@vxil/cli 0.24.2 → 0.25.0

package/dist/vxil-main.js

@@ -3182,7 +3182,8 @@ var API_STATE_DATUMS = [
   { feature: "rate-limits", datum: "policies" },
   { feature: "webhooks", datum: "subscriptions" },
   { feature: "ai", datum: "templates" },
-  { feature: "orgs", datum: "roles" }
+  { feature: "orgs", datum: "roles" },
+  { feature: "vector-search", datum: "collections" }
 ];
 function apiStateDatumOf(feature) {
   return API_STATE_DATUMS.find((d) => d.feature === feature)?.datum ?? null;
@@ -3311,6 +3312,81 @@ function planOrgRoles(declared, live) {
   for (const l of live) if (!declaredKeys.has(l.role_key)) plan.undeclared.push(l.role_key);
   return plan;
 }
+var KEYED_PROVIDERS = /* @__PURE__ */ new Set(["openai", "cohere"]);
+function planSearchCollections(declared, live) {
+  const plan = { create: [], update: [], unchanged: [], immutable: [], refused: [], undeclared: [] };
+  const byName = new Map(live.map((l) => [l.collection, l]));
+  const declaredNames = new Set(declared.map((d) => d.collection));
+  for (const d of declared) {
+    const l = byName.get(d.collection);
+    if (!l) {
+      plan.create.push({
+        collection: d.collection,
+        ...d.dimensions !== void 0 ? { dimensions: d.dimensions } : {},
+        ...d.embed && Object.keys(d.embed).length ? { embed: { ...d.embed } } : {}
+      });
+      continue;
+    }
+    if (d.dimensions !== void 0 && d.dimensions !== l.dimensions) {
+      plan.immutable.push({ collection: d.collection, declared: d.dimensions, live: l.dimensions });
+      continue;
+    }
+    const e = d.embed ?? {};
+    const changed = [];
+    const providerChanged = e.provider !== void 0 && e.provider !== (l.provider ?? null);
+    if (providerChanged) changed.push("provider");
+    if (e.model !== void 0 && l.model !== void 0 && e.model !== (l.model ?? null)) changed.push("model");
+    if (e.apiKeyRef !== void 0 && l.api_key_ref !== void 0 && e.apiKeyRef !== (l.api_key_ref ?? null)) changed.push("apiKeyRef");
+    if (!changed.length) {
+      plan.unchanged.push(d.collection);
+      continue;
+    }
+    let embed;
+    if (providerChanged) {
+      const missing = KEYED_PROVIDERS.has(e.provider) ? ["model", "apiKeyRef"].filter((k) => e[k] === void 0) : [];
+      if (missing.length) {
+        plan.refused.push({
+          collection: d.collection,
+          error: `provider change to ${e.provider} must also declare embed.${missing.join(" and embed.")} \u2014 the live ${l.provider ?? "default"} settings are never carried over to a new provider (and the new model must output the collection's ${l.dimensions} dimensions)`
+        });
+        continue;
+      }
+      embed = { ...e };
+    } else {
+      const provider = e.provider ?? l.provider ?? void 0;
+      const model = e.model ?? l.model ?? void 0;
+      const apiKeyRef = e.apiKeyRef ?? l.api_key_ref ?? void 0;
+      embed = { ...provider ? { provider } : {}, ...model ? { model } : {}, ...apiKeyRef ? { apiKeyRef } : {} };
+    }
+    const reembed = (changed.includes("provider") || changed.includes("model")) && (l.documents ?? 1) > 0;
+    plan.update.push({ body: { collection: d.collection, dimensions: l.dimensions, embed }, changed, reembed });
+  }
+  for (const l of live) if (!declaredNames.has(l.collection)) plan.undeclared.push(l.collection);
+  return plan;
+}
+function searchCollectionImmutableError(i) {
+  return `422 dimensions_immutable: declared dimensions ${i.declared} but the live collection has ${i.live} \u2014 dimensions are immutable; declare a new collection name and re-ingest`;
+}
+function pulledSearchCollections(rows) {
+  if (rows.length > SEARCH_COLLECTION_PULL_CAP) {
+    return { note: `  vector-search.collections: the tenant has ${rows.length} search collections, past the ${SEARCH_COLLECTION_PULL_CAP}-entry cap of a declared collections[] \u2014 not written; they stay live rows` };
+  }
+  return {
+    collections: rows.map((r) => {
+      const embed = {};
+      if (typeof r.provider === "string") embed.provider = r.provider;
+      if (typeof r.model === "string") embed.model = r.model;
+      if (typeof r.api_key_ref === "string") embed.apiKeyRef = r.api_key_ref;
+      return {
+        collection: String(r.collection),
+        // the server only ever stores an allowed width
+        ...typeof r.dimensions === "number" ? { dimensions: r.dimensions } : {},
+        ...Object.keys(embed).length ? { embed } : {}
+      };
+    })
+  };
+}
+var SEARCH_COLLECTION_PULL_CAP = 50;
 function emptyApiStateSummary(datum) {
   return {
     datum,
@@ -3355,7 +3431,9 @@ function formatApiStateDetail(s) {
   for (const k of s.updated) lines.push(`  ~ ${k}`);
   for (const k of s.recreated) lines.push(`  \u21BB ${k} (recreated \u2014 new id)`);
   for (const k of s.deleted) lines.push(`  - ${k} (deleted: undeclared, --allow-destructive)`);
-  for (const k of s.undeclared) lines.push(`  \xB7 ${k} \u2014 live but not declared (left in place; --allow-destructive deletes it)`);
+  for (const k of s.undeclared) {
+    lines.push(s.datum === "collections" ? `  \xB7 ${k} \u2014 live but not declared (left in place; a push never deletes a search collection)` : `  \xB7 ${k} \u2014 live but not declared (left in place; --allow-destructive deletes it)`);
+  }
   for (const k of s.pending_destructive) lines.push(`  ! ${k} \u2014 needs delete+recreate (new id); re-run with --allow-destructive`);
   for (const k of s.ambiguous) lines.push(`  ! ${k} \u2014 more than one live row carries this name; delete the extras first`);
   for (const f of s.failed) lines.push(`  \u2717 ${f.key} \u2014 ${f.error}`);
@@ -3369,6 +3447,9 @@ var PUBLIC_ASSET_TYPES = {
   webp: "image/webp",
   avif: "image/avif",
   gif: "image/gif",
+  // Favicons. A raster container (BMP/PNG frames) — no
+  // script, rendered only as an image; never a variant source.
+  ico: "image/x-icon",
   mp4: "video/mp4",
   webm: "video/webm",
   mp3: "audio/mpeg",
@@ -3382,6 +3463,7 @@ var TYPE_TO_EXT = {
   ...Object.fromEntries(Object.entries(PUBLIC_ASSET_TYPES).map(([ext, ct]) => [ct, ext])),
   "image/jpg": "jpg",
   "image/pjpeg": "jpg",
+  "image/vnd.microsoft.icon": "ico",
   "audio/mp3": "mp3",
   "audio/x-m4a": "m4a",
   "audio/m4a": "m4a",
@@ -3917,7 +3999,17 @@ var AuthConfigSchema = Type.Object({
   // OPTIONAL bag = 1 leaf. Lives in AUTH config (not orgs) because auth-v1's
   // CONFIG_KV is the auth namespace and cannot see orgs config.
   orgClaims: Type.Optional(Type.Object({
-    enabled: Type.Boolean({ default: false })
+    enabled: Type.Boolean({ default: false }),
+    // ACTIVE-ORG mode. Every mint/refresh stamps the session claim
+    // `oam: 1`, the session row stores the org it acts in (active_org_id: the
+    // most-recent membership at first mint, or the org picked by
+    // POST /v1/auth/sessions/refresh { org_id }), a refresh never falls back to
+    // another org, the org role is no longer folded into `roles`, membership
+    // changes mark live sessions `claims_stale`, and orgs membership writes are
+    // server-only for end users. Needs `enabled`. Optional WITHOUT a default
+    // (absent = off) so existing manifests fold byte-identically; inside the
+    // existing bag, so no new config leaf.
+    activeOrg: Type.Optional(Type.Boolean())
   })),
   // Note: the earlier `redirects` block was DROPPED entirely —
   // it had zero consumers (grep-verified: no worker reads config.redirects) and
@@ -3935,8 +4027,9 @@ var AuthConfigSchema = Type.Object({
   //     chars leave the worker, never the password) at sign-up / reset-confirm;
   //     fail-OPEN on network error → 422 password_breached.
   //   • captchaSecretRef — a secret-store ref (feature 'auth') holding the
-  //     Turnstile secret; when set, sign-up / OTP request / magic-link request
-  //     require `captcha_token` (403 captcha_failed otherwise).
+  //     Turnstile secret; when set, sign-up / OTP request / magic-link request /
+  //     email-verification request / password-reset request require
+  //     `captcha_token` (403 captcha_failed otherwise).
   //   • allowedRedirectOrigins — when non-empty, EVERY caller-supplied
   //     redirect/return URL (magic link, password reset, email verification,
   //     OAuth start) must match one origin exactly → 422 redirect_not_allowed.
@@ -3971,6 +4064,14 @@ var AuthConfigSchema = Type.Object({
     // account is never affected. The generic OIDC issuer keeps its own gate
     // (providers.oidc.allowedDomains + IdP assignment). auth-v1 signupGate.ts.
     inviteOnly: Type.Optional(Type.Boolean()),
+    // Squatted-address defence (guide ch. 9): a verify-link confirm with NO
+    // matching session proves the mailbox only. With verifyLinkEvicts:true it
+    // runs the eviction guard (clears a never-verified row's password, revokes
+    // its sessions, drops its provider links — the squatter defence); absent /
+    // false keeps the password, so a genuine sign-up who opens the link in a
+    // mail-app browser (or an SDK that sends no session_token) is not locked
+    // out. Optional, NO default: every existing manifest folds byte-identically.
+    verifyLinkEvicts: Type.Optional(Type.Boolean()),
     allowedEmailDomains: Type.Optional(Type.Array(
       Type.String({ minLength: 3, maxLength: 253, pattern: "^[a-z0-9][a-z0-9.-]*\\.[a-z]{2,}$" }),
       { maxItems: 32 }
@@ -4306,7 +4407,10 @@ var DeclaredOrgRoleSchema = Type.Object({
 });
 var OrgsConfigSchema = Type.Object({
   enabled: Type.Boolean({ default: true }),
-  maxOrgsPerTenant: Type.Integer({ default: 100, minimum: 1, maximum: 1e4 }),
+  // Org cap: max 100,000 (was 10,000); the default stays 100 so
+  // existing manifests fold byte-identically. The unpaged GET /v1/orgs page is
+  // clamped at 10,000 (orgs-v1 parseOrgsPage), so no response grows.
+  maxOrgsPerTenant: Type.Integer({ default: 100, minimum: 1, maximum: 1e5 }),
   maxMembersPerOrg: Type.Integer({ default: 1e3, minimum: 1, maximum: 1e5 }),
   invitationTtlHours: Type.Integer({ default: 168, minimum: 1, maximum: 720 }),
   // Declared API state (G-31): the tenant's CUSTOM role catalog. Converged by
@@ -4387,6 +4491,22 @@ var ActivityFeedConfigSchema = Type.Object({
   // per-tenant request meter are the real bounds). Re-declare it together with
   // the binding that enforces it.
 });
+var SEARCH_COLLECTION_DECLARED_CAP = 50;
+var SEARCH_COLLECTION_DIMS = [256, 384, 512, 768, 1024, 1536, 3072];
+var DeclaredSearchCollectionSchema = Type.Object({
+  collection: Type.String({ pattern: "^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$" }),
+  dimensions: Type.Optional(Type.Union(SEARCH_COLLECTION_DIMS.map((d) => Type.Literal(d)))),
+  embed: Type.Optional(Type.Object({
+    provider: Type.Optional(Type.Union([
+      Type.Literal("byov"),
+      Type.Literal("mock"),
+      Type.Literal("openai"),
+      Type.Literal("cohere")
+    ])),
+    model: Type.Optional(Type.String({ maxLength: 128 })),
+    apiKeyRef: Type.Optional(Type.String({ maxLength: 128 }))
+  }))
+});
 var VectorSearchConfigSchema = Type.Object({
   enabled: Type.Boolean({ default: true }),
   // 'auto' resolves to the default managed vector backend for the tier.
@@ -4474,7 +4594,14 @@ var VectorSearchConfigSchema = Type.Object({
       }),
       { maxItems: 8 }
     )
-  )
+  ),
+  // Declared API state: the tenant's search
+  // collections, converged by `collection` name by `vxil push` / POST
+  // /v1/apply (control-plane handlers/apiState.ts) through POST
+  // /v1/search/collections. Undeclared live collections are left and
+  // reported — there is no collection delete route, so never deleted.
+  // Absent = not managed by config. ARRAY = ONE leaf.
+  collections: Type.Optional(Type.Array(DeclaredSearchCollectionSchema, { maxItems: SEARCH_COLLECTION_DECLARED_CAP }))
 });
 var AI_TEMPLATE_NAME_PATTERN = "^[a-zA-Z0-9_.\\-]+$";
 var AI_MAX_DECLARED_TEMPLATES = 50;
@@ -4854,6 +4981,26 @@ var FunctionsConfigSchema = Type.Object({
     { enabled: Type.Boolean({ default: false }) },
     { default: {} }
   ),
+  // FN-LOG-DRAIN (2026-10-12): forward this project's function log lines, in
+  // signed batches, to the tenant's own https endpoint (functions-tail →
+  // LogDrainDO). ONE optional leaf. The ONLY member of this deploy-managed
+  // manifest a config PUT may change (handlers/functionsLogDrain.ts) — `vxil
+  // push` carries it from `features.functions.logDrain`. `dailyLines` is
+  // SERVER-SET from the plan at write time (LOG_DRAIN_LINES_PER_DAY_BY_TIER);
+  // an authored value is overwritten. `secretRef` names a functions secret
+  // (`vxil secrets set functions/<name>`), the HMAC key of the signature.
+  logDrain: Type.Optional(Type.Object({
+    url: Type.String({ minLength: 9, maxLength: 2048 }),
+    secretRef: Type.String({ pattern: "^[a-z0-9_]{1,64}$" }),
+    minLevel: Type.Optional(Type.Union([
+      Type.Literal("debug"),
+      Type.Literal("info"),
+      Type.Literal("log"),
+      Type.Literal("warn"),
+      Type.Literal("error")
+    ])),
+    dailyLines: Type.Optional(Type.Integer({ minimum: 0 }))
+  })),
   // ONE Type.Record leaf — the per-function object is DATA, not flags.
   functions: Type.Optional(
     Type.Record(
@@ -5103,6 +5250,138 @@ var FEATURE_KEYS = [
   "functions",
   "copilot"
 ];
+var CMS_RETAIN_DAYS_MAX = 3650;
+function isDeclaredRetainDays(v) {
+  return v === void 0 || v === null || typeof v === "number" && Number.isInteger(v) && v >= 1 && v <= CMS_RETAIN_DAYS_MAX;
+}
+function retainDaysShortens(declared, remote) {
+  if (declared === null) return false;
+  return remote === null || declared < remote;
+}
+
+// ../config/src/index.ts
+var CMS_ROLE_SLUG_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+var CMS_ORG_READ_ROLES_MAX = 16;
+var ORG_FIELD_SLOTS = /* @__PURE__ */ new Set(["s1", "s2", "s3", "s4"]);
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function declaredOrgField(def) {
+  if (!isObj(def)) return null;
+  const v = def.orgField ?? def.org_field;
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function workspaceCollectionErrors(name, def) {
+  if (!isObj(def)) return [];
+  const errs = [];
+  const at = `cms.collections.${name}`;
+  const camel2 = def.orgField;
+  const snake = def.org_field;
+  if (camel2 !== void 0 && snake !== void 0 && camel2 !== snake) {
+    errs.push(`${at} sets orgField and org_field to different values \u2014 send one`);
+  }
+  const rawOrg = camel2 ?? snake;
+  let orgField = null;
+  if (rawOrg !== void 0 && rawOrg !== null) {
+    if (typeof rawOrg !== "string" || rawOrg.length === 0) {
+      errs.push(`${at}.orgField must be a field name (got ${JSON.stringify(rawOrg)})`);
+    } else {
+      orgField = rawOrg;
+      const f = isObj(def.fields) ? def.fields[rawOrg] : void 0;
+      if (!isObj(f)) {
+        errs.push(`${at}.orgField '${rawOrg}' names no declared field`);
+      } else {
+        if (f.type !== "string") {
+          errs.push(`${at}.orgField '${rawOrg}' must be a string field (is ${JSON.stringify(f.type)})`);
+        }
+        const slot = f.indexSlot ?? f.index_slot;
+        if (typeof slot !== "string" || !ORG_FIELD_SLOTS.has(slot)) {
+          errs.push(`${at}.orgField '${rawOrg}' needs an indexSlot in s1\u2013s4 (every end-user read filters on it)`);
+        }
+      }
+    }
+  }
+  const owner = def.ownerField ?? def.owner_field;
+  if (orgField !== null && owner === orgField) {
+    errs.push(`${at}.orgField and ownerField must name different fields (both are '${orgField}')`);
+  }
+  const rrCamel = def.orgReadRoles;
+  const rrSnake = def.org_read_roles;
+  if (rrCamel !== void 0 && rrSnake !== void 0 && JSON.stringify(rrCamel) !== JSON.stringify(rrSnake)) {
+    errs.push(`${at} sets orgReadRoles and org_read_roles to different values \u2014 send one`);
+  }
+  const rr = rrCamel ?? rrSnake;
+  if (rr !== void 0 && rr !== null) {
+    if (!Array.isArray(rr) || rr.some((r) => typeof r !== "string" || !CMS_ROLE_SLUG_RE.test(r))) {
+      errs.push(`${at}.orgReadRoles must be an array of role slugs matching ${CMS_ROLE_SLUG_RE} (got ${JSON.stringify(rr)})`);
+    } else if (rr.length > CMS_ORG_READ_ROLES_MAX) {
+      errs.push(`${at}.orgReadRoles has ${rr.length} entries \u2014 at most ${CMS_ORG_READ_ROLES_MAX}`);
+    } else if (rr.length > 0 && orgField === null) {
+      errs.push(`${at}.orgReadRoles needs orgField (it gates reads of a workspace-scoped collection)`);
+    }
+  }
+  return errs;
+}
+var asList = (v) => Array.isArray(v) ? v : v === void 0 || v === null ? [] : [v];
+var stringsOf = (v) => asList(v).filter((s) => typeof s === "string");
+function workspaceManifestErrors(config, opts = {}) {
+  const errs = [];
+  const rawCollections = config.cms?.collections;
+  const collections = isObj(rawCollections) ? rawCollections : {};
+  const orgCols = /* @__PURE__ */ new Map();
+  for (const [name, def] of Object.entries(collections)) {
+    const of = declaredOrgField(def);
+    if (of) orgCols.set(name, of);
+  }
+  if (orgCols.size === 0) return errs;
+  const features = isObj(config.features) ? config.features : {};
+  const names = [...orgCols.keys()].join(", ");
+  const auth = isObj(features.auth) ? features.auth : {};
+  const oc = isObj(auth.orgClaims) ? auth.orgClaims : {};
+  if (opts.checkAuth !== false && (oc.enabled !== true || oc.activeOrg !== true)) {
+    errs.push(`cms.collections ${names} set orgField, which needs features.auth.orgClaims { enabled: true, activeOrg: true } \u2014 without an active org the session carries no stable workspace`);
+  }
+  const cms = isObj(features.cms) ? features.cms : {};
+  for (const [rule, r] of Object.entries(isObj(cms.cdc) ? cms.cdc : {})) {
+    if (isObj(r) && typeof r.collection === "string" && orgCols.has(r.collection)) {
+      errs.push(`features.cms.cdc.${rule}: collection '${r.collection}' is workspace-scoped (orgField) \u2014 a cdc channel is not access control, so it is refused until org channels ship (Phase 2); fan out from a function with per-workspace channel names meanwhile`);
+    }
+  }
+  const vs = isObj(features["vector-search"]) ? features["vector-search"] : {};
+  asList(vs.sync).forEach((s, i) => {
+    if (isObj(s) && typeof s.cmsCollection === "string" && orgCols.has(s.cmsCollection)) {
+      errs.push(`features.vector-search.sync[${i}]: cmsCollection '${s.cmsCollection}' is workspace-scoped (orgField) \u2014 workspace-scoped sync arrives with orgScoped (Phase 2); search through a function meanwhile`);
+    }
+  });
+  for (const [rmName, rm] of Object.entries(isObj(cms.readModels) ? cms.readModels : {})) {
+    if (!isObj(rm) || typeof rm.collection !== "string") continue;
+    const srcOrg = orgCols.get(rm.collection);
+    const to = isObj(rm.materialize) ? rm.materialize.to : void 0;
+    if (!srcOrg || typeof to !== "string") continue;
+    const tOrg = orgCols.get(to);
+    const spec = isObj(rm.spec) ? rm.spec : {};
+    const groups = [...stringsOf(spec.groupBy), ...stringsOf(spec.partitionBy)];
+    if (tOrg !== srcOrg || !groups.includes(srcOrg)) {
+      errs.push(`features.cms.readModels.${rmName}: materializes workspace-scoped '${rm.collection}' into '${to}' \u2014 the target must be an orgField collection with orgField '${srcOrg}' and the read model must group by '${srcOrg}', or one workspace's rollup rows land where every end user can read them`);
+    }
+  }
+  const orgs = isObj(features.orgs) ? features.orgs : {};
+  const longRoles = new Set(asList(orgs.roles).map((r) => isObj(r) ? r.role_key : void 0).filter((k) => typeof k === "string" && k.length > 32));
+  for (const [name] of orgCols) {
+    const def = collections[name];
+    const gate = /* @__PURE__ */ new Set([
+      ...stringsOf(def.orgReadRoles ?? def.org_read_roles),
+      ...stringsOf(def.writeRoles ?? def.write_roles)
+    ]);
+    for (const f of Object.values(isObj(def.fields) ? def.fields : {})) {
+      if (isObj(f)) for (const r of stringsOf(f.readRoles ?? f.read_roles)) gate.add(r);
+    }
+    for (const r of gate) {
+      if (r.length > 32 || longRoles.has(r)) {
+        errs.push(`cms.collections.${name}: gate role '${r}' is longer than 32 characters \u2014 an orgs role named in a cms gate must be 32 characters or fewer (longer keys stay legal in orgs)`);
+      }
+    }
+  }
+  return errs;
+}
 
 // src/lib.ts
 var MAX_FN_BINDINGS = 8;
@@ -5169,9 +5448,9 @@ function lowerAllTriggerBindings(def, name) {
   return bindings;
 }
 var CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-var VXIL_CONFIG_PKG_VERSION = "0.17.0";
-var VXIL_SDK_PKG_VERSION = "0.24.1";
-var VXIL_CLI_PKG_VERSION = "0.24.2";
+var VXIL_CONFIG_PKG_VERSION = "0.18.0";
+var VXIL_SDK_PKG_VERSION = "0.25.0";
+var VXIL_CLI_PKG_VERSION = "0.25.0";
 function ensureScaffoldPackageJson(cwd, opts = {}) {
   const file = resolve(cwd, "package.json");
   const wanted = {
@@ -5335,6 +5614,8 @@ async function loadVxilConfig(cwd = process.cwd()) {
     throw new Error(`${found}: \`features\` must be an object`);
   }
   if (typeof cfg.apiVersion === "string") loadedConfigApiVersion = cfg.apiVersion;
+  const wsErrs = workspaceManifestErrors(cfg);
+  if (wsErrs.length) throw new Error(`${found}: ${wsErrs.join("; ")}`);
   return cfg;
 }
 function diffManifest(prev, next, prefix = "") {
@@ -5353,6 +5634,19 @@ function diffManifest(prev, next, prefix = "") {
   }
   return out;
 }
+var ACTIVE_ORG_MIN_SDK = "0.25.0";
+function activeOrgEnableWarning(feature, changes) {
+  if (feature !== "auth") return null;
+  const target = ["orgClaims", "activeOrg"];
+  const at = (v, rest2) => rest2.reduce((o, k) => o && typeof o === "object" && !Array.isArray(o) ? o[k] : void 0, v);
+  const turnsOn = changes.some((c) => {
+    const segs = c.path === "" ? [] : c.path.split(".");
+    if (segs.length > target.length || segs.some((k, i) => k !== target[i])) return false;
+    const rest2 = target.slice(segs.length);
+    return at(c.to, rest2) === true && at(c.from, rest2) !== true;
+  });
+  return turnsOn ? `auth orgClaims.activeOrg turns on: apps must use @vxil/sdk ${ACTIVE_ORG_MIN_SDK} or later \u2014 older SDKs do not recover from 401 session_stale after an org membership or role change (see guide 06, orgs)` : null;
+}
 function formatDiff(changes) {
   if (!changes.length) return "  (no changes)";
   return changes.map(({ path, from, to }) => {
@@ -5415,7 +5709,6 @@ async function mapPool(items, limit, fn) {
 }
 function assembleApplyBundle(cfg, fnSources) {
   const { functions: _fnFeature, ...configFeatures } = cfg.features;
-  void _fnFeature;
   const functions = Object.entries(cfg.functions ?? {}).map(([name, def]) => {
     const source = fnSources[name];
     if (source === void 0) throw new Error(`functions: no bundled source for '${name}'`);
@@ -5434,8 +5727,11 @@ function assembleApplyBundle(cfg, fnSources) {
       ...limits ? { limits } : {}
     };
   });
+  const fnFeature = _fnFeature;
+  const features = { ...configFeatures };
+  if (fnFeature && typeof fnFeature === "object") features.functions = { logDrain: fnFeature.logDrain ?? null };
   return {
-    ...Object.keys(configFeatures).length ? { features: configFeatures } : {},
+    ...Object.keys(features).length ? { features } : {},
     ...cfg.cms?.collections && Object.keys(cfg.cms.collections).length ? { cms: { collections: cfg.cms.collections } } : {},
     ...functions.length ? { functions } : {}
   };
@@ -5593,6 +5889,40 @@ async function planOrPush({ api, features, apply, allowDestructive }) {
   }
   return results;
 }
+function sameLogDrain(want, have) {
+  const norm = (d) => {
+    if (!d || typeof d !== "object") return null;
+    const o = d;
+    return JSON.stringify([o.url, String(o.secretRef ?? "").replace(/^secret:/, ""), o.minLevel ?? "warn"]);
+  };
+  return norm(want) === norm(have);
+}
+async function planOrPushLogDrain({ api, fnFeature, apply }) {
+  if (!fnFeature || typeof fnFeature !== "object") return null;
+  const to = fnFeature.logDrain ?? null;
+  const cur = await api("GET", "/v1/config/functions");
+  const unavailable = readUnavailable("GET /v1/config/functions", cur);
+  if (unavailable) {
+    if (apply) {
+      throw new Error(`functions.logDrain: cannot read ${unavailable.route} (${unavailable.code ?? unavailable.status}) \u2014 refusing to push against a remote it could not read`);
+    }
+    return { version: 0, from: null, to, changed: false, applied: null, remoteUnavailable: unavailable };
+  }
+  const exists = cur.status === 200;
+  const version = exists ? Number(cur.body.data?.version ?? 0) : 0;
+  const from = exists ? cur.body.data?.manifest?.logDrain ?? null : null;
+  const changed = !sameLogDrain(to, from);
+  let applied = null;
+  if (apply && changed) {
+    const put = await api("PUT", "/v1/config/functions", { logDrain: to }, version > 0 ? { "if-match": String(version) } : {});
+    if (put.status !== 200) {
+      const e = put.body.error ?? {};
+      throw new Error(`push failed for functions.logDrain: ${e.code ?? put.status} ${e.message ?? ""} ${e.hint ?? ""}`);
+    }
+    applied = put.body.data?.version ?? null;
+  }
+  return { version, from, to, changed, applied };
+}
 function classifyRead(status, code) {
   if (status === 200) return "ok";
   if (status === 404) return "empty";
@@ -8126,6 +8456,35 @@ function egressDecision(targetUrl, allowHosts = []) {
   return { allow: false, reason: `not-allowlisted:${host}` };
 }
 
+// ../runtime/src/logDrain.ts
+var LOG_DRAIN_SECRET_NAME_RE = /^[a-z0-9_]{1,64}$/;
+var LOG_DRAIN_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "log", "warn", "error"]);
+var LOG_DRAIN_SHAPE_HINT = 'logDrain needs { url: "https://\u2026", secretRef: "<functions secret name>", minLevel?: "debug"|"info"|"log"|"warn"|"error" } (or null to remove it)';
+function logDrainUrlError(url) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return "logDrain.url is not a URL";
+  }
+  const d = egressDecision(url, [host]);
+  if (!d.allow) return `logDrain.url is refused by the egress guard (${d.reason})`;
+  if (d.reason === "vxil-api") return "logDrain.url must be your own endpoint, not the vxil API";
+  return null;
+}
+function logDrainShapeError(drain) {
+  if (drain === null) return null;
+  const d = drain;
+  if (!d || typeof d !== "object" || Array.isArray(d) || typeof d.url !== "string" || typeof d.secretRef !== "string") {
+    return LOG_DRAIN_SHAPE_HINT;
+  }
+  if (!LOG_DRAIN_SECRET_NAME_RE.test(d.secretRef.replace(/^secret:/, ""))) {
+    return `logDrain.secretRef must be a functions secret name matching ${LOG_DRAIN_SECRET_NAME_RE.source}`;
+  }
+  if (d.minLevel !== void 0 && !LOG_DRAIN_LEVELS.has(d.minLevel)) return LOG_DRAIN_SHAPE_HINT;
+  return logDrainUrlError(d.url);
+}
+
 // ../runtime/src/jobsCallbackSig.ts
 var JOBS_SIG_HEADER = "X-Vxil-Jobs-Signature";
 function signedString(runId, tenantId, issuedAt, bodyHashHex) {
@@ -8309,7 +8668,8 @@ var DRIFT_SECTION = {
   policies: "policy",
   subscriptions: "subscription",
   templates: "template",
-  roles: "role"
+  roles: "role",
+  collections: "search-collection"
 };
 function declaredDriftKey(datum, key) {
   return `api:${DRIFT_SECTION[datum]}:${key}`;
@@ -8318,7 +8678,8 @@ var DATUM_READ_SCOPE = {
   policies: "ratelimits:read",
   subscriptions: "webhooks:read",
   templates: "ai:read",
-  roles: "orgs:read"
+  roles: "orgs:read",
+  collections: "vector-search:read"
 };
 function declaredApiStateBlocks(features) {
   const out = [];
@@ -8357,7 +8718,8 @@ var ROUTE = {
   policies: "/v1/rate-limits/policies",
   subscriptions: "/v1/webhooks/subscriptions",
   templates: "/v1/ai/templates",
-  roles: "/v1/orgs/roles"
+  roles: "/v1/orgs/roles",
+  collections: "/v1/search/collections"
 };
 function listOf(v) {
   return Array.isArray(v) ? v : [];
@@ -8422,6 +8784,14 @@ async function readOnlyPlan(api, block, allowDestructive) {
     s.updated.push(...plan.update.map((u) => u.role.role_key));
     s.unchanged.push(...plan.unchanged);
     destructive([], plan.undeclared);
+  } else if (datum === "collections") {
+    const plan = planSearchCollections(manifest.collections, listOf(data2.collections));
+    s.created.push(...plan.create.map((c) => c.collection));
+    for (const u of plan.update) (u.reembed && !allowDestructive ? s.pending_destructive : s.updated).push(u.body.collection);
+    s.unchanged.push(...plan.unchanged);
+    s.undeclared.push(...plan.undeclared);
+    for (const i of plan.immutable) s.failed.push({ key: i.collection, error: searchCollectionImmutableError(i) });
+    for (const r of plan.refused) s.failed.push({ key: r.collection, error: r.error });
   } else {
     const hashed = await Promise.all(manifest.templates.map(async (t) => ({
       template: t.template,
@@ -9055,6 +9425,12 @@ function writeRolesWidens(declared, remote) {
   if (declared.length === 0) return true;
   return declared.some((r) => !remote.includes(r));
 }
+function orgFieldWidens(declared, remote) {
+  return remote !== null && declared !== remote;
+}
+function orgReadRolesWidens(declared, remote) {
+  return writeRolesWidens(declared, remote);
+}
 function endUserAccessOf(v) {
   return v === "read" || v === "none" ? v : "readwrite";
 }
@@ -9151,6 +9527,9 @@ function remoteCollectionOf(c) {
     public: c.public === true,
     endUserAccess: endUserAccessOf(c.end_user_access),
     writeRoles: writeRolesOf(c.write_roles),
+    orgField: typeof c.org_field === "string" && c.org_field.length > 0 ? c.org_field : null,
+    orgReadRoles: writeRolesOf(c.org_read_roles),
+    retainDays: typeof c.retain_days === "number" ? c.retain_days : null,
     actions: normalizeActions(c.actions),
     fields: Array.isArray(c.fields) ? c.fields : []
   };
@@ -9165,6 +9544,9 @@ function pulledCollectionBlock(c) {
     ...rc.public ? { public: true } : {},
     ...rc.endUserAccess !== "readwrite" ? { endUserAccess: rc.endUserAccess } : {},
     ...rc.writeRoles.length ? { writeRoles: rc.writeRoles } : {},
+    ...rc.orgField ? { orgField: rc.orgField } : {},
+    ...rc.orgReadRoles.length ? { orgReadRoles: rc.orgReadRoles } : {},
+    ...rc.retainDays !== null ? { retainDays: rc.retainDays } : {},
     ...rc.actions.length ? { actions: rc.actions } : {},
     fields
   };
@@ -9229,6 +9611,12 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
     if (wr !== void 0 && (!Array.isArray(wr) || wr.some((r) => typeof r !== "string"))) {
       throw new Error(`cms.collections.${name}.writeRoles must be an array of role slugs (got ${JSON.stringify(wr)})`);
     }
+    const wsErrs = workspaceCollectionErrors(name, def);
+    if (wsErrs.length) throw new Error(wsErrs[0]);
+    const rd = def.retainDays;
+    if (!isDeclaredRetainDays(rd)) {
+      throw new Error(`cms.collections.${name}.retainDays must be an integer 1..3650 (days) or null (got ${JSON.stringify(rd)})`);
+    }
   }
   const read = await readRemote2(api);
   if (read.unavailable) {
@@ -9409,6 +9797,63 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
         });
       }
     }
+    const declaredOrg = def.orgField ?? null;
+    const declaredOrgRoles = writeRolesOf(def.orgReadRoles);
+    const orgSteps = [];
+    if (declaredOrg !== rc.orgField) {
+      const widens = orgFieldWidens(declaredOrg, rc.orgField);
+      if (!widens || allowDestructive) {
+        orgSteps.push({
+          collection: name,
+          kind: "set-org-field",
+          detail: `${name} orgField \u2192 ${declaredOrg === null ? "none" : `'${declaredOrg}'`}${rc.orgField ? ` (was '${rc.orgField}')` : ""}` + (widens ? " \u2014 WIDENS end-user access to workspace rows (full-config reconciliation)" : " (workspace scoping, narrows)")
+        });
+      } else {
+        collChanges.push({
+          collection: name,
+          kind: "warn",
+          detail: `${name}: orgField '${rc.orgField}' is set remotely but ${declaredOrg === null ? "absent" : `'${declaredOrg}'`} in config \u2014 that WIDENS which end users reach the rows, so it is NOT applied. Declare the remote orgField to keep it, or re-run with --allow-destructive.`
+        });
+      }
+    }
+    if (stableStringify(declaredOrgRoles) !== stableStringify(rc.orgReadRoles)) {
+      const widens = orgReadRolesWidens(declaredOrgRoles, rc.orgReadRoles);
+      const fmt = (r) => r.length ? `[${r.join(", ")}]` : "none (any member)";
+      if (!widens || allowDestructive) {
+        const step = {
+          collection: name,
+          kind: "set-org-read-roles",
+          detail: `${name} orgReadRoles \u2192 ${fmt(declaredOrgRoles)} (was ${fmt(rc.orgReadRoles)})` + (widens ? " \u2014 WIDENS who may read (full-config reconciliation)" : " (narrows end-user reads)")
+        };
+        if (declaredOrg === null) orgSteps.unshift(step);
+        else orgSteps.push(step);
+      } else {
+        collChanges.push({
+          collection: name,
+          kind: "warn",
+          detail: `${name}: orgReadRoles are ${fmt(rc.orgReadRoles)} remotely but ${fmt(declaredOrgRoles)} in config \u2014 that WIDENS which workspace members may read, so it is NOT applied. Declare the remote roles to keep them, or re-run with --allow-destructive to widen.`
+        });
+      }
+    }
+    collChanges.push(...orgSteps);
+    const declaredRetain = def.retainDays;
+    if (declaredRetain !== void 0 && declaredRetain !== rc.retainDays) {
+      const fmtDays = (d) => d === null ? "off (kept until deleted)" : `${d} days`;
+      const shortens = retainDaysShortens(declaredRetain, rc.retainDays);
+      if (!shortens || allowDestructive) {
+        collChanges.push({
+          collection: name,
+          kind: "set-retain-days",
+          detail: `${name} retainDays \u2192 ${fmtDays(declaredRetain)} (was ${fmtDays(rc.retainDays)})` + (shortens ? " \u2014 the nightly sweep soft-deletes items older than that" : "")
+        });
+      } else {
+        collChanges.push({
+          collection: name,
+          kind: "warn",
+          detail: `${name}: retainDays is ${fmtDays(rc.retainDays)} remotely but ${fmtDays(declaredRetain)} in config \u2014 that makes the nightly sweep soft-delete existing items, so it is NOT applied. Re-run with --allow-destructive to apply it.`
+        });
+      }
+    }
     const declaredActions = normalizeActions(def.actions);
     if (stableStringify(declaredActions) !== stableStringify(rc.actions)) {
       collChanges.push({
@@ -9484,6 +9929,10 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
         if (access !== "readwrite") body.end_user_access = access;
         const roles = writeRolesOf(def.writeRoles);
         if (roles.length > 0) body.write_roles = roles;
+        if (def.orgField) body.org_field = def.orgField;
+        const orgRoles = writeRolesOf(def.orgReadRoles);
+        if (orgRoles.length > 0) body.org_read_roles = orgRoles;
+        if (typeof def.retainDays === "number") body.retain_days = def.retainDays;
         if (def.actions && def.actions.length > 0) body.actions = normalizeActions(def.actions);
         const res = await api("POST", "/v1/cms/collections", body);
         if (res.status !== 201 && res.status !== 200 && res.body.error?.code !== "collection_exists") {
@@ -9543,6 +9992,28 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
           throw new Error(`cms: set writeRoles on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
         }
         applied++;
+      } else if (c.kind === "set-org-field" || c.kind === "set-org-read-roles") {
+        const def = collections[c.collection];
+        const remoteRc = remote.get(c.collection);
+        const isField = c.kind === "set-org-field";
+        const target = isField ? def.orgField ?? null : writeRolesOf(def.orgReadRoles);
+        const widens = isField ? orgFieldWidens(target, remoteRc?.orgField ?? null) : orgReadRolesWidens(target, remoteRc?.orgReadRoles ?? []);
+        const body = isField ? { org_field: target } : { org_read_roles: target };
+        if (widens) body.allow_destructive = true;
+        const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`, body);
+        if (res.status !== 200 && res.status !== 201) {
+          const e = res.body.error ?? {};
+          throw new Error(`cms: set ${isField ? "orgField" : "orgReadRoles"} on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
+        }
+        applied++;
+      } else if (c.kind === "set-retain-days") {
+        const target = collections[c.collection].retainDays ?? null;
+        const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`, { retain_days: target });
+        if (res.status !== 200 && res.status !== 201) {
+          const e = res.body.error ?? {};
+          throw new Error(`cms: set retainDays on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
+        }
+        applied++;
       } else if (c.kind === "set-actions") {
         const target = normalizeActions(collections[c.collection].actions);
         const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`, { actions: target });
@@ -9608,7 +10079,7 @@ function formatCmsChanges(changes) {
     if (c.kind === "destructive") return `  ! ${c.detail}`;
     if (c.kind === "warn") return `  \u26A0 ${c.detail}`;
     if (c.kind === "reindex") return `  \u21BB ${c.detail}`;
-    if (c.kind === "alter-flags" || c.kind === "set-owner-field" || c.kind === "set-end-user-access" || c.kind === "set-write-roles") return `  ~ ${c.detail}`;
+    if (c.kind === "alter-flags" || c.kind === "set-owner-field" || c.kind === "set-end-user-access" || c.kind === "set-write-roles" || c.kind === "set-retain-days") return `  ~ ${c.detail}`;
     return `  + ${c.detail}`;
   }).join("\n");
 }
@@ -12503,7 +12974,11 @@ var TOOLS = [
           description: "Explicit locale wins; otherwise the recipient's stored `locale` attribute (users_upsert attributes.locale), then the tenant's config.defaultLocale."
         },
         send_at: { type: "string", description: "future ISO instant, \u2264 30 d out (mutually exclusive with delay_seconds)" },
-        delay_seconds: { type: "number", minimum: 0, maximum: 2592e3 }
+        delay_seconds: { type: "number", minimum: 0, maximum: 2592e3 },
+        to_email: { type: "string", description: "Deliver to this address instead of the user's stored email (an invitee with no account). user_id must still exist; suppressions are checked against this address." },
+        from_name: { type: "string", maxLength: 64, description: "This send's sender name; default config fromName." },
+        from_local_part: { type: "string", pattern: "^[a-z0-9._-]{1,40}$", description: "This send's from-address local part; the domain is always the config fromEmail domain." },
+        reply_to: { type: "string", description: "This send's Reply-To address; default config replyTo." }
       },
       required: ["user_id", "template", "data"]
     },
@@ -12530,6 +13005,10 @@ var TOOLS = [
               channel: { type: "string", enum: ["email", "inbox", "both"] },
               send_at: { type: "string", description: "future ISO instant (\u2264 30 d)" },
               delay_seconds: { type: "number", minimum: 0, maximum: 2592e3 },
+              to_email: { type: "string" },
+              from_name: { type: "string", maxLength: 64 },
+              from_local_part: { type: "string", pattern: "^[a-z0-9._-]{1,40}$" },
+              reply_to: { type: "string" },
               idempotency_key: { type: "string" }
             },
             required: ["user_id", "template", "data"]
@@ -13212,14 +13691,19 @@ var TOOLS = [
   {
     name: "files_get_download_url",
     feature: "files",
-    description: "Mint a short-lived presigned GET URL for an available object.",
+    description: 'Mint a short-lived presigned GET URL for an available object. disposition "inline" opens a PDF/image/ICO/audio/video in the browser (html, svg, js and other types always download); filename sets the saved name.',
     inputSchema: {
       type: "object",
-      properties: { object_id: { type: "string" } },
+      properties: {
+        object_id: { type: "string" },
+        disposition: { type: "string", enum: ["inline", "attachment"], description: "Omit for the default (raster images inline, everything else attachment)." },
+        filename: { type: "string", description: "Download filename (sanitised server-side, at most 200 characters). Default: the upload filename." }
+      },
       required: ["object_id"]
     },
     method: "GET",
-    path: (a) => `/v1/files/${encodeURIComponent(String(a.object_id))}/download-url`
+    path: (a) => `/v1/files/${encodeURIComponent(String(a.object_id))}/download-url`,
+    queryArgs: ["disposition", "filename"]
   },
   {
     name: "files_get_download_urls",
@@ -13355,7 +13839,7 @@ var TOOLS = [
   {
     name: "cms_list_collections",
     feature: "cms",
-    description: "List the tenant's content model: collections with their typed field definitions (the schema items are validated against). Each field row carries its attributes \u2014 required, validation, index_slot, relation_to, computed/compute, is_unique, on_delete, read_roles (the end-user org roles allowed to READ that field; null = ungated), and on an equality-indexed field indexed: true + index_ready (equality filters on it are index-served once ready; until then, and on unindexed unslotted fields, they are a bounded scan \u2014 same results). A field with read_roles is omitted from end-user reads without a matching role and is never served on the public lane, so a missing key in an item's data may be a read gate rather than an unset value. Each collection row also carries end_user_access: 'readwrite' (default), 'read' (a verified end user \u2014 a thin-client key with a session \u2014 may read but every write answers 403 server_only) or 'none' (end-user reads and writes are 403 server_only), and write_roles: the roles a verified end user must hold to WRITE the collection (null = ungated; without one every end-user write answers 403 role_required, reads are unaffected); server keys are never affected. retain_days (null = keep) is the collection's retention: the nightly platform sweep soft-deletes live items created more than that many days ago.",
+    description: "List the tenant's content model: collections with their typed field definitions (the schema items are validated against). Each field row carries its attributes \u2014 required, validation, index_slot, relation_to, computed/compute, is_unique, on_delete, read_roles (the end-user org roles allowed to READ that field; null = ungated), and on an equality-indexed field indexed: true + index_ready (equality filters on it are index-served once ready; until then, and on unindexed unslotted fields, they are a bounded scan \u2014 same results). A field with read_roles is omitted from end-user reads without a matching role and is never served on the public lane, so a missing key in an item's data may be a read gate rather than an unset value. Each collection row also carries end_user_access: 'readwrite' (default), 'read' (a verified end user \u2014 a thin-client key with a session \u2014 may read but every write answers 403 server_only) or 'none' (end-user reads and writes are 403 server_only), and write_roles: the roles a verified end user must hold to WRITE the collection (null = ungated; without one every end-user write answers 403 role_required, reads are unaffected); server keys are never affected. retain_days (null = keep) is the collection's retention: the nightly platform sweep soft-deletes live items created more than that many days ago. org_field (null = none) makes the collection workspace-scoped: a verified end user reads and writes only rows of the session's active org (no active org \u2192 403 org_required) and write_roles match the active-org role; org_read_roles (null = any member) gates reads by that role.",
     inputSchema: { type: "object", properties: {} },
     method: "GET",
     path: "/v1/cms/collections"
@@ -13703,15 +14187,18 @@ var TOOLS = [
   {
     name: "orgs_session_claims",
     feature: "orgs",
-    description: "The user's ACTIVE-ORG snapshot \u2014 the { org_id, role, perms[] } auth embeds as the session-JWT `org` claim when the tenant enables auth config orgClaims. Active org = the most recent membership (by joined_at); perms = the role's effective permission set (custom catalog entry wins, capped at 32). No membership \u2192 org_id null. EVENTUAL-CONSISTENT: JWTs recompute it only at mint/refresh \u2014 use orgs_check_permission for revocation-grade authz. Read-only \u2014 needs orgs:read.",
+    description: "The org snapshot \u2014 { org_id, role, perms[] } \u2014 auth embeds as the session-JWT `org` claim when the tenant enables auth config orgClaims. Without org_id it resolves the user's MOST RECENT membership (by joined_at): the claim a session carries with plain orgClaims, and the one a first sign-in stores with orgClaims.activeOrg. With orgClaims.activeOrg a session then acts in the org it stored or switched to (POST /v1/auth/sessions/refresh with org_id), not necessarily the most recent one \u2014 pass org_id to read that org's claim. perms = the role's effective permission set (custom catalog entry wins, capped at 32). Not a member (or no membership) \u2192 org_id null. EVENTUAL-CONSISTENT: JWTs recompute it only at mint/refresh \u2014 use orgs_check_permission for revocation-grade authz. Read-only \u2014 needs orgs:read.",
     inputSchema: {
       type: "object",
-      properties: { user_id: { type: "string", description: "The end_user_id to resolve." } },
+      properties: {
+        user_id: { type: "string", description: "The end_user_id to resolve." },
+        org_id: { type: "string", description: "Optional: resolve the claim for THIS org (the active org a session picked) instead of the most recent membership." }
+      },
       required: ["user_id"]
     },
     method: "GET",
     path: "/v1/orgs/session-claims",
-    queryArgs: ["user_id"]
+    queryArgs: ["user_id", "org_id"]
   },
   {
     name: "orgs_define_role",
@@ -13894,7 +14381,7 @@ var TOOLS = [
   {
     name: "functions_logs",
     feature: "functions",
-    description: "Log records of ONE deployed function, one per invocation (ts, outcome, wall_ms, cpu_ms, console lines, exceptions), oldest first, with `next_since` \u2014 pass it back as `since` to read only newer records (a tail). Without `since`: the most recent records of the last 24 hours. Kept 14 days. Needs functions:read.",
+    description: 'Log records of ONE deployed function, one per invocation (ts, outcome, wall_ms, cpu_ms, console lines, exceptions), oldest first, with `next_since` \u2014 pass it back as `since` to read only newer records (a tail). Without `since`: the most recent records of the last 24 hours. Kept 14 days. Needs functions:read. To forward log lines to your own https endpoint (kept as long as you like), declare features.functions.logDrain { url, secretRef, minLevel } and push it, or PUT /v1/config/functions with { "logDrain": {\u2026} } (null removes it); this tool only reads.',
     inputSchema: {
       type: "object",
       properties: {
@@ -14065,7 +14552,7 @@ var TOOLS = [
   {
     name: "search_query",
     feature: "vector-search",
-    description: "Retrieve the top-k most relevant chunks from a vector-search collection. mode 'hybrid' (default) fuses semantic + keyword via RRF; 'vector' is pure semantic; 'keyword' is lexical. filter is a JSON object of equality constraints over chunk metadata. Returns ranked results with document/chunk attribution: score is the fused rank value (orders the hits, not a similarity); similarity is the cosine similarity to the query (-1..1, null in keyword mode) \u2014 threshold on similarity. embed_provider names the collection's embedder; 'mock' is the deterministic test embedder (ranks by a hash, not meaning), so tell the user search is not semantic until a real provider is set.",
+    description: "Retrieve the top-k most relevant chunks from a vector-search collection. mode 'hybrid' (default) fuses semantic + keyword via RRF; 'vector' is pure semantic; 'keyword' is lexical. filter is a JSON object over top-level chunk metadata keys, ANDed: {key: value} is equality, {key: {$in: [a, b]}} matches any of 1\u201350 values (\u22644 $in keys); any other value is refused 422. Returns ranked results with document/chunk attribution: score is the fused rank value (orders the hits, not a similarity); similarity is the cosine similarity to the query (-1..1, null in keyword mode) \u2014 threshold on similarity. embed_provider names the collection's embedder; 'mock' is the deterministic test embedder (ranks by a hash, not meaning), so tell the user search is not semantic until a real provider is set.",
     inputSchema: {
       type: "object",
       properties: {
@@ -14073,7 +14560,7 @@ var TOOLS = [
         query: { type: "string", description: "Natural-language query text." },
         top_k: { type: "number", minimum: 1, maximum: 100, default: 10 },
         mode: { type: "string", enum: ["hybrid", "vector", "keyword"], default: "hybrid" },
-        filter: { type: "object", additionalProperties: true, description: 'Metadata equality filter, e.g. {"user_id":"u_42"}.' },
+        filter: { type: "object", additionalProperties: true, description: 'Metadata filter, keys ANDed: equality {"user_id":"u_42"} or any-of {"folder":{"$in":["a","b"]}} (1\u201350 values, \u22644 $in keys). null / arrays / other operators are refused 422.' },
         rerank: { type: "boolean", description: "Apply the configured BYO reranker (config rerank block) to the fused results before top-k. Fail-open: a provider fault returns the RRF order with reranked:false." }
       },
       required: ["collection", "query"]
@@ -14239,7 +14726,7 @@ var TOOLS = [
         template: { type: "string", description: "Override the answer template (defaults to rag config defaultTemplate)." },
         top_k: { type: "number", minimum: 1, maximum: 100, description: "Chunks to retrieve before budgeting." },
         mode: { type: "string", enum: ["hybrid", "vector", "keyword"] },
-        filter: { type: "object", additionalProperties: true, description: "Metadata equality filter applied to retrieval." },
+        filter: { type: "object", additionalProperties: true, description: 'Metadata filter applied to retrieval: equality {"key":"value"} or any-of {"key":{"$in":[...]}} (1\u201350 values), keys ANDed.' },
         provider: { type: "string" },
         model: { type: "string" },
         input: { type: "object", additionalProperties: true, description: "Extra template vars beyond {{query}}/{{context}}." },
@@ -14262,7 +14749,7 @@ var TOOLS = [
         collection: { type: "string", description: "Collection to search (defaults to rag config defaultCollection)." },
         top_k: { type: "number", minimum: 1, maximum: 100, description: "Chunks to retrieve." },
         mode: { type: "string", enum: ["hybrid", "vector", "keyword"] },
-        filter: { type: "object", additionalProperties: true, description: "Metadata equality filter applied to retrieval." },
+        filter: { type: "object", additionalProperties: true, description: 'Metadata filter applied to retrieval: equality {"key":"value"} or any-of {"key":{"$in":[...]}} (1\u201350 values), keys ANDed.' },
         rerank: { type: "boolean", description: "Forward rerank:true to vector-search's BYO rerank pass (inert until configured there)." },
         boosts: { type: "object", additionalProperties: true, description: "Per-metadata-field boost specs: { field: { kind:'recency', halfLifeDays?, weight? } | { kind:'value', weights:{\u2026} } }." },
         min_score: { type: "number", description: "Drop hits below this EFFECTIVE (post-boost) score. score is a rank value (about 0.016-0.033 at the top), so a floor above ~0.033 drops every hit; use min_similarity for a relevance threshold." },
@@ -14848,6 +15335,10 @@ function collectSecretRefs(cfg) {
       if (m) add({ name: m[1], feature, via: `features.${feature}.${path}` });
     }
   }
+  const drainRef = cfg.features?.functions?.logDrain?.secretRef;
+  if (typeof drainRef === "string" && drainRef.replace(/^secret:/, "")) {
+    add({ name: drainRef.replace(/^secret:/, ""), feature: "functions", via: "features.functions.logDrain.secretRef" });
+  }
   for (const [fn, def] of Object.entries(cfg.functions ?? {})) {
     for (const ref of normalizeSecretRefs(def.secrets)) {
       const bare = ref.slice("secret:".length);
@@ -14923,7 +15414,8 @@ var COMPARED_LABELS = [
   ["subscriptions", "subscription"],
   ["campaigns", "campaign"],
   ["templates", "template"],
-  ["roles", "role"]
+  ["roles", "role"],
+  ["searchCollections", "search collection"]
 ];
 function formatCompared(c) {
   const parts = [];
@@ -16101,7 +16593,9 @@ var EXTRA_KNOWN_FLAGS = [
   "include-empty",
   "include-password-hashes",
   "with-password-hashes",
+  "with-oauth-identities",
   "keep-source-id",
+  "keep-timestamps",
   "oidc-issuer",
   "only",
   "pg-schema",
@@ -16804,7 +17298,8 @@ function inferMapping(source, opts = {}) {
     if (owner) mapping.userRefColumn = owner.column;
     for (const col of t.columns) {
       if (col.name === "created_at" || col.name === "updated_at") {
-        mapping.reasons.push(`R13: ${col.name} dropped \u2014 cms manages created_at/updated_at (original values not preserved)`);
+        mapping.reasons.push(`R13: ${col.name} dropped \u2014 cms manages created_at/updated_at (original values kept with \`data --keep-timestamps\`)`);
+        mapping.sourceTimestamps = { ...mapping.sourceTimestamps, [col.name === "created_at" ? "created" : "updated"]: col.name };
         continue;
       }
       const isOwnerCol = owner?.column === col.name;
@@ -17206,6 +17701,32 @@ function storagePatch(row2, fields, resolve8) {
 function readColumns(mapping, pk, extra = []) {
   return [.../* @__PURE__ */ new Set([pk, ...mapping.fields.map((f) => f.source), ...mapping.changeColumn ? [mapping.changeColumn] : [], ...extra])];
 }
+function sourceTimestampColumns(mapping) {
+  if (mapping.sourceTimestamps) return { ...mapping.sourceTimestamps };
+  const out = {};
+  for (const r of mapping.reasons) {
+    const m = /^R13: (created_at|updated_at) dropped/.exec(r);
+    if (m?.[1] === "created_at") out.created = "created_at";
+    if (m?.[1] === "updated_at") out.updated = "updated_at";
+  }
+  return out;
+}
+var TS_MIN_MS = 0;
+var TS_FUTURE_MARGIN_MS = 6e4;
+var tsIso = (raw, nowMs) => {
+  let t;
+  if (raw instanceof Date) t = raw.getTime();
+  else if (typeof raw === "string" && raw !== "") t = Date.parse(raw);
+  else return null;
+  if (Number.isNaN(t) || t < TS_MIN_MS || t > nowMs + TS_FUTURE_MARGIN_MS) return null;
+  return new Date(t).toISOString();
+};
+function sourceTimestampsOf(row2, cols, nowMs = Date.now()) {
+  const created = cols.created ? tsIso(row2[cols.created], nowMs) : null;
+  if (created === null) return void 0;
+  const updated = cols.updated ? tsIso(row2[cols.updated], nowMs) : null;
+  return updated !== null && updated >= created ? { created_at: created, updated_at: updated } : { created_at: created };
+}
 var SCALAR_UNIQUE = /* @__PURE__ */ new Set(["string", "int", "float", "datetime"]);
 function buildItem(row2, mapping, state, tableByCollection, resolve8) {
   const full = {};
@@ -17262,7 +17783,18 @@ function holdsContent(stored, item, storageTargets) {
     return cur === rowHash(v) || storageTargets.has(k) && cur === rowHash(item.hashInput[k]);
   });
 }
-async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColumn, itemStatus = "published", delta }) {
+async function loadCmsTable({
+  deps,
+  plan,
+  mapping,
+  adapter,
+  state,
+  save,
+  pkColumn,
+  itemStatus = "published",
+  delta,
+  keepTimestamps = false
+}) {
   const table = mapping.table;
   const collection = mapping.collection;
   const key = `cms:${table}`;
@@ -17296,8 +17828,12 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
   let unhashedSame = 0;
   const enc2 = encodeURIComponent(collection);
   const start = cursors[key] ?? void 0;
+  const tsCols = keepTimestamps ? sourceTimestampColumns(mapping) : {};
+  if (keepTimestamps && tsCols.created === void 0) {
+    deps.log(`cms ${table}: --keep-timestamps \u2014 the source has no created_at column; items take the time of the import`);
+  }
   const readOpts = {
-    columns: readColumns(mapping, pk),
+    columns: readColumns(mapping, pk, [tsCols.created, tsCols.updated].filter((c) => c !== void 0)),
     ...delta && mapping.changeColumn ? { changedSince: { column: mapping.changeColumn, since: delta.since } } : {}
   };
   const noteStorage = (sourceId, row2) => {
@@ -17380,7 +17916,12 @@ async function loadCmsTable({ deps, plan, mapping, adapter, state, save, pkColum
             continue;
           }
           if (deps.dryRun) continue;
-          const res = await deps.api("POST", `/v1/cms/items/${enc2}`, { data: item.create, status: itemStatus });
+          const srcTs = keepTimestamps ? sourceTimestampsOf(row2, tsCols) : void 0;
+          const res = await deps.api("POST", `/v1/cms/items/${enc2}`, {
+            data: item.create,
+            status: itemStatus,
+            ...srcTs ? { source_timestamps: srcTs } : {}
+          });
           if (res.status === 201 || res.status === 200) {
             const itemId = res.body.data?.item_id;
             if (typeof itemId !== "string") {
@@ -17565,11 +18106,14 @@ async function loadUsers({ deps, adapter, mapping, state, save, delta = false })
 // src/migrate/loaders/credentials.ts
 var CREDENTIALS_BATCH_MAX = 500;
 var KEY = "users:credentials";
+var IDENTITIES_PER_USER_MAX = 8;
 function credentialEntry(row2, withHashes) {
+  const identities = (row2.identities ?? []).slice(0, IDENTITIES_PER_USER_MAX);
   return {
     id: row2.id,
     ...withHashes && row2.password_hash ? { password_hash: row2.password_hash } : {},
-    ...row2.email_verified ? { email_verified: true } : {}
+    ...row2.email_verified ? { email_verified: true } : {},
+    ...identities.length > 0 ? { identities } : {}
   };
 }
 async function loadCredentials2({ deps, adapter, state, save, opts, delta = false }) {
@@ -17582,11 +18126,17 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
   const sent = hashesFor(state, KEY);
   if (cursors[KEY] === null) {
     deps.log(delta ? "credentials: incremental pass already complete for this --since window \u2014 skipping" : `credentials: already complete \u2014 skipping (\`data --since <time>\` re-reads it)`);
+    if (opts.withIdentities) {
+      deps.log("  \u26A0 --with-oauth-identities: social links attach only to users the import CREATES \u2014 users already imported by an earlier run are kept as they are and get no links. To carry the links, import into a fresh target (`vxil dev down` / a new project) with --with-password-hashes --with-oauth-identities.");
+    }
     return result;
   }
   const reasons = /* @__PURE__ */ new Map();
   let withPassword = 0;
-  for await (const batch of adapter.readCredentials(cursors[KEY] ?? void 0)) {
+  let withLinks = 0;
+  let linked = 0;
+  const readOpts = opts.withIdentities ? { identities: true } : void 0;
+  for await (const batch of adapter.readCredentials(cursors[KEY] ?? void 0, readOpts)) {
     const entries = [];
     const digests = [];
     for (const row2 of batch.rows) {
@@ -17598,6 +18148,7 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
         continue;
       }
       if (entry.password_hash) withPassword++;
+      if (entry.identities) withLinks++;
       entries.push(entry);
       digests.push(h);
     }
@@ -17615,6 +18166,7 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
         return result;
       }
       const data2 = res.body.data ?? {};
+      linked += typeof data2.identities_linked === "number" ? data2.identities_linked : 0;
       const taken = (data2.results ?? []).filter((r) => r.status === "skipped" && r.reason === "id_taken").length;
       if (taken > 0) {
         result.errors.push(`credentials: ${taken} user id(s) already belong to another vxil project in this environment (user ids are unique across projects) \u2014 most often a rehearsal dev backend that imported the same users. Delete it (\`vxil dev down\`) or the project that holds them, then re-run: the cursor was NOT advanced and the import is idempotent. Left as is, those users would get a new id at sign-up and lose their data.`);
@@ -17636,10 +18188,13 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
     if (batch.nextCursor === null) break;
   }
   if (deps.dryRun) {
-    deps.log(`credentials: DRY-RUN \u2014 would import ${result.read - result.skipped} identit(ies)` + (opts.withHashes ? `, ${withPassword} with a password hash` : " (no hashes \u2014 --with-password-hashes not set)") + (opts.oidcIssuer ? ", each linked to the source issuer for the session hand-over" : "") + "; nothing written");
+    deps.log(`credentials: DRY-RUN \u2014 would import ${result.read - result.skipped} identit(ies)` + (opts.withHashes ? `, ${withPassword} with a password hash` : " (no hashes \u2014 --with-password-hashes not set)") + (opts.oidcIssuer ? ", each linked to the source issuer for the session hand-over" : "") + (opts.withIdentities ? `, ${withLinks} with social sign-in links` : "") + "; nothing written");
   } else {
     cursors[KEY] = null;
     save();
+    if (opts.withIdentities) {
+      deps.log(`credentials: ${linked} social sign-in link(s) created for ${withLinks} user(s) \u2014 a link is made only for an identity this import creates or still holds, and a subject already linked stays put`);
+    }
   }
   if (reasons.size > 0) {
     const list = [...reasons].map(([r, n]) => `${r}=${n}`).join(" ");
@@ -18716,6 +19271,7 @@ async function runData(deps, plan, adapter, opts = {}) {
       save: g.save,
       ...opts.pkColumns?.[table] !== void 0 ? { pkColumn: opts.pkColumns[table] } : {},
       ...opts.itemStatus !== void 0 ? { itemStatus: opts.itemStatus } : {},
+      ...opts.keepTimestamps ? { keepTimestamps: true } : {},
       ...delta ? { delta } : {}
     });
     results.push(r);
@@ -19069,7 +19625,14 @@ async function runMigrateData(io, opts = {}) {
   if (opts.oidcIssuer !== void 0 && !/^https:\/\/[^\s?#]+$/.test(opts.oidcIssuer)) {
     throw new Error(`--oidc-issuer '${opts.oidcIssuer}' must be an https URL with no query or fragment (Supabase: https://<ref>.supabase.co/auth/v1)`);
   }
-  const credentials = opts.withPasswordHashes || opts.oidcIssuer !== void 0 ? { withHashes: opts.withPasswordHashes === true, ...opts.oidcIssuer !== void 0 ? { oidcIssuer: opts.oidcIssuer } : {} } : void 0;
+  if (opts.withOauthIdentities && !opts.withPasswordHashes) {
+    throw new Error("--with-oauth-identities needs --with-password-hashes in the same run: the import creates each user once, so a user with both a password and a social link would otherwise lose the password for good");
+  }
+  const credentials = opts.withPasswordHashes || opts.oidcIssuer !== void 0 || opts.withOauthIdentities ? {
+    withHashes: opts.withPasswordHashes === true,
+    ...opts.oidcIssuer !== void 0 ? { oidcIssuer: opts.oidcIssuer } : {},
+    ...opts.withOauthIdentities ? { withIdentities: true } : {}
+  } : void 0;
   const tableNames = new Set(plan.tables.map((t) => t.table));
   for (const o of opts.only ?? []) {
     if (!DATA_STEPS.has(o) && !tableNames.has(o)) {
@@ -19104,7 +19667,8 @@ async function runMigrateData(io, opts = {}) {
     ...opts.prune ? { prune: true } : {},
     ...specs ? { payments: specs } : {},
     ...credentials ? { credentials } : {},
-    ...opts.fileLinks ? { fileLinks: opts.fileLinks } : {}
+    ...opts.fileLinks ? { fileLinks: opts.fileLinks } : {},
+    ...opts.keepTimestamps ? { keepTimestamps: true } : {}
   });
   io.log(`${execute ? "\nmigrate data" : "\nmigrate data (DRY-RUN \u2014 zero writes)"}${since ? ` \u2014 incremental since ${since}${opts.prune ? " + prune" : ""}` : ""}:`);
   for (const r of results) io.log(formatLoadResult(r));
@@ -21046,6 +21610,9 @@ function quoteIdent2(name) {
   if (!IDENT_RE2.test(name)) throw new Error(`unsafe identifier '${name}' \u2014 only [A-Za-z_][A-Za-z0-9_]* is readable`);
   return `"${name}"`;
 }
+function parseTimestampNoTz(text) {
+  return /* @__PURE__ */ new Date(`${text.replace(" ", "T")}Z`);
+}
 function redactSourceUrl(url) {
   try {
     const u = new URL(url);
@@ -21298,6 +21865,10 @@ var GenericPgAdapter = class {
       // transaction-pooler (pgbouncer/supavisor) compatible
       onnotice: () => {
       },
+      // timestamp-without-tz read as UTC (the session only ever reads).
+      types: {
+        timestampNoTz: { to: 1114, from: [1114], parse: parseTimestampNoTz, serialize: (d) => d.toISOString() }
+      },
       connection: {
         application_name: "vxil-migrate",
         // startup-parameter copies of the session SETs — they survive driver
@@ -21614,6 +22185,25 @@ var supabaseSql = {
       params: after !== null ? [after] : []
     };
   },
+  /** auth.identities column NAMES (GoTrue added `provider_id` in 2023; older
+   *  projects kept the provider subject in `id`). */
+  identitiesColumns: () => ({
+    text: `
+      SELECT a.attname AS column_name
+      FROM pg_attribute a
+      JOIN pg_class c ON c.oid = a.attrelid
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = 'auth' AND c.relname = 'identities'
+        AND a.attnum > 0 AND NOT a.attisdropped`,
+    params: []
+  }),
+  /** MIGRATE-OAUTH-IDENTITIES: the social links of ONE credentials page —
+   *  provider + the provider's subject only (never identity_data, never a
+   *  token), the four providers vxil links by subject. */
+  identitiesFor: (userIds, subjectColumn) => ({
+    text: `SELECT user_id::text AS user_id, provider, ${subjectColumn}::text AS subject FROM auth.identities WHERE user_id = ANY($1::uuid[]) AND provider IN ('google', 'apple', 'github', 'facebook') ORDER BY user_id, provider, ${subjectColumn}`,
+    params: [userIds]
+  }),
   /** does this database carry the Storage schema? */
   storageProbe: () => ({
     text: `SELECT to_regclass('storage.buckets') IS NOT NULL AS present`,
@@ -21706,17 +22296,36 @@ var SupabaseAdapter = class extends GenericPgAdapter {
   }
   /** Credential pages (supabaseSql.credentialsPage). The rows hold bcrypt
    *  hashes: never logged, never written anywhere but the import request. */
-  async *readCredentials(cursor) {
+  async *readCredentials(cursor, opts = {}) {
     const source = await this.introspect();
     if (!source.authUsers?.present) throw new Error("auth.users not present on this source");
     const cols = source.authUsers.columns ?? [];
     if (!cols.includes("encrypted_password")) throw new Error("auth.users has no encrypted_password column \u2014 nothing to import");
+    let subjectColumn = null;
+    if (opts.identities) {
+      const icols = (await this.q(supabaseSql.identitiesColumns())).map((r) => r.column_name);
+      if (!icols.includes("user_id") || !icols.includes("provider")) {
+        throw new Error("auth.identities not found on this source \u2014 drop --with-oauth-identities");
+      }
+      subjectColumn = icols.includes("provider_id") ? "provider_id" : "id";
+    }
     let after = cursor !== void 0 && cursor !== "" ? cursor : null;
     for (; ; ) {
       const rows = await this.q(supabaseSql.credentialsPage(after, this.batchSize, cols.includes("deleted_at")));
+      const links = /* @__PURE__ */ new Map();
+      if (subjectColumn !== null && rows.length > 0) {
+        for (const r of await this.q(supabaseSql.identitiesFor(rows.map((x) => String(x.id)), subjectColumn))) {
+          if (typeof r.subject !== "string" || r.subject === "") continue;
+          const list = links.get(String(r.user_id)) ?? [];
+          list.push({ provider: String(r.provider), subject: r.subject });
+          links.set(String(r.user_id), list);
+        }
+      }
       const out = rows.map((r) => {
         const h = typeof r.encrypted_password === "string" && r.encrypted_password.length > 0 ? r.encrypted_password : null;
-        return { id: String(r.id), password_hash: h, email_verified: r.email_verified === true };
+        const row2 = { id: String(r.id), password_hash: h, email_verified: r.email_verified === true };
+        if (subjectColumn !== null) row2.identities = links.get(String(r.id)) ?? [];
+        return row2;
       });
       const next = rows.length === this.batchSize ? String(rows[rows.length - 1].id) : null;
       yield { rows: out, nextCursor: next };
@@ -22428,6 +23037,11 @@ async function runApply(apply, sel = "prod", opts = {}) {
       report.errors++;
     }
   };
+  {
+    const drain = cfg.features?.functions?.logDrain;
+    const drainErr = drain === void 0 ? null : logDrainShapeError(drain);
+    if (drainErr) throw new Error(`features.functions.logDrain: ${drainErr} \u2014 nothing was ${apply ? "pushed" : "planned"}`);
+  }
   let cmsApi = api;
   if (apply) {
     const enabledAt = await enableCmsBeforeSchema({ api, cfg });
@@ -22459,7 +23073,6 @@ cms: enabled (v${enabledAt}) before its schema \u2014 the declared cms config fo
     compared.collections += Object.keys(cfg.cms.collections).length;
   });
   const { functions: _fnFeature, ...configFeatures } = cfg.features;
-  void _fnFeature;
   const serverApiState = {};
   await runSection("config", async () => {
     if (!Object.keys(configFeatures).length) return;
@@ -22476,6 +23089,8 @@ ${r.feature}:`);
       }
       console.log(`
 ${r.feature} (remote v${r.version}):`);
+      const activeOrgWarn = activeOrgEnableWarning(r.feature, r.changes);
+      if (activeOrgWarn) console.error(`vxil: warning \u2014 ${activeOrgWarn}`);
       const { kept, ignored } = partitionConfigChanges(r.feature, r.changes, ignore);
       console.log(formatDiff(kept));
       if (ignored.length) console.log(`  (${ignored.length} ignored: ${ignored.map((c) => c.path).join(", ")})`);
@@ -22488,6 +23103,30 @@ ${r.feature} (remote v${r.version}):`);
       compared.features++;
     }
   });
+  await runSection("log-drain", async () => {
+    const r = await planOrPushLogDrain({ api, fnFeature: _fnFeature, apply });
+    if (!r) return;
+    if (r.remoteUnavailable) {
+      console.log("\nfunctions.logDrain:");
+      notCompared(r.remoteUnavailable, "needs features:read or admin");
+      return;
+    }
+    const show = (d) => {
+      const url = d?.url;
+      if (typeof url !== "string") return "(none)";
+      try {
+        return new URL(url).host;
+      } catch {
+        return "(invalid url)";
+      }
+    };
+    console.log(`
+functions.logDrain (remote v${r.version}):`);
+    console.log(r.changed ? `  ~ logDrain: ${show(r.from)} \u2192 ${show(r.to)}` : "  (no changes)");
+    if (r.applied) console.log(`  \u2713 applied as v${r.applied}`);
+    if (r.changed) count("config:functions.logDrain");
+    compared.features++;
+  });
   const strictApiState = hasFlag("strict-api-state");
   const declaredApiStateKeys = [];
   await runSection("api-state", async () => {
@@ -22536,7 +23175,8 @@ ${r.feature}.${r.datum} (declared in config):`);
         if (!apply) count(key);
       }
       const n = r.summary.created.length + r.summary.updated.length + r.summary.recreated.length + r.summary.unchanged.length + r.summary.undeclared.length + r.summary.deleted.length + r.summary.pending_destructive.length + r.summary.ambiguous.length;
-      compared[r.datum] = (compared[r.datum] ?? 0) + n;
+      const ck = r.datum === "collections" ? "searchCollections" : r.datum;
+      compared[ck] = (compared[ck] ?? 0) + n;
     }
   });
   await runSection("functions", async () => {
@@ -24350,6 +24990,16 @@ ${plan.rationale}`);
           if (pulled.note) pullNotes.push(pulled.note);
         }
       }
+      if (features.includes("vector-search")) {
+        const r = await api("GET", "/v1/search/collections");
+        if (r.status === 200 && featBlocks["vector-search"]) {
+          const block = featBlocks["vector-search"];
+          const pulled = pulledSearchCollections(r.body.data?.collections ?? []);
+          if (pulled.collections) block.collections = pulled.collections;
+          else delete block.collections;
+          if (pulled.note) pullNotes.push(pulled.note);
+        }
+      }
       if (features.includes("ai")) {
         const block = featBlocks.ai;
         delete block.templates;
@@ -24901,7 +25551,7 @@ export default defineConfig(${JSON.stringify({ features: featBlocks, cms: { coll
   architect "<describe your app>" \u2014 plain English in, a reviewed vxil.config.ts draft out
   plan [--explain] \xB7 push [--dev|--target <name>|--prod] [--server [--resume <apply_id>]] [--no-gen] [--skip-functions] \xB7 pull \xB7 gen [--check] [--offline] [--out <f>] [--no-mcp] [--mcp-out <f>]
     push production overrides: --allow-mock-in-prod \xB7 --allow-sandbox-in-prod \xB7 --allow-dev-origins-in-prod \xB7 --yes
-  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>] [--strict-secrets] [--strict-api-state] [--api-state]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (an unreadable remote is 2; secrets by name only, unstored refs informational unless --strict-secrets; declared policies/subscriptions/templates/roles compared to live, an undeclared live row informational unless --strict-api-state)
+  diff [--against <target>|--exit-code] [--explain] [--ignore <k,\u2026>] [--strict-secrets] [--strict-api-state] [--api-state]  \u2014 CI gate: exit 0 no drift \xB7 1 drift \xB7 2 error (an unreadable remote is 2; secrets by name only, unstored refs informational unless --strict-secrets; declared policies/subscriptions/templates/roles/search collections compared to live, an undeclared live row informational unless --strict-api-state)
   doctor [--dev|--target <name>]  \u2014 + secrets referenced-vs-stored (advisory) + per-function served/published/local hash + keys with last-used (stored session)
   versions <feature> \xB7 rollback <feature> --to <v>
   config draft show|save [--file <f>]|publish|discard <feature> \xB7 config draft duplicate <feature> --from <v>  \u2014 stage a config change without making it live
@@ -25773,6 +26423,9 @@ function migrateUsage() {
           rehashed at each user's first sign-in) \xB7 [--oidc-issuer https://<ref>.supabase.co/auth/v1]
           link users for the installed-app session hand-over \xB7 [--file-links shared-link] stored
           public file URLs become stable shared links instead of object ids
+          \xB7 [--with-oauth-identities] carry the Google/Apple/GitHub/Facebook sign-in links (needs
+          --with-password-hashes in the same run) \xB7 [--keep-timestamps] keep each row's source
+          created_at / updated_at (cms creates; server key only)
   verify  reconcile source vs target counts + re-links + restate the residuals (exit 1 on deltas)
   payments --from-provider stripe|paddle|paypal|revenuecat (--customers <file.csv> | --all) [--dry-run]
           backfill SUBSCRIPTIONS through the server sync leg (the project's own provider keys; resumable via
@@ -25877,6 +26530,8 @@ ${migrateUsage()}`);
         resume: hasFlag("resume"),
         ...hasFlag("with-password-hashes") ? { withPasswordHashes: true } : {},
         ...oidcIssuer !== void 0 ? { oidcIssuer } : {},
+        ...hasFlag("with-oauth-identities") ? { withOauthIdentities: true } : {},
+        ...hasFlag("keep-timestamps") ? { keepTimestamps: true } : {},
         ...fileLinks !== void 0 ? { fileLinks } : {},
         ...only?.length ? { only } : {},
         ...hasFlag("assume-schema") ? { assumeSchema: true } : {},