@oxygen-agent/cli 1.982.3 → 1.1003.12

package/node_modules/@oxygen/shared/dist/research-output-contract.js

@@ -1,3 +1,4 @@
+import { isRecord as isObject } from "./type-guards.js";
 const MAX_RESEARCH_SECTIONS = 20;
 const OUTPUT_SECTIONS_MARKER = /\b(?:return|provide|include|produce|output)\b.{0,80}\b(?:labeled|named|required|requested)?\s*(?:output\s+)?sections?\s*:/i;
 const LABELED_SECTION = /^(?:[-*+]\s+|\d+[.)]\s+)?([A-Za-z][A-Za-z0-9_. /&()'’+\-]{1,79})\s*:\s*.*$/;
@@ -88,6 +89,64 @@ export function buildResearchOutputSchema(contract) {
         required: ["answer", "found", "confidence", "citations"],
     };
 }
+/**
+ * Whether a found answer MUST cite evidence. Shared by the write-path normalizer
+ * (which bakes it into the derived research contract), the runner (which
+ * validates the model output against it) and the output-field reader, so none
+ * of them can disagree.
+ *
+ * Explicit "strict" always requires it. A FETCH column requires it by default —
+ * the evidence is the one page the customer pointed at, so an answer that cites
+ * nothing answered from memory — unless the author chose "estimate".
+ */
+export function researchEvidenceRequired(webSearch) {
+    if (!isObject(webSearch))
+        return false;
+    if (webSearch.evidenceMode === "strict")
+        return true;
+    if (webSearch.evidenceMode === "estimate")
+        return false;
+    return webSearch.source === "fetch";
+}
+/**
+ * True for a model-facing schema in the research envelope shape — the derived
+ * contract, the legacy broad schema, or a catalog template's typed answer
+ * envelope — as opposed to a hand-authored schema that replaces the envelope
+ * entirely. The output-field reader rewrites only the former into the stored
+ * cell shape (`sources` in, `citations` out); the latter is used verbatim.
+ */
+export function isResearchEnvelopeSchema(schema) {
+    if (!isObject(schema) || schema.type !== "object")
+        return false;
+    const properties = isObject(schema.properties) ? schema.properties : null;
+    if (!properties)
+        return false;
+    return ["answer", "found", "confidence", "citations"].every((key) => isObject(properties[key]));
+}
+/**
+ * The model-facing schema for a research column whose ANSWER is a typed object
+ * (a catalog template such as a pricing summary): the same
+ * `{answer, found, confidence, citations}` envelope the derived contract uses,
+ * with `answer` replaced by the template's own object schema. The runner still
+ * resolves `citations` to real sources on the way to the cell, so a typed
+ * extraction cannot cite a page that was never fetched either.
+ */
+export function buildResearchOutputSchemaForAnswer(answerSchema) {
+    const envelope = buildResearchOutputSchema(null);
+    const properties = isObject(envelope.properties) ? { ...envelope.properties } : {};
+    return {
+        ...envelope,
+        properties: {
+            ...properties,
+            answer: {
+                ...answerSchema,
+                description: typeof answerSchema.description === "string"
+                    ? answerSchema.description
+                    : "The typed answer read from the evidence; unsupported fields are null or empty.",
+            },
+        },
+    };
+}
 /**
  * The schema of the research cell as it is actually STORED — which is not the
  * schema the model answers in.
@@ -101,8 +160,12 @@ export function buildResearchOutputSchema(contract) {
  * `buildResearchOutputSchema` would offer `citations`, which no cell has, and
  * hide `sources`, which every cell does.
  */
-export function buildResearchCellSchema(contract) {
-    const modelSchema = buildResearchOutputSchema(contract);
+export function buildResearchCellSchema(contract, 
+/** A column's own model-facing schema (a catalog template's typed answer
+ * envelope). When given it replaces the derived one, so the cell shape of a
+ * typed extraction exposes `answer.plan_count`, not a string answer. */
+modelSchemaOverride) {
+    const modelSchema = modelSchemaOverride ?? buildResearchOutputSchema(contract);
     const properties = isObject(modelSchema.properties) ? { ...modelSchema.properties } : {};
     delete properties.citations;
     return {
@@ -191,6 +254,3 @@ function hasExactMembers(value, expected) {
         && value.length === expected.length
         && expected.every((member) => value.includes(member));
 }
-function isObject(value) {
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}

package/node_modules/@oxygen/shared/dist/search-vocab.js

@@ -1,11 +1,10 @@
 // Shared search-planner vocabulary + stateless text helpers.
 //
 // Single source of truth for the constraint vocabulary and pure text helpers
-// consumed by BOTH the legacy web search planners
-// (apps/web/src/lib/company-search-plan.ts, people-search-plan.ts) and the
-// @oxygen/routing classifier/compiler (via packages/routing/src/vocab.ts,
-// which layers its named tuning deltas on top of these bases). Keeping one copy
-// here is what stops the two surfaces from silently drifting (OXY-414).
+// consumed by the web search planners (apps/web/src/lib/company-search-plan.ts,
+// people-search-plan.ts). Any other search classifier or compiler layers its
+// tuning deltas on top of these bases rather than re-listing vocabulary, so the
+// surfaces cannot silently drift (OXY-414).
 //
 // Everything here is a pure function or a static table: no Date.now, no
 // randomness, no I/O — safe to import from any layer.

package/node_modules/@oxygen/shared/dist/select-options.js

@@ -75,7 +75,12 @@ export const IMAGE_COLUMN_SEMANTIC = "image";
 export function isImageColumnSemantic(semanticType) {
     return semanticType === "image" || semanticType === "avatar" || semanticType === "photo";
 }
-const MAX_OPTIONS = 200;
+// A sanity ceiling, not a correctness one: it stops a malformed write from
+// turning one column into an unbounded list. Raised from 200 to 300 for the
+// CRM's country column, whose vocabulary is the 250-entry LinkedIn country set
+// (see @oxygen/shared/linkedin-countries) — at 200 the tail of the alphabet was
+// silently truncated away, which reads as "Oxygen has never heard of Vietnam".
+const MAX_OPTIONS = 300;
 // Normalize a raw options array (from a column `definition.options`, CLI/MCP, or
 // the editor) into canonical SelectOptions: dedupe by value, default colors,
 // canonical 0..n ordering. Accepts strings or {value,label,color,order} objects.

package/node_modules/@oxygen/shared/dist/sequence-crm-events.d.ts

@@ -287,5 +287,5 @@ export declare const SEQUENCE_HUBSPOT_EVENT_SYNC_TEMPLATE_ID = "sequencer-hubspo
 export declare const SEQUENCE_WORKFLOW_EVENT_SOURCE = "sequencer";
 export declare const SEQUENCE_CONTACT_ACTIVITY_EVENT = "contact_activity";
 export declare const SEQUENCE_HUBSPOT_LINKEDIN_IDENTITY_PROPERTY = "oxygen_linkedin_url";
-export declare const DEFAULT_SEQUENCE_HUBSPOT_EVENT_MAPPINGS: Readonly<Record<"email_sent" | "meeting_booked" | "email_bounced" | "linkedin_profile_visited" | "linkedin_connection_sent" | "linkedin_connection_accepted" | "linkedin_message_sent" | "linkedin_inmail_sent" | "linkedin_reply_received" | "linkedin_followed" | "linkedin_post_liked" | "linkedin_post_commented" | "linkedin_connection_withdrawn" | "email_campaign_enrolled" | "email_campaign_moved" | "email_campaign_stopped" | "email_opened" | "email_clicked" | "email_reply_received" | "email_unsubscribed" | "email_spam_complaint" | "whatsapp_message_sent" | "whatsapp_reply_received" | "call_task_created" | "call_connected" | "call_no_answer" | "call_voicemail" | "crm_task_created", string>>;
+export declare const DEFAULT_SEQUENCE_HUBSPOT_EVENT_MAPPINGS: Readonly<Record<"call_connected" | "call_no_answer" | "call_task_created" | "call_voicemail" | "crm_task_created" | "email_bounced" | "email_campaign_enrolled" | "email_campaign_moved" | "email_campaign_stopped" | "email_clicked" | "email_opened" | "email_reply_received" | "email_sent" | "email_spam_complaint" | "email_unsubscribed" | "linkedin_connection_accepted" | "linkedin_connection_sent" | "linkedin_connection_withdrawn" | "linkedin_followed" | "linkedin_inmail_sent" | "linkedin_message_sent" | "linkedin_post_commented" | "linkedin_post_liked" | "linkedin_profile_visited" | "linkedin_reply_received" | "meeting_booked" | "whatsapp_message_sent" | "whatsapp_reply_received", string>>;
 export declare function isSequenceCrmEventKey(value: unknown): value is SequenceCrmEventKey;

package/node_modules/@oxygen/shared/dist/sequence-failures.js

@@ -1,5 +1,6 @@
 import { redactCustomerFacingDetails, redactCustomerFacingError, } from "./error-redaction.js";
 import { isProviderFundingErrorCode, isProviderRateLimitErrorCode, } from "./provider-funding-errors.js";
+import { asRecordOrNull as asRecord } from "./type-guards.js";
 export const SEQUENCE_FAILURE_SCHEMA_VERSION = 1;
 export const SEQUENCE_FAILURE_RETRY_AFTER_MAX_MS = 24 * 60 * 60 * 1000;
 export const SEQUENCE_FAILURE_CLASSES = [
@@ -318,8 +319,3 @@ function firstBoolean(records, keys) {
     }
     return null;
 }
-function asRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : null;
-}

package/node_modules/@oxygen/shared/dist/sequence-hubspot-sync.d.ts

@@ -17,7 +17,7 @@ export declare const HUBSPOT_DEFAULT_LEAD_STATUS_PROPERTY = "hs_lead_status";
 export declare const DEFAULT_HUBSPOT_SEQUENCE_TIMELINE_EVENTS: readonly ["email_sent", "email_reply_received", "email_bounced", "linkedin_message_sent", "linkedin_inmail_sent", "linkedin_reply_received"];
 /** Events for which the HubSpot adapter has a first-class activity object. */
 export declare const HUBSPOT_SEQUENCE_TIMELINE_EVENT_KEYS: readonly ["email_sent", "email_reply_received", "email_bounced", "linkedin_message_sent", "linkedin_inmail_sent", "linkedin_reply_received"];
-export declare const HUBSPOT_CLASSIFIED_REPLY_TIMELINE_EVENTS: Set<"email_sent" | "meeting_booked" | "email_bounced" | "linkedin_profile_visited" | "linkedin_connection_sent" | "linkedin_connection_accepted" | "linkedin_message_sent" | "linkedin_inmail_sent" | "linkedin_reply_received" | "linkedin_followed" | "linkedin_post_liked" | "linkedin_post_commented" | "linkedin_connection_withdrawn" | "email_campaign_enrolled" | "email_campaign_moved" | "email_campaign_stopped" | "email_opened" | "email_clicked" | "email_reply_received" | "email_unsubscribed" | "email_spam_complaint" | "whatsapp_message_sent" | "whatsapp_reply_received" | "call_task_created" | "call_connected" | "call_no_answer" | "call_voicemail" | "crm_task_created">;
+export declare const HUBSPOT_CLASSIFIED_REPLY_TIMELINE_EVENTS: Set<"call_connected" | "call_no_answer" | "call_task_created" | "call_voicemail" | "crm_task_created" | "email_bounced" | "email_campaign_enrolled" | "email_campaign_moved" | "email_campaign_stopped" | "email_clicked" | "email_opened" | "email_reply_received" | "email_sent" | "email_spam_complaint" | "email_unsubscribed" | "linkedin_connection_accepted" | "linkedin_connection_sent" | "linkedin_connection_withdrawn" | "linkedin_followed" | "linkedin_inmail_sent" | "linkedin_message_sent" | "linkedin_post_commented" | "linkedin_post_liked" | "linkedin_profile_visited" | "linkedin_reply_received" | "meeting_booked" | "whatsapp_message_sent" | "whatsapp_reply_received">;
 export type HubSpotSequenceSyncConfig = {
     /** Optional latest-occurrence snapshots on HubSpot contact properties. */
     mappings: Record<SequenceCrmEventKey, string>;

package/node_modules/@oxygen/shared/dist/sequences.d.ts

@@ -919,9 +919,28 @@ export type SequenceLintIssue = {
     path: string;
     message: string;
 };
+/**
+ * A non-blocking fact about how a definition was normalized that its author must
+ * be told, as opposed to an issue that rejects it. Today exactly one:
+ * `email_reply_rewritten`. The retired kind is accepted and rewritten into a
+ * subject-less `email_send`, and a caller that only reads the stored definition
+ * back sees a different `kind` than it wrote with nothing in the response to
+ * explain it — reported as a silent coercion by a customer (Plain T-163).
+ */
+export type SequenceDefinitionNotice = {
+    path: string;
+    code: "email_reply_rewritten";
+    message: string;
+};
 export type ValidateSequenceOptions = {
     /** When provided, every channel-bearing step must use one of these channels. */
     allowedChannels?: SequenceChannel[];
+    /**
+     * Sink for non-blocking normalization notices (see SequenceDefinitionNotice).
+     * Validation never throws for these; a caller that wants to surface them to
+     * the author passes an array and reads it back after the call.
+     */
+    notices?: SequenceDefinitionNotice[];
     /**
      * Whether this sequence has NATIVE open/click tracking enabled (a verified
      * tracking domain + EMAIL_TRACKING_SECRET, so the dispatcher injects a pixel +
@@ -980,6 +999,13 @@ export declare function sequenceStepsMissingCopy(steps: readonly SequenceStep[])
  */
 export declare function validateSequenceDefinition(input: unknown, options?: ValidateSequenceOptions): SequenceDefinition;
 /** Non-throwing variant for lint surfaces. */
+/**
+ * The non-blocking notices normalizing this definition would raise, for a
+ * response `warnings` array. Never throws: an invalid definition yields whatever
+ * notices were collected before validation gave up (the caller's own validate
+ * call reports the failure), so this is safe to run beside a persist.
+ */
+export declare function sequenceDefinitionNotices(input: unknown, options?: Omit<ValidateSequenceOptions, "notices">): SequenceDefinitionNotice[];
 export declare function lintSequenceDefinition(input: unknown, options?: ValidateSequenceOptions): SequenceLintIssue[];
 /** Total base delay in milliseconds a wait step introduces (no jitter). */
 export declare function sequenceWaitStepDelayMs(step: SequenceWaitStep): number;
@@ -1150,4 +1176,27 @@ export declare function secondsUntilSendWindowEnd(window: SequenceSendWindow, no
  * describes this window's sends.
  */
 export declare function secondsSinceSendWindowStart(window: SequenceSendWindow, now: Date, timezone?: string): number | null;
+/**
+ * The next instant at which `isWithinSendWindow` becomes true, or null when the
+ * window is already open, never opens, or cannot be evaluated.
+ *
+ * This is what a deferral should wait for. Before it existed, the two
+ * native-email send-window gates deferred a flat +30 minutes, so every pending
+ * action was re-claimed, re-planned and re-written twice an hour for as long as
+ * the window stayed shut — ~128 times each across a closed weekend, which is
+ * where 24,261 of one fortnight's deferral log lines came from.
+ *
+ * Null on exactly the cases its three siblings decline: an unresolvable
+ * timezone, a malformed `start`/`end`, and a zero-width window. The caller keeps
+ * its own fallback delay for those, so a bad window can never park an action
+ * forever — the same fail-open posture isWithinSendWindow takes.
+ *
+ * Computed by stepping to the next allowed local `start` and then correcting
+ * against the real clock, because minutes-of-day arithmetic alone is wrong
+ * across a DST boundary (the offset moves between `now` and the candidate). The
+ * correction re-reads the candidate's local time and closes the gap; the result
+ * is only returned once isWithinSendWindow itself agrees, so this function can
+ * never hand back an instant the gate would reject.
+ */
+export declare function nextSendWindowOpenAt(window: SequenceSendWindow, now: Date, timezone?: string): Date | null;
 export {};

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -1,5 +1,6 @@
 import { OxygenError } from "./cli-result.js";
 import { hashVariantKey, renderTemplate, spintaxSyntaxIssues, templateColumnKeys, } from "./sequence-template.js";
+import { isRecord } from "./type-guards.js";
 /**
  * Multichannel sequence DSL — the shared contract validated identically by CLI,
  * MCP, API, and web. A sequence is an ordered list of steps applied to each
@@ -1176,6 +1177,22 @@ export function validateSequenceDefinition(input, options = {}) {
     return { steps: normalized };
 }
 /** Non-throwing variant for lint surfaces. */
+/**
+ * The non-blocking notices normalizing this definition would raise, for a
+ * response `warnings` array. Never throws: an invalid definition yields whatever
+ * notices were collected before validation gave up (the caller's own validate
+ * call reports the failure), so this is safe to run beside a persist.
+ */
+export function sequenceDefinitionNotices(input, options = {}) {
+    const notices = [];
+    try {
+        validateSequenceDefinition(input, { ...options, notices });
+    }
+    catch {
+        // Reported by the caller's own validation; the notices gathered so far stand.
+    }
+    return notices;
+}
 export function lintSequenceDefinition(input, options = {}) {
     try {
         validateSequenceDefinition(input, options);
@@ -1378,6 +1395,14 @@ raw, index, options, issues) {
             const cc = optionalEmailList(raw.cc, `${path}.cc`, issues);
             const bcc = optionalEmailList(raw.bcc, `${path}.bcc`, issues);
             const sendWindow = normalizeSendWindow(raw.send_window, `${path}.send_window`, issues);
+            // Say so. The rewrite is deliberate compatibility, but a definition read back
+            // with a different `kind` than was written, and nothing in the response to
+            // explain it, reads as data loss to the author.
+            options.notices?.push({
+                path: `${path}.kind`,
+                code: "email_reply_rewritten",
+                message: `step '${id}': kind 'email_reply' is retired and was stored as 'email_send' with no subject_template — the threaded follow-up. It goes out as "Re: <the previous email's subject>" inside the lead's previous thread; give it a subject_template of its own to start a new email instead.`,
+            });
             return {
                 id, channel: "email", kind: "email_send", body_template: body ?? "",
                 ...(bodyHtml !== undefined ? { body_html_template: bodyHtml } : {}),
@@ -2539,6 +2564,36 @@ function hhmmToMinutes(value) {
     return hours * 60 + minutes;
 }
 const ISO_WEEKDAY = { Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6, Sun: 7 };
+/**
+ * Does this window admit `isoWeekday`? Shared by every gate so they cannot
+ * disagree about what a day list means.
+ *
+ * `days` is contractually ISO numbers (normalizeWeekdays rejects anything else),
+ * but `settings.email_send_window` is stored without passing through it, and
+ * production holds windows whose days are `["mon","tue",...]`. A raw
+ * `days.includes(1)` is false for every day of the week, so such a window is
+ * never open and its Sequence can never send — a silent, permanent stall that
+ * also contradicts this module's fail-open posture for a malformed window.
+ * Names are therefore accepted, and a list with no recognisable entry at all is
+ * treated as absent (every day), which is exactly what normalizeWeekdays
+ * produces for the same input.
+ */
+function sendWindowAllowsWeekday(days, isoWeekday) {
+    let recognised = 0;
+    for (const entry of days) {
+        const day = typeof entry === "number"
+            ? entry
+            : typeof entry === "string"
+                ? ISO_WEEKDAY[`${entry.trim().slice(0, 1).toUpperCase()}${entry.trim().slice(1, 3).toLowerCase()}`] ?? Number(entry)
+                : Number.NaN;
+        if (!Number.isInteger(day) || day < 1 || day > 7)
+            continue;
+        recognised += 1;
+        if (day === isoWeekday)
+            return true;
+    }
+    return recognised === 0;
+}
 /**
  * Resolve which IANA timezone a send window evaluates in for a given lead row.
  * "recipient" mode reads the lead's tz from `recipient_timezone_column`, falling
@@ -2569,7 +2624,7 @@ export function isWithinSendWindow(window, now, timezone) {
     const endM = hhmmToMinutes(window.end);
     if (startM === null || endM === null)
         return true; // malformed window → fail open
-    if (window.days && window.days.length > 0 && !window.days.includes(parts.isoWeekday))
+    if (window.days && window.days.length > 0 && !sendWindowAllowsWeekday(window.days, parts.isoWeekday))
         return false;
     if (startM === endM)
         return false; // empty window
@@ -2630,6 +2685,84 @@ export function secondsSinceSendWindowStart(window, now, timezone) {
         : minutes + 24 * 60 - startM; // wrapped past midnight: opened yesterday evening
     return elapsedMinutes >= 0 ? elapsedMinutes * 60 : null;
 }
+/**
+ * How far ahead nextSendWindowOpenAt will look for an opening. A window with a
+ * `days` list opens at least weekly, so 8 days covers every configurable gap
+ * with a day of slack; anything that finds nothing inside it is a window that
+ * never opens (zero-width, or a malformed tz that fails the parts read).
+ */
+const SEND_WINDOW_LOOKAHEAD_DAYS = 8;
+/**
+ * The next instant at which `isWithinSendWindow` becomes true, or null when the
+ * window is already open, never opens, or cannot be evaluated.
+ *
+ * This is what a deferral should wait for. Before it existed, the two
+ * native-email send-window gates deferred a flat +30 minutes, so every pending
+ * action was re-claimed, re-planned and re-written twice an hour for as long as
+ * the window stayed shut — ~128 times each across a closed weekend, which is
+ * where 24,261 of one fortnight's deferral log lines came from.
+ *
+ * Null on exactly the cases its three siblings decline: an unresolvable
+ * timezone, a malformed `start`/`end`, and a zero-width window. The caller keeps
+ * its own fallback delay for those, so a bad window can never park an action
+ * forever — the same fail-open posture isWithinSendWindow takes.
+ *
+ * Computed by stepping to the next allowed local `start` and then correcting
+ * against the real clock, because minutes-of-day arithmetic alone is wrong
+ * across a DST boundary (the offset moves between `now` and the candidate). The
+ * correction re-reads the candidate's local time and closes the gap; the result
+ * is only returned once isWithinSendWindow itself agrees, so this function can
+ * never hand back an instant the gate would reject.
+ */
+export function nextSendWindowOpenAt(window, now, timezone) {
+    const tz = timezone?.trim() ? timezone.trim() : window.timezone;
+    const parts = tzParts(now, tz) ?? tzParts(now, window.timezone) ?? tzParts(now, "UTC");
+    if (!parts)
+        return null;
+    const startM = hhmmToMinutes(window.start);
+    const endM = hhmmToMinutes(window.end);
+    if (startM === null || endM === null || startM === endM)
+        return null;
+    if (isWithinSendWindow(window, now, timezone))
+        return null;
+    const dayAllowed = (isoWeekday) => !window.days || window.days.length === 0 || sendWindowAllowsWeekday(window.days, isoWeekday);
+    const minutes = parts.hour * 60 + parts.minute;
+    // Days to skip before the window's local `start` is both in the future and on
+    // an allowed weekday. 0 means "later today".
+    let dayOffset = minutes < startM && dayAllowed(parts.isoWeekday) ? 0 : 1;
+    while (dayOffset <= SEND_WINDOW_LOOKAHEAD_DAYS && !dayAllowed(((parts.isoWeekday - 1 + dayOffset) % 7) + 1)) {
+        dayOffset += 1;
+    }
+    if (dayOffset > SEND_WINDOW_LOOKAHEAD_DAYS)
+        return null;
+    let candidate = new Date(now.getTime() + ((dayOffset * 24 * 60) + startM - minutes) * 60_000);
+    // DST correction: the offset that applied at `now` may not apply at the
+    // candidate, so the naive arithmetic can land an hour early or late. Re-read
+    // the candidate's own local time and close the gap. Two rounds are enough for
+    // any real transition (the second only runs if the first lands on the shifted
+    // side of the boundary); a zone with no transition converges on the first.
+    for (let round = 0; round < 2; round += 1) {
+        const at = tzParts(candidate, tz);
+        if (!at)
+            break;
+        const drift = (at.hour * 60 + at.minute) - startM;
+        if (drift === 0)
+            break;
+        // Choose the nearer direction so a ±23h reading across midnight (the window
+        // opens just after a backward transition) corrects by minutes, not a day.
+        const shift = drift > 12 * 60 ? drift - 24 * 60 : drift < -12 * 60 ? drift + 24 * 60 : drift;
+        candidate = new Date(candidate.getTime() - shift * 60_000);
+    }
+    // A local `start` can be skipped entirely by a forward DST jump, and a
+    // corrected candidate can land a minute on the wrong side. Walk forward to the
+    // first minute the gate actually accepts rather than trusting the arithmetic.
+    for (let nudge = 0; nudge <= 120; nudge += 1) {
+        const at = new Date(candidate.getTime() + nudge * 60_000);
+        if (at.getTime() > now.getTime() && isWithinSendWindow(window, at, timezone))
+            return at;
+    }
+    return null;
+}
 function tzParts(now, tz) {
     try {
         const formatted = new Intl.DateTimeFormat("en-US", {
@@ -2828,6 +2961,3 @@ function normalizeWeekdays(value, path, issues) {
     }
     return out.length > 0 ? out.sort((a, b) => a - b) : undefined;
 }
-function isRecord(value) {
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}

package/node_modules/@oxygen/shared/dist/spend-safety.d.ts

@@ -20,19 +20,19 @@ export declare const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES: ReadonlySet<string>;
  * Per-run managed-credit ceiling for a LIVE workflow run fired by an autonomous
  * trigger when neither run metadata nor the manifest declares `max_credits`.
  */
-export declare const DEFAULT_TRIGGER_RUN_CREDIT_CEILING: Record<PlanTier, number | null>;
+export declare const DEFAULT_TRIGGER_RUN_CREDIT_CEILING: Record<SpendSafetyPlanTier, number | null>;
 /**
  * Per-delivery credit ceiling stamped onto a standing/webhook table auto-run
  * batch when the armed configuration carries no explicit `max_credits`.
  */
-export declare const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING: Record<PlanTier, number | null>;
+export declare const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING: Record<SpendSafetyPlanTier, number | null>;
 /**
  * Row ceiling for a BYOK AI-column run whose caller gave no explicit row bound
  * (no limit, no row_ids, selection "all"). BYOK bills the customer's own
  * provider account, so a credit ceiling is meaningless — row count is the
  * enforceable unit. An explicit limit (up to the 500k platform row cap) wins.
  */
-export declare const DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS: Record<PlanTier, number | null>;
+export declare const DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS: Record<SpendSafetyPlanTier, number | null>;
 /**
  * Default per-provider DAILY call cap for BYOK provider traffic (the customer's
  * own key). Short-window pacing defaults already exist in provider-fetch; this
@@ -40,7 +40,7 @@ export declare const DEFAULT_BYOK_COLUMN_RUN_MAX_ROWS: Record<PlanTier, number |
  * with the self-serve override surface live. A workspace
  * provider_rate_limit_policies row with windowSeconds=86400 overrides it.
  */
-export declare const DEFAULT_BYOK_PROVIDER_DAILY_CALL_CAP: Record<PlanTier, number | null>;
+export declare const DEFAULT_BYOK_PROVIDER_DAILY_CALL_CAP: Record<SpendSafetyPlanTier, number | null>;
 export declare const BYOK_PROVIDER_DAILY_WINDOW_SECONDS: number;
 export declare const BYOK_PROVIDER_DAILY_CAP_ENFORCEMENT_ENV = "OXYGEN_BYOK_DAILY_CAPS";
 export type ByokProviderDailyCapEnforcementMode = "observe_only" | "enforced";
@@ -105,10 +105,14 @@ export type OrgDailySpendGuard = {
  * decision is made, so enforcement and the read surfaces cannot drift apart.
  */
 export declare function resolveOrgDailySpendGuard(monthlyCredits: number | null | undefined): OrgDailySpendGuard | null;
-export declare function resolveDefaultTriggerRunCreditCeiling(tier: PlanTier): number | null;
-export declare function resolveDefaultAutoRunBatchCreditCeiling(tier: PlanTier): number | null;
-export declare function resolveDefaultByokColumnRunMaxRows(tier: PlanTier): number | null;
-export declare function resolveDefaultByokProviderDailyCallCap(tier: PlanTier): number | null;
+/** Credits carry 3 decimals everywhere (control-DB numeric(18,3)). */
+export declare function roundCredits(value: number): number;
+/** Credit estimates that present to 2 decimals (cent-grained customer copy). */
+export declare function roundCreditsToCents(value: number): number;
+export declare function resolveDefaultTriggerRunCreditCeiling(tier: SpendSafetyPlanTier): number | null;
+export declare function resolveDefaultAutoRunBatchCreditCeiling(tier: SpendSafetyPlanTier): number | null;
+export declare function resolveDefaultByokColumnRunMaxRows(tier: SpendSafetyPlanTier): number | null;
+export declare function resolveDefaultByokProviderDailyCallCap(tier: SpendSafetyPlanTier): number | null;
 /**
  * The plan tiers the spend-safety default tables above are keyed by. `limitsTier`
  * collapses "enterprise" onto the "scale" enforcement rung, but these tables carry
@@ -119,5 +123,13 @@ export declare function resolveDefaultByokProviderDailyCallCap(tier: PlanTier):
  * `oxygen limits` report, the org-facing provider-limits API, and the BYOK
  * daily-cap enforcement resolver — they must agree on which column an org reads.
  */
-export declare const SPEND_SAFETY_PLAN_TIERS: readonly PlanTier[];
-export declare function resolveSpendSafetyPlanTier(planTier: string | null, limitsTier: LimitsTier): PlanTier;
+/**
+ * The tiers these tables are keyed by. `oxygen` is deliberately ABSENT: its six
+ * rungs span four enforcement rungs, so an Oxygen plan must fall through to its
+ * limitsTier (the price band) rather than read one shared column. Adding an
+ * "oxygen" column here would silently give a $1,999 workspace the same ceiling
+ * as a $49 one.
+ */
+export type SpendSafetyPlanTier = Exclude<PlanTier, "oxygen">;
+export declare const SPEND_SAFETY_PLAN_TIERS: readonly SpendSafetyPlanTier[];
+export declare function resolveSpendSafetyPlanTier(planTier: string | null, limitsTier: LimitsTier): SpendSafetyPlanTier;

package/node_modules/@oxygen/shared/dist/spend-safety.js

@@ -9,11 +9,11 @@ export const AUTONOMOUS_WORKFLOW_TRIGGER_TYPES = new Set([
  * trigger when neither run metadata nor the manifest declares `max_credits`.
  */
 export const DEFAULT_TRIGGER_RUN_CREDIT_CEILING = {
-    free: 500,
-    starter: 5_000,
-    pro: 10_000,
-    team: 25_000,
-    scale: 250_000,
+    free: 50,
+    starter: 500,
+    pro: 1_000,
+    team: 2_500,
+    scale: 25_000,
     enterprise: null,
 };
 /**
@@ -21,11 +21,11 @@ export const DEFAULT_TRIGGER_RUN_CREDIT_CEILING = {
  * batch when the armed configuration carries no explicit `max_credits`.
  */
 export const DEFAULT_AUTO_RUN_BATCH_CREDIT_CEILING = {
-    free: 500,
-    starter: 5_000,
-    pro: 10_000,
-    team: 25_000,
-    scale: 250_000,
+    free: 50,
+    starter: 500,
+    pro: 1_000,
+    team: 2_500,
+    scale: 25_000,
     enterprise: null,
 };
 /**
@@ -129,9 +129,13 @@ export function resolveOrgDailySpendGuard(monthlyCredits) {
     };
 }
 /** Credits carry 3 decimals everywhere (control-DB numeric(18,3)). */
-function roundCredits(value) {
+export function roundCredits(value) {
     return Math.round(value * 1000) / 1000;
 }
+/** Credit estimates that present to 2 decimals (cent-grained customer copy). */
+export function roundCreditsToCents(value) {
+    return Math.round((value + Number.EPSILON) * 100) / 100;
+}
 export function resolveDefaultTriggerRunCreditCeiling(tier) {
     return DEFAULT_TRIGGER_RUN_CREDIT_CEILING[tier];
 }
@@ -144,16 +148,6 @@ export function resolveDefaultByokColumnRunMaxRows(tier) {
 export function resolveDefaultByokProviderDailyCallCap(tier) {
     return DEFAULT_BYOK_PROVIDER_DAILY_CALL_CAP[tier];
 }
-/**
- * The plan tiers the spend-safety default tables above are keyed by. `limitsTier`
- * collapses "enterprise" onto the "scale" enforcement rung, but these tables carry
- * a distinct "enterprise" column (null = runs on custom limits) — so prefer the
- * raw plan_tier whenever it is itself a table key, and fall back to the limits rung
- * (always a valid PlanTier key) when plan_tier is absent or an unknown/legacy
- * string (e.g. a Stripe price nickname). Single source of truth for the
- * `oxygen limits` report, the org-facing provider-limits API, and the BYOK
- * daily-cap enforcement resolver — they must agree on which column an org reads.
- */
 export const SPEND_SAFETY_PLAN_TIERS = [
     "free",
     "starter",

package/node_modules/@oxygen/shared/dist/sql-rows.d.ts

@@ -0,0 +1 @@
+export declare function executeRows<T>(value: unknown): T[];

package/node_modules/@oxygen/shared/dist/sql-rows.js

@@ -0,0 +1,3 @@
+export function executeRows(value) {
+    return (value.rows ?? value);
+}

package/node_modules/@oxygen/shared/dist/telemetry.js

@@ -1,4 +1,5 @@
 import { SpanStatusCode, metrics, trace, } from "@opentelemetry/api";
+import { deployEnvTelemetryEnvironment, deployPlatformAttribute } from "./deploy-env.js";
 import { errorId } from "./log.js";
 import { normalizeTelemetryAttributes } from "./redaction.js";
 import { redactSqlParameters, sqlErrorTelemetryAttributes } from "./sql-error.js";
@@ -73,7 +74,14 @@ export function commonTelemetryAttributes(attributes) {
     const pick = (workerKeys, webKeys) => pickEnvBySurface(workerProcess, workerKeys, webKeys);
     return {
         "oxygen.version": OXYGEN_VERSION,
-        "deployment.environment": pick(["FLY_ENVIRONMENT", "NODE_ENV"], ["VERCEL_ENV", "NODE_ENV"]),
+        // Which infrastructure this process runs on, so a self-hosted span is
+        // never mistaken for a managed one while both targets are live.
+        "oxygen.platform": deployPlatformAttribute(),
+        // OXYGEN_DEPLOY_ENV is consulted first and is the only signal a self-hosted
+        // box has: it carries neither FLY_ENVIRONMENT nor VERCEL_ENV, so without
+        // this the whole fleet would report its NODE_ENV and collapse prod, shadow
+        // and dev into one bucket. Unset leaves the managed chain untouched.
+        "deployment.environment": deployEnvTelemetryEnvironment() ?? pick(["FLY_ENVIRONMENT", "NODE_ENV"], ["VERCEL_ENV", "NODE_ENV"]),
         // deployment.sha stays the deploy artifact id: the Fly registry image ref on
         // the worker (release cross-reference), VERCEL_GIT_COMMIT_SHA on the web. The
         // worker's image ref is NOT a git commit, so deployment.git_sha carries the

package/node_modules/@oxygen/shared/dist/type-guards.d.ts

@@ -13,3 +13,25 @@
  * `Record<string, unknown>`. Rejects `null`, arrays, and every primitive.
  */
 export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/**
+ * `value` as a `Record<string, unknown>` when it is a non-null, non-array
+ * object, else null.
+ */
+export declare function asRecordOrNull(value: unknown): Record<string, unknown> | null;
+/** Alias of {@link asRecordOrNull} for call sites that spell it `asRecord`. */
+export declare const asRecord: typeof asRecordOrNull;
+/**
+ * `value` as a `Record<string, unknown>`, falling back to an empty object.
+ * Deliberately masks "absent" and "present but wrong shape" the same way its
+ * call sites always have — use {@link asRecordOrNull} when that matters.
+ */
+export declare function asRecordOrEmpty(value: unknown): Record<string, unknown>;
+/** Finite number, else null. Does not parse numeric strings. */
+export declare function readFiniteNumber(value: unknown): number | null;
+/** Trimmed non-empty string, else null. */
+export declare function readTrimmedString(value: unknown): string | null;
+/**
+ * Trimmed non-empty string, else null — additionally coercing a number to its
+ * string form. Distinct from {@link readTrimmedString}, which rejects numbers.
+ */
+export declare function readCoercedString(value: unknown): string | null;