {
      * route refuses that transition outright).
      */
     draft?: boolean;
+    /**
+     * This definition belongs to a STARTED sequence, where a wait may be zeroed
+     * but never deleted. Every in-flight enrollment tracks its position as an
+     * INTEGER index into steps[] (`current_step_index`), so removing a step
+     * renumbers the ones after it and silently walks live leads onto the wrong
+     * step — a re-send or a skipped message. Setting a wait to 0 keeps the array
+     * shape, and a 0 wait is a no-op the dispatcher passes straight through.
+     * Default false: a draft has no enrollments to shift, so its builder deletes
+     * the step outright rather than leaving a dead one behind.
+     */
+    allowZeroWaits?: boolean;
 };
 /** One step whose copy is still empty, for the launch-readiness blocker. */
 export type SequenceMissingCopy = {
@@ -816,19 +827,28 @@ export declare function sequenceWaitStepJitterMs(step: SequenceWaitStep, enrollm
  */
 export declare function sequenceWaitStepDelayWithJitterMs(step: SequenceWaitStep, enrollmentId: string): number;
 /**
- * Whether `after` changes nothing about `before` except its timing — the delays
- * between steps, including the lead-in delay in front of the very first one.
+ * Whether `after` changes nothing about `before` except how long its existing
+ * wait steps wait. This is the one journey edit a LIVE sequence accepts, and it
+ * is deliberately narrower than "the delays are the same".
+ *
+ * TWO things make it safe, and both are load-bearing:
+ *
+ * 1. SPEND. A wait dispatches nothing, so estimateSequenceActions (the start
+ *    route's estimator) skips it entirely: re-timing cannot move the planned
+ *    actions, the channel mix, or the credit estimate the launch approval was
+ *    granted against.
  *
- * This is the one journey edit a LIVE sequence accepts. The journey lock exists
- * so a revised journey gets a fresh launch preview and approval, and a wait
- * provably cannot move that preview: estimateSequenceActions (the start route's
- * estimator) skips every step with no channel, so waits contribute nothing to the
- * planned actions, the channel mix, or the credit estimate the approval was
- * granted against. What a delay does change is when the next step fires — exactly
- * the knob a founder reaches for after watching day one of a live campaign.
+ * 2. POSITION. Every in-flight enrollment stores its place as an INTEGER index
+ *    into steps[] (`current_step_index`, walked directly by the dispatcher).
+ *    Inserting or deleting ANY step — a wait included — renumbers everything
+ *    after it and marches live leads onto the wrong step: a message re-sent, or
+ *    one silently skipped. So the step ids and their ORDER must be identical;
+ *    only the fields of a wait already in place may change. Removing a delay on
+ *    a live sequence is spelled "set it to 0" (see allowZeroWaits), which the
+ *    dispatcher passes straight through and the builder renders as "No delay".
  *
- * Inserting or removing a wait counts as timing too: a wait dispatches nothing, so
- * adding one only postpones a send and removing one only brings it forward.
+ * A draft is exempt from both: it has no enrollments to shift and no approval
+ * to bypass, so its builder inserts and deletes waits freely.
  */
 export declare function sequenceDefinitionsDifferOnlyInTiming(before: SequenceDefinition, after: SequenceDefinition): boolean;
 /**

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -1065,7 +1065,7 @@ raw, index, options, issues) {
         case "wait": {
             const days = optionalNonNegativeInt(raw.days, `${path}.days`, issues);
             const hours = optionalNonNegativeInt(raw.hours, `${path}.hours`, issues);
-            if ((days ?? 0) + (hours ?? 0) <= 0) {
+            if ((days ?? 0) + (hours ?? 0) <= 0 && !options.allowZeroWaits) {
                 issues.push({ path, message: "A wait step needs days and/or hours totaling at least 1 hour." });
             }
             const jitterHours = optionalWaitJitterHours(raw.jitter_hours, `${path}.jitter_hours`, issues);
@@ -1835,14 +1835,7 @@ export function sequenceWaitStepJitterMs(step, enrollmentId) {
 export function sequenceWaitStepDelayWithJitterMs(step, enrollmentId) {
     return sequenceWaitStepDelayMs(step) + sequenceWaitStepJitterMs(step, enrollmentId);
 }
-/**
- * Branch fields that name another step. A signal branch spells its arms `then`/
- * `else`; a connection branch spells them `then_id`/`else_id`. Both are erased
- * from the skeleton and replaced by one normalized pair, so an arm that is absent
- * on one side and explicitly null on the other still compares equal.
- */
-const BRANCH_TARGET_KEYS = ["then", "else", "then_id", "else_id"];
-/** Key-sorted JSON, so two structurally equal definitions compare equal whatever order their keys were built in. */
+/** Key-sorted JSON, so two structurally equal steps compare equal whatever order their keys were built in. */
 function stableJson(value) {
     if (Array.isArray(value))
         return `[${value.map(stableJson).join(",")}]`;
@@ -1855,65 +1848,51 @@ function stableJson(value) {
     return JSON.stringify(value) ?? "null";
 }
 /**
- * The definition with every `wait` step erased: the actions, in order, with each
- * branch arm repointed to the step its delay leads INTO. Two definitions share a
- * skeleton exactly when they perform the same journey and differ only in when.
+ * Whether `after` changes nothing about `before` except how long its existing
+ * wait steps wait. This is the one journey edit a LIVE sequence accepts, and it
+ * is deliberately narrower than "the delays are the same".
  *
- * Waits are folded rather than simply filtered out because a delay is modelled as
- * a step, so an arm whose delay was edited legitimately repoints from one wait id
- * to another (setBranchArmDelay in the web builder does exactly that) — a naive
- * filter would read that as a rerouted branch.
- */
-function sequenceTimingSkeleton(definition) {
-    const steps = Array.isArray(definition?.steps) ? definition.steps : [];
-    const indexById = new Map(steps.map((step, index) => [step.id, index]));
-    // The first non-wait step at or after `id`. A dangling target, an absent one,
-    // and a trailing run of waits all end the path — all resolve to null.
-    const throughWaits = (id) => {
-        if (typeof id !== "string")
-            return null;
-        const from = indexById.get(id);
-        if (from === undefined)
-            return null;
-        for (let k = from; k < steps.length; k++) {
-            const step = steps[k];
-            if (step.kind !== "wait")
-                return step.id;
-        }
-        return null;
-    };
-    const actions = steps
-        .filter((step) => step.kind !== "wait")
-        .map((step) => {
-        const fields = { ...step };
-        const branch = step;
-        for (const key of BRANCH_TARGET_KEYS)
-            delete fields[key];
-        return {
-            ...fields,
-            arm_then: throughWaits(branch.then ?? branch.then_id),
-            arm_else: throughWaits(branch.else ?? branch.else_id),
-        };
-    });
-    return stableJson(actions);
-}
-/**
- * Whether `after` changes nothing about `before` except its timing — the delays
- * between steps, including the lead-in delay in front of the very first one.
+ * TWO things make it safe, and both are load-bearing:
  *
- * This is the one journey edit a LIVE sequence accepts. The journey lock exists
- * so a revised journey gets a fresh launch preview and approval, and a wait
- * provably cannot move that preview: estimateSequenceActions (the start route's
- * estimator) skips every step with no channel, so waits contribute nothing to the
- * planned actions, the channel mix, or the credit estimate the approval was
- * granted against. What a delay does change is when the next step fires — exactly
- * the knob a founder reaches for after watching day one of a live campaign.
+ * 1. SPEND. A wait dispatches nothing, so estimateSequenceActions (the start
+ *    route's estimator) skips it entirely: re-timing cannot move the planned
+ *    actions, the channel mix, or the credit estimate the launch approval was
+ *    granted against.
  *
- * Inserting or removing a wait counts as timing too: a wait dispatches nothing, so
- * adding one only postpones a send and removing one only brings it forward.
+ * 2. POSITION. Every in-flight enrollment stores its place as an INTEGER index
+ *    into steps[] (`current_step_index`, walked directly by the dispatcher).
+ *    Inserting or deleting ANY step — a wait included — renumbers everything
+ *    after it and marches live leads onto the wrong step: a message re-sent, or
+ *    one silently skipped. So the step ids and their ORDER must be identical;
+ *    only the fields of a wait already in place may change. Removing a delay on
+ *    a live sequence is spelled "set it to 0" (see allowZeroWaits), which the
+ *    dispatcher passes straight through and the builder renders as "No delay".
+ *
+ * A draft is exempt from both: it has no enrollments to shift and no approval
+ * to bypass, so its builder inserts and deletes waits freely.
  */
 export function sequenceDefinitionsDifferOnlyInTiming(before, after) {
-    return sequenceTimingSkeleton(before) === sequenceTimingSkeleton(after);
+    const oldSteps = Array.isArray(before?.steps) ? before.steps : [];
+    const newSteps = Array.isArray(after?.steps) ? after.steps : [];
+    if (oldSteps.length !== newSteps.length)
+        return false;
+    return oldSteps.every((oldStep, index) => {
+        const newStep = newSteps[index];
+        // Same step, same slot — anything else renumbers a live enrollment's cursor.
+        if (oldStep.id !== newStep.id || oldStep.kind !== newStep.kind)
+            return false;
+        if (oldStep.kind !== "wait")
+            return stableJson(oldStep) === stableJson(newStep);
+        // A wait may be re-timed, and nothing else about it may move.
+        const timingFree = (step) => {
+            const fields = { ...step };
+            delete fields.days;
+            delete fields.hours;
+            delete fields.jitter_hours;
+            return stableJson(fields);
+        };
+        return timingFree(oldStep) === timingFree(newStep);
+    });
 }
 /**
  * Render a sequence-copy template against a row's values. Delegates to the shared

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,4 +1,4 @@
-export declare const OXYGEN_VERSION = "1.846.6";
+export declare const OXYGEN_VERSION = "1.851.1";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
 export declare const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.846.6";
+export const OXYGEN_VERSION = "1.851.1";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.846.6",
+  "version": "1.851.1",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",