@oxygen-agent/cli 1.982.3 → 1.1003.12

package/node_modules/@oxygen/shared/dist/object-storage.d.ts

@@ -5,6 +5,23 @@ export declare function resolveObjectStorageClient(): {
     client: S3Client;
     bucket: string;
 };
+/**
+ * The same endpoint and credentials, aimed at a DIFFERENT bucket.
+ *
+ * Every namespace above shares one private bucket because they share one access
+ * story: org-scoped keys, no anonymous reads. Public blobs (agency-directory
+ * logos; Payload media reaches the same bucket through its own plugin) are the
+ * opposite — their bytes are fetched by browsers with no credential at all — so
+ * on a self-hosted deploy they belong in a bucket whose read policy is public,
+ * never in the one holding customer lead lists.
+ * Same S3 account, different bucket: hence the client is reused and only the
+ * bucket is overridden. Empty is refused rather than silently falling back to
+ * the import bucket, which is exactly the mix-up this split exists to prevent.
+ */
+export declare function resolveObjectStorageClientForBucket(bucket: string): {
+    client: S3Client;
+    bucket: string;
+};
 export declare function buildImportObjectKey(input: {
     organizationId: string;
     fileName?: string | null;

package/node_modules/@oxygen/shared/dist/object-storage.js

@@ -82,6 +82,27 @@ export function resolveObjectStorageClient() {
     const { client, config } = resolveClient();
     return { client, bucket: config.bucket };
 }
+/**
+ * The same endpoint and credentials, aimed at a DIFFERENT bucket.
+ *
+ * Every namespace above shares one private bucket because they share one access
+ * story: org-scoped keys, no anonymous reads. Public blobs (agency-directory
+ * logos; Payload media reaches the same bucket through its own plugin) are the
+ * opposite — their bytes are fetched by browsers with no credential at all — so
+ * on a self-hosted deploy they belong in a bucket whose read policy is public,
+ * never in the one holding customer lead lists.
+ * Same S3 account, different bucket: hence the client is reused and only the
+ * bucket is overridden. Empty is refused rather than silently falling back to
+ * the import bucket, which is exactly the mix-up this split exists to prevent.
+ */
+export function resolveObjectStorageClientForBucket(bucket) {
+    const target = bucket.trim();
+    if (!target) {
+        throw new OxygenError("object_storage_bucket_missing", "No object-storage bucket was resolved for this operation.", { exitCode: 1 });
+    }
+    const { client } = resolveClient();
+    return { client, bucket: target };
+}
 export function buildImportObjectKey(input) {
     const safeName = sanitizeFileName(input.fileName) || "import";
     return `imports/${input.organizationId}/${randomUUID()}/${safeName}`;

package/node_modules/@oxygen/shared/dist/otlp-log-sink.d.ts

@@ -0,0 +1,54 @@
+import type { LogSink } from "./log.js";
+/**
+ * Ships `log()` records to an OTLP/HTTP logs receiver (the self-hosted SigNoz
+ * collector) instead of — or alongside — Axiom.
+ *
+ * WHY HAND-ROLLED. This is a few dozen lines of JSON against a stable, versioned
+ * wire format. `@opentelemetry/exporter-logs-otlp-http` would pull the OTel logs
+ * SDK, a LoggerProvider, a BatchLogRecordProcessor and their transitive protobuf
+ * machinery into a package that every workspace imports — including edge-safe
+ * ones — to serialize a shape this module states in full below. The exporter
+ * also owns its own batching, so the drop-oldest/never-block/never-throw
+ * contract the two existing shippers hold would become the SDK's opinion rather
+ * than ours. OTLP/JSON is chosen over protobuf for the same reason: no codegen,
+ * no dependency, and a body an operator can read with `curl` when a collector
+ * silently rejects a batch.
+ *
+ * DELIVERY IS BEST-EFFORT BY CONSTRUCTION, exactly like
+ * `apps/worker/src/log-shipper.ts`: the sink only enqueues (it is called from
+ * inside `log()`, so it must never await, throw, or block), the queue drops the
+ * OLDEST record on overflow because the newest lines describe the incident being
+ * debugged, and a collector outage is a dropped batch rather than a process
+ * failure. Failures are written to stderr directly and at most once per flush
+ * window — reporting them through `log()` would feed this sink its own error
+ * line and recurse.
+ */
+export type OtlpLogSinkOptions = {
+    /** Full receiver URL, e.g. `http://collector.internal:4318/v1/logs`. */
+    endpoint: string;
+    /** Extra request headers (collector auth); see `parseOtlpHeaders`. */
+    headers?: Record<string, string> | undefined;
+    /** `service.name` resource attribute. */
+    serviceName: string;
+    /** Resource attributes merged after the defaults, so a caller can override them. */
+    resource?: Record<string, string | null | undefined> | undefined;
+    batchSize?: number | undefined;
+    /** `0` disables the interval timer, for runtimes that flush off a request lifecycle. */
+    flushIntervalMs?: number | undefined;
+    maxQueue?: number | undefined;
+    fetch?: typeof globalThis.fetch | undefined;
+};
+export type OtlpLogSinkHandle = {
+    sink: LogSink;
+    flush: () => Promise<void>;
+    stop: () => Promise<void>;
+};
+/**
+ * `k=v,k=v` — the same shape as `OTEL_EXPORTER_OTLP_HEADERS`, so an operator who
+ * knows the OTel variable can set ours without learning a second syntax. A pair
+ * with no `=`, or an empty key, is skipped rather than throwing: this is parsed
+ * at process start, and a malformed telemetry header must not stop a boot. The
+ * value keeps every `=` after the first (tokens contain them).
+ */
+export declare function parseOtlpHeaders(raw: string | null | undefined): Record<string, string>;
+export declare function createOtlpLogSink(options: OtlpLogSinkOptions): OtlpLogSinkHandle;

package/node_modules/@oxygen/shared/dist/otlp-log-sink.js

@@ -0,0 +1,213 @@
+const DEFAULT_BATCH_SIZE = 500;
+const DEFAULT_FLUSH_INTERVAL_MS = 2_000;
+const DEFAULT_MAX_QUEUE = 10_000;
+const EXPORT_TIMEOUT_MS = 10_000;
+const NO_TIMER_REPORT_WINDOW_MS = 60_000;
+const MAX_ERROR_BODY = 300;
+// OTLP severity numbers (logs data model): the base of each 4-value band.
+const SEVERITY_NUMBERS = { debug: 5, info: 9, warn: 13, error: 17 };
+// Set by log() on every record; they become the OTLP record's own fields rather
+// than attributes, so carrying them twice would just inflate every batch.
+const RECORD_FIELDS_NOT_ATTRIBUTES = new Set(["ts", "level", "msg"]);
+/**
+ * `k=v,k=v` — the same shape as `OTEL_EXPORTER_OTLP_HEADERS`, so an operator who
+ * knows the OTel variable can set ours without learning a second syntax. A pair
+ * with no `=`, or an empty key, is skipped rather than throwing: this is parsed
+ * at process start, and a malformed telemetry header must not stop a boot. The
+ * value keeps every `=` after the first (tokens contain them).
+ */
+export function parseOtlpHeaders(raw) {
+    const headers = {};
+    if (!raw)
+        return headers;
+    for (const pair of raw.split(",")) {
+        const separator = pair.indexOf("=");
+        if (separator <= 0)
+            continue;
+        const key = pair.slice(0, separator).trim();
+        const value = pair.slice(separator + 1).trim();
+        if (!key)
+            continue;
+        headers[key] = value;
+    }
+    return headers;
+}
+function toAnyValue(value) {
+    if (typeof value === "string")
+        return { stringValue: value };
+    if (typeof value === "boolean")
+        return { boolValue: value };
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            return { stringValue: String(value) };
+        // OTLP/JSON encodes int64 as a STRING (proto3 JSON mapping); a bare number
+        // there is what makes a collector reject an otherwise valid record.
+        return Number.isInteger(value) ? { intValue: String(value) } : { doubleValue: value };
+    }
+    if (value === null || value === undefined)
+        return null;
+    try {
+        return { stringValue: JSON.stringify(value) ?? String(value) };
+    }
+    catch {
+        return { stringValue: "[unserializable]" };
+    }
+}
+function toAttributes(source, skip) {
+    const attributes = [];
+    for (const [key, value] of Object.entries(source)) {
+        if (skip?.has(key))
+            continue;
+        const anyValue = toAnyValue(value);
+        if (!anyValue)
+            continue;
+        attributes.push({ key, value: anyValue });
+    }
+    return attributes;
+}
+function timeUnixNano(ts) {
+    const parsed = typeof ts === "string" ? Date.parse(ts) : Number.NaN;
+    const millis = Number.isFinite(parsed) ? parsed : Date.now();
+    // Decimal string, not a number: nanoseconds since the epoch exceed 2^53.
+    return `${millis}000000`;
+}
+function toLogRecord(record) {
+    const level = typeof record.level === "string" && record.level in SEVERITY_NUMBERS
+        ? record.level
+        : "info";
+    return {
+        timeUnixNano: timeUnixNano(record.ts),
+        severityNumber: SEVERITY_NUMBERS[level],
+        severityText: level.toUpperCase(),
+        body: { stringValue: typeof record.msg === "string" ? record.msg : String(record.msg ?? "") },
+        attributes: toAttributes(record, RECORD_FIELDS_NOT_ATTRIBUTES),
+    };
+}
+export function createOtlpLogSink(options) {
+    const batchSize = options.batchSize && options.batchSize > 0 ? options.batchSize : DEFAULT_BATCH_SIZE;
+    const maxQueue = options.maxQueue && options.maxQueue > 0 ? options.maxQueue : DEFAULT_MAX_QUEUE;
+    const flushIntervalMs = options.flushIntervalMs === undefined
+        ? DEFAULT_FLUSH_INTERVAL_MS
+        : options.flushIntervalMs;
+    const doFetch = options.fetch ?? globalThis.fetch;
+    const reportWindowMs = flushIntervalMs > 0 ? flushIntervalMs : NO_TIMER_REPORT_WINDOW_MS;
+    // A null/undefined override is dropped rather than applied, so a caller that
+    // resolves its own environment and comes back empty-handed falls back to the
+    // default here instead of shipping records with no `deployment.environment`.
+    const resourceOverrides = Object.fromEntries(Object.entries(options.resource ?? {}).filter(([, value]) => value !== null && value !== undefined));
+    const resourceAttributes = toAttributes({
+        "service.name": options.serviceName,
+        "deployment.environment": process.env.OXYGEN_DEPLOY_ENV
+            ?? process.env.VERCEL_ENV
+            ?? process.env.NODE_ENV
+            ?? null,
+        ...resourceOverrides,
+    });
+    const queue = [];
+    let inFlight = null;
+    let stopped = false;
+    let lastReportAt = 0;
+    // Never through log(): this module IS the sink log() calls, so a log() here
+    // would enqueue its own failure and re-fail on the next flush forever. stderr
+    // is the one destination that cannot re-enter, and the write is guarded
+    // because a closed/full stderr must not throw into the flush path either.
+    const report = (fields) => {
+        const now = Date.now();
+        if (now - lastReportAt < reportWindowMs)
+            return;
+        lastReportAt = now;
+        try {
+            process.stderr.write(`${JSON.stringify({
+                level: "error",
+                msg: "otlp_log_sink.export_failed",
+                endpoint: options.endpoint,
+                ...fields,
+            })}\n`);
+        }
+        catch {
+            // A telemetry failure that cannot even be reported is still not a fault
+            // of the code being observed.
+        }
+    };
+    const sink = (record) => {
+        if (stopped)
+            return;
+        // Drop the OLDEST record and keep this one: under sustained backpressure the
+        // newest lines are the ones describing the incident being debugged.
+        while (queue.length >= maxQueue) {
+            queue.shift();
+        }
+        queue.push(record);
+    };
+    const flush = async () => {
+        if (inFlight)
+            return inFlight;
+        if (queue.length === 0)
+            return undefined;
+        const batch = queue.splice(0, batchSize);
+        const payload = JSON.stringify({
+            resourceLogs: [
+                {
+                    resource: { attributes: resourceAttributes },
+                    scopeLogs: [
+                        {
+                            scope: { name: "oxygen" },
+                            logRecords: batch.map(toLogRecord),
+                        },
+                    ],
+                },
+            ],
+        });
+        const run = (async () => {
+            try {
+                const response = await doFetch(options.endpoint, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json", ...options.headers },
+                    body: payload,
+                    signal: AbortSignal.timeout(EXPORT_TIMEOUT_MS),
+                });
+                if (response.ok)
+                    return;
+                let body = "";
+                try {
+                    body = (await response.text()).slice(0, MAX_ERROR_BODY);
+                }
+                catch {
+                    // An unreadable body is no worse than a status-only report.
+                }
+                // The batch is gone deliberately: retrying into an unhealthy collector
+                // is how a telemetry path turns an ingest blip into memory pressure.
+                report({ status: response.status, dropped_events: batch.length, response_body: body });
+            }
+            catch (error) {
+                report({
+                    dropped_events: batch.length,
+                    error_message: error instanceof Error ? error.message : String(error),
+                });
+            }
+        })();
+        inFlight = run.finally(() => {
+            inFlight = null;
+        });
+        return inFlight;
+    };
+    const timer = flushIntervalMs > 0
+        ? setInterval(() => {
+            void flush();
+        }, flushIntervalMs)
+        : null;
+    // Never hold the process open on the telemetry timer.
+    timer?.unref?.();
+    const stop = async () => {
+        stopped = true;
+        if (timer)
+            clearInterval(timer);
+        // Drain rather than flush once: a shutdown's final lines are usually the
+        // interesting ones, and one flush ships only the oldest `batchSize`.
+        while (queue.length > 0) {
+            await flush();
+        }
+        await inFlight;
+    };
+    return { sink, flush, stop };
+}

package/node_modules/@oxygen/shared/dist/plan-capabilities.js

@@ -50,6 +50,7 @@ export const PLAN_GATED_CAPABILITIES = [
  * `required_plan_tiers` in tool-access, which the resolver consults separately.
  */
 export const PLAN_GATE_QUALIFYING_TIERS = [
+    "oxygen",
     "starter",
     "pro",
     "team",

package/node_modules/@oxygen/shared/dist/plan-limits.d.ts

@@ -185,14 +185,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 2500;
-            readonly maxInferenceCredits: 1500;
+            readonly maxTotalCredits: 250;
+            readonly maxInferenceCredits: 150;
             readonly maxUpstreamCostUsd: 10;
             readonly maxUpstreamCostUsdByok: 10;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 5000;
-            readonly defaultPerTurnCreditCeiling: 1500;
+            readonly maxSessionBudgetCredits: 500;
+            readonly defaultPerTurnCreditCeiling: 150;
         };
         readonly signals: {
             readonly maxEvents: 100;
@@ -295,14 +295,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 10000;
-            readonly maxInferenceCredits: 5000;
+            readonly maxTotalCredits: 1000;
+            readonly maxInferenceCredits: 500;
             readonly maxUpstreamCostUsd: 10;
             readonly maxUpstreamCostUsdByok: 250;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 5000;
-            readonly defaultPerTurnCreditCeiling: 1500;
+            readonly maxSessionBudgetCredits: 500;
+            readonly defaultPerTurnCreditCeiling: 150;
         };
         readonly signals: {
             readonly maxEvents: 200;
@@ -405,14 +405,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 25000;
-            readonly maxInferenceCredits: 12500;
+            readonly maxTotalCredits: 2500;
+            readonly maxInferenceCredits: 1250;
             readonly maxUpstreamCostUsd: 25;
             readonly maxUpstreamCostUsdByok: 250;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 10000;
-            readonly defaultPerTurnCreditCeiling: 2500;
+            readonly maxSessionBudgetCredits: 1000;
+            readonly defaultPerTurnCreditCeiling: 250;
         };
         readonly signals: {
             readonly maxEvents: 200;
@@ -515,14 +515,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 50000;
-            readonly maxInferenceCredits: 25000;
+            readonly maxTotalCredits: 5000;
+            readonly maxInferenceCredits: 2500;
             readonly maxUpstreamCostUsd: 50;
             readonly maxUpstreamCostUsdByok: 250;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 20000;
-            readonly defaultPerTurnCreditCeiling: 5000;
+            readonly maxSessionBudgetCredits: 2000;
+            readonly defaultPerTurnCreditCeiling: 500;
         };
         readonly signals: {
             readonly maxEvents: 200;
@@ -625,14 +625,14 @@ export declare const PLAN_LIMITS: {
             readonly maxDirectCsvBodyBytes: 10000000;
         };
         readonly agents: {
-            readonly maxTotalCredits: 100000;
-            readonly maxInferenceCredits: 50000;
+            readonly maxTotalCredits: 10000;
+            readonly maxInferenceCredits: 5000;
             readonly maxUpstreamCostUsd: 100;
             readonly maxUpstreamCostUsdByok: 250;
         };
         readonly copilot: {
-            readonly maxSessionBudgetCredits: 50000;
-            readonly defaultPerTurnCreditCeiling: 10000;
+            readonly maxSessionBudgetCredits: 5000;
+            readonly defaultPerTurnCreditCeiling: 1000;
         };
         readonly signals: {
             readonly maxEvents: 200;
@@ -645,8 +645,9 @@ export declare const PLAN_LIMITS: {
 };
 /**
  * Map a raw plan-tier string (subscription `tier`, metadata tier, legacy plan
- * key like `growth_250`) onto its enforcement rung. Unknown/absent tiers land
- * on the unentitled "free" rung; enterprise shares "scale".
+ * key like `growth_250`, or an Oxygen rung key like `oxygen_499`) onto its
+ * enforcement rung. Unknown/absent tiers land on the unentitled "free" rung;
+ * enterprise shares "scale".
  */
 export declare function limitsTierForPlanTier(tier: string | null | undefined): LimitsTier;
 export declare function planLimitsForTier(tier: LimitsTier): PlanLimits;

package/node_modules/@oxygen/shared/dist/plan-limits.js

@@ -70,8 +70,8 @@ export const PLAN_LIMITS = {
         // is bounded by its balance, not by these. The intent is only that no single
         // run can silently eat a first impression.
         agents: {
-            maxTotalCredits: 2_500,
-            maxInferenceCredits: 1_500,
+            maxTotalCredits: 250,
+            maxInferenceCredits: 150,
             maxUpstreamCostUsd: 10,
             maxUpstreamCostUsdByok: 10,
         },
@@ -80,7 +80,7 @@ export const PLAN_LIMITS = {
         // path over the CLI must be able to complete one real session on the base
         // grant alone. Lowering this would re-create the dead-on-arrival Copilot the
         // split grant exists to prevent.
-        copilot: { maxSessionBudgetCredits: 5_000, defaultPerTurnCreditCeiling: 1_500 },
+        copilot: { maxSessionBudgetCredits: 500, defaultPerTurnCreditCeiling: 150 },
         signals: { maxEvents: 100, maxWindowDays: 30 },
         tableActions: { maxActionsPerRun: 10 },
     },
@@ -108,12 +108,12 @@ export const PLAN_LIMITS = {
             maxDirectCsvBodyBytes: 10_000_000,
         },
         agents: {
-            maxTotalCredits: 10_000,
-            maxInferenceCredits: 5_000,
+            maxTotalCredits: 1_000,
+            maxInferenceCredits: 500,
             maxUpstreamCostUsd: 10,
             maxUpstreamCostUsdByok: 250,
         },
-        copilot: { maxSessionBudgetCredits: 5_000, defaultPerTurnCreditCeiling: 1_500 },
+        copilot: { maxSessionBudgetCredits: 500, defaultPerTurnCreditCeiling: 150 },
         signals: { maxEvents: 200, maxWindowDays: 90 },
         tableActions: { maxActionsPerRun: 25 },
     },
@@ -141,12 +141,12 @@ export const PLAN_LIMITS = {
             maxDirectCsvBodyBytes: 10_000_000,
         },
         agents: {
-            maxTotalCredits: 25_000,
-            maxInferenceCredits: 12_500,
+            maxTotalCredits: 2_500,
+            maxInferenceCredits: 1_250,
             maxUpstreamCostUsd: 25,
             maxUpstreamCostUsdByok: 250,
         },
-        copilot: { maxSessionBudgetCredits: 10_000, defaultPerTurnCreditCeiling: 2_500 },
+        copilot: { maxSessionBudgetCredits: 1_000, defaultPerTurnCreditCeiling: 250 },
         signals: { maxEvents: 200, maxWindowDays: 180 },
         tableActions: { maxActionsPerRun: 25 },
     },
@@ -174,12 +174,12 @@ export const PLAN_LIMITS = {
             maxDirectCsvBodyBytes: 10_000_000,
         },
         agents: {
-            maxTotalCredits: 50_000,
-            maxInferenceCredits: 25_000,
+            maxTotalCredits: 5_000,
+            maxInferenceCredits: 2_500,
             maxUpstreamCostUsd: 50,
             maxUpstreamCostUsdByok: 250,
         },
-        copilot: { maxSessionBudgetCredits: 20_000, defaultPerTurnCreditCeiling: 5_000 },
+        copilot: { maxSessionBudgetCredits: 2_000, defaultPerTurnCreditCeiling: 500 },
         signals: { maxEvents: 200, maxWindowDays: 365 },
         tableActions: { maxActionsPerRun: 25 },
     },
@@ -207,27 +207,54 @@ export const PLAN_LIMITS = {
             maxDirectCsvBodyBytes: 10_000_000,
         },
         agents: {
-            maxTotalCredits: 100_000,
-            maxInferenceCredits: 50_000,
+            maxTotalCredits: 10_000,
+            maxInferenceCredits: 5_000,
             maxUpstreamCostUsd: 100,
             maxUpstreamCostUsdByok: 250,
         },
-        copilot: { maxSessionBudgetCredits: 50_000, defaultPerTurnCreditCeiling: 10_000 },
+        copilot: { maxSessionBudgetCredits: 5_000, defaultPerTurnCreditCeiling: 1_000 },
         signals: { maxEvents: 200, maxWindowDays: 365 },
         tableActions: { maxActionsPerRun: 25 },
     },
 };
+/**
+ * Which enforcement rung a rung of the six-rung Oxygen plan lands on.
+ *
+ * The rungs share one `oxygen` tier, so the ladder has to be re-derived from
+ * price. Deliberately scoped to `oxygen` rather than applied to every plan: a
+ * blanket price band would regress the grandfathered plans, demoting `pro_149`
+ * ($149) to "starter" and `team_399` ($399) to "pro".
+ */
+function oxygenRungLimitsTier(monthlyPriceCents) {
+    if (monthlyPriceCents === null)
+        return "starter";
+    // Thresholds track the ladder these rungs replaced, so nobody's enforcement
+    // rung moves for a price they were already paying: Starter was $99, Pro $249,
+    // Team $749. A rung sits on the rung of the old plan at or below its price —
+    // $499 is below the old Team, so it enforces as "pro".
+    if (monthlyPriceCents >= 199_900)
+        return "scale";
+    if (monthlyPriceCents >= 99_900)
+        return "team";
+    if (monthlyPriceCents >= 19_900)
+        return "pro";
+    return "starter";
+}
 /**
  * Map a raw plan-tier string (subscription `tier`, metadata tier, legacy plan
- * key like `growth_250`) onto its enforcement rung. Unknown/absent tiers land
- * on the unentitled "free" rung; enterprise shares "scale".
+ * key like `growth_250`, or an Oxygen rung key like `oxygen_499`) onto its
+ * enforcement rung. Unknown/absent tiers land on the unentitled "free" rung;
+ * enterprise shares "scale".
  */
 export function limitsTierForPlanTier(tier) {
-    const base = resolveBasePricingPlan(tier)?.tier;
+    const plan = resolveBasePricingPlan(tier);
+    const base = plan?.tier;
     if (!base || base === "free")
         return "free";
     if (base === "enterprise")
         return "scale";
+    if (base === "oxygen")
+        return oxygenRungLimitsTier(plan?.monthlyPriceCents ?? null);
     return base;
 }
 export function planLimitsForTier(tier) {