lua-cli 3.38.0 → 3.39.0

package/dist/api-exports.js

@@ -359,6 +359,155 @@ function foldRichPartsIntoMessages(messages, records, makeMessage, sameTurnGroup
   while (next < synthetic.length) combined.push(synthetic[next++].message);
   return mergeRichPartMirrorMessages(combined, sameTurnGroup);
 }
+function utf8WidthAt(value3, index) {
+  const code = value3.charCodeAt(index);
+  if (code < 128) return {
+    bytes: 1,
+    units: 1
+  };
+  if (code < 2048) return {
+    bytes: 2,
+    units: 1
+  };
+  if (code >= 55296 && code <= 56319) {
+    const next = value3.charCodeAt(index + 1);
+    if (next >= 56320 && next <= 57343) return {
+      bytes: 4,
+      units: 2
+    };
+  }
+  return {
+    bytes: 3,
+    units: 1
+  };
+}
+function utf8ByteLength(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const width = utf8WidthAt(value3, i);
+    bytes += width.bytes;
+    i += width.units;
+  }
+  return bytes;
+}
+function clampUtf8(value3, maxBytes) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const width = utf8WidthAt(value3, i);
+    if (bytes + width.bytes > maxBytes) return value3.slice(0, i);
+    bytes += width.bytes;
+    i += width.units;
+  }
+  return value3;
+}
+function mapBytes(fields, withMark) {
+  return utf8ByteLength(JSON.stringify(withMark ? {
+    ...fields,
+    [LOG_FIELDS_CLAMPED_KEY]: true
+  } : fields));
+}
+function withValueCap(fields, capBytes) {
+  const out = {};
+  for (const [key, value3] of Object.entries(fields)) {
+    out[key] = typeof value3 === "string" ? clampUtf8(value3, capBytes) : value3;
+  }
+  return out;
+}
+function describeValue(value3) {
+  if (value3 === null) return "null";
+  if (value3 === void 0) return "undefined";
+  if (Array.isArray(value3)) return "an array";
+  return typeof value3 === "object" ? "an object" : `a ${typeof value3}`;
+}
+function assertValidLogFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is not allowed \u2014 a key must match ${LOG_FIELD_KEY_PATTERN.source} (lower-case, starts with a letter, then letters/digits/underscore, at most 64 characters)`);
+  }
+  if (LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key))) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is not allowed \u2014 it has the shape of a credential that the log-drain scrubber masks in values; a field KEY is never scrubbed, so it may never carry a secret shape`);
+  }
+  if (key === LOG_FIELDS_CLAMPED_KEY) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is reserved \u2014 the platform sets it to mark a field map it had to clamp`);
+  }
+}
+function normalizeLogFields(fields) {
+  if (fields === void 0 || fields === null) return void 0;
+  if (typeof fields !== "object" || Array.isArray(fields)) {
+    throw new LuaLogFieldsError(`log fields: expected a plain object of fields, received ${describeValue(fields)}`);
+  }
+  const entries = Object.entries(fields);
+  if (entries.length > LOG_FIELDS_MAX_KEYS) {
+    throw new LuaLogFieldsError(`log fields: ${entries.length} keys exceeds the cap of ${LOG_FIELDS_MAX_KEYS} keys per call`);
+  }
+  const out = {};
+  for (const [key, value3] of entries) {
+    assertValidLogFieldKey(key);
+    if (typeof value3 === "string" || typeof value3 === "boolean") {
+      out[key] = value3;
+      continue;
+    }
+    if (typeof value3 === "number") {
+      if (!Number.isFinite(value3)) {
+        throw new LuaLogFieldsError(`log fields: \`${key}\` must be a finite number \u2014 NaN and Infinity have no JSON form`);
+      }
+      out[key] = value3;
+      continue;
+    }
+    if (Array.isArray(value3)) {
+      const parts = [];
+      for (const element of value3) {
+        if (typeof element !== "string") {
+          throw new LuaLogFieldsError(`log fields: \`${key}\` is an array, so every element must be a string (found ${describeValue(element)})`);
+        }
+        if (element.includes(",")) {
+          throw new LuaLogFieldsError(`log fields: \`${key}\` \u2014 an array element may not contain a comma; elements are comma-joined into one value (with \`${key}${LOG_FIELD_ARRAY_COUNT_SUFFIX}\` beside it), so a comma inside one would be indistinguishable from the separator`);
+        }
+        parts.push(element);
+      }
+      out[key] = parts.join(",");
+      out[`${key}${LOG_FIELD_ARRAY_COUNT_SUFFIX}`] = parts.length;
+      continue;
+    }
+    throw new LuaLogFieldsError(`log fields: \`${key}\` must be a string, number, boolean or string[] \u2014 received ${describeValue(value3)}` + (value3 !== null && typeof value3 === "object" ? " (nested objects are not supported)" : ""));
+  }
+  const keys = Object.keys(out);
+  if (keys.length === 0) return void 0;
+  if (keys.length > LOG_FIELDS_MAX_KEYS) {
+    throw new LuaLogFieldsError(`log fields: ${keys.length} keys exceeds the cap of ${LOG_FIELDS_MAX_KEYS} keys per call \u2014 an array field also contributes its \`${LOG_FIELD_ARRAY_COUNT_SUFFIX.slice(1)}\` sibling`);
+  }
+  if (clampLogFields(out)) out[LOG_FIELDS_CLAMPED_KEY] = true;
+  return out;
+}
+function clampLogFields(out) {
+  let clamped = false;
+  for (const [key, value3] of Object.entries(out)) {
+    if (typeof value3 !== "string") continue;
+    const capped = clampUtf8(value3, LOG_FIELD_MAX_VALUE_BYTES);
+    if (capped !== value3) {
+      out[key] = capped;
+      clamped = true;
+    }
+  }
+  if (mapBytes(out, clamped) <= LOG_FIELDS_MAX_BYTES) return clamped;
+  const base = {
+    ...out
+  };
+  let low = 0;
+  let high = LOG_FIELD_MAX_VALUE_BYTES;
+  let best = 0;
+  while (low <= high) {
+    const mid = Math.floor((low + high) / 2);
+    if (mapBytes(withValueCap(base, mid), true) <= LOG_FIELDS_MAX_BYTES) {
+      best = mid;
+      low = mid + 1;
+    } else {
+      high = mid - 1;
+    }
+  }
+  const fitted = withValueCap(base, best);
+  for (const key of Object.keys(out)) out[key] = fitted[key];
+  return true;
+}
 function isDesktopFileCommandName(value3) {
   return typeof value3 === "string" && DESKTOP_FILE_COMMAND_SET.has(value3);
 }
@@ -586,6 +735,81 @@ function buildDefaultPersona(agentName) {
 function buildPersonalSpaceStartingPersona(agentName) {
   return PERSONAL_SPACE_STARTING_PERSONA.replace(new RegExp(AGENT_NAME_TOKEN.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), () => agentName || "Your assistant");
 }
+function utf8Bytes(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const code = value3.charCodeAt(i);
+    if (code < 128) {
+      bytes += 1;
+      i += 1;
+    } else if (code < 2048) {
+      bytes += 2;
+      i += 1;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value3.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        i += 2;
+      } else {
+        bytes += 3;
+        i += 1;
+      }
+    } else {
+      bytes += 3;
+      i += 1;
+    }
+  }
+  return bytes;
+}
+function isPlainFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
+  return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+function describeAgentLogFieldsViolation(value3) {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) {
+    return "fields must be an object";
+  }
+  const entries = Object.entries(value3);
+  let userKeys = 0;
+  for (const [key, entry] of entries) {
+    if (key === LOG_FIELDS_CLAMPED_KEY) {
+      if (entry !== true) return `fields.${key} must be true`;
+      continue;
+    }
+    userKeys += 1;
+    if (key.endsWith(LOG_FIELD_ARRAY_COUNT_SUFFIX)) {
+      const base = key.slice(0, -LOG_FIELD_ARRAY_COUNT_SUFFIX.length);
+      if (!isPlainFieldKey(base)) return `fields key \`${key}\` is not a legal field key`;
+      if (typeof entry !== "number" || !Number.isFinite(entry)) {
+        return `fields.${key} must be a finite number`;
+      }
+      continue;
+    }
+    if (!isPlainFieldKey(key)) return `fields key \`${key}\` is not a legal field key`;
+    if (typeof entry === "string") {
+      if (utf8Bytes(entry) > LOG_FIELD_MAX_VALUE_BYTES) {
+        return `fields.${key} exceeds ${LOG_FIELD_MAX_VALUE_BYTES} bytes`;
+      }
+      continue;
+    }
+    if (typeof entry === "boolean") continue;
+    if (typeof entry === "number") {
+      if (!Number.isFinite(entry)) return `fields.${key} must be a finite number`;
+      continue;
+    }
+    return `fields.${key} must be a string, number or boolean`;
+  }
+  if (userKeys > LOG_FIELDS_MAX_KEYS) {
+    return `fields has ${userKeys} keys, over the cap of ${LOG_FIELDS_MAX_KEYS}`;
+  }
+  if (utf8Bytes(JSON.stringify(value3)) > LOG_FIELDS_MAX_BYTES) {
+    return `fields exceeds ${LOG_FIELDS_MAX_BYTES} bytes`;
+  }
+  return void 0;
+}
+function isAgentLogFields(value3) {
+  return describeAgentLogFieldsViolation(value3) === void 0;
+}
 function maxDrainsForTier(tier) {
   return tier === "enterprise" ? LOG_DRAIN_MAX_PER_ORG_ENTERPRISE : LOG_DRAIN_MAX_PER_ORG;
 }
@@ -594,6 +818,148 @@ function resolvePresetEndpoint(type, site) {
   if (!template3 || !site) return void 0;
   return template3.replace("{site}", site);
 }
+function isLogDrainBucketHostAllowed(provider, host) {
+  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (!normalized) return false;
+  return (LOG_DRAIN_BUCKET_HOST_PATTERNS[provider] ?? []).some((pattern) => pattern.test(normalized));
+}
+function resolveDrainBucketEndpoint(bucket) {
+  if (!LOG_DRAIN_BUCKET_NAME_PATTERN.test(bucket.bucket)) {
+    throw new Error("log drain bucket name is not a valid S3 bucket label");
+  }
+  if (bucket.provider === "aws") {
+    const region = bucket.region.trim().toLowerCase();
+    if (!/^[a-z0-9-]{1,32}$/.test(region)) throw new Error("log drain bucket region is not an AWS region");
+    return `https://${bucket.bucket}.s3.${region}.amazonaws.com`;
+  }
+  if (!bucket.endpoint) throw new Error(`log drain '${bucket.provider}' bucket requires an endpoint`);
+  let url;
+  try {
+    url = new URL(bucket.endpoint);
+  } catch {
+    throw new Error(`log drain '${bucket.provider}' bucket endpoint is not an absolute URL`);
+  }
+  if (url.protocol !== "https:") throw new Error(`log drain '${bucket.provider}' bucket endpoint must be https`);
+  return `https://${url.host}/${bucket.bucket}`;
+}
+function drainBucketUsesPathStyle(provider) {
+  return provider !== "aws";
+}
+function presetIntakeHosts(type) {
+  const template3 = LOG_DRAIN_ENDPOINT_TEMPLATES[type];
+  const sites = LOG_DRAIN_PRESET_SITES[type];
+  if (!template3 || !sites) return [];
+  const hosts = [];
+  for (const site of sites) {
+    try {
+      hosts.push(new URL(template3.replace("{site}", site)).hostname.toLowerCase());
+    } catch {
+    }
+  }
+  return hosts;
+}
+function presetHostAllowlist(type) {
+  return [
+    ...presetIntakeHosts(type),
+    ...LOG_DRAIN_PRESET_HOST_SUFFIXES[type] ?? []
+  ];
+}
+function drainHostAllowlistAllows(allowlist, host) {
+  const needle = host.toLowerCase();
+  return allowlist.some((raw) => {
+    const entry = raw.toLowerCase();
+    if (entry.startsWith(".")) return needle === entry.slice(1) || needle.endsWith(entry);
+    return entry === needle;
+  });
+}
+function drainDestinationIsVendorPinned(type) {
+  if (LOG_DRAIN_ENDPOINT_TEMPLATES[type]) return true;
+  return presetHostAllowlist(type).length > 0;
+}
+function drainVerificationOwnership(input) {
+  if (input.proved === true) return "verified";
+  if (input.mode === "test-post" && drainDestinationIsVendorPinned(input.type)) return "verified";
+  return "reachability-only";
+}
+function drainOwnershipOrDefault(ownership) {
+  return ownership === "verified" ? "verified" : "reachability-only";
+}
+function assertDrainContentAck(input) {
+  const turningOn = input.next === true && input.was !== true;
+  if (!turningOn) return void 0;
+  if (input.ack !== true) throw new DrainContentAckRequiredError();
+  return {
+    by: input.actor,
+    source: input.source,
+    at: input.at,
+    ...input.inheritedFrom ? {
+      inheritedFrom: input.inheritedFrom
+    } : {}
+  };
+}
+function composePresetEndpoint(type, endpoint) {
+  const rule = LOG_DRAIN_PRESET_PATHS[type];
+  if (!rule) return void 0;
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    return {
+      ok: false,
+      reason: "invalid_url"
+    };
+  }
+  if (url.protocol !== "https:" || !url.hostname) return {
+    ok: false,
+    reason: "invalid_url"
+  };
+  const origin = url.origin;
+  const path3 = url.pathname.replace(/\/+$/, "");
+  if (!rule.segment) {
+    const base2 = path3.endsWith(rule.path) ? path3.slice(0, path3.length - rule.path.length) : path3;
+    return {
+      ok: true,
+      endpoint: `${origin}${base2}${rule.path}`
+    };
+  }
+  const marker = `${rule.path}/`;
+  const at = path3.indexOf(marker);
+  if (at < 0) {
+    return {
+      ok: false,
+      reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
+    };
+  }
+  const base = path3.slice(0, at);
+  const afterMarker = path3.slice(at + marker.length);
+  const rest = rule.suffix && afterMarker.endsWith(rule.suffix) ? afterMarker.slice(0, afterMarker.length - rule.suffix.length) : afterMarker;
+  if (!rest || rest.includes("/")) {
+    return {
+      ok: false,
+      reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
+    };
+  }
+  if (!PRESET_SEGMENT_RE.test(rest)) return {
+    ok: false,
+    reason: "bad_segment"
+  };
+  if (rule.segment === "dataset") {
+    return {
+      ok: true,
+      endpoint: `${origin}${base}${rule.path}/${rest}${rule.suffix ?? ""}`,
+      dataset: rest
+    };
+  }
+  return {
+    ok: true,
+    endpoint: `${origin}${base}${rule.path}/`,
+    token: rest
+  };
+}
+function joinPresetEndpointToken(endpoint, token) {
+  if (typeof token !== "string" || !PRESET_SEGMENT_RE.test(token)) return endpoint;
+  return endpoint.endsWith("/") ? `${endpoint}${token}` : `${endpoint}/${token}`;
+}
 function nextLogDrainQuotaResetAt(now) {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1)).toISOString();
 }
@@ -640,6 +1006,264 @@ function logDrainQuotaDroppedSeverities(degradation) {
       return [];
   }
 }
+function isLogExportSource(source) {
+  return LOG_EXPORT_SOURCES.includes(source);
+}
+function clamp(value3, max) {
+  if (typeof value3 !== "string") return void 0;
+  const trimmed = value3.trim();
+  if (!trimmed) return void 0;
+  return trimmed.length <= max ? trimmed : `${trimmed.slice(0, max - 1)}\u2026`;
+}
+function numberOr(value3, fallback) {
+  return typeof value3 === "number" && Number.isFinite(value3) ? value3 : fallback;
+}
+function isoOr(value3) {
+  return typeof value3 === "string" && value3.length > 0 ? value3 : void 0;
+}
+function logDrainNoticeView(drain, now) {
+  const health = drain.health ?? {};
+  const quota = drain.quota;
+  const view = {
+    id: String(drain.id ?? ""),
+    name: String(drain.name ?? ""),
+    type: drain.type,
+    state: drain.state,
+    deliveredCount24h: numberOr(health.deliveredCount24h, 0),
+    droppedCount24h: numberOr(health.droppedCount24h, 0),
+    rejectedCount24h: numberOr(health.rejectedCount24h, 0),
+    backlog: numberOr(health.backlog, 0),
+    quotaRatio: quota ? logDrainQuotaRatio(quota, now) : 0
+  };
+  if (health.pauseReason) view.pauseReason = health.pauseReason;
+  const lastError = clamp(health.lastError, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS);
+  if (lastError) view.lastError = lastError;
+  if (typeof health.lastStatusCode === "number") view.lastStatusCode = health.lastStatusCode;
+  const lastSuccessAt = isoOr(health.lastSuccessAt);
+  if (lastSuccessAt) view.lastSuccessAt = lastSuccessAt;
+  const lastFailureAt = isoOr(health.lastFailureAt);
+  if (lastFailureAt) view.lastFailureAt = lastFailureAt;
+  const resetsAt = isoOr(quota?.resetsAt);
+  if (resetsAt) view.quotaResetsAt = resetsAt;
+  return view;
+}
+function logDrainHealthCardPath(orgId, drainId) {
+  return `/orgs/${encodeURIComponent(orgId)}/log-drains/${encodeURIComponent(drainId)}`;
+}
+function percent(ratio) {
+  if (!Number.isFinite(ratio) || ratio <= 0) return "0%";
+  return `${Math.round(ratio * 100)}%`;
+}
+function becauseClause(view) {
+  const bits = [];
+  if (view.lastStatusCode) bits.push(`HTTP ${view.lastStatusCode}`);
+  if (view.lastError) bits.push(view.lastError);
+  return bits.length ? ` Last error: ${bits.join(" \u2014 ")}.` : "";
+}
+function logDrainNoticeCopy(payload) {
+  const view = payload.drain;
+  const name = view.name || view.id;
+  const backlog = view.backlog > 0 ? ` ${view.backlog.toLocaleString("en-US")} records are buffered.` : "";
+  switch (payload.kind) {
+    case "failing":
+      return {
+        title: name,
+        subject: `Log drain "${name}" is failing`,
+        previewLine: "Failing \u2014 15 minutes without a successful delivery",
+        summary: `The log drain "${name}" (${view.type}) has gone 15 minutes without a successful delivery and is now failing.${becauseClause(view)}${backlog} Records keep buffering; the drain pauses itself after 24 hours without a success.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "paused_auto":
+      return {
+        title: name,
+        subject: `Log drain "${name}" was paused`,
+        previewLine: "Paused \u2014 24 hours without a successful delivery",
+        summary: `The log drain "${name}" (${view.type}) was paused automatically after 24 hours without a successful delivery.${becauseClause(view)}${backlog} Nothing is being sent while it is paused, and the buffer is delivered on resume. Fix the destination, then resume it from the drain's health card or with \`lua drains resume ${view.id}\`.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "paused_quota":
+      return {
+        title: name,
+        subject: `Log drain "${name}" was paused \u2014 daily quota exhausted`,
+        previewLine: `Paused \u2014 ${percent(view.quotaRatio)} of the daily allowance used`,
+        summary: `The log drain "${name}" (${view.type}) reached ${percent(view.quotaRatio)} of its daily allowance and was paused.${backlog} Records keep buffering. The allowance resets${view.quotaResetsAt ? ` at ${view.quotaResetsAt}` : " at 00:00 UTC"}; narrow the drain's sources or raise the plan's limit to stop it happening again, then resume it with \`lua drains resume ${view.id}\`.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "quota_warning":
+      return {
+        title: name,
+        subject: `Log drain "${name}" has used 80% of its daily allowance`,
+        previewLine: `${percent(view.quotaRatio)} of the daily allowance used`,
+        summary: `The log drain "${name}" (${view.type}) has used ${percent(view.quotaRatio)} of today's allowance. Past 100% debug records are dropped, past 125% info records as well, and at 150% the drain pauses. The allowance resets${view.quotaResetsAt ? ` at ${view.quotaResetsAt}` : " at 00:00 UTC"}.`,
+        status: "failed",
+        priority: "normal"
+      };
+    case "dropped": {
+      const dropped = payload.droppedCount ?? view.droppedCount24h;
+      return {
+        title: name,
+        subject: `Log drain "${name}" is dropping records`,
+        previewLine: `${dropped.toLocaleString("en-US")} records dropped`,
+        summary: `The log drain "${name}" (${view.type}) dropped ${dropped.toLocaleString("en-US")} records because its buffer filled up faster than the destination accepted them.${becauseClause(view)} The gap is reported in band on the next successful batch, so the range is recoverable from the destination itself.`,
+        status: "failed",
+        priority: "high"
+      };
+    }
+    case "verification_pending":
+      return {
+        title: name,
+        subject: `Log drain "${name}" is still unverified`,
+        previewLine: "Unverified after 24 hours \u2014 nothing is being delivered",
+        summary: `The log drain "${name}" (${view.type}) was created more than 24 hours ago and has never completed verification, so nothing is being delivered to it.${becauseClause(view)} Run \`lua drains verify ${view.id}\` once the destination echoes the verification token.`,
+        status: "failed",
+        priority: "normal"
+      };
+    default: {
+      const exhaustive = payload.kind;
+      throw new Error(`unhandled log-drain notice kind: ${String(exhaustive)}`);
+    }
+  }
+}
+function logDrainNoticeLabel(kind) {
+  switch (kind) {
+    case "failing":
+      return "failing";
+    case "paused_auto":
+      return "paused (no success for 24 h)";
+    case "paused_quota":
+      return "paused (daily allowance exhausted)";
+    case "quota_warning":
+      return "80% of the daily allowance used";
+    case "dropped":
+      return "dropping records";
+    case "verification_pending":
+      return "still unverified";
+    default: {
+      const exhaustive = kind;
+      throw new Error(`unhandled log-drain notice kind: ${String(exhaustive)}`);
+    }
+  }
+}
+function logDrainNoticeDigestCopy(payload) {
+  const entries = [
+    ...payload.entries ?? []
+  ].sort((a, b) => a.at < b.at ? -1 : a.at > b.at ? 1 : 0).slice(0, LOG_DRAIN_DIGEST_MAX_ENTRIES);
+  const drains = new Set(entries.map((entry) => entry.drainId));
+  const noun = `${entries.length} notice${entries.length === 1 ? "" : "s"}`;
+  const across = `${drains.size} drain${drains.size === 1 ? "" : "s"}`;
+  const lines = entries.map((entry) => `${entry.drainName || entry.drainId} \u2014 ${logDrainNoticeLabel(entry.kind)}`);
+  return {
+    title: "Log drains \u2014 daily summary",
+    subject: `Log drains \u2014 ${noun} in the last day`,
+    previewLine: `${noun} across ${across}`,
+    summary: `${noun} across ${across} in the last day: ${lines.join("; ")}.`,
+    status: "failed",
+    priority: "normal"
+  };
+}
+function finiteNonNegative(value3) {
+  return typeof value3 === "number" && Number.isFinite(value3) && value3 >= 0 ? value3 : void 0;
+}
+function mergeLimits(base, stored) {
+  const patch = stored ?? {};
+  return {
+    eventsPerDay: finiteNonNegative(patch.eventsPerDay) ?? base.eventsPerDay,
+    bytesPerDay: finiteNonNegative(patch.bytesPerDay) ?? base.bytesPerDay
+  };
+}
+function mergeCard(base, stored) {
+  const patch = stored ?? {};
+  return {
+    includedEventsPerMonth: finiteNonNegative(patch.includedEventsPerMonth) ?? base.includedEventsPerMonth,
+    includedBytesPerMonth: finiteNonNegative(patch.includedBytesPerMonth) ?? base.includedBytesPerMonth,
+    usdPerMillionEvents: finiteNonNegative(patch.usdPerMillionEvents) ?? base.usdPerMillionEvents,
+    usdPerGiB: finiteNonNegative(patch.usdPerGiB) ?? base.usdPerGiB
+  };
+}
+function resolveStoredLogDrainPlanConfig(stored) {
+  const values = stored;
+  if (!values || typeof values.version !== "number" || !Number.isFinite(values.version)) {
+    return DEFAULT_LOG_DRAIN_PLAN_CONFIG;
+  }
+  const tiers = {};
+  const pricing = {};
+  for (const tier of TIERS) {
+    tiers[tier] = mergeLimits(DEFAULT_LOG_DRAIN_PLAN_CONFIG.tiers[tier], values.tiers?.[tier]);
+    pricing[tier] = mergeCard(DEFAULT_LOG_DRAIN_PLAN_CONFIG.pricing[tier], values.pricing?.[tier]);
+  }
+  const orgs = {};
+  for (const [orgId, override] of Object.entries(values.orgs ?? {})) {
+    if (!orgId || !override || typeof override !== "object") continue;
+    const row = {};
+    if (override.tier && TIERS.includes(override.tier)) row.tier = override.tier;
+    const events = finiteNonNegative(override.eventsPerDay);
+    const bytes = finiteNonNegative(override.bytesPerDay);
+    if (events !== void 0) row.eventsPerDay = events;
+    if (bytes !== void 0) row.bytesPerDay = bytes;
+    if (override.pricing && typeof override.pricing === "object") row.pricing = {
+      ...override.pricing
+    };
+    if (Object.keys(row).length) orgs[orgId] = row;
+  }
+  return {
+    version: values.version,
+    tiers,
+    pricing,
+    ...Object.keys(orgs).length ? {
+      orgs
+    } : {}
+  };
+}
+function logDrainPlanTierOverride(config, orgId) {
+  return orgId ? config.orgs?.[orgId]?.tier : void 0;
+}
+function logDrainQuotaLimitsFor(config, orgId, tier) {
+  const base = config.tiers[tier] ?? config.tiers.team ?? LOG_DRAIN_QUOTAS.team;
+  const override = orgId ? config.orgs?.[orgId] : void 0;
+  if (!override) return {
+    ...base
+  };
+  return {
+    eventsPerDay: override.eventsPerDay ?? base.eventsPerDay,
+    bytesPerDay: override.bytesPerDay ?? base.bytesPerDay
+  };
+}
+function logDrainPriceCardFor(config, orgId, tier) {
+  const base = config.pricing[tier] ?? config.pricing.team ?? DEFAULT_LOG_DRAIN_PLAN_CONFIG.pricing.team;
+  const override = orgId ? config.orgs?.[orgId]?.pricing : void 0;
+  return override ? mergeCard(base, override) : {
+    ...base
+  };
+}
+function priceDrainUsage(totals, card, tier) {
+  const billableRecords = Math.max(0, Math.floor(finiteNonNegative(totals?.billableRecords) ?? 0));
+  const billableBytes = Math.max(0, Math.floor(finiteNonNegative(totals?.billableBytes) ?? 0));
+  const includedEvents = card.includedEventsPerMonth;
+  const includedBytes = card.includedBytesPerMonth;
+  const overageEvents = Math.max(0, billableRecords - includedEvents);
+  const overageBytes = Math.max(0, billableBytes - includedBytes);
+  const eventsUsd = overageEvents / 1e6 * card.usdPerMillionEvents;
+  const bytesUsd = overageBytes / LOG_DRAIN_BYTES_PER_GIB * card.usdPerGiB;
+  const unpriced = card.usdPerMillionEvents === 0 && card.usdPerGiB === 0;
+  const round = /* @__PURE__ */ __name2((usd) => Math.round(usd * 100) / 100, "round");
+  return {
+    lineItem: LOG_DRAIN_USAGE_LINE_ITEM,
+    tier,
+    billableRecords,
+    billableBytes,
+    includedEvents,
+    includedBytes,
+    overageEvents,
+    overageBytes,
+    eventsUsd: round(eventsUsd),
+    bytesUsd: round(bytesUsd),
+    usd: round(Math.max(eventsUsd, bytesUsd)),
+    unpriced
+  };
+}
 function encodeLogCursor(c) {
   return Buffer.from(JSON.stringify({
     t: c.t,
@@ -1358,7 +1982,7 @@ function effectiveAgentFeatures(base, override, rule) {
   if (rule === "wholesale") return override || base || void 0;
   return effectiveAgentFeatureRows(base, override).rows;
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES;
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1686,6 +2310,50 @@ var init_dist = __esm({
       }
     ];
     BROWSER_COMMAND_NAMES = BROWSER_COMMANDS.map((c) => c.name);
+    LOG_FIELDS_MAX_KEYS = 32;
+    LOG_FIELD_MAX_VALUE_BYTES = 1024;
+    LOG_FIELDS_MAX_BYTES = 8192;
+    LOG_FIELD_KEY_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+    LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS = Object.freeze([
+      /^api_[0-9a-f]{24,}$/,
+      /^gh[pousr]_[a-z0-9]{36}$/,
+      /^(?:sk|rk|pk)_(?:live|test)_[a-z0-9]{16,}$/,
+      /^lua_hc_[a-z0-9]{20,}/,
+      /^lua_sk_[a-z0-9]{20,}/
+    ]);
+    LOG_FIELDS_CLAMPED_KEY = "lua_fields_clamped";
+    LOG_FIELD_ARRAY_COUNT_SUFFIX = ".count";
+    LuaLogFieldsError = class _LuaLogFieldsError extends Error {
+      static {
+        __name(this, "_LuaLogFieldsError");
+      }
+      static {
+        __name2(this, "LuaLogFieldsError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "LuaLogFieldsError";
+        Object.setPrototypeOf(this, _LuaLogFieldsError.prototype);
+      }
+    };
+    __name(utf8WidthAt, "utf8WidthAt");
+    __name2(utf8WidthAt, "utf8WidthAt");
+    __name(utf8ByteLength, "utf8ByteLength");
+    __name2(utf8ByteLength, "utf8ByteLength");
+    __name(clampUtf8, "clampUtf8");
+    __name2(clampUtf8, "clampUtf8");
+    __name(mapBytes, "mapBytes");
+    __name2(mapBytes, "mapBytes");
+    __name(withValueCap, "withValueCap");
+    __name2(withValueCap, "withValueCap");
+    __name(describeValue, "describeValue");
+    __name2(describeValue, "describeValue");
+    __name(assertValidLogFieldKey, "assertValidLogFieldKey");
+    __name2(assertValidLogFieldKey, "assertValidLogFieldKey");
+    __name(normalizeLogFields, "normalizeLogFields");
+    __name2(normalizeLogFields, "normalizeLogFields");
+    __name(clampLogFields, "clampLogFields");
+    __name2(clampLogFields, "clampLogFields");
     DESKTOP_FILE_COMMANDS = [
       "files_roots",
       "files_stat",
@@ -2030,6 +2698,37 @@ This text is who you are for this person. As you learn them, their name, their w
       "workflow-script",
       "workflow"
     ];
+    AGENT_LOG_FIELDS_MAX_WIRE_KEYS = LOG_FIELDS_MAX_KEYS + 1;
+    __name(utf8Bytes, "utf8Bytes");
+    __name2(utf8Bytes, "utf8Bytes");
+    __name(isPlainFieldKey, "isPlainFieldKey");
+    __name2(isPlainFieldKey, "isPlainFieldKey");
+    __name(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+    __name2(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+    __name(isAgentLogFields, "isAgentLogFields");
+    __name2(isAgentLogFields, "isAgentLogFields");
+    LOG_DRAIN_TYPES_PHASE1 = [
+      "http",
+      "otlp",
+      "datadog",
+      "betterstack"
+    ];
+    LOG_DRAIN_TYPES_PHASE2 = [
+      "splunk",
+      "loki",
+      "axiom",
+      "newrelic",
+      "sumologic"
+    ];
+    LOG_DRAIN_TYPES_IMPLEMENTED = [
+      ...LOG_DRAIN_TYPES_PHASE1,
+      ...LOG_DRAIN_TYPES_PHASE2,
+      // RECONCILE-4 (W4-4). `s3` is implemented (H4 / PRO-1887) but is NOT in
+      // `LOG_DRAIN_TYPES_PHASE2`, because its own flag opens it and `*` must not. It
+      // belongs here all the same: this list is what a CLIENT may offer, and the server
+      // remains the authority that answers 422 with the live list.
+      "s3"
+    ];
     LOG_DRAIN_SOURCES = [
       ...AGENT_LOG_SOURCES,
       "execution",
@@ -2038,17 +2737,123 @@ This text is who you are for this person. As you learn them, their name, their w
       "trigger-execution",
       "job-execution",
       "workflow-run",
-      "workflow-audit"
+      "workflow-audit",
+      // PRO-1884 (H2). Appended AFTER 'workflow-audit' so the enum stays additive and
+      // no existing member changes position.
+      "voice-call"
     ];
     LOG_DRAIN_MAX_PER_ORG = 5;
     LOG_DRAIN_MAX_PER_ORG_ENTERPRISE = 10;
     __name(maxDrainsForTier, "maxDrainsForTier");
     __name2(maxDrainsForTier, "maxDrainsForTier");
+    LOG_DRAIN_DATADOG_SITES = [
+      "datadoghq.com",
+      "datadoghq.eu",
+      "us3.datadoghq.com",
+      "us5.datadoghq.com",
+      "ap1.datadoghq.com",
+      "ddog-gov.com"
+    ];
+    LOG_DRAIN_NEWRELIC_SITES = [
+      "log-api.newrelic.com",
+      "log-api.eu.newrelic.com",
+      "log-api.jp.newrelic.com"
+    ];
     LOG_DRAIN_ENDPOINT_TEMPLATES = {
-      datadog: "https://http-intake.logs.{site}/api/v2/logs"
+      datadog: "https://http-intake.logs.{site}/api/v2/logs",
+      newrelic: "https://{site}/log/v1"
+    };
+    LOG_DRAIN_PRESET_SITES = {
+      datadog: LOG_DRAIN_DATADOG_SITES,
+      newrelic: LOG_DRAIN_NEWRELIC_SITES
     };
     __name(resolvePresetEndpoint, "resolvePresetEndpoint");
     __name2(resolvePresetEndpoint, "resolvePresetEndpoint");
+    LOG_DRAIN_BUCKET_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+    LOG_DRAIN_BUCKET_HOST_PATTERNS = Object.freeze({
+      aws: [
+        // virtual-host style, regional and legacy global
+        /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.s3(\.dualstack)?(\.[a-z0-9-]+)?\.amazonaws\.com$/,
+        // path style
+        /^s3(\.dualstack)?(\.[a-z0-9-]+)?\.amazonaws\.com$/
+      ],
+      r2: [
+        /^[a-f0-9]{32}\.r2\.cloudflarestorage\.com$/
+      ],
+      gcs: [
+        /^storage\.googleapis\.com$/
+      ]
+    });
+    __name(isLogDrainBucketHostAllowed, "isLogDrainBucketHostAllowed");
+    __name2(isLogDrainBucketHostAllowed, "isLogDrainBucketHostAllowed");
+    __name(resolveDrainBucketEndpoint, "resolveDrainBucketEndpoint");
+    __name2(resolveDrainBucketEndpoint, "resolveDrainBucketEndpoint");
+    __name(drainBucketUsesPathStyle, "drainBucketUsesPathStyle");
+    __name2(drainBucketUsesPathStyle, "drainBucketUsesPathStyle");
+    __name(presetIntakeHosts, "presetIntakeHosts");
+    __name2(presetIntakeHosts, "presetIntakeHosts");
+    LOG_DRAIN_PRESET_HOST_SUFFIXES = {
+      axiom: [
+        ".axiom.co"
+      ],
+      sumologic: [
+        ".sumologic.com"
+      ]
+    };
+    __name(presetHostAllowlist, "presetHostAllowlist");
+    __name2(presetHostAllowlist, "presetHostAllowlist");
+    __name(drainHostAllowlistAllows, "drainHostAllowlistAllows");
+    __name2(drainHostAllowlistAllows, "drainHostAllowlistAllows");
+    __name(drainDestinationIsVendorPinned, "drainDestinationIsVendorPinned");
+    __name2(drainDestinationIsVendorPinned, "drainDestinationIsVendorPinned");
+    __name(drainVerificationOwnership, "drainVerificationOwnership");
+    __name2(drainVerificationOwnership, "drainVerificationOwnership");
+    __name(drainOwnershipOrDefault, "drainOwnershipOrDefault");
+    __name2(drainOwnershipOrDefault, "drainOwnershipOrDefault");
+    DRAIN_CONTENT_ACK_ERROR_CODE = "DRAIN_CONTENT_ACK_REQUIRED";
+    DRAIN_CONTENT_ACK_FIELD = "includeContentAck";
+    DrainContentAckRequiredError = class extends Error {
+      static {
+        __name(this, "DrainContentAckRequiredError");
+      }
+      static {
+        __name2(this, "DrainContentAckRequiredError");
+      }
+      code = DRAIN_CONTENT_ACK_ERROR_CODE;
+      field = DRAIN_CONTENT_ACK_FIELD;
+      constructor() {
+        super("includeContent ships end-user message content to a third party; set includeContentAck: true to confirm.");
+        this.name = "DrainContentAckRequiredError";
+      }
+    };
+    __name(assertDrainContentAck, "assertDrainContentAck");
+    __name2(assertDrainContentAck, "assertDrainContentAck");
+    LOG_DRAIN_PRESET_PATHS = {
+      // https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples
+      splunk: {
+        path: "/services/collector/event"
+      },
+      // https://grafana.com/docs/loki/latest/reference/loki-http-api/#ingest-logs
+      loki: {
+        path: "/loki/api/v1/push"
+      },
+      // https://axiom.co/docs/restapi/endpoints/ingestIntoDataset
+      axiom: {
+        path: "/v1/datasets",
+        segment: "dataset",
+        suffix: "/ingest"
+      },
+      // https://help.sumologic.com/docs/send-data/hosted-collectors/http-source/logs-metrics/upload-logs/
+      sumologic: {
+        path: "/receiver/v1/http",
+        segment: "token"
+      }
+    };
+    PRESET_SEGMENT_RE = /^[A-Za-z0-9._~%=+-]{1,512}$/;
+    __name(composePresetEndpoint, "composePresetEndpoint");
+    __name2(composePresetEndpoint, "composePresetEndpoint");
+    __name(joinPresetEndpointToken, "joinPresetEndpointToken");
+    __name2(joinPresetEndpointToken, "joinPresetEndpointToken");
     LOG_DRAIN_QUOTAS = {
       team: {
         eventsPerDay: 1e6,
@@ -2081,6 +2886,100 @@ This text is who you are for this person. As you learn them, their name, their w
     __name2(logDrainQuotaWarned, "logDrainQuotaWarned");
     __name(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
     __name2(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
+    LOG_EXPORT_SOURCES = [
+      ...AGENT_LOG_SOURCES,
+      "execution"
+    ];
+    LOG_EXPORT_MAX_WINDOW_DAYS = 31;
+    LOG_EXPORT_MAX_WINDOW_MS = LOG_EXPORT_MAX_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
+    LOG_EXPORT_URL_TTL_SECONDS = 24 * 60 * 60;
+    LOG_EXPORT_FILE_RETENTION_DAYS = 7;
+    LOG_EXPORT_FILE_RETENTION_MS = LOG_EXPORT_FILE_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+    LOG_EXPORT_PART_MAX_BYTES = 256 * 1024 * 1024;
+    __name(isLogExportSource, "isLogExportSource");
+    __name2(isLogExportSource, "isLogExportSource");
+    LOG_DRAIN_NOTICE_RATE_LIMIT_MS = 60 * 6e4;
+    LOG_DRAIN_VERIFICATION_STALE_MS = 24 * 60 * 6e4;
+    LOG_DRAIN_DIGEST_INTERVAL_MS = 24 * 60 * 6e4;
+    LOG_DRAIN_DIGEST_MAX_ENTRIES = 50;
+    LOG_DRAIN_NOTICE_ERROR_MAX_CHARS = 200;
+    __name(clamp, "clamp");
+    __name2(clamp, "clamp");
+    __name(numberOr, "numberOr");
+    __name2(numberOr, "numberOr");
+    __name(isoOr, "isoOr");
+    __name2(isoOr, "isoOr");
+    __name(logDrainNoticeView, "logDrainNoticeView");
+    __name2(logDrainNoticeView, "logDrainNoticeView");
+    __name(logDrainHealthCardPath, "logDrainHealthCardPath");
+    __name2(logDrainHealthCardPath, "logDrainHealthCardPath");
+    __name(percent, "percent");
+    __name2(percent, "percent");
+    __name(becauseClause, "becauseClause");
+    __name2(becauseClause, "becauseClause");
+    __name(logDrainNoticeCopy, "logDrainNoticeCopy");
+    __name2(logDrainNoticeCopy, "logDrainNoticeCopy");
+    __name(logDrainNoticeLabel, "logDrainNoticeLabel");
+    __name2(logDrainNoticeLabel, "logDrainNoticeLabel");
+    __name(logDrainNoticeDigestCopy, "logDrainNoticeDigestCopy");
+    __name2(logDrainNoticeDigestCopy, "logDrainNoticeDigestCopy");
+    LOG_DRAIN_USAGE_LINE_ITEM = "log_drain_events";
+    LOG_DRAIN_BYTES_PER_GIB = 1024 ** 3;
+    DEFAULT_LOG_DRAIN_PLAN_CONFIG = {
+      version: 1,
+      tiers: {
+        team: {
+          ...LOG_DRAIN_QUOTAS.team
+        },
+        business: {
+          ...LOG_DRAIN_QUOTAS.business
+        },
+        enterprise: {
+          ...LOG_DRAIN_QUOTAS.enterprise
+        }
+      },
+      pricing: {
+        team: {
+          includedEventsPerMonth: 0,
+          includedBytesPerMonth: 0,
+          usdPerMillionEvents: 0,
+          usdPerGiB: 0
+        },
+        business: {
+          includedEventsPerMonth: 0,
+          includedBytesPerMonth: 0,
+          usdPerMillionEvents: 0,
+          usdPerGiB: 0
+        },
+        enterprise: {
+          includedEventsPerMonth: 0,
+          includedBytesPerMonth: 0,
+          usdPerMillionEvents: 0,
+          usdPerGiB: 0
+        }
+      }
+    };
+    TIERS = [
+      "team",
+      "business",
+      "enterprise"
+    ];
+    __name(finiteNonNegative, "finiteNonNegative");
+    __name2(finiteNonNegative, "finiteNonNegative");
+    __name(mergeLimits, "mergeLimits");
+    __name2(mergeLimits, "mergeLimits");
+    __name(mergeCard, "mergeCard");
+    __name2(mergeCard, "mergeCard");
+    __name(resolveStoredLogDrainPlanConfig, "resolveStoredLogDrainPlanConfig");
+    __name2(resolveStoredLogDrainPlanConfig, "resolveStoredLogDrainPlanConfig");
+    __name(logDrainPlanTierOverride, "logDrainPlanTierOverride");
+    __name2(logDrainPlanTierOverride, "logDrainPlanTierOverride");
+    __name(logDrainQuotaLimitsFor, "logDrainQuotaLimitsFor");
+    __name2(logDrainQuotaLimitsFor, "logDrainQuotaLimitsFor");
+    __name(logDrainPriceCardFor, "logDrainPriceCardFor");
+    __name2(logDrainPriceCardFor, "logDrainPriceCardFor");
+    __name(priceDrainUsage, "priceDrainUsage");
+    __name2(priceDrainUsage, "priceDrainUsage");
     LOG_CURSOR_MAX_LENGTH = 512;
     LOG_CURSOR_MAX_ID_LENGTH = 128;
     LOG_RELATIVE_TIME_PATTERN = /^(\d{1,9})([smhd])$/;
@@ -15859,6 +16758,20 @@ var env = Object.assign((key, _opts) => readEnv(key), {
     };
   }, "template")
 });
+var log = Object.freeze({
+  debug: /* @__PURE__ */ __name((message, fields) => emitLocalLog("debug", message, fields), "debug"),
+  info: /* @__PURE__ */ __name((message, fields) => emitLocalLog("info", message, fields), "info"),
+  warn: /* @__PURE__ */ __name((message, fields) => emitLocalLog("warn", message, fields), "warn"),
+  error: /* @__PURE__ */ __name((message, fields) => emitLocalLog("error", message, fields), "error")
+});
+function emitLocalLog(level, message, fields) {
+  const normalized = normalizeLogFields(fields);
+  const text = typeof message === "object" && message !== null ? JSON.stringify(message) : String(message);
+  const write = level === "error" ? console.error : level === "warn" ? console.warn : level === "info" ? console.info : console.debug;
+  if (normalized) write(text, JSON.stringify(normalized));
+  else write(text);
+}
+__name(emitLocalLog, "emitLocalLog");
 var ToolFlag = /* @__PURE__ */ (function(ToolFlag2) {
   ToolFlag2["NONE"] = "none";
   ToolFlag2["IGNORE_ON_ENTER"] = "ignore_on_enter";
@@ -17378,6 +18291,7 @@ export {
   inSet2 as inSet,
   init2 as init,
   lit2 as lit,
+  log,
   lt2 as lt,
   lte2 as lte,
   ne2 as ne,