@oxygen-agent/cli 1.800.1 → 1.804.2

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.800.1
+Version: 1.804.2

package/node_modules/@oxygen/shared/dist/error-redaction.d.ts

@@ -111,3 +111,20 @@ export type ErrorCauseEntry = {
 };
 export declare function errorCauseChain(error: unknown, maxDepth?: number): ErrorCauseEntry[];
 export declare function describeErrorWithCauses(error: unknown, maxDepth?: number): string;
+/**
+ * The operator-side view of a provider's response body, for the `log()` line
+ * that accompanies a collapsed provider failure (ADR 0023 §2).
+ *
+ * Keeps the description fields a human reads to work out what the vendor
+ * objected to, drops everything else — echoed request payloads, pagination
+ * blobs, nested account structures. `log()`'s own field sanitizer already
+ * redacts secret-NAMED keys, so this is not a credential guard; it is what keeps
+ * a withheld-detail line the size of a sentence instead of a page.
+ *
+ * Lifted out of `cli-http.ts` (its only caller until now) because the
+ * observability projection collapses the SAME provider errors on the write path
+ * and logged `provider.body` raw. Two log shapes for one fault made an Axiom
+ * query over withheld provider detail depend on which surface happened to catch
+ * it; there is one shape now.
+ */
+export declare function summarizeProviderBody(body: unknown): unknown;

package/node_modules/@oxygen/shared/dist/error-redaction.js

@@ -275,6 +275,34 @@ function describeCauseEntry(value) {
     }
     return { name: typeof value, code: null, message: truncate(String(value), MAX_CAUSE_MESSAGE_LENGTH) };
 }
+/**
+ * The operator-side view of a provider's response body, for the `log()` line
+ * that accompanies a collapsed provider failure (ADR 0023 §2).
+ *
+ * Keeps the description fields a human reads to work out what the vendor
+ * objected to, drops everything else — echoed request payloads, pagination
+ * blobs, nested account structures. `log()`'s own field sanitizer already
+ * redacts secret-NAMED keys, so this is not a credential guard; it is what keeps
+ * a withheld-detail line the size of a sentence instead of a page.
+ *
+ * Lifted out of `cli-http.ts` (its only caller until now) because the
+ * observability projection collapses the SAME provider errors on the write path
+ * and logged `provider.body` raw. Two log shapes for one fault made an Axiom
+ * query over withheld provider detail depend on which surface happened to catch
+ * it; there is one shape now.
+ */
+export function summarizeProviderBody(body) {
+    if (!isRecord(body))
+        return body;
+    const summary = {};
+    for (const key of ["code", "message", "error", "error_code", "filter_error", "type", "detail", "details", "text"]) {
+        const value = body[key];
+        if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+            summary[key] = value;
+        }
+    }
+    return Object.keys(summary).length > 0 ? summary : null;
+}
 function truncate(value, maxLength) {
     return value.length > maxLength ? `${value.slice(0, maxLength - 3)}...` : value;
 }

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -59,6 +59,7 @@ export * from "./dnc-identities.js";
 export * from "./table-limits.js";
 export * from "./table-capacity.js";
 export * from "./log.js";
+export * from "./log-collapse.js";
 export * from "./axiom-field-budget.js";
 export { redactSecretsInString, sanitizeLogFields } from "./redaction.js";
 export * from "./provider-request-outcomes.js";

package/node_modules/@oxygen/shared/dist/index.js

@@ -59,6 +59,7 @@ export * from "./dnc-identities.js";
 export * from "./table-limits.js";
 export * from "./table-capacity.js";
 export * from "./log.js";
+export * from "./log-collapse.js";
 export * from "./axiom-field-budget.js";
 // Narrow, deliberate export (ADR 0014): lets telemetry emitters regression-test
 // their field names against the REAL log sanitizer — the unanchored

package/node_modules/@oxygen/shared/dist/log-collapse.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Collapse a repeating log line to a decaying schedule WITHOUT losing the volume
+ * it absorbs.
+ *
+ * The shape is lifted from the BYOK would-block dedupe in
+ * `packages/providers/src/provider-fetch.ts`, where one organization on one
+ * provider produced 20,404 identical `provider.byok_daily_cap_would_block` lines
+ * in 48h — the single largest log-volume contributor in the 2026-08 sweep, and
+ * enough on its own to starve the Axiom shipper. Every hot path that logs a
+ * *condition* rather than an *event* has that failure mode, so the state machine
+ * lives here once instead of being re-derived per caller.
+ *
+ * What it is NOT: a sampler. A sampled line cannot answer "how many did this key
+ * really have", and the whole reason a flood is worth logging at all is the count.
+ * Two rules keep the accounting lossless:
+ *
+ * - every emitted line carries the window's running `occurrences` plus the
+ *   `suppressed` count it absorbed since the previous line, and
+ * - any window whose collapsed tail would otherwise die with its state — the
+ *   window rolled, or the entry was evicted — hands back a closing rollup so the
+ *   caller can emit one final line for it.
+ *
+ * KNOWN LIMITATION — there is no flush timer. A key stops being observed the
+ * moment its traffic stops, so its last collapsed tail is held until that key's
+ * next occurrence, a window roll, or an eviction retires it — and is lost
+ * entirely if the process exits first (Vercel functions freeze, Fly machines are
+ * replaced on deploy). That bounds the unreported remainder to one key's
+ * sub-schedule tail rather than a whole window, which is the trade this makes
+ * deliberately: a timer would keep a process-wide handle alive on serverless and
+ * would fire in a context with no request/log context to emit into. Callers that
+ * need the tail promptly should choose a shorter final delay, not add a timer
+ * here.
+ *
+ * FIELD SHAPE: the counts this returns are meant to ride in the `worker_fields`
+ * overflow map (they are deliberately NOT in AXIOM_STABLE_FIELDS) — `oxygen-logs`
+ * is at its column cap, and an allowlisted name with no column rejects the whole
+ * ingest batch. Query them as `['worker_fields']['occurrences']`, never flat.
+ *
+ * NOT a substitute for the log line: an OTel counter is not a backstop for
+ * collapsed volume. `registerOTel()` on web is called with no metric readers and
+ * the worker only builds one when AXIOM_METRICS_DATASET is set (it is not), so
+ * every recordTelemetryCounter call in this repo is a no-op today. If a signal
+ * matters it stays in the LOG — which is what `occurrences`/`suppressed` are for.
+ */
+/** Why a window's state was retired — carried on the closing rollup line. */
+export type LogCollapseRollupReason = "window_rolled" | "state_evicted";
+/** Counts for one live line, or null when this occurrence is collapsed. */
+export type LogCollapseEmit = {
+    /** Occurrences for this key in this window, emitted and suppressed alike. */
+    occurrences: number;
+    /** Occurrences collapsed into this line since the previous emitted one. */
+    suppressed: number;
+    /** Distinct labels behind the counts, sorted, capped at `maxLabels`. */
+    labels: string[];
+    /** True once an unseen label was dropped by that cap. */
+    labelsTruncated: boolean;
+    /** Window this line belongs to, as epoch ms — floor(now / windowMs) * windowMs. */
+    windowStartMs: number;
+};
+/** Closing totals for a window that will emit no further live line. */
+export type LogCollapseRollup = LogCollapseEmit & {
+    /** The `record()` key, so the caller can reconstruct its own dimensions. */
+    key: string;
+    /** Lines emitted for this key in this window before it was retired. */
+    emitted: number;
+    reason: LogCollapseRollupReason;
+};
+export type LogCollapseDecision = {
+    emit: LogCollapseEmit | null;
+    /** Windows retired by this call. Always log them — suppression must not vanish. */
+    rollups: LogCollapseRollup[];
+};
+export type LogCollapserOptions = {
+    /**
+     * Length of the counting window in ms. A key's line budget resets when the
+     * window rolls, and window boundaries are absolute (`floor(now / windowMs)`),
+     * so a caller whose underlying bucket uses the same `startOfWindow` arithmetic
+     * — e.g. a rate-limit window — rolls over together with it.
+     */
+    windowMs: number;
+    /**
+     * Delay from an emitted line to the next one the same key may emit, indexed by
+     * lines already emitted in this window. The LAST entry repeats forever, so
+     * `[5min, 30min, 1h]` means: immediately, +5min, +30min, then hourly. Front-load
+     * it so a newly-firing key is visible at once and again while a human is still
+     * looking, and decay it so a key that stays pinned all day costs tens of lines
+     * per process instead of tens of thousands. An empty schedule degrades to one
+     * line per key per window.
+     */
+    delaysMs: readonly number[];
+    /**
+     * Bound on live keys, so a pathological fan-out (many orgs x many providers)
+     * cannot grow the map without limit inside a long-lived worker process.
+     */
+    maxEntries: number;
+    /**
+     * Distinct labels tracked per key. Bounded because a label space (operations,
+     * error codes, routes) is open-ended, and this exists only to make the bias of
+     * any single-sample label field on the emitted line explicit.
+     */
+    maxLabels: number;
+};
+export type LogCollapser = {
+    /**
+     * Record one occurrence for `key` and decide what may be logged. `emit` carries
+     * the counts for a live line or is null when this occurrence is collapsed into a
+     * later one; `rollups` carries the closing totals of any window this call
+     * retired. The occurrence count is ALWAYS incremented, so a collapsed occurrence
+     * still surfaces in the next emitted line or in that window's rollup.
+     *
+     * Choose the key at the granularity of the CONDITION, not of the call: keying
+     * more finely than the thing being reported re-opens the flood for any caller
+     * that spreads its calls across the finer dimension. Encode whatever the caller
+     * must name on the rollup into the key with a separator its parts cannot contain
+     * (a NUL is the usual choice) — rollups hand the key back verbatim.
+     */
+    record: (key: string, label?: string) => LogCollapseDecision;
+    /** Test-only: lets a suite re-observe the leading-edge line of a window. */
+    reset: () => void;
+};
+export declare function createLogCollapser(options: LogCollapserOptions): LogCollapser;
+/**
+ * Claim the single log slot for `key` in the current window: true the first time,
+ * false for every repeat until the window rolls.
+ *
+ * The cheaper sibling of `createLogCollapser` and the right tool when the line
+ * reports a STATE TRANSITION rather than a rate — a budget threshold crossed, a
+ * connector going unhealthy, a floor being hit. Those lines answer "is this
+ * workspace in that state today", so a count adds nothing and a per-call emission
+ * is pure flood (the shape that has blinded this dataset before). When the count
+ * IS the point, use the collapser, which keeps `occurrences`/`suppressed`.
+ *
+ * Modelled on `claimThresholdLogSlot`
+ * (packages/integrations/src/budget-policy.ts), including its accepted trade: at
+ * the bound the set is cleared wholesale rather than evicted one by one, so a key
+ * that was already claimed can emit a second line in the same window. Bounded
+ * memory beats exactly-once for a line that is idempotent to re-read.
+ */
+export declare function claimOncePerWindow(key: string, windowMs?: number): boolean;
+/** Test-only: clear the per-process once-per-window claims between cases. */
+export declare function resetOncePerWindowClaims(): void;

package/node_modules/@oxygen/shared/dist/log-collapse.js

@@ -0,0 +1,242 @@
+/**
+ * Collapse a repeating log line to a decaying schedule WITHOUT losing the volume
+ * it absorbs.
+ *
+ * The shape is lifted from the BYOK would-block dedupe in
+ * `packages/providers/src/provider-fetch.ts`, where one organization on one
+ * provider produced 20,404 identical `provider.byok_daily_cap_would_block` lines
+ * in 48h — the single largest log-volume contributor in the 2026-08 sweep, and
+ * enough on its own to starve the Axiom shipper. Every hot path that logs a
+ * *condition* rather than an *event* has that failure mode, so the state machine
+ * lives here once instead of being re-derived per caller.
+ *
+ * What it is NOT: a sampler. A sampled line cannot answer "how many did this key
+ * really have", and the whole reason a flood is worth logging at all is the count.
+ * Two rules keep the accounting lossless:
+ *
+ * - every emitted line carries the window's running `occurrences` plus the
+ *   `suppressed` count it absorbed since the previous line, and
+ * - any window whose collapsed tail would otherwise die with its state — the
+ *   window rolled, or the entry was evicted — hands back a closing rollup so the
+ *   caller can emit one final line for it.
+ *
+ * KNOWN LIMITATION — there is no flush timer. A key stops being observed the
+ * moment its traffic stops, so its last collapsed tail is held until that key's
+ * next occurrence, a window roll, or an eviction retires it — and is lost
+ * entirely if the process exits first (Vercel functions freeze, Fly machines are
+ * replaced on deploy). That bounds the unreported remainder to one key's
+ * sub-schedule tail rather than a whole window, which is the trade this makes
+ * deliberately: a timer would keep a process-wide handle alive on serverless and
+ * would fire in a context with no request/log context to emit into. Callers that
+ * need the tail promptly should choose a shorter final delay, not add a timer
+ * here.
+ *
+ * FIELD SHAPE: the counts this returns are meant to ride in the `worker_fields`
+ * overflow map (they are deliberately NOT in AXIOM_STABLE_FIELDS) — `oxygen-logs`
+ * is at its column cap, and an allowlisted name with no column rejects the whole
+ * ingest batch. Query them as `['worker_fields']['occurrences']`, never flat.
+ *
+ * NOT a substitute for the log line: an OTel counter is not a backstop for
+ * collapsed volume. `registerOTel()` on web is called with no metric readers and
+ * the worker only builds one when AXIOM_METRICS_DATASET is set (it is not), so
+ * every recordTelemetryCounter call in this repo is a no-op today. If a signal
+ * matters it stays in the LOG — which is what `occurrences`/`suppressed` are for.
+ */
+export function createLogCollapser(options) {
+    const { windowMs, delaysMs, maxEntries, maxLabels } = options;
+    const states = new Map();
+    // Same arithmetic as the `startOfWindow` helpers in provider-rate-limits and the
+    // managed-spend limiter, so a collapser sharing a window with one of those
+    // buckets rolls at exactly the same instant.
+    function windowStartFor(nowMs) {
+        return Math.floor(nowMs / windowMs) * windowMs;
+    }
+    // An exhausted schedule repeats its last delay forever. With no schedule at all
+    // the key emits once and then waits out the window rather than emitting freely —
+    // the safe direction for a primitive whose entire job is to stop a flood.
+    function nextDelayMs(emitted) {
+        return delaysMs[emitted - 1] ?? delaysMs[delaysMs.length - 1] ?? windowMs;
+    }
+    function trackLabel(state, label) {
+        if (label === undefined || state.labels.has(label))
+            return;
+        if (state.labels.size >= maxLabels) {
+            state.labelsTruncated = true;
+            return;
+        }
+        state.labels.add(label);
+    }
+    /**
+     * Closing totals for a window being retired. Returns null when the last emitted
+     * line already carried the window's full occurrence count (`suppressed` back at
+     * 0), because then the rollup would only duplicate it.
+     */
+    function rollupFor(key, state, reason) {
+        if (state.suppressed === 0)
+            return null;
+        return {
+            key,
+            windowStartMs: state.windowStartMs,
+            occurrences: state.occurrences,
+            suppressed: state.suppressed,
+            emitted: state.emitted,
+            labels: [...state.labels].sort(),
+            labelsTruncated: state.labelsTruncated,
+            reason,
+        };
+    }
+    /**
+     * Make room for a key the map does NOT hold yet. Drops states whose window has
+     * already rolled first, then the least-recently-active one, and hands back the
+     * closing totals of everything it dropped so eviction can never silently swallow
+     * suppressed volume.
+     *
+     * Eviction is by last activity, not by insertion order: insertion order picks the
+     * key that started flooding EARLIEST — the heaviest offender — whose very next
+     * occurrence would re-insert and emit again, degrading the collapse back toward
+     * per-call emission.
+     */
+    function evict(nowMs) {
+        const rollups = [];
+        if (states.size < maxEntries)
+            return rollups;
+        for (const [key, state] of states) {
+            if (nowMs < state.windowStartMs + windowMs)
+                continue;
+            const rollup = rollupFor(key, state, "state_evicted");
+            if (rollup)
+                rollups.push(rollup);
+            states.delete(key);
+        }
+        while (states.size >= maxEntries) {
+            let lruKey;
+            let lruState;
+            for (const [key, state] of states) {
+                if (lruState && state.lastSeenMs >= lruState.lastSeenMs)
+                    continue;
+                lruKey = key;
+                lruState = state;
+            }
+            if (lruKey === undefined || lruState === undefined)
+                break;
+            const rollup = rollupFor(lruKey, lruState, "state_evicted");
+            if (rollup)
+                rollups.push(rollup);
+            states.delete(lruKey);
+        }
+        return rollups;
+    }
+    function freshState(label, windowStartMs, nowMs) {
+        return {
+            windowStartMs,
+            occurrences: 1,
+            suppressed: 0,
+            emitted: 1,
+            nextEmitAtMs: nowMs + nextDelayMs(1),
+            lastSeenMs: nowMs,
+            labels: label === undefined ? new Set() : new Set([label]),
+            labelsTruncated: false,
+        };
+    }
+    function leadingEdgeEmit(label, windowStartMs) {
+        return {
+            occurrences: 1,
+            suppressed: 0,
+            labels: label === undefined ? [] : [label],
+            labelsTruncated: false,
+            windowStartMs,
+        };
+    }
+    return {
+        record(key, label) {
+            const nowMs = Date.now();
+            const windowStartMs = windowStartFor(nowMs);
+            const existing = states.get(key);
+            // A rolled window starts a fresh line budget. The retired window's collapsed
+            // tail (up to a full final-delay's worth of occurrences) is reported as a
+            // rollup instead of being overwritten by the fresh state.
+            if (existing && existing.windowStartMs !== windowStartMs) {
+                const rollup = rollupFor(key, existing, "window_rolled");
+                states.set(key, freshState(label, windowStartMs, nowMs));
+                return {
+                    emit: leadingEdgeEmit(label, windowStartMs),
+                    rollups: rollup ? [rollup] : [],
+                };
+            }
+            // A key the map does not hold yet is the only case that grows the map, so a
+            // key that already exists never costs an unrelated live key its state.
+            if (!existing) {
+                const rollups = evict(nowMs);
+                states.set(key, freshState(label, windowStartMs, nowMs));
+                return { emit: leadingEdgeEmit(label, windowStartMs), rollups };
+            }
+            existing.occurrences += 1;
+            existing.lastSeenMs = nowMs;
+            trackLabel(existing, label);
+            if (nowMs < existing.nextEmitAtMs) {
+                existing.suppressed += 1;
+                return { emit: null, rollups: [] };
+            }
+            const suppressed = existing.suppressed;
+            existing.suppressed = 0;
+            existing.emitted += 1;
+            existing.nextEmitAtMs = nowMs + nextDelayMs(existing.emitted);
+            return {
+                emit: {
+                    occurrences: existing.occurrences,
+                    suppressed,
+                    labels: [...existing.labels].sort(),
+                    labelsTruncated: existing.labelsTruncated,
+                    windowStartMs,
+                },
+                rollups: [],
+            };
+        },
+        reset() {
+            states.clear();
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Once-per-key-per-window claims
+// ---------------------------------------------------------------------------
+/** One day. The window a state-transition line almost always wants. */
+const DEFAULT_CLAIM_WINDOW_MS = 24 * 60 * 60_000;
+/**
+ * Bounded because the slot key embeds a window that rolls: without the cap a
+ * long-lived worker process accumulates one entry per key per window forever.
+ */
+const CLAIM_SLOTS_MAX = 5_000;
+const claimedSlots = new Set();
+/**
+ * Claim the single log slot for `key` in the current window: true the first time,
+ * false for every repeat until the window rolls.
+ *
+ * The cheaper sibling of `createLogCollapser` and the right tool when the line
+ * reports a STATE TRANSITION rather than a rate — a budget threshold crossed, a
+ * connector going unhealthy, a floor being hit. Those lines answer "is this
+ * workspace in that state today", so a count adds nothing and a per-call emission
+ * is pure flood (the shape that has blinded this dataset before). When the count
+ * IS the point, use the collapser, which keeps `occurrences`/`suppressed`.
+ *
+ * Modelled on `claimThresholdLogSlot`
+ * (packages/integrations/src/budget-policy.ts), including its accepted trade: at
+ * the bound the set is cleared wholesale rather than evicted one by one, so a key
+ * that was already claimed can emit a second line in the same window. Bounded
+ * memory beats exactly-once for a line that is idempotent to re-read.
+ */
+export function claimOncePerWindow(key, windowMs = DEFAULT_CLAIM_WINDOW_MS) {
+    // NUL separator: it cannot appear in a slug, a UUID, or a decimal window index,
+    // so no two distinct (key, window) pairs can collide into one slot.
+    const slot = `${key}\u0000${Math.floor(Date.now() / windowMs)}`;
+    if (claimedSlots.has(slot))
+        return false;
+    if (claimedSlots.size >= CLAIM_SLOTS_MAX)
+        claimedSlots.clear();
+    claimedSlots.add(slot);
+    return true;
+}
+/** Test-only: clear the per-process once-per-window claims between cases. */
+export function resetOncePerWindowClaims() {
+    claimedSlots.clear();
+}

package/node_modules/@oxygen/shared/dist/log.d.ts

@@ -16,6 +16,7 @@ export type LogContext = {
 };
 export declare function withLogContext<T>(ctx: LogContext, fn: () => T): T;
 export declare function enterLogContext(ctx: LogContext): void;
+export declare function logLevelForHttpStatus(status: number): LogLevel;
 export type LogSink = (record: Record<string, unknown>) => void;
 export declare function setLogSink(sink: LogSink | null): void;
 export declare function log(level: LogLevel, msg: string, fields?: Record<string, unknown>): void;

package/node_modules/@oxygen/shared/dist/log.js

@@ -57,6 +57,54 @@ function reserveSurfaceDimension(merged, ctx) {
         surface: ctx.surface,
     };
 }
+// `org_id` is the dimension every org-bucketed monitor, dashboard, and cost query
+// groups on — but `organization_id` is an allowlisted, live column too, and a call
+// site stamps whichever of the two names it learned from its neighbours. Nothing
+// resolves the pair, so the choice is per-call-site and total: measured over 2 days
+// the org_id presence of a given `msg` is either 0% or 100%, never in between,
+// because it is hand-stamped rather than ambient.
+//
+// The consequence is that the biggest "org-less" lines are not org-less at all —
+// they stamp the OTHER name, and every dashboard filtering `org_id` silently misses
+// them: provider.byok_daily_cap_would_block 37,702 rows at 100% organization_id /
+// 0% org_id, credit_commitment_reconcile.billing_owner_unresolved 35,185,
+// ai_column.web_grounding.provider_error 2,351, email_inbox_mirror.row_failed 1,536,
+// managed_ai.timing 1,466, whatsapp.quota_denied 1,392, linkedin.quota_denied 835 —
+// ~80k rows per 2 days.
+//
+// So `organization_id` MIRRORS into `org_id`. Fill only: an org_id already stamped
+// by the call site or inherited from the ambient context wins (it is the narrower,
+// deliberate value), and `organization_id` is never deleted — existing queries and
+// monitors reading it keep working. Both names are already in AXIOM_STABLE_FIELDS
+// with live columns, so this adds ZERO new field names; an allowlisted name without
+// a column rejects the entire ingest batch (the Aug 2026 six-day blackout).
+function reserveOrgDimension(merged) {
+    const orgId = merged.org_id;
+    // Only genuinely absent/empty counts as fillable. Any other existing value —
+    // including a non-string one — is left exactly as the caller wrote it, so this
+    // can never rewrite a dimension somebody set on purpose.
+    if (!(orgId === undefined || orgId === null || orgId === ""))
+        return merged;
+    const organizationId = merged.organization_id;
+    if (typeof organizationId !== "string" || organizationId.length === 0)
+        return merged;
+    return { ...merged, org_id: organizationId };
+}
+// Canonical severity for an HTTP status that is being logged. 4xx outcomes are
+// expected client conditions and a 503 is a known-degraded/retryable state (a tenant
+// mid-migration, a provider backing off), not a server fault — so they log as warn
+// noise, and only genuine unexpected failures reach the error stream that monitors
+// page on (OXY-78).
+//
+// Lifted verbatim from `tableRouteLogLevelForStatus`
+// (apps/web/src/lib/tables/route-error-response.ts), which shaped this rule for the
+// table read routes. It lives here so every surface that maps a status to a level
+// agrees on the 503 carve-out instead of re-deriving it — divergence is how
+// `tables.views.list.failed` logged a mid-migration tenant at error while its /rows
+// and /activity siblings logged the same tenant at warn.
+export function logLevelForHttpStatus(status) {
+    return status >= 500 && status !== 503 ? "error" : "warn";
+}
 // The sink registration must live on globalThis, not in a module-local variable:
 // Next.js compiles instrumentation.ts and each route handler into separate
 // bundles, each with its OWN instance of this module. A module-local set by the
@@ -118,7 +166,7 @@ export function log(level, msg, fields) {
         sha: process.env.VERCEL_GIT_COMMIT_SHA ?? process.env.OXYGEN_GIT_SHA ?? null,
         region: process.env.VERCEL_REGION ?? null,
         env: process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? null,
-        ...sanitizeLogFields(reserveSurfaceDimension({ ...context, ...fields }, context)),
+        ...sanitizeLogFields(reserveOrgDimension(reserveSurfaceDimension({ ...context, ...fields }, context))),
     };
     const line = JSON.stringify(record);
     if (level === "error") {

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,4 +1,4 @@
-export declare const OXYGEN_VERSION = "1.800.1";
+export declare const OXYGEN_VERSION = "1.804.2";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";
 export declare const SUPPORT_AGENT_REPLY_MINIMUM_CLI_VERSION = "1.747.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.800.1";
+export const OXYGEN_VERSION = "1.804.2";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.800.1",
+  "version": "1.804.2",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",