lua-cli 3.36.0 → 3.38.0

package/dist/index.js

@@ -642,7 +642,6 @@ var init_constants = __esm({
       API: process.env.LUA_API_URL || "https://api.heylua.ai",
       AUTH: process.env.LUA_AUTH_URL || "https://auth.heylua.ai",
       CHAT: process.env.LUA_API_URL || "https://api.heylua.ai",
-      WEBHOOK: process.env.LUA_WEBHOOK_URL || "https://webhook.heylua.ai",
       CDN: "https://cdn.heylua.ai"
     };
     CREDENTIALS_FILE = join(CLI_CONFIG_DIR, "credentials");
@@ -841,6 +840,12 @@ var init_package_root = __esm({
 import { z } from "zod";
 import { z as z2 } from "zod";
 import { z as z3 } from "zod";
+function isChannelConversationChannel(channel) {
+  return !!channel && CHANNEL_CONVERSATION_CHANNELS.includes(channel);
+}
+function isChannelConversationThread(threadId, channel) {
+  return !!threadId && isChannelConversationChannel(channel);
+}
 function isPersonaTextObject(value3) {
   if (value3 === null || typeof value3 !== "object" || Array.isArray(value3)) return false;
   const obj = value3;
@@ -1403,6 +1408,101 @@ function buildDefaultPersona(agentName) {
 function buildPersonalSpaceStartingPersona(agentName) {
   return PERSONAL_SPACE_STARTING_PERSONA.replace(new RegExp(AGENT_NAME_TOKEN.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), () => agentName || "Your assistant");
 }
+function maxDrainsForTier(tier) {
+  return tier === "enterprise" ? LOG_DRAIN_MAX_PER_ORG_ENTERPRISE : LOG_DRAIN_MAX_PER_ORG;
+}
+function resolvePresetEndpoint(type, site) {
+  const template3 = LOG_DRAIN_ENDPOINT_TEMPLATES[type];
+  if (!template3 || !site) return void 0;
+  return template3.replace("{site}", site);
+}
+function nextLogDrainQuotaResetAt(now) {
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1)).toISOString();
+}
+function logDrainQuotaWindowExpired(usage, now) {
+  const resetsAt = Date.parse(usage?.resetsAt ?? "");
+  if (!Number.isFinite(resetsAt)) return true;
+  return now.getTime() >= resetsAt;
+}
+function logDrainQuotaRatio(usage, now) {
+  if (!usage) return 0;
+  if (now && logDrainQuotaWindowExpired(usage, now)) return 0;
+  const dimension = /* @__PURE__ */ __name2((used, limit) => {
+    if (!Number.isFinite(limit) || limit <= 0) return 0;
+    if (!Number.isFinite(used) || used <= 0) return 0;
+    return used / limit;
+  }, "dimension");
+  return Math.max(dimension(usage.usedEvents, usage.eventsPerDay), dimension(usage.usedBytes, usage.bytesPerDay));
+}
+function logDrainQuotaDegradationForRatio(ratio) {
+  if (!Number.isFinite(ratio)) return "none";
+  if (ratio >= LOG_DRAIN_QUOTA_PAUSE_RATIO) return "paused";
+  if (ratio >= LOG_DRAIN_QUOTA_DROP_INFO_RATIO) return "info_dropped";
+  if (ratio >= LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO) return "debug_dropped";
+  return "none";
+}
+function logDrainQuotaDegradation(usage, now) {
+  return logDrainQuotaDegradationForRatio(logDrainQuotaRatio(usage, now));
+}
+function logDrainQuotaWarned(usage, now) {
+  return logDrainQuotaRatio(usage, now) >= LOG_DRAIN_QUOTA_WARN_RATIO;
+}
+function logDrainQuotaDroppedSeverities(degradation) {
+  switch (degradation) {
+    case "debug_dropped":
+      return [
+        5
+      ];
+    case "info_dropped":
+      return [
+        5,
+        9
+      ];
+    default:
+      return [];
+  }
+}
+function encodeLogCursor(c) {
+  return Buffer.from(JSON.stringify({
+    t: c.t,
+    id: c.id
+  }), "utf8").toString("base64url");
+}
+function decodeLogCursor(raw) {
+  if (typeof raw !== "string") return null;
+  const trimmed2 = raw.trim();
+  if (!trimmed2 || trimmed2.length > LOG_CURSOR_MAX_LENGTH) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(trimmed2, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const { t, id } = parsed;
+  if (typeof t !== "number" || !Number.isSafeInteger(t) || t < 0) return null;
+  if (typeof id !== "string" || !id || id.length > LOG_CURSOR_MAX_ID_LENGTH) return null;
+  return {
+    t,
+    id
+  };
+}
+function parseLogTimeBound(raw, now = /* @__PURE__ */ new Date()) {
+  if (typeof raw !== "string") return null;
+  const value3 = raw.trim();
+  if (!value3) return null;
+  const relative3 = LOG_RELATIVE_TIME_PATTERN.exec(value3);
+  if (relative3) {
+    const amount = Number(relative3[1]);
+    const unitMs = RELATIVE_UNIT_MS[relative3[2]];
+    if (!Number.isFinite(amount) || unitMs === void 0) return null;
+    const at2 = now.getTime() - amount * unitMs;
+    return Number.isFinite(at2) ? new Date(at2) : null;
+  }
+  if (!LOG_ISO_TIME_PATTERN.test(value3)) return null;
+  const at = Date.parse(value3);
+  return Number.isNaN(at) ? null : new Date(at);
+}
 function isRecord(value3) {
   return typeof value3 === "object" && value3 !== null;
 }
@@ -1767,6 +1867,9 @@ function workflowOccurrenceId(lineageId, stepId) {
 function workflowOrgSlotKey(orgId, kind) {
   return `wf:org:${orgId}:${kind}`;
 }
+function workflowJobModelSourceLabel(source) {
+  return WORKFLOW_JOB_MODEL_SOURCE_LABELS[source];
+}
 function scheduledTimeKey(scheduledTime) {
   return scheduledTime.replace(/[^0-9TZ]/g, "");
 }
@@ -1970,17 +2073,17 @@ function isWorkflowApprovalOutput(value3) {
   return typeof v.approved === "boolean" && WORKFLOW_APPROVAL_OUTPUT_DECISIONS.includes(v.decision) && typeof v.text === "string";
 }
 function extractSingleJsonValue(text) {
-  const trimmed = (text ?? "").trim();
-  if (!trimmed) return {
+  const trimmed2 = (text ?? "").trim();
+  if (!trimmed2) return {
     reason: "reply is empty"
   };
   const fenced = [
-    ...trimmed.matchAll(JSON_FENCE_RE)
+    ...trimmed2.matchAll(JSON_FENCE_RE)
   ];
   if (fenced.length > 1) return {
     reason: "reply carries more than one fenced block"
   };
-  const candidate = fenced.length === 1 ? fenced[0][1].trim() : trimmed;
+  const candidate = fenced.length === 1 ? fenced[0][1].trim() : trimmed2;
   try {
     return {
       value: JSON.parse(candidate)
@@ -1991,17 +2094,17 @@ function extractSingleJsonValue(text) {
     };
   }
   const opens = [
-    trimmed.indexOf("{"),
-    trimmed.indexOf("[")
+    trimmed2.indexOf("{"),
+    trimmed2.indexOf("[")
   ].filter((i) => i !== -1);
   const start = opens.length ? Math.min(...opens) : -1;
-  const end = Math.max(trimmed.lastIndexOf("}"), trimmed.lastIndexOf("]"));
+  const end = Math.max(trimmed2.lastIndexOf("}"), trimmed2.lastIndexOf("]"));
   if (start === -1 || end <= start) return {
     reason: "reply is not JSON"
   };
   try {
     return {
-      value: JSON.parse(trimmed.slice(start, end + 1))
+      value: JSON.parse(trimmed2.slice(start, end + 1))
     };
   } catch {
     return {
@@ -2077,12 +2180,39 @@ function effectiveAgentFeatures(base, override, rule) {
   if (rule === "wholesale") return override || base || void 0;
   return effectiveAgentFeatureRows(base, override).rows;
 }
-var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES;
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
     __defProp2 = Object.defineProperty;
     __name2 = /* @__PURE__ */ __name((target, value3) => __defProp2(target, "name", { value: value3, configurable: true }), "__name");
+    PLUMBING_THREAD_CHANNELS = [
+      "trigger",
+      "template-install",
+      "template-uninstall"
+    ];
+    CHANNEL_CONVERSATION_CHANNELS = [
+      "whatsapp",
+      "slack",
+      "teams",
+      "front",
+      "email",
+      "messagebird",
+      "sms",
+      "mms",
+      "rcs",
+      "instagram",
+      "facebook",
+      "imessage"
+    ];
+    HIDDEN_THREAD_CHANNELS = [
+      ...PLUMBING_THREAD_CHANNELS,
+      ...CHANNEL_CONVERSATION_CHANNELS
+    ];
+    __name(isChannelConversationChannel, "isChannelConversationChannel");
+    __name2(isChannelConversationChannel, "isChannelConversationChannel");
+    __name(isChannelConversationThread, "isChannelConversationThread");
+    __name2(isChannelConversationThread, "isChannelConversationThread");
     __name(isPersonaTextObject, "isPersonaTextObject");
     __name2(isPersonaTextObject, "isPersonaTextObject");
     __name(flattenPersonaText, "flattenPersonaText");
@@ -2754,6 +2884,124 @@ This text is who you are for this person. As you learn them, their name, their w
       "workflow-script",
       "workflow"
     ];
+    AGENT_LOG_ENVIRONMENTS = [
+      "production",
+      "sandbox"
+    ];
+    LOG_DRAIN_TYPES_PHASE1 = [
+      "http",
+      "otlp",
+      "datadog",
+      "betterstack"
+    ];
+    LOG_DRAIN_FORMATS = [
+      "json",
+      "ndjson"
+    ];
+    LOG_DRAIN_SEVERITIES = [
+      "debug",
+      "info",
+      "warn",
+      "error"
+    ];
+    LOG_DRAIN_SOURCES = [
+      ...AGENT_LOG_SOURCES,
+      "execution",
+      // ── phase 2 ──
+      "delivery",
+      "trigger-execution",
+      "job-execution",
+      "workflow-run",
+      "workflow-audit"
+    ];
+    LOG_DRAIN_CONTENT_SOURCES = [
+      "user_message",
+      "agent_response"
+    ];
+    LOG_DRAIN_DEFAULT_SOURCES = [
+      "skill",
+      "job",
+      "webhook",
+      "preprocessor",
+      "postprocessor",
+      "workflow-step",
+      "workflow-script",
+      "device",
+      "runtime",
+      "model-resolver",
+      "trigger",
+      "device-trigger",
+      "workflow",
+      "mcp",
+      "rag",
+      "execution",
+      "agent_error"
+    ];
+    LOG_DRAIN_MAX_PER_ORG = 5;
+    LOG_DRAIN_MAX_PER_ORG_ENTERPRISE = 10;
+    __name(maxDrainsForTier, "maxDrainsForTier");
+    __name2(maxDrainsForTier, "maxDrainsForTier");
+    LOG_DRAIN_DATADOG_SITES = [
+      "datadoghq.com",
+      "datadoghq.eu",
+      "us3.datadoghq.com",
+      "us5.datadoghq.com",
+      "ap1.datadoghq.com",
+      "ddog-gov.com"
+    ];
+    LOG_DRAIN_ENDPOINT_TEMPLATES = {
+      datadog: "https://http-intake.logs.{site}/api/v2/logs"
+    };
+    __name(resolvePresetEndpoint, "resolvePresetEndpoint");
+    __name2(resolvePresetEndpoint, "resolvePresetEndpoint");
+    LOG_DRAIN_QUOTAS = {
+      team: {
+        eventsPerDay: 1e6,
+        bytesPerDay: 1 * 1024 ** 3
+      },
+      business: {
+        eventsPerDay: 1e7,
+        bytesPerDay: 10 * 1024 ** 3
+      },
+      enterprise: {
+        eventsPerDay: Number.MAX_SAFE_INTEGER,
+        bytesPerDay: Number.MAX_SAFE_INTEGER
+      }
+    };
+    LOG_DRAIN_QUOTA_WARN_RATIO = 0.8;
+    LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO = 1;
+    LOG_DRAIN_QUOTA_DROP_INFO_RATIO = 1.25;
+    LOG_DRAIN_QUOTA_PAUSE_RATIO = 1.5;
+    __name(nextLogDrainQuotaResetAt, "nextLogDrainQuotaResetAt");
+    __name2(nextLogDrainQuotaResetAt, "nextLogDrainQuotaResetAt");
+    __name(logDrainQuotaWindowExpired, "logDrainQuotaWindowExpired");
+    __name2(logDrainQuotaWindowExpired, "logDrainQuotaWindowExpired");
+    __name(logDrainQuotaRatio, "logDrainQuotaRatio");
+    __name2(logDrainQuotaRatio, "logDrainQuotaRatio");
+    __name(logDrainQuotaDegradationForRatio, "logDrainQuotaDegradationForRatio");
+    __name2(logDrainQuotaDegradationForRatio, "logDrainQuotaDegradationForRatio");
+    __name(logDrainQuotaDegradation, "logDrainQuotaDegradation");
+    __name2(logDrainQuotaDegradation, "logDrainQuotaDegradation");
+    __name(logDrainQuotaWarned, "logDrainQuotaWarned");
+    __name2(logDrainQuotaWarned, "logDrainQuotaWarned");
+    __name(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
+    __name2(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
+    LOG_CURSOR_MAX_LENGTH = 512;
+    LOG_CURSOR_MAX_ID_LENGTH = 128;
+    LOG_RELATIVE_TIME_PATTERN = /^(\d{1,9})([smhd])$/;
+    LOG_ISO_TIME_PATTERN = /^\d{4}-\d{2}-\d{2}([Tt ]\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?([Zz]|[+-]\d{2}:?\d{2})?)?$/;
+    RELATIVE_UNIT_MS = {
+      s: 1e3,
+      m: 6e4,
+      h: 36e5,
+      d: 864e5
+    };
+    __name(encodeLogCursor, "encodeLogCursor");
+    __name2(encodeLogCursor, "encodeLogCursor");
+    __name(decodeLogCursor, "decodeLogCursor");
+    __name2(decodeLogCursor, "decodeLogCursor");
+    __name(parseLogTimeBound, "parseLogTimeBound");
+    __name2(parseLogTimeBound, "parseLogTimeBound");
     CORE_DRAINING_CODE = "CORE_DRAINING";
     CORE_DRAINING_DEFAULT_RETRY_MS = 1e3;
     CORE_DRAINING_MAX_RETRY_MS = 5e3;
@@ -3520,6 +3768,16 @@ This text is who you are for this person. As you learn them, their name, their w
     __name2(workflowOrgSlotKey, "workflowOrgSlotKey");
     WORKFLOW_JOURNAL_PROTOCOL_VERSION = 1;
     WORKFLOW_CONNECTION_KEY_RE = /^[a-z][a-z0-9_-]{0,63}$/;
+    WORKFLOW_JOB_MODEL_SOURCE_LABELS = {
+      stamp: "lease stamp",
+      initData: "run input",
+      default: "placeholder default",
+      node: "node.model",
+      env: "platform default",
+      org: "org default"
+    };
+    __name(workflowJobModelSourceLabel, "workflowJobModelSourceLabel");
+    __name2(workflowJobModelSourceLabel, "workflowJobModelSourceLabel");
     __name(scheduledTimeKey, "scheduledTimeKey");
     __name2(scheduledTimeKey, "scheduledTimeKey");
     __name(scheduledWorkflowRunIdForTime, "scheduledWorkflowRunIdForTime");
@@ -3753,7 +4011,23 @@ This text is who you are for this person. As you learn them, their name, their w
       * gated and nobody approved it, and conflating the two would make "who approved this run"
       * unanswerable for every run of either kind (§H2 "Audit").
       */
-      "workflow.run.autonomy_applied"
+      "workflow.run.autonomy_applied",
+      // --- run budget cap enforcement (Job-tier billing plan D4; BAC-677) ---
+      /**
+      * The audit twin of the `run.budget_exceeded` run event (WJB-B2a): the run overshot its
+      * `budget.maxCredits` on its LAST step and completed anyway, `budget.exceeded: true`. The budget family
+      * already mirrors run events here — `workflow.run.budget_parked` / `workflow.run.budget_raised` are the
+      * twins of `run.budget_parked` / `run.budget_raised` — and an organisation reviewing what it was charged
+      * needs the overshoot in the audit store beside the raise that preceded it, not only in the run's own
+      * event stream.
+      *
+      * Declared with the run event rather than after it because the emitter port
+      * (`WorkflowAuditPort.action`, typed `workflow.run.${string}`) does not check against this tuple: a name
+      * that is NOT declared here is written to the audit store all the same and no compiler says so.
+      * Declaring it is what makes the later emitter checkable. `workflow.run.budget_parked` is likewise
+      * declared and not yet emitted.
+      */
+      "workflow.run.budget_exceeded"
     ];
     WORKFLOW_AUDIT_METADATA_MAX_BYTES = 4 * 1024;
     __name(isWorkflowAuditEvent, "isWorkflowAuditEvent");
@@ -4763,10 +5037,10 @@ function parseModelTemplate(model) {
   if (!looksLikeModelTemplate(model)) return {
     kind: "static"
   };
-  const trimmed = model.trim();
-  const m = WORKFLOW_MODEL_TEMPLATE_RE.exec(trimmed);
+  const trimmed2 = model.trim();
+  const m = WORKFLOW_MODEL_TEMPLATE_RE.exec(trimmed2);
   if (!m) {
-    const inner = /^\$\{([^}]*)\}$/.exec(trimmed)?.[1];
+    const inner = /^\$\{([^}]*)\}$/.exec(trimmed2)?.[1];
     const root = inner?.split(/[.|]/, 1)[0];
     const why = inner !== void 0 && root !== void 0 && root !== WORKFLOW_MODEL_TEMPLATE_ROOT ? `only the \`${WORKFLOW_MODEL_TEMPLATE_ROOT}\` root is allowed (got \`${root || "(empty)"}\`)` : inner !== void 0 && (inner === WORKFLOW_MODEL_TEMPLATE_ROOT || inner.startsWith(`${WORKFLOW_MODEL_TEMPLATE_ROOT}.`)) ? "the path after `initData.` is empty" : "the whole value must be exactly one placeholder \u2014 no prefix, suffix or second placeholder";
     return {
@@ -4796,7 +5070,7 @@ function parseModelTemplate(model) {
     return {
       kind: "template",
       template: {
-        placeholder: trimmed,
+        placeholder: trimmed2,
         path: path26,
         default: dflt
       }
@@ -4805,7 +5079,7 @@ function parseModelTemplate(model) {
   return {
     kind: "template",
     template: {
-      placeholder: trimmed,
+      placeholder: trimmed2,
       path: path26
     }
   };
@@ -5458,9 +5732,9 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const registry = opts.approvedModels;
     if (registry === void 0) return;
     if (registry === "unavailable") {
-      const trimmed = pin.trim();
-      if (trimmed && !normalizeModelId(trimmed, []).ok) {
-        warn("model-unresolved", inContext(`model "${trimmed}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path26}.model`, id);
+      const trimmed2 = pin.trim();
+      if (trimmed2 && !normalizeModelId(trimmed2, []).ok) {
+        warn("model-unresolved", inContext(`model "${trimmed2}" could not be checked against the approved-model registry (unavailable at push) \u2014 it dispatches only if it resolves there (a provider/model registry code, or a bare id exactly one approved model carries)`), `${path26}.model`, id);
       }
       return;
     }
@@ -7992,6 +8266,49 @@ function graphHasJobTierStep(envelopeOrGraph) {
   const graph = Array.isArray(envelopeOrGraph) ? envelopeOrGraph : env.definition?.graph ?? [];
   return Array.isArray(graph) && graph.some(entryHasJobTier);
 }
+function jobTierSteps(envelopeOrGraph) {
+  const out = [];
+  if (!envelopeOrGraph || typeof envelopeOrGraph !== "object") return out;
+  const env = envelopeOrGraph;
+  const graph = Array.isArray(envelopeOrGraph) ? envelopeOrGraph : env.definition?.graph ?? [];
+  if (!Array.isArray(graph)) return out;
+  for (const entry of graph) collectJobTierSteps(entry, out);
+  return out;
+}
+function jobTierStepIds(envelopeOrGraph) {
+  return jobTierSteps(envelopeOrGraph).map((s) => s.stepId);
+}
+function collectJobTierSteps(entry, out) {
+  const n2 = armEntry2(entry);
+  if (!n2 || typeof n2 !== "object") return;
+  const node = n2;
+  const ws = node.workspace;
+  if (node.tier === "job" || ws !== void 0 && ws !== "inherit") {
+    const stepId = typeof node.id === "string" && node.id ? node.id : "(unnamed)";
+    const model = typeof node.model === "string" && node.model.trim() ? node.model.trim() : void 0;
+    out.push(model === void 0 ? {
+      stepId
+    } : {
+      stepId,
+      model
+    });
+  }
+  switch (node.type) {
+    case "parallel":
+      if (Array.isArray(node.steps)) for (const s of node.steps) collectJobTierSteps(s, out);
+      return;
+    case "conditional":
+      if (Array.isArray(node.steps)) for (const s of node.steps) collectJobTierSteps(s, out);
+      if (node.otherwise !== void 0) collectJobTierSteps(node.otherwise, out);
+      return;
+    case "foreach":
+    case "loop":
+      collectJobTierSteps(node.step, out);
+      return;
+    default:
+      return;
+  }
+}
 var __defProp4, __name4, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_MODEL_TEMPLATE_ROOT, WORKFLOW_MODEL_TEMPLATE_RE, PATH_SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, WORKFLOW_INLINE_RUN_TAG, RUN_ERROR_ISSUES_MAX, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, WORKFLOW_SCHEDULE_TYPES, WORKFLOW_SCHEDULE_SHAPE_ISSUE, WORKFLOW_SCHEDULE_SHAPES_HINT, WORKFLOW_SCHEDULE_RUN_AS, isObject, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
@@ -8796,6 +9113,12 @@ var init_dist2 = __esm({
     __name4(entryHasJobTier, "entryHasJobTier");
     __name(graphHasJobTierStep, "graphHasJobTierStep");
     __name4(graphHasJobTierStep, "graphHasJobTierStep");
+    __name(jobTierSteps, "jobTierSteps");
+    __name4(jobTierSteps, "jobTierSteps");
+    __name(jobTierStepIds, "jobTierStepIds");
+    __name4(jobTierStepIds, "jobTierStepIds");
+    __name(collectJobTierSteps, "collectJobTierSteps");
+    __name4(collectJobTierSteps, "collectJobTierSteps");
   }
 });
 
@@ -12376,8 +12699,8 @@ function ensureGitignored(rootDir, entry, afterEntry) {
       return;
     }
   }
-  const trimmed = content.endsWith("\n") ? content : content + "\n";
-  fs2.writeFileSync(gitignorePath, trimmed + entry + "\n");
+  const trimmed2 = content.endsWith("\n") ? content : content + "\n";
+  fs2.writeFileSync(gitignorePath, trimmed2 + entry + "\n");
 }
 function hasEnvFile() {
   return fs2.existsSync(path2.join(process.cwd(), ".env"));
@@ -27776,6 +28099,7 @@ var init_mcp_server_handler = __esm({
 
 // src/index.ts
 import { Command } from "commander";
+import chalk5 from "chalk";
 
 // src/cli/parse-agent-version.ts
 import { InvalidArgumentError } from "commander";
@@ -29658,8 +29982,8 @@ var PostProcessorApi = class extends HttpClient {
 // src/utils/sync-fetch.ts
 init_developer_api_service();
 init_mcp_server_handler();
-function normalizeForComparison(str) {
-  return str.trim().replace(/\\'/g, "'").replace(/\\"/g, '"').replace(/\\\\/g, "\\").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+function normalizeForComparison(str2) {
+  return str2.trim().replace(/\\'/g, "'").replace(/\\"/g, '"').replace(/\\\\/g, "\\").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
 }
 __name(normalizeForComparison, "normalizeForComparison");
 function canonicalizeForm(value3) {
@@ -31504,12 +31828,30 @@ __name(buildLogsCommand, "buildLogsCommand");
 // src/utils/sync-display.ts
 init_dist();
 import { diffLines } from "diff";
+
+// src/utils/color.ts
+function noColorEnabled(env = process.env) {
+  return !!env.NO_COLOR;
+}
+__name(noColorEnabled, "noColorEnabled");
+function colorize(ansiCode, text) {
+  if (noColorEnabled()) return text;
+  return `${ansiCode}${text}\x1B[0m`;
+}
+__name(colorize, "colorize");
+function configureChalkColor(chalkLike) {
+  if (noColorEnabled()) {
+    chalkLike.level = 0;
+  }
+}
+__name(configureChalkColor, "configureChalkColor");
+
+// src/utils/sync-display.ts
 var colors = {
-  red: "\x1B[31m",
-  green: "\x1B[32m",
-  gray: "\x1B[90m",
-  reset: "\x1B[0m",
-  bold: "\x1B[1m"
+  red: /* @__PURE__ */ __name((s) => colorize("\x1B[31m", s), "red"),
+  green: /* @__PURE__ */ __name((s) => colorize("\x1B[32m", s), "green"),
+  gray: /* @__PURE__ */ __name((s) => colorize("\x1B[90m", s), "gray"),
+  bold: /* @__PURE__ */ __name((s) => colorize("\x1B[1m", s), "bold")
 };
 var primitiveTypeLabels = {
   skill: "SKILLS",
@@ -31521,31 +31863,31 @@ var primitiveTypeLabels = {
 };
 function showColoredDiff(oldText, newText, oldLabel = "Server", newLabel = "Local") {
   if (!oldText && !newText) {
-    console.log(colors.gray + "(both empty)" + colors.reset);
+    console.log(colors.gray("(both empty)"));
     return;
   }
   if (!oldText) {
-    console.log(colors.green + `+ (${newLabel} only - no ${oldLabel} content)` + colors.reset);
+    console.log(colors.green(`+ (${newLabel} only - no ${oldLabel} content)`));
     return;
   }
   if (!newText) {
-    console.log(colors.red + `- (${oldLabel} only - no ${newLabel} content)` + colors.reset);
+    console.log(colors.red(`- (${oldLabel} only - no ${newLabel} content)`));
     return;
   }
   const diff = diffLines(oldText, newText);
   diff.forEach((part) => {
     if (part.added) {
-      part.value.split("\n").filter((l) => l).forEach((line) => console.log(colors.green + "+ " + line + colors.reset));
+      part.value.split("\n").filter((l) => l).forEach((line) => console.log(colors.green("+ " + line)));
     } else if (part.removed) {
-      part.value.split("\n").filter((l) => l).forEach((line) => console.log(colors.red + "- " + line + colors.reset));
+      part.value.split("\n").filter((l) => l).forEach((line) => console.log(colors.red("- " + line)));
     } else {
       const lines = part.value.split("\n").filter((l) => l);
       if (lines.length <= 6) {
-        lines.forEach((line) => console.log(colors.gray + "  " + line + colors.reset));
+        lines.forEach((line) => console.log(colors.gray("  " + line)));
       } else {
-        lines.slice(0, 3).forEach((line) => console.log(colors.gray + "  " + line + colors.reset));
-        console.log(colors.gray + `  ... (${lines.length - 6} unchanged lines) ...` + colors.reset);
-        lines.slice(-3).forEach((line) => console.log(colors.gray + "  " + line + colors.reset));
+        lines.slice(0, 3).forEach((line) => console.log(colors.gray("  " + line)));
+        console.log(colors.gray(`  ... (${lines.length - 6} unchanged lines) ...`));
+        lines.slice(-3).forEach((line) => console.log(colors.gray("  " + line)));
       }
     }
   });
@@ -31553,8 +31895,8 @@ function showColoredDiff(oldText, newText, oldLabel = "Server", newLabel = "Loca
 __name(showColoredDiff, "showColoredDiff");
 function showPersonaDiff(serverPersona, localPersona) {
   console.log("\n" + "=".repeat(60));
-  console.log(colors.bold + "PERSONA DIFF" + colors.reset);
-  console.log(colors.red + "- Server (deployed)" + colors.reset + "  " + colors.green + "+ Local (code)" + colors.reset);
+  console.log(colors.bold("PERSONA DIFF"));
+  console.log(colors.red("- Server (deployed)") + "  " + colors.green("+ Local (code)"));
   console.log("=".repeat(60) + "\n");
   showColoredDiff(flattenPersonaTextAll(serverPersona), flattenPersonaTextAll(localPersona), "Server", "Local");
   console.log("\n" + "=".repeat(60) + "\n");
@@ -31562,19 +31904,19 @@ function showPersonaDiff(serverPersona, localPersona) {
 __name(showPersonaDiff, "showPersonaDiff");
 function showNameDiff(serverName, localName) {
   console.log("\n" + "=".repeat(60));
-  console.log(colors.bold + "NAME DIFF" + colors.reset);
+  console.log(colors.bold("NAME DIFF"));
   console.log("=".repeat(60));
-  console.log(colors.red + `- Server: "${serverName || "(none)"}"` + colors.reset);
-  console.log(colors.green + `+ Local:  "${localName || "(none)"}"` + colors.reset);
+  console.log(colors.red(`- Server: "${serverName || "(none)"}"`));
+  console.log(colors.green(`+ Local:  "${localName || "(none)"}"`));
   console.log("=".repeat(60) + "\n");
 }
 __name(showNameDiff, "showNameDiff");
 function showModelDiff(serverModel, localModel) {
   console.log("\n" + "=".repeat(60));
-  console.log(colors.bold + "MODEL DIFF" + colors.reset);
+  console.log(colors.bold("MODEL DIFF"));
   console.log("=".repeat(60));
-  console.log(colors.red + `- Server: "${serverModel || "(none)"}"` + colors.reset);
-  console.log(colors.green + `+ Local:  "${localModel || "(none)"}"` + colors.reset);
+  console.log(colors.red(`- Server: "${serverModel || "(none)"}"`));
+  console.log(colors.green(`+ Local:  "${localModel || "(none)"}"`));
   console.log("=".repeat(60) + "\n");
 }
 __name(showModelDiff, "showModelDiff");
@@ -31593,17 +31935,17 @@ function showPrimitiveDrift(items, backupAvailable) {
   }
   for (const [type, groupItems] of grouped) {
     const label2 = primitiveTypeLabels[type] ?? type.toUpperCase();
-    console.log("\n" + colors.bold + `\u2501\u2501\u2501 ${label2} \u2501\u2501\u2501` + colors.reset);
+    console.log("\n" + colors.bold(`\u2501\u2501\u2501 ${label2} \u2501\u2501\u2501`));
     for (const item of groupItems) {
-      console.log("\n  " + colors.bold + item.name + colors.reset);
-      const localDisplay = item.localVersion ? `v${item.localVersion}` : colors.gray + "(not found)" + colors.reset;
+      console.log("\n  " + colors.bold(item.name));
+      const localDisplay = item.localVersion ? `v${item.localVersion}` : colors.gray("(not found)");
       console.log(`  Local:  ${localDisplay}`);
-      const serverDisplay = item.serverVersion ? `v${item.serverVersion}` : colors.gray + "(not found)" + colors.reset;
+      const serverDisplay = item.serverVersion ? `v${item.serverVersion}` : colors.gray("(not found)");
       console.log(`  Server: ${serverDisplay}`);
     }
   }
   if (backupAvailable !== void 0) {
-    const backupDisplay = backupAvailable ? colors.green + "available" + colors.reset : colors.red + "not available" + colors.reset;
+    const backupDisplay = backupAvailable ? colors.green("available") : colors.red("not available");
     console.log(`
   Backup: ${backupDisplay}`);
   }
@@ -31625,14 +31967,14 @@ function showPrimitiveDriftSummary(items) {
       versionInfo = `local only${vSuffix(item.localVersion)}`;
     }
     const paddedLabel = label2.padEnd(16);
-    console.log(`  ${colors.red}${paddedLabel}${colors.reset} ${item.name} (${versionInfo})`);
+    console.log(`  ${colors.red(paddedLabel)} ${item.name} (${versionInfo})`);
   }
 }
 __name(showPrimitiveDriftSummary, "showPrimitiveDriftSummary");
 function showGovernanceDiff(serverGovernance, localGovernance) {
   console.log("\n" + "=".repeat(60));
-  console.log(colors.bold + "GOVERNANCE DIFF" + colors.reset);
-  console.log(colors.red + "- Server (deployed)" + colors.reset + "  " + colors.green + "+ Local (code)" + colors.reset);
+  console.log(colors.bold("GOVERNANCE DIFF"));
+  console.log(colors.red("- Server (deployed)") + "  " + colors.green("+ Local (code)"));
   console.log("=".repeat(60) + "\n");
   showColoredDiff(JSON.stringify(serverGovernance, null, 2) || "(none)", JSON.stringify(localGovernance, null, 2) || "(none)", "Server", "Local");
   console.log("\n" + "=".repeat(60) + "\n");
@@ -36930,6 +37272,9 @@ init_artifact_loader();
 init_types();
 init_analytics();
 
+// src/utils/aliases.ts
+init_dist();
+
 // src/utils/suggest.ts
 function levenshtein(a, b) {
   const m = a.length, n2 = b.length;
@@ -37062,21 +37407,58 @@ var ALIAS_MAP = {
       everything: "all"
     })
   },
+  // PRO-1798 (log drains) — `lua drains <action>`; the canonical list is §B.14's verb
+  // table. `rotate-secret` keeps its hyphen: it is the route name too.
+  "drains.action": {
+    canonical: [
+      "list",
+      "status",
+      "deliveries",
+      "create",
+      "update",
+      "delete",
+      "test",
+      "verify",
+      "pause",
+      "resume",
+      "rotate-secret"
+    ],
+    aliases: lowerKeys({
+      ls: "list",
+      view: "list",
+      show: "status",
+      info: "status",
+      health: "status",
+      history: "deliveries",
+      attempts: "deliveries",
+      deliver: "deliveries",
+      new: "create",
+      add: "create",
+      edit: "update",
+      patch: "update",
+      rm: "delete",
+      remove: "delete",
+      del: "delete",
+      send: "test",
+      check: "verify",
+      off: "pause",
+      disable: "pause",
+      on: "resume",
+      enable: "resume",
+      rotate: "rotate-secret",
+      rotatesecret: "rotate-secret",
+      "rotate-key": "rotate-secret"
+    })
+  },
   "logs.type": {
+    // PRO-1838 (A5) / design D-17: DERIVED from the canonical constant, never hand-listed.
+    // `logs.ts` already derives its own enum from `AGENT_LOG_SOURCES`, but THIS list is what
+    // actually rejects `--type` — hand-maintaining it left the five platform sources
+    // (trigger, model-resolver, workflow, workflow-step, workflow-script) unreachable.
+    // `getCanonicalValues` sorts, so the order here is irrelevant to the `Valid values` hint.
+    // `all` and `calls` are handled by the caller before the check and are not members.
     canonical: [
-      "skill",
-      "job",
-      "webhook",
-      "preprocessor",
-      "postprocessor",
-      "user_message",
-      "agent_response",
-      "agent_error",
-      "mcp",
-      "runtime",
-      "rag",
-      "device",
-      "device-trigger"
+      ...AGENT_LOG_SOURCES
     ],
     aliases: lowerKeys({
       skills: "skill",
@@ -40275,8 +40657,8 @@ async function gitUserConfigured(cwd) {
         cwd
       });
       if (code !== 0) return void 0;
-      const trimmed = stdout.trim();
-      return trimmed.length > 0 ? trimmed : void 0;
+      const trimmed2 = stdout.trim();
+      return trimmed2.length > 0 ? trimmed2 : void 0;
     } catch {
       return void 0;
     }
@@ -40301,8 +40683,8 @@ async function getRemoteOriginUrl(cwd) {
       cwd
     });
     if (code !== 0) return null;
-    const trimmed = stdout.trim();
-    return trimmed.length > 0 ? trimmed : null;
+    const trimmed2 = stdout.trim();
+    return trimmed2.length > 0 ? trimmed2 : null;
   } catch {
     return null;
   }
@@ -40673,9 +41055,9 @@ async function readCurrentBranch(cwd) {
     cwd
   });
   if (res.code !== 0) return null;
-  const trimmed = res.stdout.trim();
-  if (!trimmed || trimmed === "HEAD") return null;
-  return trimmed;
+  const trimmed2 = res.stdout.trim();
+  if (!trimmed2 || trimmed2 === "HEAD") return null;
+  return trimmed2;
 }
 __name(readCurrentBranch, "readCurrentBranch");
 
@@ -40793,8 +41175,8 @@ __name(reportFailure, "reportFailure");
 var GIT_MESSAGES = {
   pushStaged: "lua: push staged code",
   createVersion: /* @__PURE__ */ __name((version, message) => {
-    const trimmed = message?.trim();
-    return trimmed ? `lua: create version v${version}: ${trimmed}` : `lua: create version v${version}`;
+    const trimmed2 = message?.trim();
+    return trimmed2 ? `lua: create version v${version}: ${trimmed2}` : `lua: create version v${version}`;
   }, "createVersion"),
   promote: /* @__PURE__ */ __name((version) => `lua: promote v${version} to production`, "promote"),
   delete: /* @__PURE__ */ __name((version) => `lua: delete version v${version}`, "delete"),
@@ -43411,17 +43793,22 @@ var LogsApi = class extends HttpClient {
   }
   /**
   * Retrieves logs for an agent
+  *
+  * The signature is unchanged from before A4 — `filters` simply gained four optional
+  * keys. When `filters.cursor` is set, `page` is NOT sent: the route refuses the two
+  * together (docs `reference/rest/log-drains.mdx`, "Cannot be combined with `page`").
+  *
   * @param agentId - The ID of the agent
   * @param limit - Number of logs per page (default: 20)
-  * @param page - Page number (default: 1)
+  * @param page - Page number (default: 1); ignored when `filters.cursor` is set
   * @param filters - Optional filters to narrow log results
-  * @returns Promise resolving to an ApiResponse containing logs and pagination
+  * @returns Promise resolving to an ApiResponse containing logs, nextCursor and pagination
   */
   async getAgentLogs(agentId, limit, page, filters = {}) {
     const queryParams = new URLSearchParams({
-      limit: limit.toString(),
-      page: page.toString()
+      limit: limit.toString()
     });
+    if (!filters.cursor) queryParams.append("page", page.toString());
     if (filters.logSource) queryParams.append("logSource", filters.logSource);
     if (filters.primitiveId) queryParams.append("primitiveId", filters.primitiveId);
     if (filters.primitiveName) queryParams.append("primitiveName", filters.primitiveName);
@@ -43429,6 +43816,10 @@ var LogsApi = class extends HttpClient {
     if (filters.toolName) queryParams.append("toolName", filters.toolName);
     if (filters.logType) queryParams.append("logType", filters.logType);
     if (filters.userId) queryParams.append("userId", filters.userId);
+    if (filters.since) queryParams.append("since", filters.since);
+    if (filters.until) queryParams.append("until", filters.until);
+    if (filters.environment) queryParams.append("environment", filters.environment);
+    if (filters.cursor) queryParams.append("cursor", filters.cursor);
     return this.httpGet(`/developer/agents/${agentId}/logs?${queryParams.toString()}`, {});
   }
 };
@@ -43729,14 +44120,14 @@ async function startChatLoop(chatEnv, probeWindow) {
   });
   rl.prompt();
   rl.on("line", async (input) => {
-    const trimmed = input.trim();
-    if (!trimmed) {
+    const trimmed2 = input.trim();
+    if (!trimmed2) {
       rl.prompt();
       return;
     }
     let messages;
     try {
-      messages = await parseMessageWithAttachments(trimmed);
+      messages = await parseMessageWithAttachments(trimmed2);
     } catch (error) {
       console.error(`
 \u274C ${error instanceof Error ? error.message : "Failed to process attachments"}
@@ -46554,8 +46945,8 @@ async function promptAreaCode() {
       default: ""
     }
   ]);
-  const trimmed = pattern.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
+  const trimmed2 = pattern.trim();
+  return trimmed2.length > 0 ? trimmed2 : void 0;
 }
 __name(promptAreaCode, "promptAreaCode");
 function smsLabel(transportOrUndefined) {
@@ -47500,6 +47891,7 @@ var CallMetricsApi = class extends HttpClient {
 
 // src/commands/logs.ts
 init_cli_error();
+init_dist();
 var ALL_VALID_SOURCES = AGENT_LOG_SOURCES;
 var ENTITY_SOURCES = /* @__PURE__ */ new Set([
   "skill",
@@ -47510,19 +47902,35 @@ var ENTITY_SOURCES = /* @__PURE__ */ new Set([
   "device"
 ]);
 var NON_ENTITY_SOURCES = new Set(ALL_VALID_SOURCES.filter((s) => !ENTITY_SOURCES.has(s)));
+var FOLLOW_POLL_MS = 2e3;
+var FOLLOW_POLL_JITTER_MS = 500;
+var FOLLOW_BACKOFF_MIN_MS = 1e3;
+var FOLLOW_BACKOFF_MAX_MS = 3e4;
+var FOLLOW_PAGE_CAP = 10;
+var RELATIVE_WINDOW = LOG_RELATIVE_TIME_PATTERN;
+var ISO_TIME_SHAPE = LOG_ISO_TIME_PATTERN;
 async function logsCommand(cmdObj) {
   return withErrorHandling(async () => {
+    const pageGiven = cmdObj?.page !== void 0 && cmdObj?.page !== null && cmdObj?.page !== "";
     const options = {
       type: cmdObj?.type || null,
       name: cmdObj?.name || null,
       limit: cmdObj?.limit ? parseInt(cmdObj.limit, 10) : 20,
-      page: cmdObj?.page ? parseInt(cmdObj.page, 10) : 1,
+      page: pageGiven ? parseInt(cmdObj.page, 10) : 1,
+      pageGiven,
       json: cmdObj?.json || false,
       userId: cmdObj?.userId || null,
       agentId: cmdObj?.agentId || null,
       direction: cmdObj?.direction || null,
-      status: cmdObj?.status || null
+      status: cmdObj?.status || null,
+      since: cmdObj?.since ? parseWindowBound("--since", String(cmdObj.since)) : void 0,
+      until: cmdObj?.until ? parseWindowBound("--until", String(cmdObj.until)) : void 0,
+      follow: cmdObj?.follow || false,
+      environment: cmdObj?.environment ? parseEnvironment(String(cmdObj.environment)) : void 0
     };
+    if (options.follow && options.pageGiven) {
+      throw CliError.usage("lua: --follow cannot be combined with --page.", "Drop --page: --follow starts from --since (or the newest page) and keeps going.");
+    }
     const { agentId: configAgentId, apiKey } = await initializeCommand();
     const effectiveAgentId = options.agentId || configAgentId;
     if (options.type === "calls") {
@@ -47537,7 +47945,18 @@ async function logsCommand(cmdObj) {
       return;
     }
     const logsApi = new LogsApi(BASE_URLS.API, apiKey);
-    const hasNonInteractiveFlags = options.type || options.name || options.json || options.userId;
+    const hasNonInteractiveFlags = Boolean(options.type || options.name || options.json || options.userId || options.since || options.until || options.environment || options.follow);
+    trackEvent("cli_logs_action", {
+      filter_type: options.type || null,
+      json_output: options.json || false,
+      non_interactive: hasNonInteractiveFlags,
+      page_requested: options.page || 1,
+      agent_id_override: !!options.agentId,
+      follow: !!options.follow,
+      has_since: !!options.since,
+      has_until: !!options.until,
+      environment: options.environment || null
+    });
     if (hasNonInteractiveFlags) {
       await nonInteractiveLogs(logsApi, effectiveAgentId, apiKey, options);
     } else {
@@ -47545,13 +47964,6 @@ async function logsCommand(cmdObj) {
 `);
       await interactiveLogs(logsApi, effectiveAgentId, apiKey);
     }
-    trackEvent("cli_logs_action", {
-      filter_type: options.type || null,
-      json_output: options.json || false,
-      non_interactive: hasNonInteractiveFlags,
-      page_requested: options.page || 1,
-      agent_id_override: !!options.agentId
-    });
   }, "logs viewing");
 }
 __name(logsCommand, "logsCommand");
@@ -47603,7 +48015,7 @@ function renderLogEntry(log, isLast) {
   const logSource = log.metadata?.logSource;
   const primitiveId = log.metadata?.primitiveId;
   const primitiveName = log.metadata?.primitiveName;
-  const { toolName, channel, userId } = log.metadata;
+  const { toolName, channel, userId, environment, agentVersion } = log.metadata;
   const icon = getLogIcon(log.subType, logSource);
   const color = getLogColor(log.subType, logSource);
   console.log(color(`${icon} [${timestamp}] ${log.subType.toUpperCase()}`));
@@ -47626,6 +48038,12 @@ function renderLogEntry(log, isLast) {
       console.log(chalk2.gray(`   Tool Name: ${toolName}`));
     }
   }
+  if (environment) {
+    console.log(chalk2.gray(`   Env:      ${environment}`));
+  }
+  if (agentVersion) {
+    console.log(chalk2.gray(`   Version:  ${agentVersion}`));
+  }
   if (log.duration !== void 0) {
     console.log(chalk2.gray(`   Duration: ${log.duration}ms`));
   }
@@ -47635,6 +48053,13 @@ function renderLogEntry(log, isLast) {
   }
 }
 __name(renderLogEntry, "renderLogEntry");
+function formatPageHeader(pagination) {
+  if (pagination?.totalCountExact === false) {
+    return `Page ${pagination.currentPage} (${pagination.totalCount}+ total logs \u2014 count capped; page with --json nextCursor)`;
+  }
+  return `Page ${pagination.currentPage} of ${pagination.totalPages} (${pagination.totalCount} total logs)`;
+}
+__name(formatPageHeader, "formatPageHeader");
 function displayLogsCore(logs, pagination, title, clearScreen = false) {
   if (clearScreen) {
     console.clear();
@@ -47643,7 +48068,7 @@ function displayLogsCore(logs, pagination, title, clearScreen = false) {
 ${title}
 `);
   writeInfo(`${"\u2500".repeat(80)}`);
-  writeInfo(`Page ${pagination.currentPage} of ${pagination.totalPages} (${pagination.totalCount} total logs)
+  writeInfo(`${formatPageHeader(pagination)}
 `);
   if (logs.length === 0) {
     writeInfo("No logs found.");
@@ -47699,6 +48124,149 @@ async function resolveEntityId(apiKey, agentId, type, nameOrId) {
   return found?.id || null;
 }
 __name(resolveEntityId, "resolveEntityId");
+function parseWindowBound(flag, raw) {
+  const value3 = raw.trim();
+  if (RELATIVE_WINDOW.test(value3)) return value3;
+  if (ISO_TIME_SHAPE.test(value3)) {
+    const parsed = Date.parse(value3);
+    if (Number.isFinite(parsed)) return new Date(parsed).toISOString();
+  }
+  throw CliError.usage(`lua: ${flag} "${raw}" is not a time.`, `Use an ISO 8601 instant (2026-09-21T09:00:00Z) or a relative window: 15m, 2h, 7d.`);
+}
+__name(parseWindowBound, "parseWindowBound");
+function parseEnvironment(raw) {
+  const value3 = raw.trim().toLowerCase();
+  const valid = [
+    ...AGENT_LOG_ENVIRONMENTS
+  ].sort();
+  if (valid.includes(value3)) return value3;
+  throw CliError.usage(`lua: "${raw}" is not a valid --environment value.`, `Valid values: ${valid.join(", ")}`);
+}
+__name(parseEnvironment, "parseEnvironment");
+function followDelayMs() {
+  const raw = Number(process.env.LUA_LOGS_FOLLOW_INTERVAL_MS);
+  const base = Number.isFinite(raw) && raw >= 0 && raw <= 6e4 ? raw : FOLLOW_POLL_MS;
+  const jitter = Math.min(FOLLOW_POLL_JITTER_MS, Math.floor(base / 4));
+  return base + (jitter > 0 ? Math.floor(Math.random() * jitter) : 0);
+}
+__name(followDelayMs, "followDelayMs");
+function sleep2(ms, signal) {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve7) => {
+    const done = /* @__PURE__ */ __name(() => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve7();
+    }, "done");
+    const timer = setTimeout(done, ms);
+    signal.addEventListener("abort", done, {
+      once: true
+    });
+  });
+}
+__name(sleep2, "sleep");
+function rowKey(row2) {
+  return row2.id || row2._id;
+}
+__name(rowKey, "rowKey");
+async function sweepWindow(logsApi, agentId, limit, filters, pageCap) {
+  const rows3 = [];
+  let cursor = filters.cursor;
+  let pagination;
+  let pages = 0;
+  for (; ; ) {
+    const response = await logsApi.getAgentLogs(agentId, limit, 1, {
+      ...filters,
+      cursor
+    });
+    if (!response.success) {
+      throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Unknown error", void 0, apiErrorDetail(response.error));
+    }
+    const data = response.data;
+    rows3.push(...data.logs ?? []);
+    pagination = data.pagination;
+    pages += 1;
+    const next = data.nextCursor ?? null;
+    if (!next || pages >= pageCap) {
+      return {
+        rows: rows3,
+        nextCursor: next,
+        pagination,
+        capped: Boolean(next) && pages >= pageCap
+      };
+    }
+    cursor = next;
+  }
+}
+__name(sweepWindow, "sweepWindow");
+async function followLogs(logsApi, agentId, options, baseFilters) {
+  const limit = options.limit || 20;
+  const controller = new AbortController();
+  const onSigint = /* @__PURE__ */ __name(() => controller.abort(), "onSigint");
+  process.once("SIGINT", onSigint);
+  const untilMs = options.until ? RELATIVE_WINDOW.test(options.until) ? 0 : Date.parse(options.until) : void 0;
+  let boundarySeen = /* @__PURE__ */ new Set();
+  let since = baseFilters.since;
+  let backoff = 0;
+  try {
+    while (!controller.signal.aborted) {
+      let sweep;
+      try {
+        const pageCap = since ? FOLLOW_PAGE_CAP : 1;
+        sweep = await sweepWindow(logsApi, agentId, limit, {
+          ...baseFilters,
+          since,
+          cursor: void 0
+        }, pageCap);
+      } catch (error) {
+        if (controller.signal.aborted) break;
+        if (error instanceof CliError && error.exitCode === CLI_EXIT.UNAVAILABLE) {
+          backoff = Math.min(FOLLOW_BACKOFF_MAX_MS, backoff ? backoff * 2 : FOLLOW_BACKOFF_MIN_MS);
+          await sleep2(backoff, controller.signal);
+          continue;
+        }
+        throw error;
+      }
+      backoff = 0;
+      const fresh = sweep.rows.filter((row2) => !boundarySeen.has(rowKey(row2)));
+      if (fresh.length > 0) {
+        if (options.json) {
+          console.log(JSON.stringify({
+            logs: fresh,
+            nextCursor: sweep.nextCursor ?? null,
+            pagination: sweep.pagination ?? null
+          }, null, 2));
+        } else {
+          const ordered = [
+            ...fresh
+          ].reverse();
+          ordered.forEach((row2, index) => renderLogEntry(row2, index === ordered.length - 1));
+        }
+        if (sweep.capped && !options.json) {
+          writeInfo(`   \u2026 more rows remain in this window (stopped after ${FOLLOW_PAGE_CAP} pages); raising --limit catches up faster.`);
+        }
+      }
+      if (sweep.rows.length > 0) {
+        let newestMs = Number.NEGATIVE_INFINITY;
+        for (const row2 of sweep.rows) {
+          const ms = Date.parse(row2.timestamp);
+          if (Number.isFinite(ms) && ms > newestMs) newestMs = ms;
+        }
+        if (Number.isFinite(newestMs)) {
+          since = new Date(newestMs).toISOString();
+          boundarySeen = new Set(sweep.rows.filter((row2) => Date.parse(row2.timestamp) === newestMs).map((row2) => rowKey(row2)));
+        }
+      }
+      if (untilMs !== void 0 && Date.now() >= untilMs) break;
+      if (controller.signal.aborted) break;
+      await sleep2(followDelayMs(), controller.signal);
+    }
+  } finally {
+    process.off("SIGINT", onSigint);
+    if (!controller.signal.aborted) controller.abort();
+  }
+}
+__name(followLogs, "followLogs");
 async function nonInteractiveLogs(logsApi, agentId, apiKey, options) {
   const filters = {};
   if (options.type && options.type !== "all") {
@@ -47721,6 +48289,13 @@ async function nonInteractiveLogs(logsApi, agentId, apiKey, options) {
   if (options.userId) {
     filters.userId = options.userId;
   }
+  if (options.since) filters.since = options.since;
+  if (options.until) filters.until = options.until;
+  if (options.environment) filters.environment = options.environment;
+  if (options.follow) {
+    await followLogs(logsApi, agentId, options, filters);
+    return;
+  }
   const response = await logsApi.getAgentLogs(agentId, options.limit || 20, options.page || 1, filters);
   if (!response.success) {
     throw CliError.fromStatus(response.error?.statusCode, response.error?.message || "Unknown error", void 0, apiErrorDetail(response.error));
@@ -47729,6 +48304,10 @@ async function nonInteractiveLogs(logsApi, agentId, apiKey, options) {
   if (options.json) {
     console.log(JSON.stringify({
       logs: data.logs,
+      // Always present so a script can `while (nextCursor)` without probing for the
+      // key; `null` is the documented end-of-stream, and a server that predates A4
+      // simply never sets it.
+      nextCursor: data.nextCursor ?? null,
       pagination: data.pagination
     }, null, 2));
   } else {
@@ -48017,8 +48596,8 @@ async function handleNavigation(action, pagination, setPage) {
   }
 }
 __name(handleNavigation, "handleNavigation");
-function capitalize(str) {
-  return str.charAt(0).toUpperCase() + str.slice(1);
+function capitalize(str2) {
+  return str2.charAt(0).toUpperCase() + str2.slice(1);
 }
 __name(capitalize, "capitalize");
 function getLogIcon(subType, logSource) {
@@ -48082,6 +48661,1423 @@ function getLogColor(subType, logSource) {
 }
 __name(getLogColor, "getLogColor");
 
+// src/commands/drains.ts
+init_cli();
+init_command_utils();
+init_files();
+init_credential_operational_context();
+init_constants();
+init_cli_error();
+init_analytics();
+
+// src/api/drains.api.service.ts
+init_http_client();
+var DrainsApi = class extends HttpClient {
+  static {
+    __name(this, "DrainsApi");
+  }
+  orgId;
+  constructor(baseUrl, credential, orgId) {
+    super(baseUrl, credential), this.orgId = orgId;
+  }
+  /**
+  * The base path every call hangs off — RELATIVE to `baseUrl`, because every
+  * `HttpClient` verb prepends `this.baseUrl` itself (`httpGet(url) => baseUrl + url`).
+  * The scaffolded body interpolated `baseUrl` a second time, which would have sent
+  * every request to `<base><base>/admin/…`; the signature is unchanged.
+  */
+  base() {
+    return `/admin/orgs/${encodeURIComponent(this.orgId)}/log-drains`;
+  }
+  /** `…/log-drains/:drainId` with the id encoded. */
+  drainPath(drainId, suffix = "") {
+    return `${this.base()}/${encodeURIComponent(drainId)}${suffix}`;
+  }
+  async listDrains() {
+    return this.httpGet(this.base());
+  }
+  async getDrain(drainId) {
+    return this.httpGet(this.drainPath(drainId));
+  }
+  /** The response carries `secret` — print it ONCE and never store it. */
+  async createDrain(input) {
+    return this.httpPostOnce(this.base(), input);
+  }
+  async updateDrain(drainId, input) {
+    return this.httpPatch(this.drainPath(drainId), input);
+  }
+  async deleteDrain(drainId) {
+    return this.httpDelete(this.drainPath(drainId));
+  }
+  async testDrain(drainId) {
+    return this.httpPost(this.drainPath(drainId, "/test"));
+  }
+  async verifyDrain(drainId) {
+    return this.httpPost(this.drainPath(drainId, "/verify"));
+  }
+  async pauseDrain(drainId, reason) {
+    return this.httpPost(this.drainPath(drainId, "/pause"), reason ? {
+      reason
+    } : {});
+  }
+  async resumeDrain(drainId) {
+    return this.httpPost(this.drainPath(drainId, "/resume"), {});
+  }
+  /**
+  * `finalize` closes an open rotation window instead of opening a new one — that
+  * answer is a plain `LogDrainRead` and is safe to retry; minting is not.
+  */
+  async rotateSecret(drainId, finalize) {
+    const path26 = this.drainPath(drainId, `/rotate-secret${finalize ? "?finalize=true" : ""}`);
+    return finalize ? this.httpPost(path26, {}) : this.httpPostOnce(path26, {});
+  }
+  async listDeliveries(drainId, opts = {}) {
+    const query = new URLSearchParams();
+    if (opts.limit !== void 0) query.set("limit", String(opts.limit));
+    if (opts.cursor) query.set("cursor", opts.cursor);
+    if (opts.kind) query.set("kind", opts.kind);
+    const suffix = query.toString() ? `?${query.toString()}` : "";
+    return this.httpGet(this.drainPath(drainId, `/deliveries${suffix}`));
+  }
+};
+
+// src/commands/drains.mutations.ts
+init_dist();
+init_cli();
+init_cli_error();
+var CONTENT_WARNING_TEXT = "These sources carry customer content: user_message and agent_response bodies, and the debug tool envelopes attached to them. Message bodies and tool inputs may contain personal data and secrets. Lua scrubs known token shapes only \u2014 anything it does not recognise leaves the platform with the record.";
+var CONTENT_ACKNOWLEDGEMENT_TEXT = "I understand that user messages, agent responses and debug tool envelopes may contain personal data and secrets, and that Lua scrubs known token shapes only.";
+var MAX_HEADERS = 10;
+var HEADER_NAME_PATTERN = /^[A-Za-z0-9-]{1,64}$/;
+var ENDPOINT_TYPES = [
+  "http",
+  "otlp",
+  "betterstack"
+];
+var SITE_TYPES = [
+  "datadog"
+];
+var PHASE2_SOURCES = [
+  "delivery",
+  "trigger-execution",
+  "job-execution",
+  "workflow-run",
+  "workflow-audit"
+];
+var SELECTABLE_SOURCES = LOG_DRAIN_SOURCES.filter((source) => !PHASE2_SOURCES.includes(source));
+var NON_CONTENT_SOURCES = SELECTABLE_SOURCES.filter((source) => !LOG_DRAIN_CONTENT_SOURCES.includes(source));
+var TOKEN_ECHO_TYPES = [
+  "http"
+];
+var VERIFY_OUTCOME_TEXT = {
+  ok: "verified",
+  no_2xx: "the endpoint did not answer 2xx",
+  token_not_echoed: "token not echoed",
+  ssrf_refused: "the endpoint was refused by the SSRF guard",
+  timeout: "the endpoint did not answer in time",
+  error: "the verification request failed"
+};
+var DRAIN_POLL = {
+  intervalMs: 1e3,
+  testAttempts: 30,
+  verifyAttempts: 60,
+  sleep: /* @__PURE__ */ __name((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)), "sleep")
+};
+function printJson(payload) {
+  console.log(JSON.stringify(payload, null, 2));
+}
+__name(printJson, "printJson");
+function emitAside(line, json) {
+  if (json) process.stderr.write(`${line}
+`);
+  else writeInfo(line);
+}
+__name(emitAside, "emitAside");
+function shortIso(value3) {
+  if (typeof value3 !== "string" || value3.length === 0) return "\u2014";
+  const date = new Date(value3);
+  if (Number.isNaN(date.getTime())) return value3;
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+__name(shortIso, "shortIso");
+function trimmed(value3) {
+  if (typeof value3 !== "string") return void 0;
+  const text = value3.trim();
+  return text.length > 0 ? text : void 0;
+}
+__name(trimmed, "trimmed");
+function parseType(raw) {
+  const value3 = trimmed(raw)?.toLowerCase();
+  if (!value3) return void 0;
+  if (!LOG_DRAIN_TYPES_PHASE1.includes(value3)) {
+    throw CliError.usage(`--type "${raw}" is not available.`, listHint("Available destinations", LOG_DRAIN_TYPES_PHASE1));
+  }
+  return value3;
+}
+__name(parseType, "parseType");
+function parseFormat(raw) {
+  const value3 = trimmed(raw)?.toLowerCase();
+  if (!value3) return void 0;
+  if (!LOG_DRAIN_FORMATS.includes(value3)) {
+    throw CliError.usage(`--format "${raw}" is not a drain format.`, listHint("Valid values", LOG_DRAIN_FORMATS));
+  }
+  return value3;
+}
+__name(parseFormat, "parseFormat");
+function parseSeverity(raw) {
+  const value3 = trimmed(raw)?.toLowerCase();
+  if (!value3) return void 0;
+  if (!LOG_DRAIN_SEVERITIES.includes(value3)) {
+    throw CliError.usage(`--min-severity "${raw}" is not a severity.`, listHint("Valid values", LOG_DRAIN_SEVERITIES));
+  }
+  return value3;
+}
+__name(parseSeverity, "parseSeverity");
+function splitList(raw) {
+  return raw.split(",").map((part) => part.trim()).filter((part) => part.length > 0);
+}
+__name(splitList, "splitList");
+function parseSources(raw) {
+  const value3 = trimmed(raw);
+  if (!value3) return void 0;
+  const requested = splitList(value3);
+  if (requested.length === 0) {
+    throw CliError.usage("--sources was empty \u2014 name at least one source, or leave the flag off for the default set.");
+  }
+  const sources = [];
+  for (const source of requested) {
+    if (!SELECTABLE_SOURCES.includes(source)) {
+      throw CliError.usage(`--sources "${source}" is not a selectable source.`, listHint("Valid values", SELECTABLE_SOURCES));
+    }
+    if (!sources.includes(source)) sources.push(source);
+  }
+  return sources;
+}
+__name(parseSources, "parseSources");
+function parseEnvironments(raw) {
+  const value3 = trimmed(raw);
+  if (!value3) return void 0;
+  const environments = [];
+  for (const environment of splitList(value3)) {
+    if (!AGENT_LOG_ENVIRONMENTS.includes(environment)) {
+      throw CliError.usage(`--environments "${environment}" is not an environment.`, listHint("Valid values", AGENT_LOG_ENVIRONMENTS));
+    }
+    if (!environments.includes(environment)) {
+      environments.push(environment);
+    }
+  }
+  return environments.length > 0 ? environments : void 0;
+}
+__name(parseEnvironments, "parseEnvironments");
+function parseAgents(raw) {
+  const value3 = trimmed(raw);
+  if (!value3) return void 0;
+  if (value3.toLowerCase() === "all" || value3 === "*") return "*";
+  const agents = splitList(value3);
+  if (agents.length === 0) {
+    throw CliError.usage("--agents was empty \u2014 pass 'all' or a comma-separated list of agent ids.");
+  }
+  return agents;
+}
+__name(parseAgents, "parseAgents");
+function parseSampling(raw) {
+  const value3 = trimmed(raw);
+  if (!value3) return void 0;
+  const hint = "Only debug is sampleable in phase 1, e.g. --sampling debug=0.1";
+  const eq3 = value3.indexOf("=");
+  if (eq3 === -1) throw CliError.usage(`--sampling "${raw}" must read <key>=<fraction>.`, hint);
+  const key = value3.slice(0, eq3).trim().toLowerCase();
+  const fraction = Number(value3.slice(eq3 + 1).trim());
+  if (key !== "debug") throw CliError.usage(`--sampling "${key}" is not sampleable.`, hint);
+  if (!Number.isFinite(fraction) || fraction <= 0 || fraction > 1) {
+    throw CliError.usage(`--sampling debug must be a fraction in (0, 1] (got "${value3.slice(eq3 + 1).trim()}").`, hint);
+  }
+  return {
+    debug: fraction
+  };
+}
+__name(parseSampling, "parseSampling");
+function assertHeaderName(name, flag) {
+  if (!HEADER_NAME_PATTERN.test(name)) {
+    throw CliError.usage(`${flag} header name "${name}" must match ^[A-Za-z0-9-]{1,64}$.`, "A header name is a token \u2014 no spaces, no colon, no newline");
+  }
+}
+__name(assertHeaderName, "assertHeaderName");
+async function resolveHeaders(options) {
+  const headers = [];
+  const seen = /* @__PURE__ */ new Set();
+  const remember = /* @__PURE__ */ __name((header) => {
+    const key = header.name.toLowerCase();
+    if (seen.has(key)) {
+      throw CliError.usage(`Header "${header.name}" was given twice.`, "Each header name may appear once");
+    }
+    seen.add(key);
+    headers.push(header);
+  }, "remember");
+  for (const entry of options.headerFromEnv ?? []) {
+    const raw = `${entry}`.trim();
+    const eq3 = raw.indexOf("=");
+    if (eq3 <= 0 || eq3 === raw.length - 1) {
+      throw CliError.usage(`--header-from-env "${raw}" must read <name>=<ENV_VAR>.`, "The VALUE stays in the environment \u2014 e.g. --header-from-env DD-API-KEY=DATADOG_API_KEY");
+    }
+    const name = raw.slice(0, eq3).trim();
+    const variable = raw.slice(eq3 + 1).trim();
+    assertHeaderName(name, "--header-from-env");
+    const value3 = process.env[variable];
+    if (value3 === void 0 || value3 === "") {
+      throw CliError.usage(`--header-from-env ${name}=${variable}: the environment variable ${variable} is unset or empty.`, `Export ${variable} in the step that runs this command`);
+    }
+    remember({
+      name,
+      value: value3,
+      fromEnv: variable
+    });
+  }
+  for (const entry of options.header ?? []) {
+    const raw = `${entry}`.trim();
+    if (raw.includes("=")) {
+      throw CliError.usage(`--header takes a header NAME, not a value ("${raw.slice(0, raw.indexOf("="))}=\u2026").`, joinHint("Header values are never flags \u2014 a shell history and a CI log both keep them.", "Interactively: --header " + raw.slice(0, raw.indexOf("=")) + " (the value is prompted)", "In --ci: --header-from-env " + raw.slice(0, raw.indexOf("=")) + "=YOUR_ENV_VAR"));
+    }
+    assertHeaderName(raw, "--header");
+    if (isCiModeEnabled()) {
+      throw CliError.usage(`--header ${raw} needs an interactive prompt for its value, and --ci is set.`, `Use --header-from-env ${raw}=YOUR_ENV_VAR so the value never reaches the command line`);
+    }
+    const answer = await safePrompt([
+      {
+        type: "password",
+        name: "value",
+        mask: "*",
+        message: `Value for header ${raw}:`,
+        validate: /* @__PURE__ */ __name((input) => input && input.length > 0 ? true : "A header value cannot be empty", "validate")
+      }
+    ]);
+    const value3 = answer?.value;
+    if (!value3) throw CliError.usage(`No value was given for header ${raw}.`);
+    remember({
+      name: raw,
+      value: value3
+    });
+  }
+  if (headers.length > MAX_HEADERS) {
+    throw CliError.usage(`A drain carries at most ${MAX_HEADERS} headers (got ${headers.length}).`);
+  }
+  return headers;
+}
+__name(resolveHeaders, "resolveHeaders");
+function wireHeaders(headers) {
+  return headers.map(({ name, value: value3 }) => ({
+    name,
+    value: value3
+  }));
+}
+__name(wireHeaders, "wireHeaders");
+function wantsContent(options, sources) {
+  if (options.includeContent === true) return true;
+  return (sources ?? []).some((source) => LOG_DRAIN_CONTENT_SOURCES.includes(source));
+}
+__name(wantsContent, "wantsContent");
+async function acknowledgeContent(options) {
+  emitAside("", options.json);
+  emitAside(CONTENT_WARNING_TEXT, options.json);
+  emitAside("", options.json);
+  emitAside(CONTENT_ACKNOWLEDGEMENT_TEXT, options.json);
+  emitAside("", options.json);
+  if (options.yes) return true;
+  if (isCiModeEnabled()) {
+    throw CliError.usage("--include-content needs the acknowledgement above; pass --yes to give it non-interactively.", "Nothing was created");
+  }
+  const answer = await safePrompt([
+    {
+      type: "confirm",
+      name: "acknowledged",
+      message: "Do you acknowledge this?",
+      default: false
+    }
+  ]);
+  if (!answer?.acknowledged) {
+    throw CliError.usage("Content was not enabled: the acknowledgement was declined.", "Nothing was created");
+  }
+  return true;
+}
+__name(acknowledgeContent, "acknowledgeContent");
+function missingFlag(flag, what, hint) {
+  return CliError.usage(`${flag} is required (${what}).`, joinHint(hint, "Prompting is not possible under --ci"));
+}
+__name(missingFlag, "missingFlag");
+async function promptText(message, flag, what) {
+  if (isCiModeEnabled()) throw missingFlag(flag, what);
+  const answer = await safePrompt([
+    {
+      type: "input",
+      name: "value",
+      message,
+      validate: /* @__PURE__ */ __name((input) => input && input.trim().length > 0 ? true : "Required", "validate")
+    }
+  ]);
+  const value3 = trimmed(answer?.value);
+  if (!value3) throw missingFlag(flag, what);
+  return value3;
+}
+__name(promptText, "promptText");
+async function promptChoice(message, choices, flag, what) {
+  if (isCiModeEnabled()) throw missingFlag(flag, what, `Values: ${choices.join(" | ")}`);
+  const answer = await safePrompt([
+    {
+      type: "list",
+      name: "value",
+      message,
+      choices
+    }
+  ]);
+  const value3 = answer?.value;
+  if (!value3) throw missingFlag(flag, what, `Values: ${choices.join(" | ")}`);
+  return value3;
+}
+__name(promptChoice, "promptChoice");
+async function promptSources() {
+  const answer = await safePrompt([
+    {
+      type: "checkbox",
+      name: "sources",
+      message: "Which sources should this drain carry?",
+      pageSize: 20,
+      choices: [
+        {
+          type: "separator",
+          line: "\u2500\u2500 Conversation content (needs the acknowledgement) \u2500\u2500"
+        },
+        ...LOG_DRAIN_CONTENT_SOURCES.map((source) => ({
+          name: source,
+          value: source,
+          checked: false
+        })),
+        {
+          type: "separator",
+          line: "\u2500\u2500 Execution and platform \u2500\u2500"
+        },
+        ...NON_CONTENT_SOURCES.map((source) => ({
+          name: source,
+          value: source,
+          checked: LOG_DRAIN_DEFAULT_SOURCES.includes(source)
+        }))
+      ],
+      validate: /* @__PURE__ */ __name((chosen) => chosen.length > 0 ? true : "Pick at least one source", "validate")
+    }
+  ]);
+  const sources = answer?.sources ?? [];
+  if (sources.length === 0) throw CliError.usage("A drain needs at least one source.");
+  return sources;
+}
+__name(promptSources, "promptSources");
+async function resolveDestination(type, options) {
+  const endpoint = trimmed(options.endpoint);
+  const site = trimmed(options.site);
+  if (SITE_TYPES.includes(type)) {
+    if (endpoint) {
+      throw CliError.usage(`--endpoint is not accepted for ${type}: its URL is derived from --site.`, listHint("Sites", LOG_DRAIN_DATADOG_SITES));
+    }
+    const chosen = site ?? await promptChoice("Which site?", LOG_DRAIN_DATADOG_SITES, "--site", `${type}`);
+    if (!LOG_DRAIN_DATADOG_SITES.includes(chosen)) {
+      throw CliError.usage(`--site "${chosen}" is not a ${type} site.`, listHint("Sites", LOG_DRAIN_DATADOG_SITES));
+    }
+    return {
+      site: chosen
+    };
+  }
+  if (!ENDPOINT_TYPES.includes(type)) {
+    throw CliError.usage(`This lua-cli does not know how to address a "${type}" destination yet.`, "Upgrade lua-cli, or create the drain from the dashboard");
+  }
+  if (site) {
+    throw CliError.usage(`--site is not accepted for ${type}: give the destination URL with --endpoint.`);
+  }
+  const url = endpoint ?? await promptText(type === "otlp" ? "OTLP logs endpoint (the full /v1/logs URL):" : "Destination URL:", "--endpoint", `${type} sends to your own URL`);
+  return {
+    endpoint: url
+  };
+}
+__name(resolveDestination, "resolveDestination");
+function verificationCurl(type, endpoint, headers) {
+  const target = endpoint ?? "<your endpoint>";
+  const headerArgs = headers.map((header) => header.fromEnv ? `  -H "${header.name}: $${header.fromEnv}" \\` : `  -H '${header.name}: <the value you entered>' \\`);
+  if (TOKEN_ECHO_TYPES.includes(type)) {
+    return [
+      `curl -isS -X POST '${target}' \\`,
+      ...headerArgs,
+      `  -H 'Content-Type: application/json' \\`,
+      `  -H 'X-Lua-Verify: lua-echo-check' \\`,
+      `  --data '{"records":[]}' | grep -i 'x-lua-verify'`
+    ];
+  }
+  return [
+    `curl -isS -X POST '${target}' \\`,
+    ...headerArgs,
+    `  -H 'Content-Type: application/json' \\`,
+    `  --data '[]'`
+  ];
+}
+__name(verificationCurl, "verificationCurl");
+function verificationInstructions(drain, headers, options) {
+  const type = drain.type;
+  const json = options.json;
+  emitAside("", json);
+  emitAside("Before anything is delivered, Lua has to confirm you own this destination.", json);
+  if (TOKEN_ECHO_TYPES.includes(type)) {
+    emitAside("Lua POSTs one record carrying an X-Lua-Verify header; your receiver must answer 2xx AND", json);
+    emitAside("repeat that header back on the response. Check yours first:", json);
+  } else {
+    emitAside("Lua POSTs one record to the intake; any 2xx from the vendor verifies the drain.", json);
+    emitAside("Check the credentials reach the intake first:", json);
+  }
+  emitAside("", json);
+  for (const line of verificationCurl(type, drain.endpoint, headers)) emitAside(`  ${line}`, json);
+  emitAside("", json);
+  emitAside(`Then:  lua drains verify ${drain.id}`, json);
+}
+__name(verificationInstructions, "verificationInstructions");
+async function createDrainCore(context, options) {
+  const name = trimmed(options.name) ?? await promptText("Drain name:", "--name", "1\u201364 chars, unique per org");
+  const type = parseType(options.type) ?? await promptChoice("Where should the logs go?", LOG_DRAIN_TYPES_PHASE1, "--type", "the destination kind");
+  const destination = await resolveDestination(type, options);
+  const format = parseFormat(options.format);
+  const headers = await resolveHeaders(options);
+  const flagSources = parseSources(options.sources);
+  const sources = flagSources ?? (isCiModeEnabled() ? void 0 : await promptSources());
+  const minSeverity = parseSeverity(options.minSeverity);
+  const environments = parseEnvironments(options.environments);
+  const sampling = parseSampling(options.sampling);
+  const agents = parseAgents(options.agents) ?? (context.agentId ? [
+    context.agentId
+  ] : "*");
+  const includeContent = wantsContent(options, sources);
+  const includeContentAck = includeContent ? await acknowledgeContent(options) : void 0;
+  const input = {
+    name,
+    type,
+    ...destination.endpoint ? {
+      endpoint: destination.endpoint
+    } : {},
+    ...destination.site ? {
+      site: destination.site
+    } : {},
+    ...format ? {
+      format
+    } : {},
+    ...headers.length > 0 ? {
+      headers: wireHeaders(headers)
+    } : {},
+    ...sources ? {
+      sources
+    } : {},
+    ...minSeverity ? {
+      minSeverity
+    } : {},
+    agents,
+    environments: environments ?? [
+      "production"
+    ],
+    ...sampling ? {
+      sampling
+    } : {},
+    ...includeContent ? {
+      includeContent: true,
+      includeContentAck
+    } : {}
+  };
+  const created = await drainsCall(() => drainsApiFor(context).createDrain(input));
+  const { secret, ...drain } = created;
+  if (options.json) {
+    printJson(secret ? {
+      drain,
+      secret
+    } : {
+      drain
+    });
+  } else {
+    writeSuccess(`\u2705 Created drain ${drain.name} (${drain.id})`);
+    writeInfo(`   type ${drain.type}  \xB7  ${drain.endpoint ?? drain.site ?? "\u2014"}  \xB7  state ${drain.state}`);
+    if (secret) {
+      writeInfo("");
+      writeInfo("\u{1F511} Signing secret \u2014 shown once, and never again. Store it now:");
+      writeInfo(`   ${secret}`);
+      writeInfo("   Your receiver verifies X-Lua-Signature with it (docs: /drains/verify-signatures).");
+    }
+  }
+  verificationInstructions(drain, headers, options);
+  if (!options.json) {
+    writeHintBlock({
+      headline: "Next:",
+      lines: [
+        {
+          label: "Verify",
+          command: `lua drains verify ${drain.id}`
+        },
+        {
+          label: "Send one record",
+          command: `lua drains test ${drain.id}`
+        }
+      ]
+    });
+  }
+}
+__name(createDrainCore, "createDrainCore");
+async function updateDrainCore(context, drainId, options) {
+  if (trimmed(options.type)) {
+    throw CliError.usage("A drain cannot change type in place.", "Delete this drain and create a new one of the other type");
+  }
+  const patch = {};
+  const name = trimmed(options.name);
+  if (name) patch.name = name;
+  const endpoint = trimmed(options.endpoint);
+  if (endpoint) patch.endpoint = endpoint;
+  const site = trimmed(options.site);
+  if (site) patch.site = site;
+  const format = parseFormat(options.format);
+  if (format) patch.format = format;
+  const headers = await resolveHeaders(options);
+  if (headers.length > 0) patch.headers = wireHeaders(headers);
+  const sources = parseSources(options.sources);
+  if (sources) patch.sources = sources;
+  const minSeverity = parseSeverity(options.minSeverity);
+  if (minSeverity) patch.minSeverity = minSeverity;
+  const agents = parseAgents(options.agents);
+  if (agents) patch.agents = agents;
+  const environments = parseEnvironments(options.environments);
+  if (environments) patch.environments = environments;
+  const sampling = parseSampling(options.sampling);
+  if (sampling) patch.sampling = sampling;
+  if (options.includeContent === false) {
+    if ((sources ?? []).some((source) => LOG_DRAIN_CONTENT_SOURCES.includes(source))) {
+      throw CliError.usage("--no-include-content cannot be combined with a content source in the same update.", "Send the sources first, then --no-include-content \u2014 or drop the content sources");
+    }
+    patch.includeContent = false;
+  } else if (wantsContent(options, sources)) {
+    patch.includeContent = true;
+    patch.includeContentAck = await acknowledgeContent(options);
+  }
+  if (Object.keys(patch).length === 0) {
+    throw CliError.usage("Nothing to update \u2014 no field flags were given.", listHint("Changeable", [
+      "--name",
+      "--endpoint",
+      "--site",
+      "--format",
+      "--header / --header-from-env",
+      "--sources",
+      "--min-severity",
+      "--agents",
+      "--environments",
+      "--sampling",
+      "--include-content"
+    ]));
+  }
+  const drain = await drainsCall(() => drainsApiFor(context).updateDrain(drainId, patch));
+  if (options.json) {
+    printJson({
+      drain
+    });
+    return;
+  }
+  writeSuccess(`\u2705 Updated ${drain.name} (${drain.id})`);
+  writeInfo(`   state ${drain.state}`);
+  if (drain.state === "pending_verification") {
+    writeInfo("   The destination changed, so delivery is paused until the drain is verified again.");
+    writeInfo("   Records keep buffering while you do.");
+    writeHintBlock({
+      headline: "Next:",
+      lines: [
+        {
+          label: "Verify",
+          command: `lua drains verify ${drain.id}`
+        }
+      ]
+    });
+  }
+}
+__name(updateDrainCore, "updateDrainCore");
+async function deleteDrainCore(context, drainId, options) {
+  if (!options.yes) {
+    if (isCiModeEnabled()) {
+      throw CliError.usage(`Deleting ${drainId} needs a confirmation; pass --yes to give it non-interactively.`, "Nothing was deleted");
+    }
+    writeInfo(`Deleting a drain purges the destination's stored credentials and drops its queued records.`);
+    const answer = await safePrompt([
+      {
+        type: "confirm",
+        name: "confirmed",
+        message: `Delete drain ${drainId}?`,
+        default: false
+      }
+    ]);
+    if (!answer?.confirmed) {
+      throw CliError.usage("Cancelled \u2014 nothing was deleted.");
+    }
+  }
+  await drainsCall(() => drainsApiFor(context).deleteDrain(drainId));
+  if (options.json) {
+    printJson({
+      id: drainId,
+      deleted: true
+    });
+    return;
+  }
+  writeSuccess(`\u2705 Deleted drain ${drainId}`);
+  writeInfo("   Stored credentials were purged and queued records were dropped.");
+}
+__name(deleteDrainCore, "deleteDrainCore");
+async function awaitTestDelivery(api, drainId, batchId) {
+  for (let attempt = 0; attempt < DRAIN_POLL.testAttempts; attempt++) {
+    await DRAIN_POLL.sleep(DRAIN_POLL.intervalMs);
+    const page = await drainsCall(() => api.listDeliveries(drainId, {
+      kind: "test",
+      limit: 20
+    }));
+    const row2 = (page.deliveries ?? []).find((delivery) => delivery.batchId === batchId);
+    if (row2) return row2;
+  }
+  return null;
+}
+__name(awaitTestDelivery, "awaitTestDelivery");
+async function testDrainCore(context, drainId, options) {
+  const api = drainsApiFor(context);
+  const started = await drainsCall(() => api.testDrain(drainId));
+  if (!options.json) writeInfo(`Sent one test record to ${drainId} (batch ${started.batchId}) \u2014 waiting for it\u2026`);
+  const attempt = await awaitTestDelivery(api, drainId, started.batchId);
+  const delivered = attempt?.ok === true;
+  if (options.json) {
+    printJson({
+      batchId: started.batchId,
+      statusCode: attempt?.statusCode ?? null,
+      latencyMs: attempt?.latencyMs ?? null,
+      responseExcerpt: attempt?.responseExcerpt ?? null,
+      ok: delivered,
+      errorClass: attempt?.errorClass ?? null,
+      ...attempt ? {} : {
+        pending: true
+      }
+    });
+  } else if (!attempt) {
+    writeInfo(`\u23F3 No delivery attempt recorded yet for batch ${started.batchId}.`);
+    writeHintBlock({
+      headline: "Read it when it lands:",
+      lines: [
+        {
+          label: "Attempts",
+          command: `lua drains deliveries ${drainId} --kind test`
+        }
+      ],
+      when: "partial"
+    });
+  } else {
+    const status = attempt.statusCode === void 0 ? "\u2014" : String(attempt.statusCode);
+    const latency = attempt.latencyMs === void 0 ? "\u2014" : `${attempt.latencyMs} ms`;
+    if (delivered) writeSuccess(`\u2705 Delivered \u2014 HTTP ${status} in ${latency}`);
+    else writeInfo(`Not delivered \u2014 HTTP ${status} in ${latency}${attempt.errorClass ? ` (${attempt.errorClass})` : ""}`);
+    if (attempt.responseExcerpt) writeInfo(`   response: ${attempt.responseExcerpt}`);
+  }
+  if (!delivered) process.exitCode = CLI_EXIT.ERROR;
+}
+__name(testDrainCore, "testDrainCore");
+async function awaitVerification(api, drainId, previousAttemptedAt) {
+  for (let attempt = 0; attempt < DRAIN_POLL.verifyAttempts; attempt++) {
+    await DRAIN_POLL.sleep(DRAIN_POLL.intervalMs);
+    const drain = await drainsCall(() => api.getDrain(drainId));
+    const verification = drain.verification;
+    if (verification?.outcome && verification.attemptedAt !== previousAttemptedAt) return drain;
+  }
+  return null;
+}
+__name(awaitVerification, "awaitVerification");
+async function verifyDrainCore(context, drainId, options) {
+  const api = drainsApiFor(context);
+  const before = await drainsCall(() => api.getDrain(drainId));
+  const started = await drainsCall(() => api.verifyDrain(drainId));
+  if (!options.json) writeInfo(`Verifying ${drainId} \u2014 waiting for your endpoint to answer\u2026`);
+  const drain = await awaitVerification(api, drainId, before.verification?.attemptedAt);
+  const verification = drain?.verification;
+  const outcome = verification?.outcome;
+  const verified = outcome === "ok";
+  const line = outcome ? VERIFY_OUTCOME_TEXT[outcome] : "no result yet";
+  if (options.json) {
+    printJson({
+      verificationId: started.verificationId,
+      expiresAt: started.expiresAt,
+      outcome: outcome ?? null,
+      message: line,
+      statusCode: verification?.statusCode ?? null,
+      latencyMs: verification?.latencyMs ?? null,
+      responseExcerpt: verification?.responseExcerpt ?? null,
+      state: drain?.state ?? null,
+      verifiedAt: drain?.verifiedAt ?? null,
+      verified,
+      ...drain ? {} : {
+        pending: true
+      }
+    });
+  } else {
+    const status = verification?.statusCode === void 0 ? "\u2014" : String(verification.statusCode);
+    const latency = verification?.latencyMs === void 0 ? "\u2014" : `${verification.latencyMs} ms`;
+    if (verified) {
+      writeSuccess(`\u2705 Verified \u2014 HTTP ${status} in ${latency}`);
+      writeInfo(`   state ${drain?.state ?? "\u2014"}  \xB7  verifiedAt ${shortIso(drain?.verifiedAt)}`);
+    } else if (!drain) {
+      writeInfo(`\u23F3 ${line} (attempt ${started.verificationId}, expires ${shortIso(started.expiresAt)}).`);
+      writeHintBlock({
+        headline: "Read it when it lands:",
+        lines: [
+          {
+            label: "Drain",
+            command: `lua drains status ${drainId}`
+          }
+        ],
+        when: "partial"
+      });
+    } else {
+      writeInfo(`Not verified: ${line} \u2014 HTTP ${status} in ${latency}`);
+      if (verification?.responseExcerpt) writeInfo(`   response: ${verification.responseExcerpt}`);
+      if (outcome === "token_not_echoed") {
+        writeInfo("   Your receiver answered, but did not repeat the X-Lua-Verify header on its response.");
+      }
+    }
+  }
+  if (!verified) process.exitCode = CLI_EXIT.ERROR;
+}
+__name(verifyDrainCore, "verifyDrainCore");
+async function pauseDrainCore(context, drainId, options) {
+  const reason = trimmed(options.reason);
+  const drain = await drainsCall(() => drainsApiFor(context).pauseDrain(drainId, reason));
+  if (options.json) {
+    printJson({
+      drain
+    });
+    return;
+  }
+  writeSuccess(`\u2705 Paused ${drain.name} (${drain.id})`);
+  writeInfo(`   state ${drain.state}${reason ? `  \xB7  reason "${reason}"` : ""}`);
+  writeInfo("   Records keep buffering while the drain is paused; nothing is delivered.");
+  writeHintBlock({
+    headline: "Next:",
+    lines: [
+      {
+        label: "Resume",
+        command: `lua drains resume ${drain.id}`
+      }
+    ]
+  });
+}
+__name(pauseDrainCore, "pauseDrainCore");
+async function resumeDrainCore(context, drainId, options) {
+  const drain = await drainsCall(() => drainsApiFor(context).resumeDrain(drainId));
+  if (options.json) {
+    printJson({
+      drain
+    });
+    return;
+  }
+  writeSuccess(`\u2705 Resumed ${drain.name} (${drain.id})`);
+  writeInfo(`   state ${drain.state} \u2014 a resumed drain proves itself before it reads healthy again.`);
+  writeHintBlock({
+    headline: "Next:",
+    lines: [
+      {
+        label: "Health",
+        command: `lua drains status ${drain.id}`
+      }
+    ]
+  });
+}
+__name(resumeDrainCore, "resumeDrainCore");
+async function rotateSecretCore(context, drainId, options) {
+  const finalize = options.finalize === true;
+  const answer = await drainsCall(() => drainsApiFor(context).rotateSecret(drainId, finalize));
+  if (finalize) {
+    const drain = answer;
+    if (options.json) {
+      printJson({
+        drain
+      });
+      return;
+    }
+    writeSuccess(`\u2705 Rotation window closed for ${drain.name ?? drainId}`);
+    writeInfo("   Deliveries now carry the new signature only.");
+    return;
+  }
+  const rotated = answer;
+  if (options.json) {
+    printJson({
+      secret: rotated.secret,
+      rotation: rotated.rotation
+    });
+    return;
+  }
+  writeSuccess(`\u2705 Rotated the signing secret for ${drainId}`);
+  writeInfo("");
+  writeInfo("\u{1F511} New signing secret \u2014 shown once, and never again. Store it now:");
+  writeInfo(`   ${rotated.secret}`);
+  writeInfo("");
+  writeInfo(`   Both secrets are accepted until ${shortIso(rotated.rotation?.expiresAt)}; every batch in that`);
+  writeInfo("   window carries two signatures, so deploy the new value and then close the window.");
+  writeHintBlock({
+    headline: "When the receiver has the new value:",
+    lines: [
+      {
+        label: "Close early",
+        command: `lua drains rotate-secret ${drainId} --finalize`
+      }
+    ]
+  });
+}
+__name(rotateSecretCore, "rotateSecretCore");
+
+// src/commands/drains.ts
+var DRAIN_ACTIONS = [
+  "list",
+  "status",
+  "deliveries",
+  "create",
+  "update",
+  "delete",
+  "test",
+  "verify",
+  "pause",
+  "resume",
+  "rotate-secret"
+];
+var MISSING_SCOPE_MESSAGE = "Missing scope: logs:manage. Create a key with that scope (lua auth key) or ask an org admin.";
+var DRAINS_FAILING_EXIT = 2;
+var DELIVERY_KINDS = [
+  "batch",
+  "test",
+  "verify",
+  "heartbeat",
+  "dropped",
+  "truncated"
+];
+var DEFAULT_DELIVERY_LIMIT = 20;
+var MAX_DELIVERY_LIMIT = 100;
+var MAX_TABLE_WIDTH = 100;
+async function resolveDrainsContext(options) {
+  const apiKey = await requireAuth();
+  const flagOrg = typeof options.org === "string" ? options.org.trim() : "";
+  if (flagOrg) return {
+    orgId: flagOrg,
+    apiKey
+  };
+  const config = readYamlConfig();
+  const projectOrg = config?.agent?.orgId;
+  if (projectOrg) return {
+    orgId: projectOrg,
+    agentId: config?.agent?.agentId,
+    apiKey
+  };
+  return {
+    orgId: await orgFromCredential(apiKey),
+    apiKey
+  };
+}
+__name(resolveDrainsContext, "resolveDrainsContext");
+async function orgFromCredential(apiKey) {
+  const { authorization } = await resolveCredentialOperationalContext(apiKey);
+  const orgs = (authorization.orgs ?? []).filter((org) => !org.archived);
+  if (orgs.length === 1) return orgs[0].orgId;
+  if (orgs.length === 0) {
+    throw CliError.usage("This credential does not reach any organization, so there is no drain to read.", "Ask an org admin for access, or run the command from a Lua project directory");
+  }
+  throw CliError.usage(`This credential reaches ${orgs.length} organizations \u2014 name one with --org <id>.`, joinHint(listHint("Organizations", orgs.map((org) => `${org.orgId}${org.name ? ` \u2014 ${org.name}` : ""}`)), "Inside a Lua project directory the org comes from lua.skill.yaml"));
+}
+__name(orgFromCredential, "orgFromCredential");
+function drainsApiFor(context) {
+  return new DrainsApi(BASE_URLS.API, context.apiKey, context.orgId);
+}
+__name(drainsApiFor, "drainsApiFor");
+function drainRefusalMessage(error) {
+  const message = error?.message || "The log drains API refused the request.";
+  const code = error?.code;
+  const field = error?.field;
+  const line = code ? `${code}: ${message}` : message;
+  return field ? `${line} (field: ${field})` : line;
+}
+__name(drainRefusalMessage, "drainRefusalMessage");
+async function drainsCall(call) {
+  let response;
+  try {
+    response = await call();
+  } catch (error) {
+    if (CliError.isCliError(error) && error.statusCode === 403) {
+      throw CliError.forbidden(MISSING_SCOPE_MESSAGE);
+    }
+    throw error;
+  }
+  if (response.success && response.data !== void 0) return response.data;
+  if (response.error?.statusCode === 403) throw CliError.forbidden(MISSING_SCOPE_MESSAGE);
+  throw CliError.fromStatus(response.error?.statusCode, drainRefusalMessage(response.error), void 0, apiErrorDetail(response.error));
+}
+__name(drainsCall, "drainsCall");
+function printJson2(payload) {
+  console.log(JSON.stringify(payload, null, 2));
+}
+__name(printJson2, "printJson");
+function tableOverhead(columns) {
+  return 3 * columns + 1;
+}
+__name(tableOverhead, "tableOverhead");
+function clip(value3, width) {
+  if (value3.length <= width) return value3;
+  return width <= 1 ? value3.slice(0, width) : `${value3.slice(0, width - 1)}\u2026`;
+}
+__name(clip, "clip");
+function renderFittedTable(headers, rows3, options = {}) {
+  if (rows3.length === 0) return renderTable(headers, rows3);
+  const { maxWidth = MAX_TABLE_WIDTH, shrinkFirst = [], softFloor = 12 } = options;
+  const budget = maxWidth - tableOverhead(headers.length);
+  const hardFloors = headers.map((header) => header.length);
+  const widths = headers.map((header, i) => Math.max(header.length, ...rows3.map((row2) => (row2[i] ?? "").length)));
+  let total = widths.reduce((sum, width) => sum + width, 0);
+  const shrink = /* @__PURE__ */ __name((candidates, floorOf) => {
+    for (; ; ) {
+      if (total <= budget) return;
+      let widest = -1;
+      for (const i of candidates) {
+        if (widths[i] <= floorOf(i)) continue;
+        if (widest === -1 || widths[i] > widths[widest]) widest = i;
+      }
+      if (widest === -1) return;
+      widths[widest] -= 1;
+      total -= 1;
+    }
+  }, "shrink");
+  shrink(shrinkFirst, (i) => Math.max(hardFloors[i], softFloor));
+  shrink(shrinkFirst, (i) => hardFloors[i]);
+  shrink(headers.map((_, i) => i), (i) => hardFloors[i]);
+  return renderTable(headers, rows3.map((row2) => row2.map((cell, i) => clip(cell ?? "", widths[i]))));
+}
+__name(renderFittedTable, "renderFittedTable");
+function shortIso2(value3) {
+  if (typeof value3 !== "string" || value3.length === 0) return "\u2014";
+  const date = new Date(value3);
+  if (Number.isNaN(date.getTime())) return value3;
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+__name(shortIso2, "shortIso");
+function environmentsOf(drain) {
+  const environments = drain.selectors?.environments ?? [];
+  return environments.length > 0 ? environments.join(",") : "\u2014";
+}
+__name(environmentsOf, "environmentsOf");
+function agentsOf(drain) {
+  const agents = drain.selectors?.agents;
+  if (agents === "*" || agents === void 0) return "all";
+  return String(agents.length);
+}
+__name(agentsOf, "agentsOf");
+function drainsTable(drains) {
+  return renderFittedTable(
+    [
+      "NAME",
+      "TYPE",
+      "STATE",
+      "ENV",
+      "AGENTS",
+      "BACKLOG",
+      "LAST SUCCESS"
+    ],
+    drains.map((drain) => [
+      drain.name ?? "",
+      drain.type ?? "",
+      drain.state ?? "",
+      environmentsOf(drain),
+      agentsOf(drain),
+      String(drain.health?.backlog ?? 0),
+      shortIso2(drain.health?.lastSuccessAt)
+    ]),
+    {
+      shrinkFirst: [
+        0,
+        3
+      ]
+    }
+    // NAME and ENV give way before a state, a count or a timestamp
+  );
+}
+__name(drainsTable, "drainsTable");
+function statusTable(drains) {
+  return renderFittedTable([
+    "NAME",
+    "STATE",
+    "BACKLOG",
+    "DELIVERED",
+    "DROPPED",
+    "REJECTED",
+    "P50 MS",
+    "QUOTA",
+    "LAST SUCCESS"
+  ], drains.map((drain) => [
+    drain.name ?? "",
+    drain.state ?? "",
+    String(drain.health?.backlog ?? 0),
+    String(drain.health?.deliveredCount24h ?? 0),
+    String(drain.health?.droppedCount24h ?? 0),
+    String(drain.health?.rejectedCount24h ?? 0),
+    drain.health?.p50LatencyMs === null || drain.health?.p50LatencyMs === void 0 ? "\u2014" : String(drain.health.p50LatencyMs),
+    quotaRatio(drain),
+    shortIso2(drain.health?.lastSuccessAt)
+  ]), {
+    shrinkFirst: [
+      0
+    ]
+  });
+}
+__name(statusTable, "statusTable");
+function quotaRatio(drain) {
+  const quota = drain.quota;
+  if (!quota || !quota.eventsPerDay) return "\u2014";
+  const ratio = quota.eventsPerDay > 0 ? (quota.usedEvents ?? 0) / quota.eventsPerDay : 0;
+  const percent = Math.round(ratio * 1e3) / 10;
+  return quota.degradation && quota.degradation !== "none" ? `${percent}% ${quota.degradation}` : `${percent}%`;
+}
+__name(quotaRatio, "quotaRatio");
+function printDrainDetail(drain) {
+  const health = drain.health ?? {};
+  const quota = drain.quota ?? {};
+  const rows3 = [
+    [
+      "type",
+      drain.type ?? "\u2014"
+    ],
+    [
+      "state",
+      drain.state ?? "\u2014"
+    ],
+    [
+      "endpoint",
+      drain.endpoint ?? "\u2014"
+    ],
+    [
+      "site",
+      drain.site ?? "\u2014"
+    ],
+    [
+      "format",
+      drain.format ?? "\u2014"
+    ],
+    [
+      "environments",
+      environmentsOf(drain)
+    ],
+    [
+      "agents",
+      drain.selectors?.agents === "*" ? "all" : (drain.selectors?.agents ?? []).join(",") || "\u2014"
+    ],
+    [
+      "minSeverity",
+      drain.selectors?.minSeverity ?? "\u2014"
+    ],
+    [
+      "includeContent",
+      String(drain.selectors?.includeContent ?? false)
+    ],
+    [
+      "verifiedAt",
+      shortIso2(drain.verifiedAt)
+    ],
+    [
+      "lastSuccessAt",
+      shortIso2(health.lastSuccessAt)
+    ],
+    [
+      "lastFailureAt",
+      shortIso2(health.lastFailureAt)
+    ],
+    [
+      "lastStatusCode",
+      health.lastStatusCode === void 0 ? "\u2014" : String(health.lastStatusCode)
+    ],
+    [
+      "lastError",
+      health.lastError ?? "\u2014"
+    ],
+    [
+      "backlog",
+      String(health.backlog ?? 0)
+    ],
+    [
+      "backlogBytes",
+      String(health.backlogBytes ?? 0)
+    ],
+    [
+      "deliveredCount24h",
+      String(health.deliveredCount24h ?? 0)
+    ],
+    [
+      "droppedCount24h",
+      String(health.droppedCount24h ?? 0)
+    ],
+    [
+      "rejectedCount24h",
+      String(health.rejectedCount24h ?? 0)
+    ],
+    [
+      "p50LatencyMs",
+      health.p50LatencyMs === null || health.p50LatencyMs === void 0 ? "\u2014" : String(health.p50LatencyMs)
+    ],
+    [
+      "scrubHits24h",
+      String(health.scrubHits24h ?? 0)
+    ],
+    [
+      "pauseReason",
+      health.pauseReason ?? "\u2014"
+    ],
+    [
+      "usedEvents",
+      `${quota.usedEvents ?? 0} / ${quota.eventsPerDay ?? 0}`
+    ],
+    [
+      "usedBytes",
+      `${quota.usedBytes ?? 0} / ${quota.bytesPerDay ?? 0}`
+    ],
+    [
+      "degradation",
+      quota.degradation ?? "\u2014"
+    ],
+    [
+      "resetsAt",
+      shortIso2(quota.resetsAt)
+    ]
+  ];
+  const label2 = Math.max(...rows3.map(([key]) => key.length));
+  console.log(`
+\u{1F6B0} ${drain.name} (${drain.id})`);
+  for (const [key, value3] of rows3) {
+    console.log(`   ${key.padEnd(label2)}  ${clip(value3, MAX_TABLE_WIDTH - label2 - 5)}`);
+  }
+  console.log("");
+}
+__name(printDrainDetail, "printDrainDetail");
+function statusView(drain) {
+  return {
+    id: drain.id,
+    name: drain.name,
+    state: drain.state,
+    health: drain.health,
+    quota: drain.quota
+  };
+}
+__name(statusView, "statusView");
+function str(value3) {
+  if (value3 === void 0 || value3 === null || value3 === "") return "\u2014";
+  return String(value3);
+}
+__name(str, "str");
+function deliveriesTable(deliveries) {
+  return renderFittedTable(
+    [
+      "STARTED",
+      "KIND",
+      "TRY",
+      "OK",
+      "STATUS",
+      "MS",
+      "RECORDS",
+      "BYTES",
+      "ERROR"
+    ],
+    deliveries.map((delivery) => [
+      shortIso2(delivery.startedAt),
+      str(delivery.kind),
+      str(delivery.attempt),
+      delivery.ok === true ? "yes" : "no",
+      str(delivery.statusCode),
+      str(delivery.latencyMs),
+      str(delivery.recordCount),
+      str(delivery.bytes),
+      str(delivery.errorClass)
+    ]),
+    {
+      shrinkFirst: [
+        8
+      ],
+      softFloor: 8
+    }
+    // the error class gives way before the timings do
+  );
+}
+__name(deliveriesTable, "deliveriesTable");
+async function listDrainsCore(context, options) {
+  const payload = await drainsCall(() => drainsApiFor(context).listDrains());
+  if (options.json) {
+    printJson2(payload);
+    return;
+  }
+  const drains = payload.drains ?? [];
+  if (drains.length === 0) {
+    writeInfo(`No log drains in ${context.orgId}.`);
+    writeHintBlock({
+      headline: "Send this org\u2019s logs somewhere you own:",
+      lines: [
+        {
+          label: "Create one",
+          command: "lua drains create"
+        }
+      ]
+    });
+    return;
+  }
+  console.log(drainsTable(drains));
+  writeHintBlock({
+    headline: "Next:",
+    lines: [
+      {
+        label: "Health",
+        command: "lua drains status"
+      },
+      {
+        label: "Attempts",
+        command: `lua drains deliveries ${drains[0].id}`
+      }
+    ]
+  });
+}
+__name(listDrainsCore, "listDrainsCore");
+async function statusDrainsCore(context, drainId, options) {
+  const api = drainsApiFor(context);
+  const drains = drainId ? [
+    await drainsCall(() => api.getDrain(drainId))
+  ] : (await drainsCall(() => api.listDrains())).drains ?? [];
+  if (options.json) {
+    printJson2({
+      drains: drains.map(statusView)
+    });
+  } else if (drains.length === 0) {
+    writeInfo(`No log drains in ${context.orgId}.`);
+  } else if (drainId) {
+    printDrainDetail(drains[0]);
+  } else {
+    console.log(statusTable(drains));
+  }
+  const failing = drains.filter((drain) => drain.state === "failing");
+  if (failing.length > 0) {
+    if (!options.json) {
+      writeInfo(`\u26A0\uFE0F  ${failing.length} drain(s) failing: ${failing.map((drain) => drain.name).join(", ")}`);
+      writeHintBlock({
+        headline: "Why a drain is failing:",
+        lines: [
+          {
+            label: "Attempts",
+            command: `lua drains deliveries ${failing[0].id} --kind batch`
+          }
+        ],
+        when: "partial"
+      });
+    }
+    process.exitCode = DRAINS_FAILING_EXIT;
+  }
+}
+__name(statusDrainsCore, "statusDrainsCore");
+async function deliveriesCore(context, drainId, options) {
+  const limit = parseLimit(options.limit);
+  const kind = parseKind(options.kind);
+  const page = await drainsCall(() => drainsApiFor(context).listDeliveries(drainId, {
+    limit,
+    ...kind ? {
+      kind
+    } : {}
+  }));
+  if (options.json) {
+    printJson2(page);
+    return;
+  }
+  const deliveries = page.deliveries ?? [];
+  if (deliveries.length === 0) {
+    writeInfo(`No delivery attempts recorded for ${drainId}${kind ? ` (kind ${kind})` : ""}.`);
+    return;
+  }
+  console.log(deliveriesTable(deliveries));
+  if (page.nextCursor) {
+    writeInfo(`\u2026 more attempts available \u2014 raise --limit (max ${MAX_DELIVERY_LIMIT}) or read --json for the cursor.`);
+  }
+}
+__name(deliveriesCore, "deliveriesCore");
+function parseLimit(raw) {
+  if (raw === void 0 || raw === null || `${raw}`.trim() === "") return DEFAULT_DELIVERY_LIMIT;
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1 || limit > MAX_DELIVERY_LIMIT) {
+    throw CliError.usage(`--limit must be a whole number between 1 and ${MAX_DELIVERY_LIMIT} (got "${raw}").`, `Default is ${DEFAULT_DELIVERY_LIMIT}`);
+  }
+  return limit;
+}
+__name(parseLimit, "parseLimit");
+function parseKind(raw) {
+  if (raw === void 0 || raw === null || `${raw}`.trim() === "") return void 0;
+  const kind = `${raw}`.trim().toLowerCase();
+  if (!DELIVERY_KINDS.includes(kind)) {
+    throw CliError.usage(`--kind "${raw}" is not a delivery kind.`, listHint("Valid values", DELIVERY_KINDS));
+  }
+  return kind;
+}
+__name(parseKind, "parseKind");
+async function drainsCommand(action, drainId, cmdObj) {
+  return withErrorHandling(
+    async () => {
+      const options = cmdObj ?? {};
+      const verb = action ? validateOrSuggest("drains.action", action) : "list";
+      const needsId = /* @__PURE__ */ __name((v) => v === "deliveries" || v === "update" || v === "delete" || v === "test" || v === "verify" || v === "pause" || v === "resume" || v === "rotate-secret", "needsId");
+      if (needsId(verb) && !drainId) {
+        throw CliError.usage(`lua drains ${verb} needs a drain id.`, listHint("Run", [
+          "lua drains list"
+        ]));
+      }
+      const context = await resolveDrainsContext(options);
+      switch (verb) {
+        case "list":
+          await listDrainsCore(context, options);
+          break;
+        case "status":
+          await statusDrainsCore(context, drainId, options);
+          break;
+        case "deliveries":
+          await deliveriesCore(context, drainId, options);
+          break;
+        case "create":
+          await createDrainCore(context, options);
+          break;
+        case "update":
+          await updateDrainCore(context, drainId, options);
+          break;
+        case "delete":
+          await deleteDrainCore(context, drainId, options);
+          break;
+        case "test":
+          await testDrainCore(context, drainId, options);
+          break;
+        case "verify":
+          await verifyDrainCore(context, drainId, options);
+          break;
+        case "pause":
+          await pauseDrainCore(context, drainId, options);
+          break;
+        case "resume":
+          await resumeDrainCore(context, drainId, options);
+          break;
+        case "rotate-secret":
+          await rotateSecretCore(context, drainId, options);
+          break;
+        default:
+          throw CliError.usage(`Unknown drains action '${action}'.`, listHint("Try", DRAIN_ACTIONS));
+      }
+      trackEvent("cli_drains_action", {
+        action: verb,
+        non_interactive: !!action
+      });
+    },
+    "drains",
+    // LUA-803: a refusal that escapes a verb under `--json` is the typed envelope on stdout,
+    // never the `✖` line — the one shape a script parses.
+    {
+      json: /* @__PURE__ */ __name(() => !!cmdObj?.json, "json")
+    }
+  );
+}
+__name(drainsCommand, "drainsCommand");
+
 // src/commands/completion.ts
 init_cli();
 init_analytics();
@@ -49422,10 +51418,10 @@ function truncate2(s, n2) {
   return s.length <= n2 ? s : s.slice(0, Math.max(0, n2 - 1)) + "\u2026";
 }
 __name(truncate2, "truncate");
-function printJson(report2) {
+function printJson3(report2) {
   console.log(JSON.stringify(report2));
 }
-__name(printJson, "printJson");
+__name(printJson3, "printJson");
 var TICK = chalk3.green("\u2713");
 var WARN = chalk3.yellow("!");
 var CROSS = chalk3.red("\u2717");
@@ -49708,7 +51704,7 @@ async function statusCommand(options) {
       hints
     };
     if (options.json) {
-      printJson(report2);
+      printJson3(report2);
     } else {
       printHuman(report2);
     }
@@ -53102,31 +55098,58 @@ function runMetering(run) {
   return run.usage?.metering === "priced" ? "priced" : "flat";
 }
 __name(runMetering, "runMetering");
+var SEAT_COPY = "charged like chat \u2014 actions = the call's price band \xD7 the model's multiplier per model call; cached tokens count at the provider's ratio";
 function budgetCopy(run) {
   if (runMetering(run) === "priced") {
-    if (run.usage?.engine === "seat") return "charged like chat \u2014 actions (tier \xD7 model multiplier) per model call on your seat plan";
-    if (run.usage?.engine === "legacy") return "charged like chat \u2014 one credit per model call on the legacy plan";
-    return "charged like chat \u2014 one credit per model call on the legacy plan, or actions (tier \xD7 model multiplier) on a seat plan";
+    const engine = budgetEngineOf(run);
+    if (engine === "seat") return SEAT_COPY;
+    if (engine === "legacy") return "charged like chat \u2014 a credit is one model reply on a Job step, one agent step otherwise; tokens are never metered";
+    return "charged like chat \u2014 a credit is one model reply on a Job step (one agent step otherwise) on the legacy plan, or actions = price band \xD7 the model's multiplier per model call on a seat plan";
   }
+  if (run.budget?.unit === "actions") return SEAT_COPY;
   return "a credit is one agent step; a Job-tier attempt is 4 \u2014 tokens are never metered";
 }
 __name(budgetCopy, "budgetCopy");
+function budgetEngineOf(run) {
+  const engine = run.usage?.engine;
+  if (engine === "seat" || engine === "legacy") return engine;
+  const unit = run.budget?.unit;
+  return unit === "actions" ? "seat" : unit === "credits" ? "legacy" : void 0;
+}
+__name(budgetEngineOf, "budgetEngineOf");
 var fmtNum = /* @__PURE__ */ __name((v) => v.toLocaleString("en-US"), "fmtNum");
 function budgetLine(run) {
   const u = run.usage;
   const b = run.budget;
   if (!u && !b) return void 0;
-  const seat = u?.engine === "seat" || b?.unit === "actions";
+  const seat = budgetEngineOf(run) === "seat";
   const spent = seat ? u?.actionsUsed ?? b?.spent?.actionsEstimate ?? 0 : u?.creditsUsed ?? b?.spent?.credits ?? 0;
   const cap = runBudgetCap(b);
   const parts = [
     `${fmtNum(spent)}${cap !== void 0 ? ` of ${fmtNum(cap)}` : ""} ${seat ? "actions" : "credits"} spent`,
     b?.remaining !== void 0 ? `${fmtNum(b.remaining)} remaining` : void 0,
-    seat && u?.creditsUsed ? `${fmtNum(u.creditsUsed)} flat credits` : void 0
+    seat && u?.creditsUsed ? `${fmtNum(u.creditsUsed)} flat credits` : void 0,
+    // [WJB-B5] (BAC-677 / plan D4): the run's own `budget.exceeded` stamp — the last step crossed the cap and
+    // the run finished rather than parking for a raise nobody could act on. Printed only when the server
+    // stamped it (never `false`, never inferred from `spent > cap`, which a concurrent settle can show for a
+    // run that parked legitimately).
+    b?.exceeded === true ? "finished past the cap" : void 0
   ].filter((p) => !!p);
   return `${parts.join(" \xB7 ")} (${budgetCopy(run)})`;
 }
 __name(budgetLine, "budgetLine");
+function tokensLine(run) {
+  const t = run.usage?.tokens;
+  if (!t) return void 0;
+  const parts = [
+    typeof t.inputTokens === "number" ? `${fmtNum(t.inputTokens)} uncached in` : void 0,
+    typeof t.cacheReadTokens === "number" ? `${fmtNum(t.cacheReadTokens)} cache read` : void 0,
+    typeof t.cacheCreationTokens === "number" ? `${fmtNum(t.cacheCreationTokens)} cache write` : void 0,
+    typeof t.outputTokens === "number" ? `${fmtNum(t.outputTokens)} out` : void 0
+  ].filter((p) => !!p);
+  return parts.length ? parts.join(" \xB7 ") : void 0;
+}
+__name(tokensLine, "tokensLine");
 function autonomyDurationLabel(seconds) {
   if (!Number.isFinite(seconds) || seconds < 0) return `${seconds} s`;
   if (seconds >= 86400 && seconds % 86400 === 0) return `${fmtNum(seconds / 86400)} d`;
@@ -53265,6 +55288,8 @@ function printRun(run, withSteps) {
   if (consent) console.log(`   Consent:  ${consent}`);
   const budget = budgetLine(run);
   if (budget) console.log(`   Budget:   ${budget}`);
+  const tokens = tokensLine(run);
+  if (tokens) console.log(`   Tokens:   ${tokens}`);
   if (run.cancel) console.log(`   Cancel:   ${formatRunCancel(run.cancel)}`);
   if (run.gate) {
     const kind = run.gate.kind;
@@ -53275,7 +55300,7 @@ function printRun(run, withSteps) {
     } else if (kind === "budget") {
       console.log(`
 \u23F8\uFE0F  Paused \u2014 run budget reached (${budgetCopy(run)}):`);
-      console.log(`   lua workflows raise-budget ${id} --credits <n>`);
+      console.log(`   lua workflows raise-budget ${id} --credits <n>   (<n> is the new cap in ${budgetEngineOf(run) === "seat" ? "actions" : "credits"})`);
     } else if (kind === "billing") {
       for (const line of billingParkLines(run)) console.log(line);
     } else if (kind === "model_policy") {
@@ -53309,11 +55334,17 @@ function printRun(run, withSteps) {
     else {
       console.log("");
       const withChildren = steps.some((s) => typeof s.childRunId === "string");
+      const withTokens = steps.some((s) => !!s.tokens);
       console.log(renderTable([
         "Step",
         "Kind",
         "Status",
         "Attempt",
+        ...withTokens ? [
+          "Uncached",
+          "Cached",
+          "Output"
+        ] : [],
         "Error",
         ...withChildren ? [
           "Child run"
@@ -53323,6 +55354,7 @@ function printRun(run, withSteps) {
         s.kind ?? "\u2014",
         s.status,
         stepAttemptCell(s),
+        ...withTokens ? stepTokenCells(s) : [],
         stepErrorCell(s.error),
         ...withChildren ? [
           s.childRunId ?? ""
@@ -53352,6 +55384,22 @@ function billingParkLines(run) {
   return out;
 }
 __name(billingParkLines, "billingParkLines");
+function stepTokenCells(s) {
+  const t = s.tokens;
+  const cell = /* @__PURE__ */ __name((v) => typeof v === "number" && Number.isFinite(v) ? fmtNum(v) : "\u2014", "cell");
+  if (!t) return [
+    "\u2014",
+    "\u2014",
+    "\u2014"
+  ];
+  const cached = typeof t.cacheReadTokens === "number" || typeof t.cacheCreationTokens === "number" ? (t.cacheReadTokens ?? 0) + (t.cacheCreationTokens ?? 0) : void 0;
+  return [
+    cell(t.inputTokens),
+    cell(cached),
+    cell(t.outputTokens)
+  ];
+}
+__name(stepTokenCells, "stepTokenCells");
 function stepAttemptLines(s) {
   const out = [];
   const cause = stepFailureLine(s.error);
@@ -53360,6 +55408,8 @@ function stepAttemptLines(s) {
   if (burned) out.push(`   \u03A3 ${s.stepId}: attempt ${s.attempt ?? 1} ${s.status}: ${burned}`);
   const billed = stepBillingLine(s.billing);
   if (billed) out.push(`   $ ${s.stepId}: attempt ${s.billing?.attempt ?? s.attempt ?? 1} billed: ${billed}`);
+  const jobModel = stepJobModelLine(s);
+  if (jobModel) out.push(`   \u2699 ${s.stepId}: ${jobModel}`);
   const fetchable = outputRefLine(s.outputRef);
   if (fetchable) out.push(`   \u21E9 ${s.stepId}: ${fetchable}`);
   const escalated = approverFallbackLine(s);
@@ -53373,6 +55423,22 @@ function stepAttemptLines(s) {
   return out;
 }
 __name(stepAttemptLines, "stepAttemptLines");
+function stepJobModelLine(s) {
+  const j = s.job;
+  if (!j) return void 0;
+  const parts = [
+    j.model ? `model ${j.model}` : void 0,
+    typeof j.multiplier === "number" ? `\xD7${fmtNum(j.multiplier)}` : void 0,
+    j.modelSource ? `chosen by ${jobModelSourceWord(j.modelSource)}` : void 0
+  ].filter((p) => !!p);
+  return parts.length ? parts.join(" \xB7 ") : void 0;
+}
+__name(stepJobModelLine, "stepJobModelLine");
+function jobModelSourceWord(source) {
+  const labels = WORKFLOW_JOB_MODEL_SOURCE_LABELS;
+  return labels[source] ?? source;
+}
+__name(jobModelSourceWord, "jobModelSourceWord");
 function approverFallbackLine(s) {
   const f = s.suspend?.approverFallback;
   if (!f?.from || !f.to) return void 0;
@@ -53674,18 +55740,23 @@ __name(handleWatchFrame, "handleWatchFrame");
 async function boundaryVerdict(runId, ev, state3, boundary) {
   const type = ev.type;
   if (type === "run.gated") {
-    const gate = ev.data?.gate;
-    const stepId = ev.data?.stepId;
-    if (gate === "exception") {
+    const raw = ev.data;
+    const rawKind = raw?.kind ?? raw?.gate;
+    const stepId = raw?.stepId;
+    if (rawKind === "exception") {
       return boundary(`\u26A0\uFE0F  run parked on an exception gate \u2014 a human decides next: lua workflows status ${runId}`, WORKFLOW_EXIT.RUN_PARKED);
     }
-    if (gate === "billing") {
+    if (rawKind === "billing") {
       return boundary(`\u23F8\uFE0F  run parked on a billing gate \u2014 top up the workspace; it resumes within a few minutes (right away: lua workflows retry-step ${runId} --step ${stepId ?? "<stepId>"})`, WORKFLOW_EXIT.RUN_PARKED);
     }
-    if (gate === "budget") {
-      return boundary(`\u23F8\uFE0F  run budget reached \u2014 lua workflows raise-budget ${runId} --credits <n> (lua workflows status ${runId} says what a credit buys)`, WORKFLOW_EXIT.RUN_PARKED);
+    if (rawKind === "budget") {
+      return boundary(`\u23F8\uFE0F  run budget reached \u2014 lua workflows raise-budget ${runId} --credits <n> (the cap is in this run's own budget unit \u2014 credits, or actions on a seat plan; lua workflows status ${runId} says which)`, WORKFLOW_EXIT.RUN_PARKED);
     }
-    return boundary(`\u23F8\uFE0F  run gated (${gate ?? "consent"}) \u2014 approve it from the desktop; then: lua workflows watch ${runId}`, WORKFLOW_EXIT.RUN_GATED);
+    if (rawKind === "quota") {
+      return boundary(`\u23F8\uFE0F  run gated on the concurrency quota \u2014 it clears on its own as a slot frees (oldest-gated run first); check progress: lua workflows status ${runId}`, WORKFLOW_EXIT.RUN_GATED);
+    }
+    const label2 = rawKind === "start-consent" || rawKind === void 0 ? "consent" : rawKind;
+    return boundary(`\u23F8\uFE0F  run gated (${label2}) \u2014 approve it from the desktop; then: lua workflows watch ${runId}`, WORKFLOW_EXIT.RUN_GATED);
   }
   if (type === "run.suspended") {
     const kind = ev.data?.kind;
@@ -53700,7 +55771,7 @@ async function boundaryVerdict(runId, ev, state3, boundary) {
     }
   }
   if (type === "run.budget_parked") {
-    return boundary(`\u23F8\uFE0F  run budget reached \u2014 lua workflows raise-budget ${runId} --credits <n> (lua workflows status ${runId} says what a credit buys)`, WORKFLOW_EXIT.RUN_PARKED);
+    return boundary(`\u23F8\uFE0F  run budget reached \u2014 lua workflows raise-budget ${runId} --credits <n> (the cap is in this run's own budget unit \u2014 credits, or actions on a seat plan; lua workflows status ${runId} says which)`, WORKFLOW_EXIT.RUN_PARKED);
   }
   if (type === "run.completed") return WORKFLOW_EXIT.OK;
   if (type === "run.failed" || type === "run.timed_out") return WORKFLOW_EXIT.RUN_FAILED;
@@ -53930,10 +56001,10 @@ function budgetCapFlag(cap) {
   return "--credits";
 }
 __name(budgetCapFlag, "budgetCapFlag");
-function budgetCapsLabel(b) {
+function budgetCapsLabel(b, unit) {
   if (!b) return "";
   const parts = [];
-  if (b.maxCredits !== void 0) parts.push(`${b.maxCredits} credits`);
+  if (b.maxCredits !== void 0) parts.push(`${b.maxCredits} ${unit ?? "credits"}`);
   if (b.maxSteps !== void 0) parts.push(`${b.maxSteps} steps`);
   if (b.maxJobSeconds !== void 0) parts.push(`${b.maxJobSeconds}s job`);
   if (b.maxDurationSeconds !== void 0) parts.push(`${b.maxDurationSeconds}s wall`);
@@ -53999,9 +56070,10 @@ async function raiseBudgetCore(ctx, runId, o) {
   emitJson(ctx, res);
   if (!ctx.json) {
     const d = res.data;
-    const caps = budgetCapsLabel(d.budget ?? d.to);
+    const unit = d.unit === "actions" ? "actions" : "credits";
+    const caps = budgetCapsLabel(d.budget ?? d.to, unit);
     if (d.raised) {
-      const delta = d.from && d.to ? ` (${budgetCapsLabel(d.from)} \u2192 ${budgetCapsLabel(d.to)})` : caps ? ` to ${caps}` : "";
+      const delta = d.from && d.to ? ` (${budgetCapsLabel(d.from, unit)} \u2192 ${budgetCapsLabel(d.to, unit)})` : caps ? ` to ${caps}` : "";
       writeSuccess(`\u2705 budget raised${delta}${d.runStatus ? ` \xB7 run is ${d.runStatus}` : ""}`);
       if (d.resumed === false) writeInfo(`\u2139\uFE0F  the run did not resume on this raise \u2014 the next step's reserve is still short (raise again), or nothing was parked: lua workflows status ${runId}`);
       else if (d.resumed) writeInfo(`\u{1F4A1} Follow it: lua workflows watch ${runId}`);
@@ -54346,23 +56418,77 @@ async function replayChildRun(ctx, childRunId) {
   };
 }
 __name(replayChildRun, "replayChildRun");
-var WORKFLOW_LOG_EVENT_PATTERN = /progress|log|started|completed|failed|skipped|model_resolved|model_policy_warning/;
+var WORKFLOW_LOG_EVENT_PATTERN = /progress|log|started|completed|failed|skipped|model_resolved|model_policy_warning|budget_parked|budget_raised|budget_exceeded/;
+function jobModelEventDetail(data) {
+  const d = data ?? {};
+  const nested = d.detail && typeof d.detail === "object" ? d.detail : {};
+  const pick = /* @__PURE__ */ __name((key) => d[key] !== void 0 ? d[key] : nested[key], "pick");
+  const model = typeof pick("model") === "string" ? pick("model") : void 0;
+  const raw = pick("multiplier");
+  const multiplier = typeof raw === "number" && Number.isFinite(raw) ? raw : void 0;
+  const source = typeof pick("source") === "string" ? pick("source") : void 0;
+  const calibrated = pick("calibrated");
+  if (!model && multiplier === void 0 && !source) return void 0;
+  const tail = [
+    multiplier !== void 0 ? `\xD7${fmtNum(multiplier)}` : void 0,
+    source ? `(${jobModelSourceWord(source)})` : void 0,
+    calibrated === false ? "\u2014 uncalibrated model, fallback rate" : void 0
+  ].filter((p) => !!p);
+  return `job model \u2192 ${model ?? "?"}${tail.length ? ` ${tail.join(" ")}` : ""}`;
+}
+__name(jobModelEventDetail, "jobModelEventDetail");
+function budgetEventDetail(type, data) {
+  if (type !== "run.budget_parked" && type !== "run.budget_raised" && type !== "run.budget_exceeded") return void 0;
+  const d = data ?? {};
+  const nested = d.detail && typeof d.detail === "object" ? d.detail : {};
+  const pick = /* @__PURE__ */ __name((key) => d[key] !== void 0 ? d[key] : nested[key], "pick");
+  const numberOf = /* @__PURE__ */ __name((key) => {
+    const v = pick(key);
+    return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+  }, "numberOf");
+  const stringOf = /* @__PURE__ */ __name((key) => {
+    const v = pick(key);
+    return typeof v === "string" && v ? v : void 0;
+  }, "stringOf");
+  const stepId = stringOf("stepId");
+  const step3 = stepId ? ` (step ${stepId})` : "";
+  if (type === "run.budget_raised") {
+    const from = numberOf("from");
+    const to = numberOf("to");
+    const move = from !== void 0 && to !== void 0 ? `cap ${fmtNum(from)} \u2192 ${fmtNum(to)}` : "cap raised";
+    const by = stringOf("by");
+    const resumed = pick("resumed") === true ? " \u2014 run resumed" : "";
+    return `${move}${by ? ` by ${by}` : ""}${resumed}`;
+  }
+  const dimension = stringOf("dimension");
+  const spent = numberOf("spent");
+  const cap = numberOf("cap");
+  const figures = spent !== void 0 && cap !== void 0 ? `${fmtNum(spent)} of ${fmtNum(cap)}${dimension ? ` ${dimension}` : ""}` : dimension;
+  const lead = type === "run.budget_exceeded" ? "finished past the cap" : "paused on its run budget";
+  const detail = [
+    figures,
+    stringOf("engine")
+  ].filter((p) => !!p).join(", ");
+  return `${lead}${detail ? ` \u2014 ${detail}` : ""}${step3}`;
+}
+__name(budgetEventDetail, "budgetEventDetail");
 function modelEventDetail(type, data) {
+  if (type === "step.job_model_resolved") return jobModelEventDetail(data);
   if (type !== "step.model_resolved" && type !== "step.model_policy_warning") return void 0;
   const d = data ?? {};
   const nested = d.detail ?? {};
-  const str = /* @__PURE__ */ __name((...vals) => {
+  const str2 = /* @__PURE__ */ __name((...vals) => {
     for (const v of vals) if (typeof v === "string" && v) return v;
     return void 0;
   }, "str");
-  const requested = str(d.requested, nested.requested, d.modelRequested, nested.modelRequested);
-  const resolved = str(d.resolved, nested.resolved, d.model, nested.model);
+  const requested = str2(d.requested, nested.requested, d.modelRequested, nested.modelRequested);
+  const resolved = str2(d.resolved, nested.resolved, d.model, nested.model);
   if (type === "step.model_resolved") {
-    const cls = requested?.startsWith("class/") ? requested.slice("class/".length) : str(d.taskClass, nested.taskClass);
+    const cls = requested?.startsWith("class/") ? requested.slice("class/".length) : str2(d.taskClass, nested.taskClass);
     return `model resolved \u2192 ${resolved ?? requested ?? "?"}${cls ? ` (${cls})` : ""}`;
   }
-  const outcome = str(d.outcome, nested.outcome, d.code, nested.code) ?? "unknown";
-  const detail = str(d.message, nested.message) ?? (requested && resolved && requested !== resolved ? `${requested} \u2192 ${resolved}` : requested ?? resolved);
+  const outcome = str2(d.outcome, nested.outcome, d.code, nested.code) ?? "unknown";
+  const detail = str2(d.message, nested.message) ?? (requested && resolved && requested !== resolved ? `${requested} \u2192 ${resolved}` : requested ?? resolved);
   return `model policy warning: ${outcome}${detail ? ` ${detail}` : ""}`;
 }
 __name(modelEventDetail, "modelEventDetail");
@@ -54378,7 +56504,9 @@ async function logsCore(ctx, runId, o) {
   if (events.length === 0) console.log("(no log events yet)");
   for (const e of events) {
     const data = scrubEventData(e.data);
-    const msg = modelEventDetail(e.type, data) ?? data?.message ?? subrunEventDetail(e);
+    const msg = modelEventDetail(e.type, data) ?? // [WJB-B5]: the budget events carry no `message` of their own — without a renderer they would print as a
+    // bare type, which is why the pattern admitting them and this line land together.
+    budgetEventDetail(e.type, data) ?? data?.message ?? subrunEventDetail(e);
     console.log(`[${clockOf(e.ts)}] ${e.type}${e.stepId ? ` \xB7 ${e.stepId}` : ""}${msg ? ` \xB7 ${msg}` : ""}`);
   }
   return WORKFLOW_EXIT.OK;
@@ -54756,7 +56884,7 @@ async function archiveRunsCore(ctx, o) {
     if (!ctx.json) console.log(line);
   }, "say");
   const sha256 = /* @__PURE__ */ __name((buf) => crypto5.createHash("sha256").update(buf).digest("hex"), "sha256");
-  const sleep3 = /* @__PURE__ */ __name((ms) => new Promise((r) => setTimeout(r, ms)), "sleep");
+  const sleep4 = /* @__PURE__ */ __name((ms) => new Promise((r) => setTimeout(r, ms)), "sleep");
   const archiveOne = /* @__PURE__ */ __name(async (apiRow) => {
     const run = {
       ...apiRow,
@@ -54814,7 +56942,7 @@ async function archiveRunsCore(ctx, o) {
     }
     let dto = req.data;
     for (let attempt = 0; !dto || dto.status === "pending"; attempt++) {
-      if (attempt > 0) await sleep3(Math.min(5e3, 250 * 2 ** Math.min(attempt, 5)));
+      if (attempt > 0) await sleep4(Math.min(5e3, 250 * 2 ** Math.min(attempt, 5)));
       if (attempt > 60) {
         report2.deferred.push({
           runId: run.id,
@@ -56315,12 +58443,8 @@ async function clearGateCore(ctx, runId, o) {
   if (!res.success || !res.data) return apiFailure(ctx, res, "clear-gate");
   emitJson(ctx, res);
   if (ctx.json) return WORKFLOW_EXIT.OK;
-  if (res.data.cleared) {
-    writeSuccess(`\u2705 Cleared the ${res.data.kind ?? kind} gate on ${runId}${res.data.status ? ` \u2014 ${res.data.status}` : ""}`);
-    console.log(`   lua workflows watch ${runId}`);
-  } else {
-    writeInfo(`\u2139\uFE0F  ${runId} is not parked on a ${kind} gate${res.data.reason ? ` \u2014 ${res.data.reason}` : ""}. Nothing to clear.`);
-  }
+  writeSuccess(`\u2705 Cleared the ${res.data.kind ?? kind} gate on ${runId}${res.data.status ? ` \u2014 ${res.data.status}` : ""}`);
+  console.log(`   lua workflows watch ${runId}`);
   return WORKFLOW_EXIT.OK;
 }
 __name(clearGateCore, "clearGateCore");
@@ -56345,12 +58469,18 @@ async function recomposeCore(ctx, name, _o) {
   emitJson(ctx, res);
   if (ctx.json) return WORKFLOW_EXIT.OK;
   const d = res.data;
-  if (d.unchanged) {
+  const rewrittenCount = d.rewritten?.length ?? 0;
+  if (rewrittenCount === 0) {
     writeInfo(`\u2139\uFE0F  ${wf.name} already asks for model classes everywhere it can \u2014 no new version was published.`);
     return WORKFLOW_EXIT.OK;
   }
-  writeSuccess(`\u2705 ${wf.name} recomposed \u2192 version ${d.version ?? d.versionId ?? "(new)"}` + (d.rewritten !== void 0 ? ` \xB7 ${d.rewritten} agent step${d.rewritten === 1 ? "" : "s"} rewritten` : ""));
-  for (const line of recomposeNextSteps(wf, d.version)) console.log(line);
+  const saved = d.composed?.saved;
+  const version = saved?.version ?? saved?.versionId ?? "(new)";
+  writeSuccess(`\u2705 ${wf.name} recomposed \u2192 version ${version} \xB7 ${rewrittenCount} agent step${rewrittenCount === 1 ? "" : "s"} rewritten`);
+  if (saved?.supersededBy) {
+    writeInfo(`\u2139\uFE0F  a concurrent recompose already holds the pin at version ${saved.supersededBy} \u2014 that is what runs.`);
+  }
+  for (const line of recomposeNextSteps(wf, version)) console.log(line);
   return WORKFLOW_EXIT.OK;
 }
 __name(recomposeCore, "recomposeCore");
@@ -58395,10 +60525,10 @@ async function templateCommand(action, options = {}) {
   });
 }
 __name(templateCommand, "templateCommand");
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
-__name(sleep2, "sleep");
+__name(sleep3, "sleep");
 function missingVersionOrRethrow(error) {
   if (CliError.isCliError(error) && error.statusCode === 404) return null;
   throw error;
@@ -58442,12 +60572,12 @@ function parseEnvContract(raw) {
   const result = {};
   for (const entry of raw) {
     for (const pair of entry.split(/,(?=\s*[A-Za-z_][A-Za-z0-9_]*\??\s*=)/)) {
-      const trimmed = pair.trim();
-      if (!trimmed) continue;
-      const eqIdx = trimmed.indexOf("=");
+      const trimmed2 = pair.trim();
+      if (!trimmed2) continue;
+      const eqIdx = trimmed2.indexOf("=");
       if (eqIdx === -1) continue;
-      let key = trimmed.slice(0, eqIdx).trim();
-      const description = trimmed.slice(eqIdx + 1).trim();
+      let key = trimmed2.slice(0, eqIdx).trim();
+      const description = trimmed2.slice(eqIdx + 1).trim();
       let required = true;
       if (key.endsWith("?")) {
         required = false;
@@ -59014,8 +61144,7 @@ Apply v${versionObj.version} to ${targets.length} agent(s)?`);
   writeProgress("\u{1F504} Starting apply run...");
   const { runId } = await templateApi.apply(templateId, {
     version: versionObj.version,
-    targets,
-    skipEnvCheck: options.skipEnvCheck
+    targets
   });
   if (options.wait === false) {
     if (options.json) {
@@ -59034,7 +61163,7 @@ Apply v${versionObj.version} to ${targets.length} agent(s)?`);
     if (Date.now() > waitDeadline) {
       throw new Error(`Apply run ${runId} still running after 30 minutes \u2014 a crashed worker can leave a run stuck. Check later with: lua marketplace template status --template-id ${templateId}`);
     }
-    await sleep2(3e3);
+    await sleep3(3e3);
     run = await templateApi.getApplyRun(templateId, runId);
   }
   if (options.json) {
@@ -67422,7 +69551,7 @@ function setupMarketplaceCommands(program2) {
   program2.command("marketplace [noun] [action]").description("\u{1F6CD}\uFE0F  Browse, install, and manage marketplace skills and agent templates").option("--skill-name <name>", "Skill name (for skill list/update/uninstall)").option("--marketplace-id <id>", "Marketplace skill ID").option("--new-org-id <id>", "Destination organization ID (for skill transfer)").option("--version-id <id>", "Version ID (for skill publish/install)").option("--env-vars-json <json>", "JSON string with env var metadata (for skill publish)").option("--query <text>", "Search query (for skill search)").option("--page <n>", "Page number (for skill search)").option("--limit <n>", "Results per page (for skill search)").option("--name <name>", "Template name, an internal identifier (for template create)").option("--description <text>", "Description (for template create)").option("--template-id <id>", "Template ID").option("--window-days <n>", "Fleet-health window in days (template health, R46)").option("--source-version <n>", "Agent version to freeze into this template version (default: active) (for template publish)").option("--env-contract <pair>", "KEY=description env contract entry, repeatable; use KEY?=description for optional (for template publish)", (val, previous) => [
     ...previous,
     val
-  ], []).option("--skip-auto-apply", "Publish without auto-updating the installs that consented to creator updates (for template publish)").option("--version <n>", "Template version (for template view/install/apply)").option("--allow-creator-updates", "Allow the template creator to push future updates onto this install").option("--skip-env-check", "Skip env-contract validation (for template install/apply)").option("--agents <ids>", "Comma-separated target agent IDs (for template apply)").option("--file <path>", "Path to a file with one target agent ID per line (for template apply)").option("--all-installed", "Target every agent that already has this template installed (for template apply)").option("--no-wait", "Print the apply runId immediately instead of polling for completion (for template apply)").option("--display-name <name>", "Display name (for skill list/edit, template create)").option("--visibility <visibility>", "Who can see and install it: public or private (for skill list, template create)").option("--changelog <text>", "Changelog for this version (for skill/template publish)").option("--env-vars <pairs>", "Comma-separated key=value pairs (for skill/template install/update)").option("--json", "Output as JSON").option("--force", "Skip confirmation prompts").option("--yes", "Auto-confirm ONLY the template-publish consequence prompt (section clear/narrow); unlike --force it skips no other confirmation").addHelpText("after", `
+  ], []).option("--skip-auto-apply", "Publish without auto-updating the installs that consented to creator updates (for template publish)").option("--version <n>", "Template version (for template view/install/apply)").option("--allow-creator-updates", "Allow the template creator to push future updates onto this install").option("--skip-env-check", "Deprecated no-op: the env-contract check is server-enforced; use `lua env` to satisfy the contract (for template install/apply)").option("--agents <ids>", "Comma-separated target agent IDs (for template apply)").option("--file <path>", "Path to a file with one target agent ID per line (for template apply)").option("--all-installed", "Target every agent that already has this template installed (for template apply)").option("--no-wait", "Print the apply runId immediately instead of polling for completion (for template apply)").option("--display-name <name>", "Display name (for skill list/edit, template create)").option("--visibility <visibility>", "Who can see and install it: public or private (for skill list, template create)").option("--changelog <text>", "Changelog for this version (for skill/template publish)").option("--env-vars <pairs>", "Comma-separated key=value pairs (for skill/template install/update)").option("--json", "Output as JSON").option("--force", "Skip confirmation prompts").option("--yes", "Auto-confirm ONLY the template-publish consequence prompt (section clear/narrow); unlike --force it skips no other confirmation").addHelpText("after", `
 Arguments:
   noun                   Optional: 'skill' or 'template' (prompts if not provided)
   action                 Optional: specific action for non-interactive mode
@@ -67699,9 +69828,9 @@ Examples:
   $ lua channels              Interactive management
   $ lua channels list         List all channels
 `).action(channelsCommand);
-  program2.command("logs").description("\u{1F4CA} View agent and skill logs").option("--type <type>", "Filter by type: all, skill, job, webhook, preprocessor, postprocessor, user_message, agent_response, mcp, mastra").option("--name <name>", "Entity name to filter (requires --type)").option("--user-id <userId>", "Filter logs by user ID").option("--agent-id <agentId>", "View logs for a specific agent ID (admin access required)").option("--limit <n>", "Number of logs to show (default: 20)").option("--page <n>", "Page number for pagination").option("--json", "Output as JSON (for scripting)").option("--direction <direction>", "Filter calls by direction (inbound | outbound) \u2014 only with --type calls").option("--status <status>", "Filter calls by status \u2014 only with --type calls").addHelpText("after", `
+  program2.command("logs").description("\u{1F4CA} View agent and skill logs").option("--type <type>", "Filter by type: all, calls, or any of the 18 log sources (skill, job, webhook, trigger, preprocessor, postprocessor, user_message, agent_response, agent_error, runtime, mcp, rag, device, device-trigger, model-resolver, workflow-step, workflow-script, workflow)").option("--name <name>", "Entity name to filter (requires --type)").option("--user-id <userId>", "Filter logs by user ID").option("--agent-id <agentId>", "View logs for a specific agent ID (admin access required)").option("--limit <n>", "Number of logs to show (default: 20)").option("--page <n>", "Page number for pagination").option("--json", "Output as JSON (for scripting)").option("--direction <direction>", "Filter calls by direction (inbound | outbound) \u2014 only with --type calls").option("--status <status>", "Filter calls by status \u2014 only with --type calls").option("--since <when>", "Only logs at or after this time: an ISO 8601 instant, or 15m | 2h | 7d").option("--until <when>", "Only logs at or before this time; same formats (ends a --follow)").option("--environment <env>", "production | sandbox (a row with no environment reads as production)").option("--follow", "Stream new logs as they arrive (Ctrl-C to stop); not valid with --page").addHelpText("after", `
 Options:
-  --type <type>          Filter by type: all, skill, job, webhook, preprocessor, postprocessor, user_message, agent_response, mcp, mastra, calls
+  --type <type>          Filter by type: all, calls, or any of the 18 log sources (skill, job, webhook, trigger, preprocessor, postprocessor, user_message, agent_response, agent_error, runtime, mcp, rag, device, device-trigger, model-resolver, workflow-step, workflow-script, workflow)
   --name <name>          Entity name to filter (requires --type, not for message types)
   --user-id <userId>     Filter logs by user ID
   --agent-id <agentId>   View logs for a specific agent ID (admin access required, overrides the agent in lua.config.yaml)
@@ -67710,6 +69839,11 @@ Options:
   --json                 Output as JSON for scripting
   --direction <dir>      Filter calls by direction (inbound | outbound) \u2014 only with --type calls
   --status <status>      Filter calls by status \u2014 only with --type calls
+  --since <when>         Inclusive lower bound: an ISO 8601 instant, or a relative window (15m, 2h, 7d)
+  --until <when>         Inclusive upper bound, same formats; it also ends a --follow
+  --environment <env>    production | sandbox \u2014 a row with no environment reads as production
+  --follow               Poll for new logs until Ctrl-C; refuses --page, and --json emits one
+                         {logs, nextCursor, pagination} envelope per poll
 
 Examples:
   $ lua logs                                      Interactive selection
@@ -67723,6 +69857,16 @@ Examples:
   $ lua logs --type calls                         Recent voice calls (renders as table)
   $ lua logs --type calls --direction outbound    Outbound calls only
   $ lua logs --type calls --status failed --json  Failed calls as JSON
+  $ lua logs --since 15m                          The last fifteen minutes
+  $ lua logs --since 2026-09-21T09:00:00Z --until 2026-09-21T10:00:00Z   One hour, exactly
+  $ lua logs --environment sandbox --type skill   Sandbox skill logs only
+  $ lua logs --follow                             Stream new logs until Ctrl-C
+  $ lua logs --follow --since 5m --json           Tail the last five minutes, as JSON
+
+Notes:
+  A relative --since/--until is resolved by the SERVER's clock, so a skewed machine cannot
+  shift the window. --type calls reads voice calls and ignores --since/--until/--environment
+  /--follow. --since is INCLUSIVE; the boundary row is de-duplicated by id while following.
 `).action(logsCommand);
   program2.command("skills [actionOrEnv] [action]").description("\u2699\uFE0F  Manage and view skills").option("--skill-name <name>", "Skill name").option("--skill-version <version>", "Version for deploy action (or 'latest')").addHelpText("after", `
 Arguments:
@@ -67765,6 +69909,28 @@ Examples:
   $ lua webhooks subscribe --webhook-name myWebhook --event message.delivered    Subscribe to event
   $ lua webhooks unsubscribe --webhook-name myWebhook --event message.delivered  Unsubscribe from event
 `).action(webhooksCommand);
+  program2.command("drains [action] [id]").description("\u{1F6B0} Manage log drains (stream this organization's logs to your own destination)").option("--json", "Output as JSON").option("--yes", "Skip confirmation prompts (required with --include-content in CI)").option("--org <id>", "The organization to act on (default: the project, or the key when it reaches one org)").option("--name <name>", "Drain name (1-64 chars, unique per org)").option("--type <type>", "http | otlp | datadog | betterstack").option("--endpoint <url>", "Destination URL (http and otlp only; https, public host)").option("--site <site>", "Preset site/region, e.g. datadoghq.eu").option("--format <format>", "json | ndjson").option("--header <name>", "Custom header NAME (the value is prompted)", collect, []).option("--header-from-env <name=ENV_VAR>", "Custom header, value read from an env var (CI form)", collect, []).option("--sources <list>", "Comma-separated source selectors (default: the recommended set)").option("--min-severity <level>", "debug | info | warn | error (default info)").option("--agents <list>", "'all' or a comma-separated list of agent ids").option("--environments <list>", "production,sandbox (default production)").option("--sampling <spec>", "Head sampling, e.g. debug=0.1").option("--include-content", "Include user messages and agent responses (prints an acknowledgement)").option("--no-include-content", "update: stop sending message bodies (the drain keeps its sources)").option("--limit <n>", "deliveries: rows to return (max 100)").option("--kind <kind>", "deliveries: batch | test | verify | heartbeat | dropped | truncated").option("--reason <text>", "pause: why").option("--finalize", "rotate-secret: close an open rotation window early").addHelpText("after", `
+Arguments:
+  action                   Optional: list (default), status, deliveries, create, update, delete,
+                           test, verify, pause, resume, rotate-secret
+  id                       The drain id, for every action but list, status and create
+
+Examples:
+  $ lua drains                                                     List this org's drains
+  $ lua drains status --json                                       Health + quota (exit 2 if any is failing)
+  $ lua drains create --name prod-siem --type http --endpoint https://logs.example.com/lua
+  $ lua drains verify drn_...                                      Prove you own the endpoint
+  $ lua drains deliveries drn_... --limit 20 --kind batch          Recent delivery attempts
+  $ lua drains rotate-secret drn_...                               New signing secret (shown once)
+  $ lua drains rotate-secret drn_... --finalize                    Close the rotation window
+  $ lua drains pause drn_... --reason "noisy vendor"               Stop delivering (buffering continues)
+  $ lua drains update drn_... --no-include-content                 Stop sending message bodies
+
+Notes:
+  Secrets are never flags. --header takes a NAME and prompts for the value; in --ci mode use
+  --header-from-env DD_API_KEY=DATADOG_KEY. The HMAC signing secret is minted by the server and
+  printed exactly once, at create and at rotate-secret.
+`).action(drainsCommand);
   program2.command("devices [action]").description("\u{1F4E1} Manage connected devices").option("--device-name <name>", "Device name").option("--group <group>", "Filter by device group").option("--payload <json>", "JSON payload for test/test-trigger", "{}").option("--timeout <ms>", "Timeout in milliseconds", "30000").option("--force", "Skip confirmation prompts").addHelpText("after", `
 Arguments:
   action                   Optional: list, status, enable, disable, remove, test, test-trigger
@@ -67808,7 +69974,7 @@ Examples:
   $ lua jobs versions -i myJob                         View job versions
   $ lua jobs history -i myJob                          View execution history
 `).action(jobsCommand);
-  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, retry-step, resolve-step, raise-budget, approve, signal, replay, export, schedules)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/export/goals create/schedules create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create/schedules create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs/schedules create: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start/schedules create: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list/approval-payload --path: page size").option("--cursor <c>", "runs/goals list/approval-payload --path: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status, 6 for a gated run").option("--compose <on|off>", "policy models set: may the composer be shown the model menu").option("--max-class <fast|balanced|strong>", "policy models set: ceiling for class requests and the class map").option("--consent-actions <n>", "policy models set: estimated actions above which a composed run shows the card").option("--allow <codes>", "policy models set: comma-separated approved codes to narrow the set to").option("--class-fast <codes>", "policy models set: ordered overrides of the fast class (comma-separated)").option("--class-balanced <codes>", "policy models set: ordered overrides of the balanced class (comma-separated)").option("--class-strong <codes>", "policy models set: ordered overrides of the strong class (comma-separated)").option("--class-map <pairs>", "policy models set: comma-separated <taskClass>=<modelClass> pairs").option("--pins <class-only|allowed>", "policy models set: may a composed definition pin a concrete code").option("--fallback <same-class|same-provider>", "policy models set: where a failed leg may hop to").option("--enabled <on|off>", "policy autonomy set: may a start inside the envelope skip the consent card").option("--max-duration <seconds>", "policy autonomy set: the envelope\u2019s duration bound, in seconds").option("--max-actions <n>", "policy autonomy set: the envelope\u2019s estimated-actions bound").option("--max-runs-per-hour <n>", "policy autonomy set: autonomous starts per hour, per agent").option("--forms <list>", "policy autonomy set: comma-separated forms the envelope admits (graph,script,static)").option("--clear <keys>", "policy autonomy set: comma-separated members to clear back to the platform default").option("--agent <agentId>", "policy autonomy: not supported \u2014 no route writes a per-agent envelope (see the refusal)").option("--kind <kind>", "clear-gate: the gate kind to clear (e.g. model_policy)").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/retry-step/resolve-step/logs: step id").option("--outcome <skip|complete|fail>", "resolve-step: the decision on the parked step (--action is accepted too)").option("--action <skip|complete|fail>", "resolve-step: alias of --outcome").option("--output <json|@file>", "resolve-step: the output a completed step would have produced (required with --outcome complete)").option("--credits <n>", "raise-budget: the new credit cap of a budget-parked run (above the current one)").option("--max-steps <n>", "raise-budget: the new step cap").option("--max-job-seconds <n>", "raise-budget: the new Job-tier seconds cap").option("--max-duration-seconds <n>", "raise-budget: the new wall-clock cap").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve/approval-payload: approval id").option("--path <array.path>", "approval-payload: page one array of a large payload (--cursor / --limit inside it)").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/retry-step/resolve-step/raise-budget/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph \xB7 export: overwrite files").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip) \xB7 export: target dir").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create/schedules create: cadence entry (repeatable, \u2264 5); goals: none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit/schedules create: IANA timezone for bare cron cadences").option("--notify <emailApp|email|app|off>", "schedules create: where each fire notifies").option("--backfill-on-enable <n|none>", "schedules create/patch/resume: replay \u2264 n missed fires on re-enable (patch: none clears it)").option("--backfill-now", "schedules resume (or patch --paused false): one-shot backfill on THIS re-enable").option("--paused <true|false>", "schedules patch: pause (true) or re-enable (false) the schedule").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit/schedules create: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
+  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, retry-step, resolve-step, raise-budget, approve, signal, replay, export, schedules)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/export/goals create/schedules create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create/schedules create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs/schedules create: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start/schedules create: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list/approval-payload --path: page size").option("--cursor <c>", "runs/goals list/approval-payload --path: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status, 6 for a gated run").option("--compose <on|off>", "policy models set: may the composer be shown the model menu").option("--max-class <fast|balanced|strong>", "policy models set: ceiling for class requests and the class map").option("--consent-actions <n>", "policy models set: estimated actions above which a composed run shows the card").option("--allow <codes>", "policy models set: comma-separated approved codes to narrow the set to").option("--class-fast <codes>", "policy models set: ordered overrides of the fast class (comma-separated)").option("--class-balanced <codes>", "policy models set: ordered overrides of the balanced class (comma-separated)").option("--class-strong <codes>", "policy models set: ordered overrides of the strong class (comma-separated)").option("--class-map <pairs>", "policy models set: comma-separated <taskClass>=<modelClass> pairs").option("--pins <class-only|allowed>", "policy models set: may a composed definition pin a concrete code").option("--fallback <same-class|same-provider>", "policy models set: where a failed leg may hop to").option("--enabled <on|off>", "policy autonomy set: may a start inside the envelope skip the consent card").option("--max-duration <seconds>", "policy autonomy set: the envelope\u2019s duration bound, in seconds").option("--max-actions <n>", "policy autonomy set: the envelope\u2019s estimated-actions bound").option("--max-runs-per-hour <n>", "policy autonomy set: autonomous starts per hour, per agent").option("--forms <list>", "policy autonomy set: comma-separated forms the envelope admits (graph,script,static)").option("--clear <keys>", "policy autonomy set: comma-separated members to clear back to the platform default").option("--agent <agentId>", "policy autonomy: not supported \u2014 no route writes a per-agent envelope (see the refusal)").option("--kind <kind>", "clear-gate: the gate kind to clear (e.g. model_policy)").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/retry-step/resolve-step/logs: step id").option("--outcome <skip|complete|fail>", "resolve-step: the decision on the parked step (--action is accepted too)").option("--action <skip|complete|fail>", "resolve-step: alias of --outcome").option("--output <json|@file>", "resolve-step: the output a completed step would have produced (required with --outcome complete)").option("--credits <n>", "raise-budget: the new priced cap of a budget-parked run, in the run's own budget unit \u2014 credits, or actions on a seat plan (above the current one)").option("--max-steps <n>", "raise-budget: the new step cap").option("--max-job-seconds <n>", "raise-budget: the new Job-tier seconds cap").option("--max-duration-seconds <n>", "raise-budget: the new wall-clock cap").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve/approval-payload: approval id").option("--path <array.path>", "approval-payload: page one array of a large payload (--cursor / --limit inside it)").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/retry-step/resolve-step/raise-budget/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph \xB7 export: overwrite files").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip) \xB7 export: target dir").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create/schedules create: cadence entry (repeatable, \u2264 5); goals: none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit/schedules create: IANA timezone for bare cron cadences").option("--notify <emailApp|email|app|off>", "schedules create: where each fire notifies").option("--backfill-on-enable <n|none>", "schedules create/patch/resume: replay \u2264 n missed fires on re-enable (patch: none clears it)").option("--backfill-now", "schedules resume (or patch --paused false): one-shot backfill on THIS re-enable").option("--paused <true|false>", "schedules patch: pause (true) or re-enable (false) the schedule").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit/schedules create: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
 Arguments:
   action    list \xB7 view \xB7 versions \xB7 deploy \xB7 activate \xB7 deactivate \xB7 start \xB7 run \xB7 runs \xB7 status \xB7
             watch \xB7 cancel \xB7 resume \xB7 retry-step \xB7 resolve-step \xB7 raise-budget \xB7 approve \xB7 approval-payload \xB7
@@ -68228,7 +70394,7 @@ __name(visibleLength, "visibleLength");
 function printBanner(opts) {
   if (process.env.LUA_NO_BANNER) return;
   if (!process.stdout.isTTY && !process.env.LUA_FORCE_BANNER) return;
-  if (process.env.NO_COLOR) {
+  if (noColorEnabled()) {
     process.stdout.write(`
 lua-cli v${opts.version}  \xB7  Build and deploy AI agents with superpowers
 
@@ -68251,6 +70417,7 @@ __name(printBanner, "printBanner");
 // src/index.ts
 init_package_root();
 var CLI_VERSION = getCliVersion();
+configureChalkColor(chalk5);
 var args = process.argv.slice(2);
 var isBareInvocation = args.length === 0;
 var isHelpInvocation = args.includes("--help") || args.includes("-h");