lua-cli 3.38.0 → 3.39.0

package/dist/index.js

@@ -1181,6 +1181,155 @@ function foldRichPartsIntoMessages(messages, records, makeMessage, sameTurnGroup
   while (next < synthetic.length) combined.push(synthetic[next++].message);
   return mergeRichPartMirrorMessages(combined, sameTurnGroup);
 }
+function utf8WidthAt(value3, index) {
+  const code = value3.charCodeAt(index);
+  if (code < 128) return {
+    bytes: 1,
+    units: 1
+  };
+  if (code < 2048) return {
+    bytes: 2,
+    units: 1
+  };
+  if (code >= 55296 && code <= 56319) {
+    const next = value3.charCodeAt(index + 1);
+    if (next >= 56320 && next <= 57343) return {
+      bytes: 4,
+      units: 2
+    };
+  }
+  return {
+    bytes: 3,
+    units: 1
+  };
+}
+function utf8ByteLength(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const width = utf8WidthAt(value3, i);
+    bytes += width.bytes;
+    i += width.units;
+  }
+  return bytes;
+}
+function clampUtf8(value3, maxBytes) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const width = utf8WidthAt(value3, i);
+    if (bytes + width.bytes > maxBytes) return value3.slice(0, i);
+    bytes += width.bytes;
+    i += width.units;
+  }
+  return value3;
+}
+function mapBytes(fields, withMark) {
+  return utf8ByteLength(JSON.stringify(withMark ? {
+    ...fields,
+    [LOG_FIELDS_CLAMPED_KEY]: true
+  } : fields));
+}
+function withValueCap(fields, capBytes) {
+  const out = {};
+  for (const [key, value3] of Object.entries(fields)) {
+    out[key] = typeof value3 === "string" ? clampUtf8(value3, capBytes) : value3;
+  }
+  return out;
+}
+function describeValue(value3) {
+  if (value3 === null) return "null";
+  if (value3 === void 0) return "undefined";
+  if (Array.isArray(value3)) return "an array";
+  return typeof value3 === "object" ? "an object" : `a ${typeof value3}`;
+}
+function assertValidLogFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is not allowed \u2014 a key must match ${LOG_FIELD_KEY_PATTERN.source} (lower-case, starts with a letter, then letters/digits/underscore, at most 64 characters)`);
+  }
+  if (LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key))) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is not allowed \u2014 it has the shape of a credential that the log-drain scrubber masks in values; a field KEY is never scrubbed, so it may never carry a secret shape`);
+  }
+  if (key === LOG_FIELDS_CLAMPED_KEY) {
+    throw new LuaLogFieldsError(`log fields: key \`${key}\` is reserved \u2014 the platform sets it to mark a field map it had to clamp`);
+  }
+}
+function normalizeLogFields(fields) {
+  if (fields === void 0 || fields === null) return void 0;
+  if (typeof fields !== "object" || Array.isArray(fields)) {
+    throw new LuaLogFieldsError(`log fields: expected a plain object of fields, received ${describeValue(fields)}`);
+  }
+  const entries = Object.entries(fields);
+  if (entries.length > LOG_FIELDS_MAX_KEYS) {
+    throw new LuaLogFieldsError(`log fields: ${entries.length} keys exceeds the cap of ${LOG_FIELDS_MAX_KEYS} keys per call`);
+  }
+  const out = {};
+  for (const [key, value3] of entries) {
+    assertValidLogFieldKey(key);
+    if (typeof value3 === "string" || typeof value3 === "boolean") {
+      out[key] = value3;
+      continue;
+    }
+    if (typeof value3 === "number") {
+      if (!Number.isFinite(value3)) {
+        throw new LuaLogFieldsError(`log fields: \`${key}\` must be a finite number \u2014 NaN and Infinity have no JSON form`);
+      }
+      out[key] = value3;
+      continue;
+    }
+    if (Array.isArray(value3)) {
+      const parts = [];
+      for (const element of value3) {
+        if (typeof element !== "string") {
+          throw new LuaLogFieldsError(`log fields: \`${key}\` is an array, so every element must be a string (found ${describeValue(element)})`);
+        }
+        if (element.includes(",")) {
+          throw new LuaLogFieldsError(`log fields: \`${key}\` \u2014 an array element may not contain a comma; elements are comma-joined into one value (with \`${key}${LOG_FIELD_ARRAY_COUNT_SUFFIX}\` beside it), so a comma inside one would be indistinguishable from the separator`);
+        }
+        parts.push(element);
+      }
+      out[key] = parts.join(",");
+      out[`${key}${LOG_FIELD_ARRAY_COUNT_SUFFIX}`] = parts.length;
+      continue;
+    }
+    throw new LuaLogFieldsError(`log fields: \`${key}\` must be a string, number, boolean or string[] \u2014 received ${describeValue(value3)}` + (value3 !== null && typeof value3 === "object" ? " (nested objects are not supported)" : ""));
+  }
+  const keys = Object.keys(out);
+  if (keys.length === 0) return void 0;
+  if (keys.length > LOG_FIELDS_MAX_KEYS) {
+    throw new LuaLogFieldsError(`log fields: ${keys.length} keys exceeds the cap of ${LOG_FIELDS_MAX_KEYS} keys per call \u2014 an array field also contributes its \`${LOG_FIELD_ARRAY_COUNT_SUFFIX.slice(1)}\` sibling`);
+  }
+  if (clampLogFields(out)) out[LOG_FIELDS_CLAMPED_KEY] = true;
+  return out;
+}
+function clampLogFields(out) {
+  let clamped = false;
+  for (const [key, value3] of Object.entries(out)) {
+    if (typeof value3 !== "string") continue;
+    const capped = clampUtf8(value3, LOG_FIELD_MAX_VALUE_BYTES);
+    if (capped !== value3) {
+      out[key] = capped;
+      clamped = true;
+    }
+  }
+  if (mapBytes(out, clamped) <= LOG_FIELDS_MAX_BYTES) return clamped;
+  const base = {
+    ...out
+  };
+  let low = 0;
+  let high = LOG_FIELD_MAX_VALUE_BYTES;
+  let best = 0;
+  while (low <= high) {
+    const mid = Math.floor((low + high) / 2);
+    if (mapBytes(withValueCap(base, mid), true) <= LOG_FIELDS_MAX_BYTES) {
+      best = mid;
+      low = mid + 1;
+    } else {
+      high = mid - 1;
+    }
+  }
+  const fitted = withValueCap(base, best);
+  for (const key of Object.keys(out)) out[key] = fitted[key];
+  return true;
+}
 function isDesktopFileCommandName(value3) {
   return typeof value3 === "string" && DESKTOP_FILE_COMMAND_SET.has(value3);
 }
@@ -1408,6 +1557,81 @@ function buildDefaultPersona(agentName) {
 function buildPersonalSpaceStartingPersona(agentName) {
   return PERSONAL_SPACE_STARTING_PERSONA.replace(new RegExp(AGENT_NAME_TOKEN.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), () => agentName || "Your assistant");
 }
+function utf8Bytes(value3) {
+  let bytes = 0;
+  for (let i = 0; i < value3.length; ) {
+    const code = value3.charCodeAt(i);
+    if (code < 128) {
+      bytes += 1;
+      i += 1;
+    } else if (code < 2048) {
+      bytes += 2;
+      i += 1;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value3.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        i += 2;
+      } else {
+        bytes += 3;
+        i += 1;
+      }
+    } else {
+      bytes += 3;
+      i += 1;
+    }
+  }
+  return bytes;
+}
+function isPlainFieldKey(key) {
+  if (!LOG_FIELD_KEY_PATTERN.test(key)) return false;
+  return !LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+function describeAgentLogFieldsViolation(value3) {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) {
+    return "fields must be an object";
+  }
+  const entries = Object.entries(value3);
+  let userKeys = 0;
+  for (const [key, entry] of entries) {
+    if (key === LOG_FIELDS_CLAMPED_KEY) {
+      if (entry !== true) return `fields.${key} must be true`;
+      continue;
+    }
+    userKeys += 1;
+    if (key.endsWith(LOG_FIELD_ARRAY_COUNT_SUFFIX)) {
+      const base = key.slice(0, -LOG_FIELD_ARRAY_COUNT_SUFFIX.length);
+      if (!isPlainFieldKey(base)) return `fields key \`${key}\` is not a legal field key`;
+      if (typeof entry !== "number" || !Number.isFinite(entry)) {
+        return `fields.${key} must be a finite number`;
+      }
+      continue;
+    }
+    if (!isPlainFieldKey(key)) return `fields key \`${key}\` is not a legal field key`;
+    if (typeof entry === "string") {
+      if (utf8Bytes(entry) > LOG_FIELD_MAX_VALUE_BYTES) {
+        return `fields.${key} exceeds ${LOG_FIELD_MAX_VALUE_BYTES} bytes`;
+      }
+      continue;
+    }
+    if (typeof entry === "boolean") continue;
+    if (typeof entry === "number") {
+      if (!Number.isFinite(entry)) return `fields.${key} must be a finite number`;
+      continue;
+    }
+    return `fields.${key} must be a string, number or boolean`;
+  }
+  if (userKeys > LOG_FIELDS_MAX_KEYS) {
+    return `fields has ${userKeys} keys, over the cap of ${LOG_FIELDS_MAX_KEYS}`;
+  }
+  if (utf8Bytes(JSON.stringify(value3)) > LOG_FIELDS_MAX_BYTES) {
+    return `fields exceeds ${LOG_FIELDS_MAX_BYTES} bytes`;
+  }
+  return void 0;
+}
+function isAgentLogFields(value3) {
+  return describeAgentLogFieldsViolation(value3) === void 0;
+}
 function maxDrainsForTier(tier) {
   return tier === "enterprise" ? LOG_DRAIN_MAX_PER_ORG_ENTERPRISE : LOG_DRAIN_MAX_PER_ORG;
 }
@@ -1416,6 +1640,148 @@ function resolvePresetEndpoint(type, site) {
   if (!template3 || !site) return void 0;
   return template3.replace("{site}", site);
 }
+function isLogDrainBucketHostAllowed(provider, host) {
+  const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  if (!normalized) return false;
+  return (LOG_DRAIN_BUCKET_HOST_PATTERNS[provider] ?? []).some((pattern) => pattern.test(normalized));
+}
+function resolveDrainBucketEndpoint(bucket) {
+  if (!LOG_DRAIN_BUCKET_NAME_PATTERN.test(bucket.bucket)) {
+    throw new Error("log drain bucket name is not a valid S3 bucket label");
+  }
+  if (bucket.provider === "aws") {
+    const region = bucket.region.trim().toLowerCase();
+    if (!/^[a-z0-9-]{1,32}$/.test(region)) throw new Error("log drain bucket region is not an AWS region");
+    return `https://${bucket.bucket}.s3.${region}.amazonaws.com`;
+  }
+  if (!bucket.endpoint) throw new Error(`log drain '${bucket.provider}' bucket requires an endpoint`);
+  let url;
+  try {
+    url = new URL(bucket.endpoint);
+  } catch {
+    throw new Error(`log drain '${bucket.provider}' bucket endpoint is not an absolute URL`);
+  }
+  if (url.protocol !== "https:") throw new Error(`log drain '${bucket.provider}' bucket endpoint must be https`);
+  return `https://${url.host}/${bucket.bucket}`;
+}
+function drainBucketUsesPathStyle(provider) {
+  return provider !== "aws";
+}
+function presetIntakeHosts(type) {
+  const template3 = LOG_DRAIN_ENDPOINT_TEMPLATES[type];
+  const sites = LOG_DRAIN_PRESET_SITES[type];
+  if (!template3 || !sites) return [];
+  const hosts = [];
+  for (const site of sites) {
+    try {
+      hosts.push(new URL(template3.replace("{site}", site)).hostname.toLowerCase());
+    } catch {
+    }
+  }
+  return hosts;
+}
+function presetHostAllowlist(type) {
+  return [
+    ...presetIntakeHosts(type),
+    ...LOG_DRAIN_PRESET_HOST_SUFFIXES[type] ?? []
+  ];
+}
+function drainHostAllowlistAllows(allowlist, host) {
+  const needle = host.toLowerCase();
+  return allowlist.some((raw) => {
+    const entry = raw.toLowerCase();
+    if (entry.startsWith(".")) return needle === entry.slice(1) || needle.endsWith(entry);
+    return entry === needle;
+  });
+}
+function drainDestinationIsVendorPinned(type) {
+  if (LOG_DRAIN_ENDPOINT_TEMPLATES[type]) return true;
+  return presetHostAllowlist(type).length > 0;
+}
+function drainVerificationOwnership(input) {
+  if (input.proved === true) return "verified";
+  if (input.mode === "test-post" && drainDestinationIsVendorPinned(input.type)) return "verified";
+  return "reachability-only";
+}
+function drainOwnershipOrDefault(ownership) {
+  return ownership === "verified" ? "verified" : "reachability-only";
+}
+function assertDrainContentAck(input) {
+  const turningOn = input.next === true && input.was !== true;
+  if (!turningOn) return void 0;
+  if (input.ack !== true) throw new DrainContentAckRequiredError();
+  return {
+    by: input.actor,
+    source: input.source,
+    at: input.at,
+    ...input.inheritedFrom ? {
+      inheritedFrom: input.inheritedFrom
+    } : {}
+  };
+}
+function composePresetEndpoint(type, endpoint) {
+  const rule = LOG_DRAIN_PRESET_PATHS[type];
+  if (!rule) return void 0;
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    return {
+      ok: false,
+      reason: "invalid_url"
+    };
+  }
+  if (url.protocol !== "https:" || !url.hostname) return {
+    ok: false,
+    reason: "invalid_url"
+  };
+  const origin = url.origin;
+  const path26 = url.pathname.replace(/\/+$/, "");
+  if (!rule.segment) {
+    const base2 = path26.endsWith(rule.path) ? path26.slice(0, path26.length - rule.path.length) : path26;
+    return {
+      ok: true,
+      endpoint: `${origin}${base2}${rule.path}`
+    };
+  }
+  const marker = `${rule.path}/`;
+  const at = path26.indexOf(marker);
+  if (at < 0) {
+    return {
+      ok: false,
+      reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
+    };
+  }
+  const base = path26.slice(0, at);
+  const afterMarker = path26.slice(at + marker.length);
+  const rest = rule.suffix && afterMarker.endsWith(rule.suffix) ? afterMarker.slice(0, afterMarker.length - rule.suffix.length) : afterMarker;
+  if (!rest || rest.includes("/")) {
+    return {
+      ok: false,
+      reason: rule.segment === "dataset" ? "missing_dataset" : "missing_token"
+    };
+  }
+  if (!PRESET_SEGMENT_RE.test(rest)) return {
+    ok: false,
+    reason: "bad_segment"
+  };
+  if (rule.segment === "dataset") {
+    return {
+      ok: true,
+      endpoint: `${origin}${base}${rule.path}/${rest}${rule.suffix ?? ""}`,
+      dataset: rest
+    };
+  }
+  return {
+    ok: true,
+    endpoint: `${origin}${base}${rule.path}/`,
+    token: rest
+  };
+}
+function joinPresetEndpointToken(endpoint, token) {
+  if (typeof token !== "string" || !PRESET_SEGMENT_RE.test(token)) return endpoint;
+  return endpoint.endsWith("/") ? `${endpoint}${token}` : `${endpoint}/${token}`;
+}
 function nextLogDrainQuotaResetAt(now) {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1)).toISOString();
 }
@@ -1462,6 +1828,264 @@ function logDrainQuotaDroppedSeverities(degradation) {
       return [];
   }
 }
+function isLogExportSource(source) {
+  return LOG_EXPORT_SOURCES.includes(source);
+}
+function clamp(value3, max) {
+  if (typeof value3 !== "string") return void 0;
+  const trimmed2 = value3.trim();
+  if (!trimmed2) return void 0;
+  return trimmed2.length <= max ? trimmed2 : `${trimmed2.slice(0, max - 1)}\u2026`;
+}
+function numberOr(value3, fallback) {
+  return typeof value3 === "number" && Number.isFinite(value3) ? value3 : fallback;
+}
+function isoOr(value3) {
+  return typeof value3 === "string" && value3.length > 0 ? value3 : void 0;
+}
+function logDrainNoticeView(drain, now) {
+  const health = drain.health ?? {};
+  const quota = drain.quota;
+  const view = {
+    id: String(drain.id ?? ""),
+    name: String(drain.name ?? ""),
+    type: drain.type,
+    state: drain.state,
+    deliveredCount24h: numberOr(health.deliveredCount24h, 0),
+    droppedCount24h: numberOr(health.droppedCount24h, 0),
+    rejectedCount24h: numberOr(health.rejectedCount24h, 0),
+    backlog: numberOr(health.backlog, 0),
+    quotaRatio: quota ? logDrainQuotaRatio(quota, now) : 0
+  };
+  if (health.pauseReason) view.pauseReason = health.pauseReason;
+  const lastError = clamp(health.lastError, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS);
+  if (lastError) view.lastError = lastError;
+  if (typeof health.lastStatusCode === "number") view.lastStatusCode = health.lastStatusCode;
+  const lastSuccessAt = isoOr(health.lastSuccessAt);
+  if (lastSuccessAt) view.lastSuccessAt = lastSuccessAt;
+  const lastFailureAt = isoOr(health.lastFailureAt);
+  if (lastFailureAt) view.lastFailureAt = lastFailureAt;
+  const resetsAt = isoOr(quota?.resetsAt);
+  if (resetsAt) view.quotaResetsAt = resetsAt;
+  return view;
+}
+function logDrainHealthCardPath(orgId, drainId) {
+  return `/orgs/${encodeURIComponent(orgId)}/log-drains/${encodeURIComponent(drainId)}`;
+}
+function percent(ratio) {
+  if (!Number.isFinite(ratio) || ratio <= 0) return "0%";
+  return `${Math.round(ratio * 100)}%`;
+}
+function becauseClause(view) {
+  const bits = [];
+  if (view.lastStatusCode) bits.push(`HTTP ${view.lastStatusCode}`);
+  if (view.lastError) bits.push(view.lastError);
+  return bits.length ? ` Last error: ${bits.join(" \u2014 ")}.` : "";
+}
+function logDrainNoticeCopy(payload) {
+  const view = payload.drain;
+  const name = view.name || view.id;
+  const backlog = view.backlog > 0 ? ` ${view.backlog.toLocaleString("en-US")} records are buffered.` : "";
+  switch (payload.kind) {
+    case "failing":
+      return {
+        title: name,
+        subject: `Log drain "${name}" is failing`,
+        previewLine: "Failing \u2014 15 minutes without a successful delivery",
+        summary: `The log drain "${name}" (${view.type}) has gone 15 minutes without a successful delivery and is now failing.${becauseClause(view)}${backlog} Records keep buffering; the drain pauses itself after 24 hours without a success.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "paused_auto":
+      return {
+        title: name,
+        subject: `Log drain "${name}" was paused`,
+        previewLine: "Paused \u2014 24 hours without a successful delivery",
+        summary: `The log drain "${name}" (${view.type}) was paused automatically after 24 hours without a successful delivery.${becauseClause(view)}${backlog} Nothing is being sent while it is paused, and the buffer is delivered on resume. Fix the destination, then resume it from the drain's health card or with \`lua drains resume ${view.id}\`.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "paused_quota":
+      return {
+        title: name,
+        subject: `Log drain "${name}" was paused \u2014 daily quota exhausted`,
+        previewLine: `Paused \u2014 ${percent(view.quotaRatio)} of the daily allowance used`,
+        summary: `The log drain "${name}" (${view.type}) reached ${percent(view.quotaRatio)} of its daily allowance and was paused.${backlog} Records keep buffering. The allowance resets${view.quotaResetsAt ? ` at ${view.quotaResetsAt}` : " at 00:00 UTC"}; narrow the drain's sources or raise the plan's limit to stop it happening again, then resume it with \`lua drains resume ${view.id}\`.`,
+        status: "failed",
+        priority: "high"
+      };
+    case "quota_warning":
+      return {
+        title: name,
+        subject: `Log drain "${name}" has used 80% of its daily allowance`,
+        previewLine: `${percent(view.quotaRatio)} of the daily allowance used`,
+        summary: `The log drain "${name}" (${view.type}) has used ${percent(view.quotaRatio)} of today's allowance. Past 100% debug records are dropped, past 125% info records as well, and at 150% the drain pauses. The allowance resets${view.quotaResetsAt ? ` at ${view.quotaResetsAt}` : " at 00:00 UTC"}.`,
+        status: "failed",
+        priority: "normal"
+      };
+    case "dropped": {
+      const dropped = payload.droppedCount ?? view.droppedCount24h;
+      return {
+        title: name,
+        subject: `Log drain "${name}" is dropping records`,
+        previewLine: `${dropped.toLocaleString("en-US")} records dropped`,
+        summary: `The log drain "${name}" (${view.type}) dropped ${dropped.toLocaleString("en-US")} records because its buffer filled up faster than the destination accepted them.${becauseClause(view)} The gap is reported in band on the next successful batch, so the range is recoverable from the destination itself.`,
+        status: "failed",
+        priority: "high"
+      };
+    }
+    case "verification_pending":
+      return {
+        title: name,
+        subject: `Log drain "${name}" is still unverified`,
+        previewLine: "Unverified after 24 hours \u2014 nothing is being delivered",
+        summary: `The log drain "${name}" (${view.type}) was created more than 24 hours ago and has never completed verification, so nothing is being delivered to it.${becauseClause(view)} Run \`lua drains verify ${view.id}\` once the destination echoes the verification token.`,
+        status: "failed",
+        priority: "normal"
+      };
+    default: {
+      const exhaustive = payload.kind;
+      throw new Error(`unhandled log-drain notice kind: ${String(exhaustive)}`);
+    }
+  }
+}
+function logDrainNoticeLabel(kind) {
+  switch (kind) {
+    case "failing":
+      return "failing";
+    case "paused_auto":
+      return "paused (no success for 24 h)";
+    case "paused_quota":
+      return "paused (daily allowance exhausted)";
+    case "quota_warning":
+      return "80% of the daily allowance used";
+    case "dropped":
+      return "dropping records";
+    case "verification_pending":
+      return "still unverified";
+    default: {
+      const exhaustive = kind;
+      throw new Error(`unhandled log-drain notice kind: ${String(exhaustive)}`);
+    }
+  }
+}
+function logDrainNoticeDigestCopy(payload) {
+  const entries = [
+    ...payload.entries ?? []
+  ].sort((a, b) => a.at < b.at ? -1 : a.at > b.at ? 1 : 0).slice(0, LOG_DRAIN_DIGEST_MAX_ENTRIES);
+  const drains = new Set(entries.map((entry) => entry.drainId));
+  const noun = `${entries.length} notice${entries.length === 1 ? "" : "s"}`;
+  const across = `${drains.size} drain${drains.size === 1 ? "" : "s"}`;
+  const lines = entries.map((entry) => `${entry.drainName || entry.drainId} \u2014 ${logDrainNoticeLabel(entry.kind)}`);
+  return {
+    title: "Log drains \u2014 daily summary",
+    subject: `Log drains \u2014 ${noun} in the last day`,
+    previewLine: `${noun} across ${across}`,
+    summary: `${noun} across ${across} in the last day: ${lines.join("; ")}.`,
+    status: "failed",
+    priority: "normal"
+  };
+}
+function finiteNonNegative(value3) {
+  return typeof value3 === "number" && Number.isFinite(value3) && value3 >= 0 ? value3 : void 0;
+}
+function mergeLimits(base, stored) {
+  const patch = stored ?? {};
+  return {
+    eventsPerDay: finiteNonNegative(patch.eventsPerDay) ?? base.eventsPerDay,
+    bytesPerDay: finiteNonNegative(patch.bytesPerDay) ?? base.bytesPerDay
+  };
+}
+function mergeCard(base, stored) {
+  const patch = stored ?? {};
+  return {
+    includedEventsPerMonth: finiteNonNegative(patch.includedEventsPerMonth) ?? base.includedEventsPerMonth,
+    includedBytesPerMonth: finiteNonNegative(patch.includedBytesPerMonth) ?? base.includedBytesPerMonth,
+    usdPerMillionEvents: finiteNonNegative(patch.usdPerMillionEvents) ?? base.usdPerMillionEvents,
+    usdPerGiB: finiteNonNegative(patch.usdPerGiB) ?? base.usdPerGiB
+  };
+}
+function resolveStoredLogDrainPlanConfig(stored) {
+  const values = stored;
+  if (!values || typeof values.version !== "number" || !Number.isFinite(values.version)) {
+    return DEFAULT_LOG_DRAIN_PLAN_CONFIG;
+  }
+  const tiers = {};
+  const pricing = {};
+  for (const tier of TIERS) {
+    tiers[tier] = mergeLimits(DEFAULT_LOG_DRAIN_PLAN_CONFIG.tiers[tier], values.tiers?.[tier]);
+    pricing[tier] = mergeCard(DEFAULT_LOG_DRAIN_PLAN_CONFIG.pricing[tier], values.pricing?.[tier]);
+  }
+  const orgs = {};
+  for (const [orgId, override] of Object.entries(values.orgs ?? {})) {
+    if (!orgId || !override || typeof override !== "object") continue;
+    const row2 = {};
+    if (override.tier && TIERS.includes(override.tier)) row2.tier = override.tier;
+    const events = finiteNonNegative(override.eventsPerDay);
+    const bytes = finiteNonNegative(override.bytesPerDay);
+    if (events !== void 0) row2.eventsPerDay = events;
+    if (bytes !== void 0) row2.bytesPerDay = bytes;
+    if (override.pricing && typeof override.pricing === "object") row2.pricing = {
+      ...override.pricing
+    };
+    if (Object.keys(row2).length) orgs[orgId] = row2;
+  }
+  return {
+    version: values.version,
+    tiers,
+    pricing,
+    ...Object.keys(orgs).length ? {
+      orgs
+    } : {}
+  };
+}
+function logDrainPlanTierOverride(config, orgId) {
+  return orgId ? config.orgs?.[orgId]?.tier : void 0;
+}
+function logDrainQuotaLimitsFor(config, orgId, tier) {
+  const base = config.tiers[tier] ?? config.tiers.team ?? LOG_DRAIN_QUOTAS.team;
+  const override = orgId ? config.orgs?.[orgId] : void 0;
+  if (!override) return {
+    ...base
+  };
+  return {
+    eventsPerDay: override.eventsPerDay ?? base.eventsPerDay,
+    bytesPerDay: override.bytesPerDay ?? base.bytesPerDay
+  };
+}
+function logDrainPriceCardFor(config, orgId, tier) {
+  const base = config.pricing[tier] ?? config.pricing.team ?? DEFAULT_LOG_DRAIN_PLAN_CONFIG.pricing.team;
+  const override = orgId ? config.orgs?.[orgId]?.pricing : void 0;
+  return override ? mergeCard(base, override) : {
+    ...base
+  };
+}
+function priceDrainUsage(totals, card, tier) {
+  const billableRecords = Math.max(0, Math.floor(finiteNonNegative(totals?.billableRecords) ?? 0));
+  const billableBytes = Math.max(0, Math.floor(finiteNonNegative(totals?.billableBytes) ?? 0));
+  const includedEvents = card.includedEventsPerMonth;
+  const includedBytes = card.includedBytesPerMonth;
+  const overageEvents = Math.max(0, billableRecords - includedEvents);
+  const overageBytes = Math.max(0, billableBytes - includedBytes);
+  const eventsUsd = overageEvents / 1e6 * card.usdPerMillionEvents;
+  const bytesUsd = overageBytes / LOG_DRAIN_BYTES_PER_GIB * card.usdPerGiB;
+  const unpriced = card.usdPerMillionEvents === 0 && card.usdPerGiB === 0;
+  const round = /* @__PURE__ */ __name2((usd) => Math.round(usd * 100) / 100, "round");
+  return {
+    lineItem: LOG_DRAIN_USAGE_LINE_ITEM,
+    tier,
+    billableRecords,
+    billableBytes,
+    includedEvents,
+    includedBytes,
+    overageEvents,
+    overageBytes,
+    eventsUsd: round(eventsUsd),
+    bytesUsd: round(bytesUsd),
+    usd: round(Math.max(eventsUsd, bytesUsd)),
+    unpriced
+  };
+}
 function encodeLogCursor(c) {
   return Buffer.from(JSON.stringify({
     t: c.t,
@@ -2180,7 +2804,7 @@ function effectiveAgentFeatures(base, override, rule) {
   if (rule === "wholesale") return override || base || void 0;
   return effectiveAgentFeatureRows(base, override).rows;
 }
-var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES;
+var __defProp2, __name2, PLUMBING_THREAD_CHANNELS, CHANNEL_CONVERSATION_CHANNELS, HIDDEN_THREAD_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_STANDING_START_TOOLS, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, LOG_FIELDS_MAX_KEYS, LOG_FIELD_MAX_VALUE_BYTES, LOG_FIELDS_MAX_BYTES, LOG_FIELD_KEY_PATTERN, LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS, LOG_FIELDS_CLAMPED_KEY, LOG_FIELD_ARRAY_COUNT_SUFFIX, LuaLogFieldsError, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_AGENT_EFFORTS, WORKFLOW_MODEL_CLASSES, WORKFLOW_TASK_CLASSES, WORKFLOW_MODEL_TRAITS, WORKFLOW_MODEL_REASON_MAX_LENGTH, WORKFLOW_MODELS_COMPOSE_MODES, WORKFLOW_MODELS_PIN_MODES, WORKFLOW_MODELS_FALLBACK_MODES, WORKFLOW_MODELS_CONSENT_ACTIONS_MIN, WORKFLOW_DEFAULT_TASK_CLASS_MAP, WORKFLOW_MODELS_MAX_CLASS_DEFAULT, WORKFLOW_AUTONOMY_FORMS, WORKFLOW_AUTONOMY_NUMERIC_KEYS, WORKFLOW_AUTONOMY_ENVELOPE_KEYS, WORKFLOW_AUTONOMY_ENABLED_DEFAULT, WORKFLOW_AUTONOMY_DEFAULTS, WORKFLOW_AUTONOMY_CEILINGS, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_ENV, WORKFLOW_AUTONOMY_MAX_RUNS_PER_HOUR_CEILING, WORKFLOW_AUTONOMY_FORMS_DEFAULT, WORKFLOW_AUTONOMY_MIN_VALUE, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, MODEL_ID_BYOK_PROVIDERS, MODEL_CLASS_REF_PREFIX, MODEL_SNAPSHOT_SUFFIX, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, AGENT_LOG_ENVIRONMENTS, AGENT_LOG_FIELDS_MAX_WIRE_KEYS, LOG_DRAIN_TYPES_PHASE1, LOG_DRAIN_TYPES_PHASE2, LOG_DRAIN_TYPES_IMPLEMENTED, LOG_DRAIN_FORMATS, LOG_DRAIN_SEVERITIES, LOG_DRAIN_SOURCES, LOG_DRAIN_CONTENT_SOURCES, LOG_DRAIN_DEFAULT_SOURCES, LOG_DRAIN_MAX_PER_ORG, LOG_DRAIN_MAX_PER_ORG_ENTERPRISE, LOG_DRAIN_DATADOG_SITES, LOG_DRAIN_NEWRELIC_SITES, LOG_DRAIN_ENDPOINT_TEMPLATES, LOG_DRAIN_PRESET_SITES, LOG_DRAIN_BUCKET_NAME_PATTERN, LOG_DRAIN_BUCKET_HOST_PATTERNS, LOG_DRAIN_PRESET_HOST_SUFFIXES, DRAIN_CONTENT_ACK_ERROR_CODE, DRAIN_CONTENT_ACK_FIELD, DrainContentAckRequiredError, LOG_DRAIN_PRESET_PATHS, PRESET_SEGMENT_RE, LOG_DRAIN_QUOTAS, LOG_DRAIN_QUOTA_WARN_RATIO, LOG_DRAIN_QUOTA_DROP_DEBUG_RATIO, LOG_DRAIN_QUOTA_DROP_INFO_RATIO, LOG_DRAIN_QUOTA_PAUSE_RATIO, LOG_EXPORT_SOURCES, LOG_EXPORT_MAX_WINDOW_DAYS, LOG_EXPORT_MAX_WINDOW_MS, LOG_EXPORT_URL_TTL_SECONDS, LOG_EXPORT_FILE_RETENTION_DAYS, LOG_EXPORT_FILE_RETENTION_MS, LOG_EXPORT_PART_MAX_BYTES, LOG_DRAIN_NOTICE_RATE_LIMIT_MS, LOG_DRAIN_VERIFICATION_STALE_MS, LOG_DRAIN_DIGEST_INTERVAL_MS, LOG_DRAIN_DIGEST_MAX_ENTRIES, LOG_DRAIN_NOTICE_ERROR_MAX_CHARS, LOG_DRAIN_USAGE_LINE_ITEM, LOG_DRAIN_BYTES_PER_GIB, DEFAULT_LOG_DRAIN_PLAN_CONFIG, TIERS, LOG_CURSOR_MAX_LENGTH, LOG_CURSOR_MAX_ID_LENGTH, LOG_RELATIVE_TIME_PATTERN, LOG_ISO_TIME_PATTERN, RELATIVE_UNIT_MS, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, KEYS, MAX_BODY_BYTES, MAX_ID_LENGTH, UTC_ISO, TEMPLATE_TRIGGER_URL_ENV_PREFIX, TEMPLATE_INSTALL_POLICY_PER_WORKSPACE_VALUES, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, SESSION_AUTH_TIME_MAX_S, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, LUA_SESSION_ID_CLAIM, SESSION_REVOKED_CODE, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_RUN_GATE_KINDS, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, WORKFLOW_SIGNAL_EVENT_SITES, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_SCHEDULE_KEY_MAX, WORKFLOW_SCHEDULE_IDEMPOTENCY_KEY_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_JOB_MODEL_SOURCE_LABELS, WORKFLOW_SUSPEND_KINDS, WORKFLOW_RUN_NOTIFICATION_SUSPENDED_KINDS, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_GOAL_JUDGE_SELF, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE, DEFAULT_ON_AGENT_FEATURES, SUBAGENT_PER_KEY_FLAG_ENV, PER_KEY_FLAG_VALUES;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -2499,6 +3123,50 @@ var init_dist = __esm({
       }
     ];
     BROWSER_COMMAND_NAMES = BROWSER_COMMANDS.map((c) => c.name);
+    LOG_FIELDS_MAX_KEYS = 32;
+    LOG_FIELD_MAX_VALUE_BYTES = 1024;
+    LOG_FIELDS_MAX_BYTES = 8192;
+    LOG_FIELD_KEY_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+    LOG_FIELD_SECRET_SHAPED_KEY_PATTERNS = Object.freeze([
+      /^api_[0-9a-f]{24,}$/,
+      /^gh[pousr]_[a-z0-9]{36}$/,
+      /^(?:sk|rk|pk)_(?:live|test)_[a-z0-9]{16,}$/,
+      /^lua_hc_[a-z0-9]{20,}/,
+      /^lua_sk_[a-z0-9]{20,}/
+    ]);
+    LOG_FIELDS_CLAMPED_KEY = "lua_fields_clamped";
+    LOG_FIELD_ARRAY_COUNT_SUFFIX = ".count";
+    LuaLogFieldsError = class _LuaLogFieldsError extends Error {
+      static {
+        __name(this, "_LuaLogFieldsError");
+      }
+      static {
+        __name2(this, "LuaLogFieldsError");
+      }
+      constructor(message) {
+        super(message);
+        this.name = "LuaLogFieldsError";
+        Object.setPrototypeOf(this, _LuaLogFieldsError.prototype);
+      }
+    };
+    __name(utf8WidthAt, "utf8WidthAt");
+    __name2(utf8WidthAt, "utf8WidthAt");
+    __name(utf8ByteLength, "utf8ByteLength");
+    __name2(utf8ByteLength, "utf8ByteLength");
+    __name(clampUtf8, "clampUtf8");
+    __name2(clampUtf8, "clampUtf8");
+    __name(mapBytes, "mapBytes");
+    __name2(mapBytes, "mapBytes");
+    __name(withValueCap, "withValueCap");
+    __name2(withValueCap, "withValueCap");
+    __name(describeValue, "describeValue");
+    __name2(describeValue, "describeValue");
+    __name(assertValidLogFieldKey, "assertValidLogFieldKey");
+    __name2(assertValidLogFieldKey, "assertValidLogFieldKey");
+    __name(normalizeLogFields, "normalizeLogFields");
+    __name2(normalizeLogFields, "normalizeLogFields");
+    __name(clampLogFields, "clampLogFields");
+    __name2(clampLogFields, "clampLogFields");
     DESKTOP_FILE_COMMANDS = [
       "files_roots",
       "files_stat",
@@ -2888,12 +3556,37 @@ This text is who you are for this person. As you learn them, their name, their w
       "production",
       "sandbox"
     ];
+    AGENT_LOG_FIELDS_MAX_WIRE_KEYS = LOG_FIELDS_MAX_KEYS + 1;
+    __name(utf8Bytes, "utf8Bytes");
+    __name2(utf8Bytes, "utf8Bytes");
+    __name(isPlainFieldKey, "isPlainFieldKey");
+    __name2(isPlainFieldKey, "isPlainFieldKey");
+    __name(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+    __name2(describeAgentLogFieldsViolation, "describeAgentLogFieldsViolation");
+    __name(isAgentLogFields, "isAgentLogFields");
+    __name2(isAgentLogFields, "isAgentLogFields");
     LOG_DRAIN_TYPES_PHASE1 = [
       "http",
       "otlp",
       "datadog",
       "betterstack"
     ];
+    LOG_DRAIN_TYPES_PHASE2 = [
+      "splunk",
+      "loki",
+      "axiom",
+      "newrelic",
+      "sumologic"
+    ];
+    LOG_DRAIN_TYPES_IMPLEMENTED = [
+      ...LOG_DRAIN_TYPES_PHASE1,
+      ...LOG_DRAIN_TYPES_PHASE2,
+      // RECONCILE-4 (W4-4). `s3` is implemented (H4 / PRO-1887) but is NOT in
+      // `LOG_DRAIN_TYPES_PHASE2`, because its own flag opens it and `*` must not. It
+      // belongs here all the same: this list is what a CLIENT may offer, and the server
+      // remains the authority that answers 422 with the live list.
+      "s3"
+    ];
     LOG_DRAIN_FORMATS = [
       "json",
       "ndjson"
@@ -2912,7 +3605,10 @@ This text is who you are for this person. As you learn them, their name, their w
       "trigger-execution",
       "job-execution",
       "workflow-run",
-      "workflow-audit"
+      "workflow-audit",
+      // PRO-1884 (H2). Appended AFTER 'workflow-audit' so the enum stays additive and
+      // no existing member changes position.
+      "voice-call"
     ];
     LOG_DRAIN_CONTENT_SOURCES = [
       "user_message",
@@ -2935,7 +3631,22 @@ This text is who you are for this person. As you learn them, their name, their w
       "mcp",
       "rag",
       "execution",
-      "agent_error"
+      "agent_error",
+      // ── phase 2 ──
+      // PRO-1882 / H1. `delivery` carries one record per applied status transition of an
+      // outbound message. It is on by default because a send that failed at the vendor is
+      // operational truth a customer's own on-call needs, and nothing in it is content:
+      // the recipient is masked to its last four characters unless the drain selects
+      // `includeContent`.
+      "delivery",
+      // PRO-1884 / H2. The three adjacent execution ledgers. ON for a NEW drain: they are
+      // the platform's own record of a dispatch, a run and a job outcome — the same class
+      // of operational line the phase-1 defaults already carry, and none of them is
+      // content-bearing without `includeContent`. A drain created before this shipped keeps
+      // the source set it was created with; nothing is added to an existing drain.
+      "trigger-execution",
+      "job-execution",
+      "workflow-run"
     ];
     LOG_DRAIN_MAX_PER_ORG = 5;
     LOG_DRAIN_MAX_PER_ORG_ENTERPRISE = 10;
@@ -2949,11 +3660,106 @@ This text is who you are for this person. As you learn them, their name, their w
       "ap1.datadoghq.com",
       "ddog-gov.com"
     ];
+    LOG_DRAIN_NEWRELIC_SITES = [
+      "log-api.newrelic.com",
+      "log-api.eu.newrelic.com",
+      "log-api.jp.newrelic.com"
+    ];
     LOG_DRAIN_ENDPOINT_TEMPLATES = {
-      datadog: "https://http-intake.logs.{site}/api/v2/logs"
+      datadog: "https://http-intake.logs.{site}/api/v2/logs",
+      newrelic: "https://{site}/log/v1"
+    };
+    LOG_DRAIN_PRESET_SITES = {
+      datadog: LOG_DRAIN_DATADOG_SITES,
+      newrelic: LOG_DRAIN_NEWRELIC_SITES
     };
     __name(resolvePresetEndpoint, "resolvePresetEndpoint");
     __name2(resolvePresetEndpoint, "resolvePresetEndpoint");
+    LOG_DRAIN_BUCKET_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+    LOG_DRAIN_BUCKET_HOST_PATTERNS = Object.freeze({
+      aws: [
+        // virtual-host style, regional and legacy global
+        /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.s3(\.dualstack)?(\.[a-z0-9-]+)?\.amazonaws\.com$/,
+        // path style
+        /^s3(\.dualstack)?(\.[a-z0-9-]+)?\.amazonaws\.com$/
+      ],
+      r2: [
+        /^[a-f0-9]{32}\.r2\.cloudflarestorage\.com$/
+      ],
+      gcs: [
+        /^storage\.googleapis\.com$/
+      ]
+    });
+    __name(isLogDrainBucketHostAllowed, "isLogDrainBucketHostAllowed");
+    __name2(isLogDrainBucketHostAllowed, "isLogDrainBucketHostAllowed");
+    __name(resolveDrainBucketEndpoint, "resolveDrainBucketEndpoint");
+    __name2(resolveDrainBucketEndpoint, "resolveDrainBucketEndpoint");
+    __name(drainBucketUsesPathStyle, "drainBucketUsesPathStyle");
+    __name2(drainBucketUsesPathStyle, "drainBucketUsesPathStyle");
+    __name(presetIntakeHosts, "presetIntakeHosts");
+    __name2(presetIntakeHosts, "presetIntakeHosts");
+    LOG_DRAIN_PRESET_HOST_SUFFIXES = {
+      axiom: [
+        ".axiom.co"
+      ],
+      sumologic: [
+        ".sumologic.com"
+      ]
+    };
+    __name(presetHostAllowlist, "presetHostAllowlist");
+    __name2(presetHostAllowlist, "presetHostAllowlist");
+    __name(drainHostAllowlistAllows, "drainHostAllowlistAllows");
+    __name2(drainHostAllowlistAllows, "drainHostAllowlistAllows");
+    __name(drainDestinationIsVendorPinned, "drainDestinationIsVendorPinned");
+    __name2(drainDestinationIsVendorPinned, "drainDestinationIsVendorPinned");
+    __name(drainVerificationOwnership, "drainVerificationOwnership");
+    __name2(drainVerificationOwnership, "drainVerificationOwnership");
+    __name(drainOwnershipOrDefault, "drainOwnershipOrDefault");
+    __name2(drainOwnershipOrDefault, "drainOwnershipOrDefault");
+    DRAIN_CONTENT_ACK_ERROR_CODE = "DRAIN_CONTENT_ACK_REQUIRED";
+    DRAIN_CONTENT_ACK_FIELD = "includeContentAck";
+    DrainContentAckRequiredError = class extends Error {
+      static {
+        __name(this, "DrainContentAckRequiredError");
+      }
+      static {
+        __name2(this, "DrainContentAckRequiredError");
+      }
+      code = DRAIN_CONTENT_ACK_ERROR_CODE;
+      field = DRAIN_CONTENT_ACK_FIELD;
+      constructor() {
+        super("includeContent ships end-user message content to a third party; set includeContentAck: true to confirm.");
+        this.name = "DrainContentAckRequiredError";
+      }
+    };
+    __name(assertDrainContentAck, "assertDrainContentAck");
+    __name2(assertDrainContentAck, "assertDrainContentAck");
+    LOG_DRAIN_PRESET_PATHS = {
+      // https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples
+      splunk: {
+        path: "/services/collector/event"
+      },
+      // https://grafana.com/docs/loki/latest/reference/loki-http-api/#ingest-logs
+      loki: {
+        path: "/loki/api/v1/push"
+      },
+      // https://axiom.co/docs/restapi/endpoints/ingestIntoDataset
+      axiom: {
+        path: "/v1/datasets",
+        segment: "dataset",
+        suffix: "/ingest"
+      },
+      // https://help.sumologic.com/docs/send-data/hosted-collectors/http-source/logs-metrics/upload-logs/
+      sumologic: {
+        path: "/receiver/v1/http",
+        segment: "token"
+      }
+    };
+    PRESET_SEGMENT_RE = /^[A-Za-z0-9._~%=+-]{1,512}$/;
+    __name(composePresetEndpoint, "composePresetEndpoint");
+    __name2(composePresetEndpoint, "composePresetEndpoint");
+    __name(joinPresetEndpointToken, "joinPresetEndpointToken");
+    __name2(joinPresetEndpointToken, "joinPresetEndpointToken");
     LOG_DRAIN_QUOTAS = {
       team: {
         eventsPerDay: 1e6,
@@ -2986,6 +3792,100 @@ This text is who you are for this person. As you learn them, their name, their w
     __name2(logDrainQuotaWarned, "logDrainQuotaWarned");
     __name(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
     __name2(logDrainQuotaDroppedSeverities, "logDrainQuotaDroppedSeverities");
+    LOG_EXPORT_SOURCES = [
+      ...AGENT_LOG_SOURCES,
+      "execution"
+    ];
+    LOG_EXPORT_MAX_WINDOW_DAYS = 31;
+    LOG_EXPORT_MAX_WINDOW_MS = LOG_EXPORT_MAX_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
+    LOG_EXPORT_URL_TTL_SECONDS = 24 * 60 * 60;
+    LOG_EXPORT_FILE_RETENTION_DAYS = 7;
+    LOG_EXPORT_FILE_RETENTION_MS = LOG_EXPORT_FILE_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+    LOG_EXPORT_PART_MAX_BYTES = 256 * 1024 * 1024;
+    __name(isLogExportSource, "isLogExportSource");
+    __name2(isLogExportSource, "isLogExportSource");
+    LOG_DRAIN_NOTICE_RATE_LIMIT_MS = 60 * 6e4;
+    LOG_DRAIN_VERIFICATION_STALE_MS = 24 * 60 * 6e4;
+    LOG_DRAIN_DIGEST_INTERVAL_MS = 24 * 60 * 6e4;
+    LOG_DRAIN_DIGEST_MAX_ENTRIES = 50;
+    LOG_DRAIN_NOTICE_ERROR_MAX_CHARS = 200;
+    __name(clamp, "clamp");
+    __name2(clamp, "clamp");
+    __name(numberOr, "numberOr");
+    __name2(numberOr, "numberOr");
+    __name(isoOr, "isoOr");
+    __name2(isoOr, "isoOr");
+    __name(logDrainNoticeView, "logDrainNoticeView");
+    __name2(logDrainNoticeView, "logDrainNoticeView");
+    __name(logDrainHealthCardPath, "logDrainHealthCardPath");
+    __name2(logDrainHealthCardPath, "logDrainHealthCardPath");
+    __name(percent, "percent");
+    __name2(percent, "percent");
+    __name(becauseClause, "becauseClause");
+    __name2(becauseClause, "becauseClause");
+    __name(logDrainNoticeCopy, "logDrainNoticeCopy");
+    __name2(logDrainNoticeCopy, "logDrainNoticeCopy");
+    __name(logDrainNoticeLabel, "logDrainNoticeLabel");
+    __name2(logDrainNoticeLabel, "logDrainNoticeLabel");
+    __name(logDrainNoticeDigestCopy, "logDrainNoticeDigestCopy");
+    __name2(logDrainNoticeDigestCopy, "logDrainNoticeDigestCopy");
+    LOG_DRAIN_USAGE_LINE_ITEM = "log_drain_events";
+    LOG_DRAIN_BYTES_PER_GIB = 1024 ** 3;
+    DEFAULT_LOG_DRAIN_PLAN_CONFIG = {
+      version: 1,
+      tiers: {
+        team: {
+          ...LOG_DRAIN_QUOTAS.team
+        },
+        business: {
+          ...LOG_DRAIN_QUOTAS.business
+        },
+        enterprise: {
+          ...LOG_DRAIN_QUOTAS.enterprise
+        }
+      },
+      pricing: {
+        team: {
+          includedEventsPerMonth: 0,
+          includedBytesPerMonth: 0,
+          usdPerMillionEvents: 0,
+          usdPerGiB: 0
+        },
+        business: {
+          includedEventsPerMonth: 0,
+          includedBytesPerMonth: 0,
+          usdPerMillionEvents: 0,
+          usdPerGiB: 0
+        },
+        enterprise: {
+          includedEventsPerMonth: 0,
+          includedBytesPerMonth: 0,
+          usdPerMillionEvents: 0,
+          usdPerGiB: 0
+        }
+      }
+    };
+    TIERS = [
+      "team",
+      "business",
+      "enterprise"
+    ];
+    __name(finiteNonNegative, "finiteNonNegative");
+    __name2(finiteNonNegative, "finiteNonNegative");
+    __name(mergeLimits, "mergeLimits");
+    __name2(mergeLimits, "mergeLimits");
+    __name(mergeCard, "mergeCard");
+    __name2(mergeCard, "mergeCard");
+    __name(resolveStoredLogDrainPlanConfig, "resolveStoredLogDrainPlanConfig");
+    __name2(resolveStoredLogDrainPlanConfig, "resolveStoredLogDrainPlanConfig");
+    __name(logDrainPlanTierOverride, "logDrainPlanTierOverride");
+    __name2(logDrainPlanTierOverride, "logDrainPlanTierOverride");
+    __name(logDrainQuotaLimitsFor, "logDrainQuotaLimitsFor");
+    __name2(logDrainQuotaLimitsFor, "logDrainQuotaLimitsFor");
+    __name(logDrainPriceCardFor, "logDrainPriceCardFor");
+    __name2(logDrainPriceCardFor, "logDrainPriceCardFor");
+    __name(priceDrainUsage, "priceDrainUsage");
+    __name2(priceDrainUsage, "priceDrainUsage");
     LOG_CURSOR_MAX_LENGTH = 512;
     LOG_CURSOR_MAX_ID_LENGTH = 128;
     LOG_RELATIVE_TIME_PATTERN = /^(\d{1,9})([smhd])$/;
@@ -5218,15 +6118,15 @@ function validateApproverBlock(node, opts = {
       const users = spec?.users;
       if (Array.isArray(users) && users.length > APPROVER_SPEC_MAX_USERS) push("cap-exceeded", path26, `at most ${APPROVER_SPEC_MAX_USERS} users`);
       else {
-        const refusal = describeApproverSpecRefusal(spec);
+        const refusal2 = describeApproverSpecRefusal(spec);
         issues.push({
           code: "approver-invalid",
           path: path26,
           severity: "error",
-          message: refusal.message,
+          message: refusal2.message,
           repair: {
-            approver: refusal.approver,
-            written: refusal.written
+            approver: refusal2.approver,
+            written: refusal2.written
           }
         });
       }
@@ -13765,7 +14665,26 @@ var init_ast_helpers = __esm({
 });
 
 // src/compiler/utils/class-hierarchy.ts
+import path3 from "path";
 import { Node as Node2 } from "ts-morph";
+function normalizePath(filePath) {
+  return path3.resolve(filePath).split(path3.sep).join("/");
+}
+function sdkDistDir() {
+  if (sdkDistDirCache !== void 0) return sdkDistDirCache;
+  try {
+    sdkDistDirCache = `${normalizePath(getPackageRoot())}/dist`;
+  } catch {
+    sdkDistDirCache = null;
+  }
+  return sdkDistDirCache;
+}
+function isSdkDeclaration(classDecl) {
+  const filePath = normalizePath(classDecl.getSourceFile().getFilePath());
+  if (filePath.includes(SDK_NODE_MODULES_SEGMENT)) return true;
+  const distDir = sdkDistDir();
+  return distDir !== null && filePath.startsWith(`${distDir}/`);
+}
 function getClassHierarchy(classDecl, maxDepth = DEFAULT_MAX_DEPTH) {
   const chain = [
     classDecl
@@ -13794,9 +14713,10 @@ function extendsAny(classDecl, baseNames) {
   }
   return false;
 }
-function findClassMember(classDecl, memberName, kind = "either") {
+function findClassMember(classDecl, memberName, kind = "either", options = {}) {
   const chain = getClassHierarchy(classDecl);
   for (const cls of chain) {
+    if (!options.includeSdkDeclarations && isSdkDeclaration(cls)) break;
     if (kind === "property" || kind === "either") {
       const prop = cls.getProperty(memberName);
       if (prop && Node2.isPropertyDeclaration(prop)) {
@@ -13837,11 +14757,16 @@ function safeGetBaseClass(classDecl) {
 function classKey(c) {
   return `${c.getSourceFile().getFilePath()}#${c.getName() ?? "<anonymous>"}#${c.getStartLineNumber()}`;
 }
-var DEFAULT_MAX_DEPTH;
+var DEFAULT_MAX_DEPTH, SDK_NODE_MODULES_SEGMENT, sdkDistDirCache;
 var init_class_hierarchy = __esm({
   "src/compiler/utils/class-hierarchy.ts"() {
     "use strict";
+    init_package_root();
     DEFAULT_MAX_DEPTH = 10;
+    SDK_NODE_MODULES_SEGMENT = "/node_modules/lua-cli/";
+    __name(normalizePath, "normalizePath");
+    __name(sdkDistDir, "sdkDistDir");
+    __name(isSdkDeclaration, "isSdkDeclaration");
     __name(getClassHierarchy, "getClassHierarchy");
     __name(extendsAny, "extendsAny");
     __name(findClassMember, "findClassMember");
@@ -14858,9 +15783,8 @@ var init_job_plugin = __esm({
 });
 
 // src/compiler/plugins/webhook.plugin.ts
-import path3 from "path";
 import { Node as Node6 } from "ts-morph";
-var LUA_CLI_DECLARATION_PATH, WebhookPlugin;
+var WebhookPlugin;
 var init_webhook_plugin = __esm({
   "src/compiler/plugins/webhook.plugin.ts"() {
     "use strict";
@@ -14868,8 +15792,6 @@ var init_webhook_plugin = __esm({
     init_ast_helpers();
     init_class_hierarchy();
     init_schema_converter();
-    init_package_root();
-    LUA_CLI_DECLARATION_PATH = path3.join(getPackageRoot(), "dist", "api-exports.d.ts");
     WebhookPlugin = class extends BasePlugin {
       static {
         __name(this, "WebhookPlugin");
@@ -14896,8 +15818,7 @@ var init_webhook_plugin = __esm({
         const exportName = isDefaultExport ? "default" : className;
         const name = readStringMember(classDecl, "name") ?? deriveNameFromClassName(className);
         const description = readStringMember(classDecl, "description") ?? "";
-        const secretMember = findClassMember(classDecl, "secret", "property");
-        const hasSecret = secretMember !== void 0 && !(secretMember.owner.getName() === "LuaWebhook" && path3.resolve(secretMember.owner.getSourceFile().getFilePath()) === path3.resolve(LUA_CLI_DECLARATION_PATH));
+        const hasSecret = findClassMember(classDecl, "secret", "property") !== void 0;
         return {
           kind: this.kind,
           name,
@@ -18692,13 +19613,15 @@ var init_voice_plugin = __esm({
 
 // ../shared-sandbox/dist/index.mjs
 import vm from "vm";
-import { createRequire } from "module";
+import { builtinModules, createRequire } from "module";
 import path6 from "path";
 import dns from "dns";
 import net2 from "net";
 import { promisify } from "util";
 import * as net from "net";
 import { Agent as UndiciAgent } from "undici";
+import { isIP } from "net";
+import { Agent } from "undici";
 import vm2 from "vm";
 function buildSandboxProcess(opts) {
   const hrtimeFn = /* @__PURE__ */ __name6((time) => process.hrtime(time), "hrtimeFn");
@@ -18841,10 +19764,13 @@ function buildSandboxGlobals() {
     undefined: void 0
   };
 }
+function isRequireBlocklisted(id) {
+  return REQUIRE_BLOCKLIST.has(id) || BLOCKLISTED_PACKAGES.some((name) => id.startsWith(`${name}/`));
+}
 function buildSandboxRequire(opts) {
   const realRequire = createRequire(path6.join(opts.cwd, "package.json"));
   const wrapped = /* @__PURE__ */ __name6((id) => {
-    if (REQUIRE_BLOCKLIST.has(id)) {
+    if (isRequireBlocklisted(id)) {
       const evt = {
         event: "sandbox_require_blocklisted",
         module: id,
@@ -19586,6 +20512,67 @@ function resolveExtraAllowedHostnames() {
   if (!csv) return [];
   return csv.split(",").map((s) => s.trim()).filter(Boolean);
 }
+function pinnedLookup(addresses) {
+  const rows3 = addresses.map((address) => ({
+    address,
+    family: isIP(address) === 6 ? 6 : 4
+  }));
+  return (hostname, optionsOrCb, maybeCb) => {
+    const options = typeof optionsOrCb === "function" ? {} : optionsOrCb ?? {};
+    const cb = typeof optionsOrCb === "function" ? optionsOrCb : maybeCb;
+    const family = options.family === 4 || options.family === 6 ? options.family : void 0;
+    const matching = family ? rows3.filter((row2) => row2.family === family) : rows3;
+    if (matching.length === 0) {
+      const error = new Error(`pinned lookup has no address for ${hostname}`);
+      error.code = "ENOTFOUND";
+      error.syscall = "getaddrinfo";
+      error.hostname = hostname;
+      cb(error);
+      return;
+    }
+    if (options.all) {
+      cb(null, matching);
+      return;
+    }
+    cb(null, matching[0].address, matching[0].family);
+  };
+}
+function pinnedDispatcherFor(addresses) {
+  if (!addresses || addresses.length === 0) return void 0;
+  const pinned = [
+    ...addresses
+  ];
+  const dispatcher = new Agent({
+    connect: {
+      // undici forwards `connect.lookup` to `net.createConnection`, so this is the
+      // hook that runs at TCP-connection time — the same hook the sandbox guard uses.
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      lookup: pinnedLookup(pinned)
+    }
+  });
+  dispatcher[PINNED_ADDRESSES] = pinned;
+  return {
+    dispatcher,
+    addresses: pinned,
+    // `destroy`, not `close`: close waits for in-flight requests, and this is called
+    // once the body has been read or cancelled, where waiting can only hang.
+    close: /* @__PURE__ */ __name6(async () => {
+      try {
+        await dispatcher.destroy();
+      } catch {
+      }
+    }, "close")
+  };
+}
+function pinnedAddressesOf(dispatcher) {
+  return dispatcher?.[PINNED_ADDRESSES];
+}
+function withPinnedDispatcher(init3, pin) {
+  return pin ? {
+    ...init3,
+    dispatcher: pin.dispatcher
+  } : init3;
+}
 function wrapBundleAsCjsModule(source) {
   return "(function(module, exports, require) {\n" + source + "\n})(module, module.exports, require);";
 }
@@ -19690,7 +20677,7 @@ function logUserCodeOrError(logger, message, error, context = {}) {
     logger.error(message, error, context);
   }
 }
-var __defProp6, __name6, REQUIRE_BLOCKLIST, SANDBOX_FAKE_DIRNAME, SANDBOX_FAKE_FILENAME, EGRESS_DENIED_CODE, EGRESS_PROBE_DEFAULT_MS, PRIVATE_RANGES, dnsLookup, DEFAULT_BLOCK_CIDRS, HOSTNAME_NON_OVERRIDABLE_CIDRS, WorkflowDeterminismError, WORKFLOW_SCRIPT_REMOVED_GLOBALS, WORKFLOW_SCRIPT_TRAPPED_GLOBALS, WORKFLOW_SCRIPT_FORBIDDEN_PLATFORM_KEYS, USER_CODE_ERROR_CODE, PLATFORM_VM_ERROR_CODE, UserCodeError, DEFAULT_MAX_CAUSE_DEPTH, MissingPrimitiveCodeError;
+var __defProp6, __name6, REQUIRE_BLOCKLIST, SANDBOX_FAKE_DIRNAME, SANDBOX_FAKE_FILENAME, BLOCKLISTED_PACKAGES, EGRESS_DENIED_CODE, EGRESS_PROBE_DEFAULT_MS, PRIVATE_RANGES, dnsLookup, DEFAULT_BLOCK_CIDRS, HOSTNAME_NON_OVERRIDABLE_CIDRS, PINNED_ADDRESSES, WorkflowDeterminismError, WORKFLOW_SCRIPT_REMOVED_GLOBALS, WORKFLOW_SCRIPT_TRAPPED_GLOBALS, WORKFLOW_SCRIPT_FORBIDDEN_PLATFORM_KEYS, USER_CODE_ERROR_CODE, PLATFORM_VM_ERROR_CODE, UserCodeError, DEFAULT_MAX_CAUSE_DEPTH, MissingPrimitiveCodeError;
 var init_dist4 = __esm({
   "../shared-sandbox/dist/index.mjs"() {
     "use strict";
@@ -19734,6 +20721,11 @@ var init_dist4 = __esm({
     ]);
     SANDBOX_FAKE_DIRNAME = "/";
     SANDBOX_FAKE_FILENAME = "/index.ts";
+    BLOCKLISTED_PACKAGES = [
+      ...REQUIRE_BLOCKLIST
+    ].filter((id) => !id.startsWith("node:") && !builtinModules.includes(id));
+    __name(isRequireBlocklisted, "isRequireBlocklisted");
+    __name6(isRequireBlocklisted, "isRequireBlocklisted");
     __name(buildSandboxRequire, "buildSandboxRequire");
     __name6(buildSandboxRequire, "buildSandboxRequire");
     EGRESS_DENIED_CODE = "EGRESS_DENIED";
@@ -19849,6 +20841,15 @@ var init_dist4 = __esm({
     __name6(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
     __name(resolveExtraAllowedHostnames, "resolveExtraAllowedHostnames");
     __name6(resolveExtraAllowedHostnames, "resolveExtraAllowedHostnames");
+    PINNED_ADDRESSES = /* @__PURE__ */ Symbol.for("lua.pinnedDispatch.addresses");
+    __name(pinnedLookup, "pinnedLookup");
+    __name6(pinnedLookup, "pinnedLookup");
+    __name(pinnedDispatcherFor, "pinnedDispatcherFor");
+    __name6(pinnedDispatcherFor, "pinnedDispatcherFor");
+    __name(pinnedAddressesOf, "pinnedAddressesOf");
+    __name6(pinnedAddressesOf, "pinnedAddressesOf");
+    __name(withPinnedDispatcher, "withPinnedDispatcher");
+    __name6(withPinnedDispatcher, "withPinnedDispatcher");
     __name(wrapBundleAsCjsModule, "wrapBundleAsCjsModule");
     __name6(wrapBundleAsCjsModule, "wrapBundleAsCjsModule");
     __name(runBundleInContext, "runBundleInContext");
@@ -20481,6 +21482,12 @@ function safeDate() {
   SafeDate.UTC = Date.UTC;
   return SafeDate;
 }
+function safeMath() {
+  const math = {};
+  for (const key of Reflect.ownKeys(Math)) math[key] = Math[key];
+  math.random = notStaticStub("Math.random");
+  return Object.freeze(math);
+}
 function createSerializationContext() {
   const moduleRef = {
     exports: {}
@@ -20536,10 +21543,7 @@ function createSerializationContext() {
     setImmediate: notStaticStub("setImmediate"),
     queueMicrotask: notStaticStub("queueMicrotask"),
     Date: safeDate(),
-    Math: Object.freeze({
-      ...Math,
-      random: notStaticStub("Math.random")
-    }),
+    Math: safeMath(),
     process: {
       env: new Proxy({}, {
         get: /* @__PURE__ */ __name((_t, prop) => typeof prop === "symbol" ? void 0 : notStaticStub(`process.env.${String(prop)}`)(), "get")
@@ -21131,6 +22135,7 @@ var init_graph_serializer = __esm({
       "Workflows"
     ];
     __name(safeDate, "safeDate");
+    __name(safeMath, "safeMath");
     __name(createSerializationContext, "createSerializationContext");
     __name(serializeViaVm, "serializeViaVm");
     __name(locateWorkflowExpression, "locateWorkflowExpression");
@@ -34856,7 +35861,7 @@ async function runWorkflowLocallyInner(rawOpts) {
     ]
   ]));
   let seq = 0;
-  const emit2 = /* @__PURE__ */ __name((type, stepId, payload) => {
+  const emit3 = /* @__PURE__ */ __name((type, stepId, payload) => {
     seq += 1;
     ledger.events.push({
       seq,
@@ -34939,7 +35944,7 @@ async function runWorkflowLocallyInner(rawOpts) {
       completedAt: clock
     });
     if (status === "completed") stepResults[row2.stepId] = row2.output;
-    emit2(`step.${status}`, row2.stepId, row2.error ? {
+    emit3(`step.${status}`, row2.stepId, row2.error ? {
       error: row2.error
     } : void 0);
     say(`[${stamp()}] ${row2.stepId} \xB7 ${status}${row2.error ? ` \xB7 ${row2.error.code}: ${row2.error.message}` : ""}`);
@@ -35113,7 +36118,7 @@ async function runWorkflowLocallyInner(rawOpts) {
         throw new BailRunSignal(output2);
       }, "bailRun"),
       log: /* @__PURE__ */ __name((message) => {
-        emit2("step.progress", row2.stepId, {
+        emit3("step.progress", row2.stepId, {
           message
         });
         say(`[${stamp()}] ${row2.stepId} \xB7 log \xB7 ${message}`);
@@ -35182,7 +36187,7 @@ async function runWorkflowLocallyInner(rawOpts) {
         clock += wallS * 1e3;
         const requeued = s < segments;
         const nextSession = `session-${id}-s${s}`;
-        emit2("step.checkpointed", id, {
+        emit3("step.checkpointed", id, {
           segment: s,
           segmentsMax: segments,
           headSha: `local${s}`,
@@ -35239,7 +36244,7 @@ async function runWorkflowLocallyInner(rawOpts) {
           } catch (e) {
             if (e instanceof SuspendSignal) {
               row2.status = "suspended";
-              emit2("step.suspended", id, {
+              emit3("step.suspended", id, {
                 kind: "input"
               });
               say(`[${stamp()}] ${id} \xB7 suspended \xB7 awaiting resumeData`);
@@ -35304,7 +36309,7 @@ async function runWorkflowLocallyInner(rawOpts) {
     }
     for (; ; ) {
       say(`[park:${row2.stepId}] ${code} \u2014 retry/skip/complete/fail?`);
-      emit2("step.parked", row2.stepId, {
+      emit3("step.parked", row2.stepId, {
         code
       });
       const answer = await opts.prompt("park", row2.stepId, {
@@ -35356,7 +36361,7 @@ async function runWorkflowLocallyInner(rawOpts) {
     const maxAttempts = retryOf(single);
     row2.status = "running";
     row2.startedAt = clock;
-    emit2("step.started", row2.stepId);
+    emit3("step.started", row2.stepId);
     const parkBaseId = row2.stepId.replace(/(\[\d+\]|#\d+)$/, "");
     if (opts.park?.includes(row2.stepId) || opts.park?.includes(parkBaseId)) {
       row2.attempt = Math.max(1, row2.attempt);
@@ -35830,7 +36835,7 @@ async function runWorkflowLocallyInner(rawOpts) {
     }
   }, "runRow");
   const throttleAt = /* @__PURE__ */ new Map();
-  emit2("run.started");
+  emit3("run.started");
   say(`[${stamp()}] run ${runId} \xB7 ${plan.order.length} planned step(s)`);
   try {
     for (; ; ) {
@@ -35898,7 +36903,7 @@ async function runWorkflowLocallyInner(rawOpts) {
     ledger.status = "completed";
     ledger.output = bailed.output;
     ledger.bailedFromStepId = bailed.stepId;
-    emit2("run.completed", void 0, {
+    emit3("run.completed", void 0, {
       bailed: true,
       bailedFromStepId: bailed.stepId
     });
@@ -35915,7 +36920,7 @@ async function runWorkflowLocallyInner(rawOpts) {
   if (runFailure) {
     for (const r of rows3.values()) skipRow(r, "run_failed");
     ledger.status = "failed";
-    emit2("run.failed", runFailure.stepId, {
+    emit3("run.failed", runFailure.stepId, {
       code: runFailure.code
     });
     say(`[${stamp()}] run \xB7 failed \xB7 ${runFailure.code}: ${runFailure.message}`);
@@ -35972,7 +36977,7 @@ async function runWorkflowLocallyInner(rawOpts) {
   }
   ledger.status = "completed";
   ledger.output = output;
-  emit2("run.completed");
+  emit3("run.completed");
   say(`[${stamp()}] run \xB7 completed`);
   finalizeLedger();
   return {
@@ -36068,6 +37073,23 @@ function parseJsonOrFile(raw, what) {
 __name(parseJsonOrFile, "parseJsonOrFile");
 
 // src/utils/sandbox.ts
+init_dist();
+function createSandboxLog(consoleObj) {
+  const emit3 = /* @__PURE__ */ __name((level, message, fields) => {
+    const normalized = normalizeLogFields(fields);
+    const text = typeof message === "object" && message !== null ? JSON.stringify(message) : String(message);
+    const write = level === "error" ? consoleObj.error : level === "warn" ? consoleObj.warn : level === "info" ? consoleObj.info : consoleObj.log;
+    if (normalized) write.call(consoleObj, text, JSON.stringify(normalized));
+    else write.call(consoleObj, text);
+  }, "emit");
+  return Object.freeze({
+    debug: /* @__PURE__ */ __name((message, fields) => emit3("debug", message, fields), "debug"),
+    info: /* @__PURE__ */ __name((message, fields) => emit3("info", message, fields), "info"),
+    warn: /* @__PURE__ */ __name((message, fields) => emit3("warn", message, fields), "warn"),
+    error: /* @__PURE__ */ __name((message, fields) => emit3("error", message, fields), "error")
+  });
+}
+__name(createSandboxLog, "createSandboxLog");
 function resolveRequireMode() {
   return process.env.LUA_SANDBOX_REQUIRE_MODE === "enforce" ? "enforce" : "log";
 }
@@ -36211,6 +37233,13 @@ function createSandbox(options) {
         __envRef: key
       }), "template")
     }),
+    // K1a (PRO-2142) — the `log` global, so `lua test` runs the same code
+    // production runs. There is no `VmLogSink` here, so the line goes to the
+    // developer's console with its fields rendered beside it; the VALIDATION is
+    // the identical `normalizeLogFields` the production VM calls, which is the
+    // half that has to agree — a field map `lua test` accepts is one production
+    // accepts, and one it refuses is refused here with the same message.
+    log: createSandboxLog(consoleObj),
     BasketStatus,
     OrderStatus,
     AI: {
@@ -36341,10 +37370,7 @@ async function executeTool(options) {
       return await primitive.execute(inputs);
     } catch (e) {
       console.error(e);
-      return {
-        status: "error",
-        error: e.message
-      };
+      throw e;
     }
   } else {
     const commonJsWrapper = `
@@ -36355,7 +37381,7 @@ module.exports = async (input) => {
     return await executeFunction(input);
   } catch(e) {
     console.error(e);
-    return { status: 'error', error: e.message };
+    throw e;
   }
 };
 `;
@@ -36391,10 +37417,7 @@ async function executeWebhook(options) {
       return await primitive.execute(event);
     } catch (e) {
       console.error(e);
-      return {
-        status: "error",
-        error: e.message
-      };
+      throw e;
     }
   } else {
     const commonJsWrapper = `
@@ -36405,7 +37428,7 @@ module.exports = async (event) => {
     return await executeFunction(event);
   } catch(e) {
     console.error(e);
-    return { status: 'error', error: e.message };
+    throw e;
   }
 };
 `;
@@ -36457,10 +37480,7 @@ async function executeJob(options) {
       return await primitive.execute(jobInstance);
     } catch (e) {
       console.error(e);
-      return {
-        status: "error",
-        error: e.message
-      };
+      throw e;
     }
   } else {
     const commonJsWrapper = `
@@ -36471,7 +37491,7 @@ module.exports = async (job) => {
     return await executeFunction(job);
   } catch(e) {
     console.error(e);
-    return { status: 'error', error: e.message };
+    throw e;
   }
 };
 `;
@@ -36557,10 +37577,7 @@ async function executePreProcessor(options) {
       return await primitive.execute(userInstance, messages, channel);
     } catch (e) {
       console.error(e);
-      return {
-        status: "error",
-        error: e.message
-      };
+      throw e;
     }
   } else {
     const commonJsWrapper = `
@@ -36571,7 +37588,7 @@ module.exports = async (input) => {
     return await executeFunction(input.user, input.messages, input.channel);
   } catch(e) {
     console.error(e);
-    return { status: 'error', error: e.message };
+    throw e;
   }
 };
 `;
@@ -37419,8 +38436,13 @@ var ALIAS_MAP = {
       "delete",
       "test",
       "verify",
+      // H4 / PRO-1887: the second half of a BUCKET verification, for the write-only
+      // role that cannot read its own challenge object back.
+      "confirm",
       "pause",
       "resume",
+      // PRO-2126: re-enqueue one batch's records after a terminal refusal.
+      "replay",
       "rotate-secret"
     ],
     aliases: lowerKeys({
@@ -39562,13 +40584,18 @@ async function compileQuietly(asJson) {
   }
 }
 __name(compileQuietly, "compileQuietly");
-function handleExecutionError(error, entityType) {
-  console.error(`
+function handleExecutionError(error, entityType, asJson = false) {
+  if (asJson) {
+    console.log(JSON.stringify(cliErrorEnvelope(error), null, 2));
+  } else {
+    console.error(`
 \u274C ${entityType} execution failed:`);
-  console.error(error.message);
-  if (error.stack) {
-    console.error(error.stack);
+    console.error(error.message);
+    if (error.stack) {
+      console.error(error.stack);
+    }
   }
+  process.exitCode = classifyCliError(error).exitCode;
 }
 __name(handleExecutionError, "handleExecutionError");
 function extractToolsFromManifest(manifest) {
@@ -39744,7 +40771,7 @@ async function testSkill(entityName, inputJson, asJson = false) {
         });
       }
     } catch (error) {
-      handleExecutionError(error, "Tool");
+      handleExecutionError(error, "Tool", asJson);
       if (!asJson) {
         writeHintBlock({
           headline: "Tool ran locally \u2014 no server logs exist for this execution.",
@@ -39863,7 +40890,7 @@ async function testWebhook(entityName, inputJson, asJson = false) {
         });
       }
     } catch (error) {
-      handleExecutionError(error, "Webhook");
+      handleExecutionError(error, "Webhook", asJson);
       if (!asJson) {
         writeHintBlock({
           headline: "Webhook ran locally \u2014 no server logs exist for this execution.",
@@ -39955,7 +40982,7 @@ async function testJob(entityName, asJson = false) {
         });
       }
     } catch (error) {
-      handleExecutionError(error, "Job");
+      handleExecutionError(error, "Job", asJson);
       if (!asJson) {
         writeHintBlock({
           headline: "Job ran locally \u2014 no server logs exist for this execution.",
@@ -40107,7 +41134,7 @@ Raw result:`);
         });
       }
     } catch (error) {
-      handleExecutionError(error, "PreProcessor");
+      handleExecutionError(error, "PreProcessor", asJson);
       if (!asJson) {
         writeHintBlock({
           headline: "Preprocessor ran locally \u2014 no server logs exist for this execution.",
@@ -40236,7 +41263,7 @@ async function testPostProcessor(entityName, inputJson, asJson = false) {
         });
       }
     } catch (error) {
-      handleExecutionError(error, "PostProcessor");
+      handleExecutionError(error, "PostProcessor", asJson);
       if (!asJson) {
         writeHintBlock({
           headline: "Postprocessor ran locally \u2014 no server logs exist for this execution.",
@@ -41194,6 +42221,10 @@ function pickPushAllNextStepVariant(opts) {
   return null;
 }
 __name(pickPushAllNextStepVariant, "pickPushAllNextStepVariant");
+function pushAllExitCode(variant) {
+  return variant === "partial" || variant === "error" ? CLI_EXIT.ERROR : void 0;
+}
+__name(pushAllExitCode, "pushAllExitCode");
 function formatPushFailureSummary(failedItems) {
   if (failedItems.length === 0) return "";
   const lines = [];
@@ -42331,6 +43362,7 @@ Until the backup catches up, \`lua init\` for this agent will restore an older s
     pushedSomething,
     failedCount: failedItems.length + deployFailedCount
   });
+  process.exitCode = pushAllExitCode(variant);
   if (variant === "success") {
     console.log("");
     if (!options.suppressVersionCreateHint) {
@@ -42380,6 +43412,7 @@ init_command_utils();
 
 // src/utils/deploy-helpers.ts
 init_cli();
+init_cli_error();
 import inquirer8 from "inquirer";
 function formatVersionChoice(version) {
   const currentIndicator = version.isCurrent ? " (CURRENT)" : "";
@@ -42428,6 +43461,10 @@ function formatDeploySuccess(params) {
   return `\u2705 ${label2} "${name}" v${version} deployed successfully`;
 }
 __name(formatDeploySuccess, "formatDeploySuccess");
+function deployAllExitCode(failedCount) {
+  return failedCount > 0 ? CLI_EXIT.ERROR : void 0;
+}
+__name(deployAllExitCode, "deployAllExitCode");
 
 // src/commands/deploy.ts
 init_constants();
@@ -42869,6 +43906,12 @@ async function deployAllCommand(_options) {
         const versions = await deployConfig.getVersions(apiKey, agentId, entityId);
         if (!versions || versions.length === 0) {
           writeInfo(`  \u2139\uFE0F  No versions for ${deployConfig.label} "${entity.name}", skipping`);
+          failedItems.push({
+            kind: deployConfig.type,
+            name: entity.name,
+            error: `No versions found on the server for ${deployConfig.idField} "${entityId}" \u2014 push it first, or remove the stale id from lua.skill.yaml if it was deleted server-side`
+          });
+          failedCount++;
           continue;
         }
         const latestVersion = sortVersionsByDate(versions)[0].version;
@@ -42985,6 +44028,7 @@ async function deployAllCommand(_options) {
       when: "partial"
     });
   }
+  process.exitCode = deployAllExitCode(failedCount);
 }
 __name(deployAllCommand, "deployAllCommand");
 
@@ -43816,6 +44860,7 @@ var LogsApi = class extends HttpClient {
     if (filters.toolName) queryParams.append("toolName", filters.toolName);
     if (filters.logType) queryParams.append("logType", filters.logType);
     if (filters.userId) queryParams.append("userId", filters.userId);
+    if (filters.channel) queryParams.append("channel", filters.channel);
     if (filters.since) queryParams.append("since", filters.since);
     if (filters.until) queryParams.append("until", filters.until);
     if (filters.environment) queryParams.append("environment", filters.environment);
@@ -43881,6 +44926,14 @@ async function probeAgentErrorsSince(apiKey, agentId, sinceISO) {
 }
 __name(probeAgentErrorsSince, "probeAgentErrorsSince");
 
+// src/commands/chat-log-environment.ts
+function declaredLogEnvironment(session) {
+  if (session.type !== "production") return void 0;
+  if (session.previewVersion != null) return void 0;
+  return "production";
+}
+__name(declaredLogEnvironment, "declaredLogEnvironment");
+
 // src/commands/chat.ts
 init_cli_error();
 async function runChatProbe(chatEnv, window) {
@@ -44323,6 +45376,10 @@ async function sendProductionMessageStream(chatEnv, messages, callbacks) {
   if (chatEnv.previewVersion != null) {
     chatRequest.version = chatEnv.previewVersion;
   }
+  const declared = declaredLogEnvironment(chatEnv);
+  if (declared) {
+    chatRequest.environment = declared;
+  }
   const chatApi = new ChatApi(BASE_URLS.CHAT, chatEnv.apiKey);
   await chatApi.sendMessageStream(chatEnv.agentId, chatRequest, callbacks.onChunk, callbacks.onPostprocessComplete, callbacks.onPreprocessorBlocked, callbacks.onBatchAbort, callbacks.onBatchHandled);
 }
@@ -47920,6 +48977,7 @@ async function logsCommand(cmdObj) {
       pageGiven,
       json: cmdObj?.json || false,
       userId: cmdObj?.userId || null,
+      channel: cmdObj?.channel || null,
       agentId: cmdObj?.agentId || null,
       direction: cmdObj?.direction || null,
       status: cmdObj?.status || null,
@@ -47945,7 +49003,7 @@ async function logsCommand(cmdObj) {
       return;
     }
     const logsApi = new LogsApi(BASE_URLS.API, apiKey);
-    const hasNonInteractiveFlags = Boolean(options.type || options.name || options.json || options.userId || options.since || options.until || options.environment || options.follow);
+    const hasNonInteractiveFlags = Boolean(options.type || options.name || options.json || options.userId || options.channel || options.since || options.until || options.environment || options.follow);
     trackEvent("cli_logs_action", {
       filter_type: options.type || null,
       json_output: options.json || false,
@@ -48010,6 +49068,12 @@ async function listCallLogs(agentId, apiKey, options) {
   }
 }
 __name(listCallLogs, "listCallLogs");
+function formatLogFields(fields) {
+  if (!fields || typeof fields !== "object" || Array.isArray(fields)) return void 0;
+  const pairs = Object.keys(fields).sort().map((key) => `${key}=${String(fields[key])}`);
+  return pairs.length > 0 ? pairs.join(" ") : void 0;
+}
+__name(formatLogFields, "formatLogFields");
 function renderLogEntry(log, isLast) {
   const timestamp = new Date(log.timestamp).toLocaleString();
   const logSource = log.metadata?.logSource;
@@ -48048,6 +49112,10 @@ function renderLogEntry(log, isLast) {
     console.log(chalk2.gray(`   Duration: ${log.duration}ms`));
   }
   console.log(`   ${log.message}`);
+  const fieldsLine = formatLogFields(log.metadata?.fields);
+  if (fieldsLine) {
+    console.log(chalk2.gray(`   ${fieldsLine}`));
+  }
   if (!isLast) {
     console.log(chalk2.gray(`   ${"-".repeat(78)}`));
   }
@@ -48289,6 +49357,9 @@ async function nonInteractiveLogs(logsApi, agentId, apiKey, options) {
   if (options.userId) {
     filters.userId = options.userId;
   }
+  if (options.channel) {
+    filters.channel = options.channel;
+  }
   if (options.since) filters.since = options.since;
   if (options.until) filters.until = options.until;
   if (options.environment) filters.environment = options.environment;
@@ -48661,6 +49732,38 @@ function getLogColor(subType, logSource) {
 }
 __name(getLogColor, "getLogColor");
 
+// src/commands/logs.export.ts
+init_cli();
+init_cli_error();
+init_analytics();
+import { basename } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "fs";
+import { join as join9, resolve as resolvePath2 } from "path";
+init_constants();
+init_lua_fetch();
+
+// src/api/log-export.api.service.ts
+init_http_client();
+var LogExportApi = class extends HttpClient {
+  static {
+    __name(this, "LogExportApi");
+  }
+  orgId;
+  constructor(baseUrl, credential, orgId) {
+    super(baseUrl, credential), this.orgId = orgId;
+  }
+  /** RELATIVE to `baseUrl` — every `HttpClient` verb prepends it itself. */
+  base() {
+    return `/admin/orgs/${encodeURIComponent(this.orgId)}/logs/export`;
+  }
+  async startExport(input) {
+    return this.httpPost(this.base(), input);
+  }
+  async getExport(jobId) {
+    return this.httpGet(`${this.base()}/${encodeURIComponent(jobId)}`);
+  }
+};
+
 // src/commands/drains.ts
 init_cli();
 init_command_utils();
@@ -48715,6 +49818,15 @@ var DrainsApi = class extends HttpClient {
   async verifyDrain(drainId) {
     return this.httpPost(this.drainPath(drainId, "/verify"));
   }
+  /**
+  * Settle a bucket ownership challenge (H4). Not `httpPostOnce`: confirming is
+  * idempotent and answers the same `verifiedAt`, so a retried request is safe.
+  */
+  async confirmChallenge(drainId, token) {
+    return this.httpPost(this.drainPath(drainId, "/challenge/confirm"), {
+      token
+    });
+  }
   async pauseDrain(drainId, reason) {
     return this.httpPost(this.drainPath(drainId, "/pause"), reason ? {
       reason
@@ -48731,6 +49843,17 @@ var DrainsApi = class extends HttpClient {
     const path26 = this.drainPath(drainId, `/rotate-secret${finalize ? "?finalize=true" : ""}`);
     return finalize ? this.httpPost(path26, {}) : this.httpPostOnce(path26, {});
   }
+  /**
+  * Re-enqueue one batch's records (PRO-2126).
+  *
+  * `httpPost`, not `httpPostOnce`: a replay is idempotent in the way that matters —
+  * the second call finds the rows already `pending`, matches nothing and answers 409
+  * — so a retried request cannot double-deliver. It DOES spend a second slot of the
+  * per-drain budget, which is the price of a retry and not a correctness problem.
+  */
+  async replayBatch(drainId, batchId) {
+    return this.httpPost(this.drainPath(drainId, `/deliveries/${encodeURIComponent(batchId)}/replay`));
+  }
   async listDeliveries(drainId, opts = {}) {
     const query = new URLSearchParams();
     if (opts.limit !== void 0) query.set("limit", String(opts.limit));
@@ -48752,19 +49875,30 @@ var HEADER_NAME_PATTERN = /^[A-Za-z0-9-]{1,64}$/;
 var ENDPOINT_TYPES = [
   "http",
   "otlp",
-  "betterstack"
+  "betterstack",
+  "splunk",
+  "loki",
+  "axiom",
+  "sumologic"
 ];
 var SITE_TYPES = [
-  "datadog"
-];
-var PHASE2_SOURCES = [
-  "delivery",
-  "trigger-execution",
-  "job-execution",
-  "workflow-run",
-  "workflow-audit"
+  "datadog",
+  "newrelic"
 ];
-var SELECTABLE_SOURCES = LOG_DRAIN_SOURCES.filter((source) => !PHASE2_SOURCES.includes(source));
+function sitesFor(type) {
+  return LOG_DRAIN_PRESET_SITES[type] ?? LOG_DRAIN_DATADOG_SITES;
+}
+__name(sitesFor, "sitesFor");
+function endpointHint(type) {
+  const rule = LOG_DRAIN_PRESET_PATHS[type];
+  if (!rule) return void 0;
+  if (rule.segment === "dataset") return `the full ingest URL, ending in ${rule.path}/<dataset>${rule.suffix ?? ""}`;
+  if (rule.segment === "token") return `the full HTTP Source URL, ending in ${rule.path}/<collector code>`;
+  return `your host \u2014 ${rule.path} is appended for you`;
+}
+__name(endpointHint, "endpointHint");
+var UNAVAILABLE_SOURCES = [];
+var SELECTABLE_SOURCES = LOG_DRAIN_SOURCES.filter((source) => !UNAVAILABLE_SOURCES.includes(source));
 var NON_CONTENT_SOURCES = SELECTABLE_SOURCES.filter((source) => !LOG_DRAIN_CONTENT_SOURCES.includes(source));
 var TOKEN_ECHO_TYPES = [
   "http"
@@ -48809,8 +49943,8 @@ __name(trimmed, "trimmed");
 function parseType(raw) {
   const value3 = trimmed(raw)?.toLowerCase();
   if (!value3) return void 0;
-  if (!LOG_DRAIN_TYPES_PHASE1.includes(value3)) {
-    throw CliError.usage(`--type "${raw}" is not available.`, listHint("Available destinations", LOG_DRAIN_TYPES_PHASE1));
+  if (!LOG_DRAIN_TYPES_IMPLEMENTED.includes(value3)) {
+    throw CliError.usage(`--type "${raw}" is not a destination lua-cli knows how to address.`, listHint("Destinations", LOG_DRAIN_TYPES_IMPLEMENTED));
   }
   return value3;
 }
@@ -49073,12 +50207,13 @@ async function resolveDestination(type, options) {
   const endpoint = trimmed(options.endpoint);
   const site = trimmed(options.site);
   if (SITE_TYPES.includes(type)) {
+    const sites = sitesFor(type);
     if (endpoint) {
-      throw CliError.usage(`--endpoint is not accepted for ${type}: its URL is derived from --site.`, listHint("Sites", LOG_DRAIN_DATADOG_SITES));
+      throw CliError.usage(`--endpoint is not accepted for ${type}: its URL is derived from --site.`, listHint("Sites", sites));
     }
-    const chosen = site ?? await promptChoice("Which site?", LOG_DRAIN_DATADOG_SITES, "--site", `${type}`);
-    if (!LOG_DRAIN_DATADOG_SITES.includes(chosen)) {
-      throw CliError.usage(`--site "${chosen}" is not a ${type} site.`, listHint("Sites", LOG_DRAIN_DATADOG_SITES));
+    const chosen = site ?? await promptChoice("Which site?", sites, "--site", `${type}`);
+    if (!sites.includes(chosen)) {
+      throw CliError.usage(`--site "${chosen}" is not a ${type} site.`, listHint("Sites", sites));
     }
     return {
       site: chosen
@@ -49090,12 +50225,108 @@ async function resolveDestination(type, options) {
   if (site) {
     throw CliError.usage(`--site is not accepted for ${type}: give the destination URL with --endpoint.`);
   }
-  const url = endpoint ?? await promptText(type === "otlp" ? "OTLP logs endpoint (the full /v1/logs URL):" : "Destination URL:", "--endpoint", `${type} sends to your own URL`);
+  const hint = endpointHint(type);
+  const url = endpoint ?? await promptText(type === "otlp" ? "OTLP logs endpoint (the full /v1/logs URL):" : "Destination URL:", "--endpoint", hint ?? `${type} sends to your own URL`);
   return {
     endpoint: url
   };
 }
 __name(resolveDestination, "resolveDestination");
+var BUCKET_PROVIDERS = [
+  "aws",
+  "r2",
+  "gcs"
+];
+function parseProvider(raw) {
+  const value3 = trimmed(raw)?.toLowerCase() ?? "aws";
+  if (!BUCKET_PROVIDERS.includes(value3)) {
+    throw CliError.usage(`--provider "${raw}" is not an object store.`, listHint("Valid values", BUCKET_PROVIDERS));
+  }
+  return value3;
+}
+__name(parseProvider, "parseProvider");
+function resolveBucketCredentials(options) {
+  const roleArn = trimmed(options.roleArn);
+  const spec = trimmed(options.credentialsFromEnv);
+  if (roleArn && spec) {
+    throw CliError.usage("Give either --role-arn or --credentials-from-env, not both.", "A role is assumed at send time; a key pair is stored. One drain uses one of them.");
+  }
+  if (roleArn) {
+    return {
+      roleArn,
+      ...trimmed(options.externalId) ? {
+        externalId: trimmed(options.externalId)
+      } : {}
+    };
+  }
+  if (!spec) return void 0;
+  const eq3 = spec.indexOf("=");
+  if (eq3 === -1) {
+    throw CliError.usage(`--credentials-from-env "${spec}" must read <KEY_ID_VAR>=<SECRET_VAR>.`, "Both values stay in the environment \u2014 e.g. --credentials-from-env AWS_KEY_ID=AWS_SECRET");
+  }
+  const keyVar = spec.slice(0, eq3).trim();
+  const secretVar = spec.slice(eq3 + 1).trim();
+  if (!keyVar || !secretVar) {
+    throw CliError.usage(`--credentials-from-env "${spec}" must name two environment variables.`);
+  }
+  const accessKeyId = process.env[keyVar];
+  const secretAccessKey = process.env[secretVar];
+  for (const [variable, value3] of [
+    [
+      keyVar,
+      accessKeyId
+    ],
+    [
+      secretVar,
+      secretAccessKey
+    ]
+  ]) {
+    if (!value3) {
+      throw CliError.usage(`--credentials-from-env ${keyVar}=${secretVar}: the environment variable ${variable} is unset or empty.`, "Export it in the shell or the CI job that runs this command");
+    }
+  }
+  return {
+    accessKeyId,
+    secretAccessKey
+  };
+}
+__name(resolveBucketCredentials, "resolveBucketCredentials");
+async function resolveBucket(options) {
+  const provider = parseProvider(options.provider);
+  const endpoint = trimmed(options.endpoint);
+  if (provider === "aws" && endpoint) {
+    throw CliError.usage("--endpoint is not accepted for an aws bucket: its URL is derived from --bucket and --region.", "Use --endpoint only for --provider r2 or gcs");
+  }
+  const bucket = trimmed(options.bucket) ?? await promptText("Bucket name:", "--bucket", "the bucket to write to");
+  const region = trimmed(options.region) ?? await promptText("Region:", "--region", provider === "r2" ? "R2 uses 'auto'" : "the bucket's region");
+  const host = provider === "aws" ? void 0 : endpoint ?? await promptText("S3-compatible endpoint:", "--endpoint", provider === "r2" ? "https://<account>.r2.cloudflarestorage.com" : "https://storage.googleapis.com");
+  return {
+    provider,
+    bucket,
+    region,
+    ...trimmed(options.prefix) ? {
+      prefix: trimmed(options.prefix)
+    } : {},
+    ...host ? {
+      endpoint: host
+    } : {},
+    ...resolveBucketCredentials(options) ? {
+      credentials: resolveBucketCredentials(options)
+    } : {}
+  };
+}
+__name(resolveBucket, "resolveBucket");
+async function confirmChallengeCore(context, drainId, options) {
+  const token = trimmed(options.token) ?? await promptText("Token from the _lua-verify-<token> object in your bucket:", "--token", "list your prefix for _lua-verify-* to find it");
+  const result = await drainsCall(() => drainsApiFor(context).confirmChallenge(drainId, token));
+  if (options.json) {
+    printJson(result);
+    return;
+  }
+  writeSuccess(`\u2705 Ownership confirmed for ${drainId}`);
+  writeInfo(`   verified at ${result.verifiedAt}`);
+}
+__name(confirmChallengeCore, "confirmChallengeCore");
 function verificationCurl(type, endpoint, headers) {
   const target = endpoint ?? "<your endpoint>";
   const headerArgs = headers.map((header) => header.fromEnv ? `  -H "${header.name}: $${header.fromEnv}" \\` : `  -H '${header.name}: <the value you entered>' \\`);
@@ -49116,11 +50347,37 @@ function verificationCurl(type, endpoint, headers) {
   ];
 }
 __name(verificationCurl, "verificationCurl");
+function bucketVerificationInstructions(drain, json) {
+  const prefix = drain.bucket?.prefix;
+  const where = prefix ? `${prefix}/_lua-verify-*` : "_lua-verify-*";
+  const bucket = drain.bucket?.bucket ?? "<your bucket>";
+  const endpointArg = drain.bucket?.endpoint ? ` --endpoint-url '${drain.bucket.endpoint}'` : "";
+  emitAside("Lua writes a challenge object into the bucket itself \u2014 nothing is POSTed to a URL.", json);
+  emitAside("Check the credentials can write under the prefix first:", json);
+  emitAside("", json);
+  emitAside(`  aws s3 cp - 's3://${bucket}/${prefix ? `${prefix}/` : ""}_lua-write-check'${endpointArg} </dev/null`, json);
+  emitAside("", json);
+  emitAside("  (a zero-byte object, yours to delete \u2014 a write-only role cannot remove it itself)", json);
+  emitAside("", json);
+  emitAside(`Then:  lua drains verify ${drain.id}`, json);
+  emitAside("", json);
+  emitAside("That is what mints the challenge, and how it settles depends on the role:", json);
+  emitAside("  \xB7 with s3:GetObject, Lua reads the object back and 'verify' finishes on its own;", json);
+  emitAside("  \xB7 write-only \u2014 the grant we recommend \u2014 leaves the claim open. List the prefix", json);
+  emitAside(`    for ${where}, take the <token> off the object name, and run:`, json);
+  emitAside("", json);
+  emitAside(`  lua drains confirm ${drain.id} --token <token>`, json);
+}
+__name(bucketVerificationInstructions, "bucketVerificationInstructions");
 function verificationInstructions(drain, headers, options) {
   const type = drain.type;
   const json = options.json;
   emitAside("", json);
   emitAside("Before anything is delivered, Lua has to confirm you own this destination.", json);
+  if (type === "s3") {
+    bucketVerificationInstructions(drain, json);
+    return;
+  }
   if (TOKEN_ECHO_TYPES.includes(type)) {
     emitAside("Lua POSTs one record carrying an X-Lua-Verify header; your receiver must answer 2xx AND", json);
     emitAside("repeat that header back on the response. Check yours first:", json);
@@ -49136,8 +50393,9 @@ function verificationInstructions(drain, headers, options) {
 __name(verificationInstructions, "verificationInstructions");
 async function createDrainCore(context, options) {
   const name = trimmed(options.name) ?? await promptText("Drain name:", "--name", "1\u201364 chars, unique per org");
-  const type = parseType(options.type) ?? await promptChoice("Where should the logs go?", LOG_DRAIN_TYPES_PHASE1, "--type", "the destination kind");
-  const destination = await resolveDestination(type, options);
+  const type = parseType(options.type) ?? await promptChoice("Where should the logs go?", LOG_DRAIN_TYPES_IMPLEMENTED, "--type", "the destination kind");
+  const bucket = type === "s3" ? await resolveBucket(options) : void 0;
+  const destination = bucket ? {} : await resolveDestination(type, options);
   const format = parseFormat(options.format);
   const headers = await resolveHeaders(options);
   const flagSources = parseSources(options.sources);
@@ -49159,6 +50417,9 @@ async function createDrainCore(context, options) {
     ...destination.site ? {
       site: destination.site
     } : {},
+    ...bucket ? {
+      bucket
+    } : {},
     ...format ? {
       format
     } : {},
@@ -49211,6 +50472,14 @@ async function createDrainCore(context, options) {
           label: "Verify",
           command: `lua drains verify ${drain.id}`
         },
+        // W4-D3: on a bucket drain the step after `verify` is `confirm`, not `test` —
+        // a write-only role (the recommended grant) cannot settle its own claim.
+        ...drain.type === "s3" ? [
+          {
+            label: "Settle the challenge",
+            command: `lua drains confirm ${drain.id} --token <token>`
+          }
+        ] : [],
         {
           label: "Send one record",
           command: `lua drains test ${drain.id}`
@@ -49526,6 +50795,30 @@ async function rotateSecretCore(context, drainId, options) {
   });
 }
 __name(rotateSecretCore, "rotateSecretCore");
+async function replayDrainCore(context, drainId, batchId, options) {
+  const replayed = await drainsCall(() => drainsApiFor(context).replayBatch(drainId, batchId));
+  if (options.json) {
+    printJson({
+      replayOf: replayed.replayOf,
+      records: replayed.records,
+      enqueuedAt: replayed.enqueuedAt
+    });
+    return;
+  }
+  const records = replayed.records === 1 ? "1 record" : `${replayed.records} records`;
+  writeSuccess(`\u2705 Re-enqueued ${records} from batch ${replayed.replayOf}`);
+  writeInfo("   They go out in a NEW batch with a new id; delivery is asynchronous.");
+  writeHintBlock({
+    headline: "Watch for it:",
+    lines: [
+      {
+        label: "Attempts",
+        command: `lua drains deliveries ${drainId} --kind batch`
+      }
+    ]
+  });
+}
+__name(replayDrainCore, "replayDrainCore");
 
 // src/commands/drains.ts
 var DRAIN_ACTIONS = [
@@ -49537,8 +50830,10 @@ var DRAIN_ACTIONS = [
   "delete",
   "test",
   "verify",
+  "confirm",
   "pause",
   "resume",
+  "replay",
   "rotate-secret"
 ];
 var MISSING_SCOPE_MESSAGE = "Missing scope: logs:manage. Create a key with that scope (lua auth key) or ask an org admin.";
@@ -49554,6 +50849,8 @@ var DELIVERY_KINDS = [
 var DEFAULT_DELIVERY_LIMIT = 20;
 var MAX_DELIVERY_LIMIT = 100;
 var MAX_TABLE_WIDTH = 100;
+var DRAIN_ID_PREFIX = "drn_";
+var MAX_LISTED_DRAINS = 10;
 async function resolveDrainsContext(options) {
   const apiKey = await requireAuth();
   const flagOrg = typeof options.org === "string" ? options.org.trim() : "";
@@ -49611,6 +50908,25 @@ async function drainsCall(call) {
   throw CliError.fromStatus(response.error?.statusCode, drainRefusalMessage(response.error), void 0, apiErrorDetail(response.error));
 }
 __name(drainsCall, "drainsCall");
+function identify(drain) {
+  return `${drain.id} \u2014 ${drain.name}`;
+}
+__name(identify, "identify");
+async function resolveDrainRef(context, ref, options = {}) {
+  const wanted = `${ref ?? ""}`.trim();
+  if (wanted.startsWith(DRAIN_ID_PREFIX)) return wanted;
+  const drains = (await drainsCall(() => drainsApiFor(context).listDrains())).drains ?? [];
+  const matches = drains.filter((drain) => drain.name === wanted);
+  if (matches.length === 1) {
+    if (!options.json) writeInfo(`\u{1F6B0} ${wanted} \u2192 ${matches[0].id}`);
+    return matches[0].id;
+  }
+  if (matches.length > 1) {
+    throw CliError.usage(`${matches.length} log drains in ${context.orgId} are named "${wanted}" \u2014 address one by id.`, listHint("Matching drains", matches.map(identify)));
+  }
+  throw CliError.usage(`No log drain named "${wanted}" in ${context.orgId}.`, joinHint(`A drain is addressed by its id (${DRAIN_ID_PREFIX}\u2026) or by its exact name`, drains.length > 0 ? listHint("Drains", drains.slice(0, MAX_LISTED_DRAINS).map(identify)) : void 0, drains.length > MAX_LISTED_DRAINS && "Run lua drains list for the rest", drains.length === 0 && "This organization has no log drains \u2014 lua drains create"));
+}
+__name(resolveDrainRef, "resolveDrainRef");
 function printJson2(payload) {
   console.log(JSON.stringify(payload, null, 2));
 }
@@ -49730,8 +51046,8 @@ function quotaRatio(drain) {
   const quota = drain.quota;
   if (!quota || !quota.eventsPerDay) return "\u2014";
   const ratio = quota.eventsPerDay > 0 ? (quota.usedEvents ?? 0) / quota.eventsPerDay : 0;
-  const percent = Math.round(ratio * 1e3) / 10;
-  return quota.degradation && quota.degradation !== "none" ? `${percent}% ${quota.degradation}` : `${percent}%`;
+  const percent2 = Math.round(ratio * 1e3) / 10;
+  return quota.degradation && quota.degradation !== "none" ? `${percent2}% ${quota.degradation}` : `${percent2}%`;
 }
 __name(quotaRatio, "quotaRatio");
 function printDrainDetail(drain) {
@@ -49778,6 +51094,13 @@ function printDrainDetail(drain) {
       "verifiedAt",
       shortIso2(drain.verifiedAt)
     ],
+    // PRO-2120 (G5-04). `verifiedAt` alone says WHEN, never WHAT — and for a vendor
+    // preset on a host the customer supplied, what was proved is reachability, not
+    // ownership. Absent (every drain verified before this shipped) reads the same way.
+    [
+      "ownership",
+      drain.verification?.ownership ?? "reachability-only"
+    ],
     [
       "lastSuccessAt",
       shortIso2(health.lastSuccessAt)
@@ -49937,7 +51260,9 @@ async function listDrainsCore(context, options) {
   });
 }
 __name(listDrainsCore, "listDrainsCore");
-async function statusDrainsCore(context, drainId, options) {
+async function statusDrainsCore(context, drainRef, options) {
+  const wanted = `${drainRef ?? ""}`.trim();
+  const drainId = wanted ? await resolveDrainRef(context, wanted, options) : void 0;
   const api = drainsApiFor(context);
   const drains = drainId ? [
     await drainsCall(() => api.getDrain(drainId))
@@ -49972,9 +51297,10 @@ async function statusDrainsCore(context, drainId, options) {
   }
 }
 __name(statusDrainsCore, "statusDrainsCore");
-async function deliveriesCore(context, drainId, options) {
+async function deliveriesCore(context, drainRef, options) {
   const limit = parseLimit(options.limit);
   const kind = parseKind(options.kind);
+  const drainId = await resolveDrainRef(context, drainRef, options);
   const page = await drainsCall(() => drainsApiFor(context).listDeliveries(drainId, {
     limit,
     ...kind ? {
@@ -50014,17 +51340,25 @@ function parseKind(raw) {
   return kind;
 }
 __name(parseKind, "parseKind");
-async function drainsCommand(action, drainId, cmdObj) {
+async function drainsCommand(action, drainId, batchIdOrOptions, cmdObj) {
+  const batchId = typeof batchIdOrOptions === "string" ? batchIdOrOptions : void 0;
+  const resolvedOptions = batchIdOrOptions && typeof batchIdOrOptions === "object" ? batchIdOrOptions : cmdObj;
   return withErrorHandling(
     async () => {
-      const options = cmdObj ?? {};
+      const options = resolvedOptions ?? {};
       const verb = action ? validateOrSuggest("drains.action", action) : "list";
-      const needsId = /* @__PURE__ */ __name((v) => v === "deliveries" || v === "update" || v === "delete" || v === "test" || v === "verify" || v === "pause" || v === "resume" || v === "rotate-secret", "needsId");
+      const needsId = /* @__PURE__ */ __name((v) => v === "deliveries" || v === "update" || v === "delete" || v === "test" || v === "verify" || v === "confirm" || v === "pause" || v === "resume" || v === "replay" || v === "rotate-secret", "needsId");
       if (needsId(verb) && !drainId) {
-        throw CliError.usage(`lua drains ${verb} needs a drain id.`, listHint("Run", [
+        const takesName = verb === "deliveries";
+        throw CliError.usage(`lua drains ${verb} needs a drain id${takesName ? " or name" : ""}.`, listHint("Run", [
           "lua drains list"
         ]));
       }
+      if (verb === "replay" && !batchId) {
+        throw CliError.usage("lua drains replay needs a drain id and a batch id.", listHint("Find one", [
+          `lua drains deliveries ${drainId ?? "<drain id>"} --kind batch`
+        ]));
+      }
       const context = await resolveDrainsContext(options);
       switch (verb) {
         case "list":
@@ -50051,12 +51385,18 @@ async function drainsCommand(action, drainId, cmdObj) {
         case "verify":
           await verifyDrainCore(context, drainId, options);
           break;
+        case "confirm":
+          await confirmChallengeCore(context, drainId, options);
+          break;
         case "pause":
           await pauseDrainCore(context, drainId, options);
           break;
         case "resume":
           await resumeDrainCore(context, drainId, options);
           break;
+        case "replay":
+          await replayDrainCore(context, drainId, batchId, options);
+          break;
         case "rotate-secret":
           await rotateSecretCore(context, drainId, options);
           break;
@@ -50078,6 +51418,207 @@ async function drainsCommand(action, drainId, cmdObj) {
 }
 __name(drainsCommand, "drainsCommand");
 
+// src/commands/logs.export.ts
+var LOG_EXPORT_POLL = {
+  /** First delay; doubles to `maxIntervalMs`. */
+  intervalMs: 2e3,
+  maxIntervalMs: 15e3,
+  /** Polls before the command gives up and prints how to resume. */
+  maxAttempts: 240,
+  sleep: /* @__PURE__ */ __name((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)), "sleep")
+};
+var LOG_EXPORT_DOWNLOAD = {
+  fetchBytes: /* @__PURE__ */ __name(async (url) => {
+    const res = await luaFetch(url);
+    if (!res.ok) throw new Error(`download failed: HTTP ${res.status}`);
+    return Buffer.from(await res.arrayBuffer());
+  }, "fetchBytes")
+};
+var ALREADY_RUNNING = "EXPORT_ALREADY_RUNNING";
+var MISSING_EXPORT_SCOPE_MESSAGE = "Missing scope: logs:read. Create a key with that scope (lua auth key) or ask an org admin.";
+var TERMINAL2 = /* @__PURE__ */ new Set([
+  "succeeded",
+  "failed",
+  "expired"
+]);
+async function logsExportCommand(cmdObj) {
+  return withErrorHandling(
+    async () => {
+      const options = cmdObj ?? {};
+      const since = options.since ? parseWindowBound("--since", String(options.since)) : void 0;
+      const until = options.until ? parseWindowBound("--until", String(options.until)) : void 0;
+      if (!since) {
+        throw CliError.usage("logs export: --since <when> is required", "An ISO 8601 instant, or a relative form such as 24h or 7d");
+      }
+      const sources = parseTypeFlag(options.type);
+      const outDir = options.out ? resolveOutDir(String(options.out)) : void 0;
+      const context = await resolveDrainsContext(options);
+      const api = new LogExportApi(BASE_URLS.API, context.apiKey, context.orgId);
+      const say = /* @__PURE__ */ __name((line) => {
+        if (!options.json) writeProgress(line);
+      }, "say");
+      const jobId = await startOrAttach(api, {
+        from: since,
+        to: until ?? (/* @__PURE__ */ new Date()).toISOString(),
+        sources
+      }, say);
+      if (options.noWait || options.wait === false) {
+        emit2(options, {
+          jobId,
+          state: "queued",
+          files: []
+        });
+        trackEvent("cli_logs_export", {
+          waited: false,
+          json_output: !!options.json,
+          downloaded: 0
+        });
+        return;
+      }
+      const job = await pollToTerminal(api, jobId, say);
+      if (job.state === "failed") {
+        throw CliError.fromStatus(500, `The export failed: ${job.error ?? "no reason recorded"}`);
+      }
+      if (job.state === "expired") {
+        throw CliError.fromStatus(410, "The export expired before it could be downloaded.");
+      }
+      const written = outDir ? await downloadParts(job, outDir, say) : [];
+      emit2(options, {
+        jobId,
+        state: job.state,
+        files: job.files,
+        written,
+        truncated: job.truncated
+      });
+      if (!options.json) {
+        writeInfo(`Export ${jobId}: ${job.counts.rows} record(s) in ${job.files.length} file(s)` + (job.truncated ? " (TRUNCATED \u2014 the row cap was reached; narrow the window)" : ""));
+        if (!outDir && job.files.length) {
+          writeHintBlock({
+            headline: `${job.files.length} part(s) are ready for 24 h`,
+            lines: [
+              {
+                label: "Download them",
+                command: `lua logs export --since ${options.since} --out ./export`
+              },
+              {
+                label: "Read the signed URLs",
+                command: `lua logs export --since ${options.since} --json`
+              }
+            ]
+          });
+        }
+      }
+      trackEvent("cli_logs_export", {
+        waited: true,
+        json_output: !!options.json,
+        downloaded: written.length,
+        truncated: !!job.truncated
+      });
+    },
+    "logs export",
+    // LUA-803: a refusal that escapes under `--json` is the typed envelope on stdout.
+    {
+      json: /* @__PURE__ */ __name(() => !!cmdObj?.json, "json")
+    }
+  );
+}
+__name(logsExportCommand, "logsExportCommand");
+function parseTypeFlag(raw) {
+  const value3 = typeof raw === "string" ? raw.trim() : "";
+  if (!value3 || value3 === "all") return void 0;
+  return value3.split(",").map((one) => one.trim()).filter(Boolean).map((one) => validateOrSuggest("logs.type", one));
+}
+__name(parseTypeFlag, "parseTypeFlag");
+function resolveOutDir(raw) {
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(raw)) {
+    throw CliError.usage(`logs export: --out must be a local directory, not ${raw}`);
+  }
+  const dir = resolvePath2(raw);
+  if (!existsSync9(dir)) mkdirSync8(dir, {
+    recursive: true
+  });
+  return dir;
+}
+__name(resolveOutDir, "resolveOutDir");
+async function startOrAttach(api, input, say) {
+  const body = {
+    from: input.from,
+    to: input.to,
+    ...input.sources ? {
+      sources: input.sources
+    } : {}
+  };
+  const started = await callExport(() => api.startExport(body));
+  if (started.success && started.data?.jobId) {
+    say(`Export ${started.data.jobId} queued`);
+    return started.data.jobId;
+  }
+  if (started.error?.code === ALREADY_RUNNING) {
+    const running = /\b(lex_[0-9a-f]{24})\b/.exec(started.error.message ?? "")?.[1];
+    if (running) {
+      say(`This organization already has export ${running} running \u2014 following it`);
+      return running;
+    }
+  }
+  throw refusal(started);
+}
+__name(startOrAttach, "startOrAttach");
+async function pollToTerminal(api, jobId, say) {
+  let delay = LOG_EXPORT_POLL.intervalMs;
+  let last;
+  for (let attempt = 0; attempt < LOG_EXPORT_POLL.maxAttempts; attempt++) {
+    if (attempt > 0) {
+      await LOG_EXPORT_POLL.sleep(delay);
+      delay = Math.min(LOG_EXPORT_POLL.maxIntervalMs, delay * 2);
+    }
+    const res = await callExport(() => api.getExport(jobId));
+    if (!res.success || !res.data) throw refusal(res);
+    last = res.data;
+    if (TERMINAL2.has(last.state)) return last;
+    say(`Export ${jobId}: ${last.state} \u2014 ${last.counts.rows} record(s) so far`);
+  }
+  throw CliError.fromStatus(504, `The export ${jobId} is still running after ${LOG_EXPORT_POLL.maxAttempts} polls.`, `Check it later with: lua logs export --since ${last?.window.from ?? "24h"} --no-wait`);
+}
+__name(pollToTerminal, "pollToTerminal");
+async function downloadParts(job, outDir, say) {
+  const written = [];
+  for (const file of job.files) {
+    if (!file.url) {
+      throw CliError.fromStatus(410, `Part ${file.seq} of ${job.id} no longer has a download URL (it expires 24 h after the export finishes).`);
+    }
+    const target = join9(outDir, basename(String(file.name)));
+    say(`Downloading ${basename(target)} (${file.rows} record(s))`);
+    const bytes = await LOG_EXPORT_DOWNLOAD.fetchBytes(file.url);
+    writeFileSync10(target, bytes);
+    written.push(target);
+  }
+  return written;
+}
+__name(downloadParts, "downloadParts");
+async function callExport(call) {
+  try {
+    return await call();
+  } catch (error) {
+    if (CliError.isCliError(error) && error.statusCode === 403) {
+      throw CliError.forbidden(MISSING_EXPORT_SCOPE_MESSAGE);
+    }
+    throw error;
+  }
+}
+__name(callExport, "callExport");
+function emit2(options, payload) {
+  if (options.json) console.log(JSON.stringify(payload, null, 2));
+}
+__name(emit2, "emit");
+function refusal(response) {
+  const error = response.error;
+  if (error?.statusCode === 403) return CliError.forbidden(MISSING_EXPORT_SCOPE_MESSAGE);
+  const message = error?.message || "The log export API refused the request.";
+  const line = error?.code ? `${error.code}: ${message}` : message;
+  return CliError.fromStatus(error?.statusCode, line, void 0, apiErrorDetail(error));
+}
+__name(refusal, "refusal");
+
 // src/commands/completion.ts
 init_cli();
 init_analytics();
@@ -50985,8 +52526,8 @@ init_credential_operational_context();
 init_files();
 init_artifact_loader();
 import chalk3 from "chalk";
-import { existsSync as existsSync9, readFileSync as readFileSync13 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
+import { join as join10 } from "path";
 import { performance } from "perf_hooks";
 import * as os from "os";
 init_semver();
@@ -51176,7 +52717,7 @@ function gatherProject(config) {
     };
   }
   const rootDir = process.cwd();
-  const configPath = join9(rootDir, COMPILE_FILES.LUA_SKILL_YAML);
+  const configPath = join10(rootDir, COMPILE_FILES.LUA_SKILL_YAML);
   const agentId = config.agent?.agentId != null ? String(config.agent.agentId) : null;
   let agentName = null;
   let manifestFound = false;
@@ -51358,7 +52899,7 @@ function gatherTelemetry() {
     ].includes(envVal.toLowerCase());
   } else {
     try {
-      if (existsSync9(TELEMETRY_FILE)) {
+      if (existsSync10(TELEMETRY_FILE)) {
         const raw = readFileSync13(TELEMETRY_FILE, "utf8");
         const cfg = JSON.parse(raw);
         if (typeof cfg.enabled === "boolean") enabled = cfg.enabled;
@@ -54404,7 +55945,7 @@ var TERMINAL_CANCELLED = /* @__PURE__ */ new Set([
   "cancelled",
   "abandoned"
 ]);
-var TERMINAL2 = /* @__PURE__ */ new Set([
+var TERMINAL3 = /* @__PURE__ */ new Set([
   ...TERMINAL_FAILED,
   ...TERMINAL_CANCELLED,
   "completed"
@@ -55648,14 +57189,14 @@ function frameSeq(frame, ev) {
   return typeof ev.seq === "number" ? ev.seq : void 0;
 }
 __name(frameSeq, "frameSeq");
-async function watchBoundary(ctx, runId, state3, seq, line, code, emit2) {
+async function watchBoundary(ctx, runId, state3, seq, line, code, emit3) {
   if (state3.truth === void 0 || state3.truth !== null && state3.truth.watermark === void 0) {
     state3.truth = await readWatchTruth(ctx, runId);
   }
   const truth = state3.truth;
-  if (truth === null) return emit2(line, code);
-  if (truth.watermark === void 0 || seq === void 0) return truth.parked ? emit2(line, code) : void 0;
-  if (seq > truth.watermark) return emit2(line, code);
+  if (truth === null) return emit3(line, code);
+  if (truth.watermark === void 0 || seq === void 0) return truth.parked ? emit3(line, code) : void 0;
+  if (seq > truth.watermark) return emit3(line, code);
   if (!truth.parked) return void 0;
   state3.pending = {
     line,
@@ -55788,7 +57329,7 @@ async function cancelCore(ctx, runId, o) {
   emitJson(ctx, res);
   if (!ctx.json) {
     const v = res.data;
-    const alreadyTerminal = v.transitioned !== true && (v.state === "terminal" || v.state === "abandoned" || TERMINAL2.has(v.status));
+    const alreadyTerminal = v.transitioned !== true && (v.state === "terminal" || v.state === "abandoned" || TERMINAL3.has(v.status));
     if (alreadyTerminal) {
       writeInfo(`\u2139\uFE0F  run ${runId} was already ${v.status} \u2014 nothing to cancel`);
       return WORKFLOW_EXIT.OK;
@@ -56725,7 +58266,7 @@ async function exportCore(ctx, name, o) {
     } : {},
     message: w.message
   }));
-  const refusal = issues.length === 0 ? void 0 : checkIssues.length === 0 ? new CliError("export_not_expressible", `"${wf.name}" v${d.version} has ${inexpressible.length} node${inexpressible.length === 1 ? "" : "s"} the export codegen has no SDK spelling for \u2014 the file compiles WITHOUT ${inexpressible.length === 1 ? "it" : "them"} and cannot round-trip`, {
+  const refusal2 = issues.length === 0 ? void 0 : checkIssues.length === 0 ? new CliError("export_not_expressible", `"${wf.name}" v${d.version} has ${inexpressible.length} node${inexpressible.length === 1 ? "" : "s"} the export codegen has no SDK spelling for \u2014 the file compiles WITHOUT ${inexpressible.length === 1 ? "it" : "them"} and cannot round-trip`, {
     issues,
     hint: "The file is written for review \u2014 add the node by hand, or keep the version dynamic (the chat composer edits it in place)."
   }) : new CliError("export_not_compilable", `"${wf.name}" v${d.version} exported to a file \`lua compile\` refuses \u2014 ${checkIssues.length} error${checkIssues.length === 1 ? "" : "s"} (the export codegen could not produce a file the SDK builder accepts)`, {
@@ -56737,12 +58278,12 @@ async function exportCore(ctx, name, o) {
       ...d,
       warnings
     };
-    if (refusal) {
+    if (refusal2) {
       console.log(JSON.stringify({
-        ...cliErrorEnvelope(refusal),
+        ...cliErrorEnvelope(refusal2),
         data
       }, null, 2));
-      return refusal.exitCode;
+      return refusal2.exitCode;
     }
     console.log(JSON.stringify({
       ...res,
@@ -56764,14 +58305,14 @@ async function exportCore(ctx, name, o) {
     console.log(`   ${f.path}`);
   }
   const written = `exported "${wf.name}" v${d.version} (${d.form} form) \u2014 ${d.files.length} file(s) under ${outDir}`;
-  if (refusal) {
+  if (refusal2) {
     console.error(`\u274C ${written}, but ${check && !check.ok ? "the file does not compile as written" : "the file cannot round-trip"}`);
   } else {
     const verdict = check ? ` \xB7 compiles as written${check.workflows[0]?.graphHash ? ` (${check.workflows[0].graphHash})` : ""}` : ` \xB7 dry compile skipped \u2014 the file compiles once the TODO tool import${todoTools.length === 1 ? "" : "s"} ${todoTools.length === 1 ? "is" : "are"} resolved`;
     writeSuccess(`\u2705 ${written}${verdict}`);
   }
   for (const w of warnings) console.warn(`\u26A0\uFE0F  ${w.code}${w.path ? ` at ${w.path}` : ""}: ${w.message}`);
-  if (refusal) throw refusal;
+  if (refusal2) throw refusal2;
   if (warnings.length) writeInfo("\u{1F4A1} Review the TODOs the warnings name; `lua push workflow` then mints a static version from the file.");
   return WORKFLOW_EXIT.OK;
 }
@@ -56789,7 +58330,7 @@ function parseSinceFlag(raw, now = Date.now()) {
 __name(parseSinceFlag, "parseSinceFlag");
 var ARCHIVE_EXPORT_TTL_DAYS = 7;
 var ARCHIVE_TERMINAL_STATUS_FILTER = [
-  ...TERMINAL2
+  ...TERMINAL3
 ].join(",");
 var ARCHIVE_DEFAULT_RETENTION_DAYS = 90;
 var archiveDownload = {
@@ -57204,7 +58745,7 @@ async function jobLogsCore(ctx, runId, stepId, o) {
     }
     for (const line of v.logs.slice(printed)) console.log(`   ${line}`);
     printed = Math.max(printed, v.logs.length);
-    const terminal = TERMINAL2.has(v.status) || /^(completed|failed|cancelled|skipped|reaped|deleted)$/.test(v.status);
+    const terminal = TERMINAL3.has(v.status) || /^(completed|failed|cancelled|skipped|reaped|deleted)$/.test(v.status);
     if (!o.follow || terminal || v.attemptFinished || v.phase === "deleted") {
       if (o.follow && !ctx.json) writeInfo(`   \u2014 ${v.status} (${v.phase})`);
       return WORKFLOW_EXIT.OK;
@@ -67000,8 +68541,8 @@ __name(telemetryCommand, "telemetryCommand");
 init_cli();
 init_command_utils();
 init_analytics();
-import { writeFileSync as writeFileSync10, existsSync as existsSync10, unlinkSync as unlinkSync3 } from "fs";
-import { resolve as resolve5, join as join10 } from "path";
+import { writeFileSync as writeFileSync11, existsSync as existsSync11, unlinkSync as unlinkSync3 } from "fs";
+import { resolve as resolve5, join as join11 } from "path";
 init_artifact_loader();
 init_types();
 function getProjectToolNames() {
@@ -67024,9 +68565,9 @@ async function governanceCommand(action) {
       return;
     }
     const srcDir = resolve5(process.cwd(), "src");
-    const targetDir = existsSync10(srcDir) ? srcDir : process.cwd();
-    const filePath = join10(targetDir, "governance.ts");
-    if (existsSync10(filePath)) {
+    const targetDir = existsSync11(srcDir) ? srcDir : process.cwd();
+    const filePath = join11(targetDir, "governance.ts");
+    if (existsSync11(filePath)) {
       const { overwrite } = await safePrompt([
         {
           type: "confirm",
@@ -67117,7 +68658,7 @@ async function governanceCommand(action) {
       }
     }
     const content = generateGovernanceFile(setup);
-    writeFileSync10(filePath, content, "utf-8");
+    writeFileSync11(filePath, content, "utf-8");
     const relativePath = filePath.replace(process.cwd() + "/", "");
     writeSuccess(`Created ${relativePath}`);
     console.log("");
@@ -67155,9 +68696,9 @@ async function governanceCommand(action) {
 __name(governanceCommand, "governanceCommand");
 async function governanceRemove() {
   const srcDir = resolve5(process.cwd(), "src");
-  const targetDir = existsSync10(srcDir) ? srcDir : process.cwd();
-  const filePath = join10(targetDir, "governance.ts");
-  const hasLocal = existsSync10(filePath);
+  const targetDir = existsSync11(srcDir) ? srcDir : process.cwd();
+  const filePath = join11(targetDir, "governance.ts");
+  const hasLocal = existsSync11(filePath);
   const { confirm } = await safePrompt([
     {
       type: "confirm",
@@ -67508,8 +69049,8 @@ init_command_utils();
 init_artifact_loader();
 init_types();
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync11, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
-import { join as join11, relative as relative2, resolve as resolve6 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
+import { join as join12, relative as relative2, resolve as resolve6 } from "path";
 init_voice_api_service();
 init_constants();
 
@@ -68097,8 +69638,8 @@ function escapeRegex(s) {
 }
 __name(escapeRegex, "escapeRegex");
 function detectRunner(cwd) {
-  const pkgPath = join11(cwd, "package.json");
-  if (!existsSync11(pkgPath)) return null;
+  const pkgPath = join12(cwd, "package.json");
+  if (!existsSync12(pkgPath)) return null;
   try {
     const pkg2 = JSON.parse(__require("fs").readFileSync(pkgPath, "utf8"));
     const deps = {
@@ -68470,7 +70011,7 @@ function findVoiceTestFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const full = join11(dir, entry);
+      const full = join12(dir, entry);
       let s;
       try {
         s = statSync6(full);
@@ -69512,6 +71053,22 @@ function collect(value3, previous) {
   ];
 }
 __name(collect, "collect");
+function withGroupOptions(options, command) {
+  const parent = command.parent;
+  if (!parent) return options;
+  const merged = {
+    ...options
+  };
+  for (const option of command.options) {
+    const key = option.attributeName();
+    if (merged[key] !== void 0) continue;
+    if (!parent.options.some((parentOption) => parentOption.attributeName() === key)) continue;
+    if (parent.getOptionValueSource(key) !== "cli") continue;
+    merged[key] = parent.getOptionValue(key);
+  }
+  return merged;
+}
+__name(withGroupOptions, "withGroupOptions");
 function setupAuthCommands(program2) {
   const authCommand = program2.command("auth").description("\u{1F510} Authentication management").addHelpText("after", `
 Examples:
@@ -69828,11 +71385,12 @@ Examples:
   $ lua channels              Interactive management
   $ lua channels list         List all channels
 `).action(channelsCommand);
-  program2.command("logs").description("\u{1F4CA} View agent and skill logs").option("--type <type>", "Filter by type: all, calls, or any of the 18 log sources (skill, job, webhook, trigger, preprocessor, postprocessor, user_message, agent_response, agent_error, runtime, mcp, rag, device, device-trigger, model-resolver, workflow-step, workflow-script, workflow)").option("--name <name>", "Entity name to filter (requires --type)").option("--user-id <userId>", "Filter logs by user ID").option("--agent-id <agentId>", "View logs for a specific agent ID (admin access required)").option("--limit <n>", "Number of logs to show (default: 20)").option("--page <n>", "Page number for pagination").option("--json", "Output as JSON (for scripting)").option("--direction <direction>", "Filter calls by direction (inbound | outbound) \u2014 only with --type calls").option("--status <status>", "Filter calls by status \u2014 only with --type calls").option("--since <when>", "Only logs at or after this time: an ISO 8601 instant, or 15m | 2h | 7d").option("--until <when>", "Only logs at or before this time; same formats (ends a --follow)").option("--environment <env>", "production | sandbox (a row with no environment reads as production)").option("--follow", "Stream new logs as they arrive (Ctrl-C to stop); not valid with --page").addHelpText("after", `
+  const logsGroup = program2.command("logs").description("\u{1F4CA} View agent and skill logs").option("--type <type>", "Filter by type: all, calls, or any of the 18 log sources (skill, job, webhook, trigger, preprocessor, postprocessor, user_message, agent_response, agent_error, runtime, mcp, rag, device, device-trigger, model-resolver, workflow-step, workflow-script, workflow)").option("--name <name>", "Entity name to filter (requires --type)").option("--user-id <userId>", "Filter logs by user ID").option("--channel <channel>", "Filter logs by messaging channel (e.g. whatsapp, slack, integration:<type>)").option("--agent-id <agentId>", "View logs for a specific agent ID (admin access required)").option("--limit <n>", "Number of logs to show (default: 20)").option("--page <n>", "Page number for pagination").option("--json", "Output as JSON (for scripting)").option("--direction <direction>", "Filter calls by direction (inbound | outbound) \u2014 only with --type calls").option("--status <status>", "Filter calls by status \u2014 only with --type calls").option("--since <when>", "Only logs at or after this time: an ISO 8601 instant, or 15m | 2h | 7d").option("--until <when>", "Only logs at or before this time; same formats (ends a --follow)").option("--environment <env>", "production | sandbox (a row with no environment reads as production)").option("--follow", "Stream new logs as they arrive (Ctrl-C to stop); not valid with --page").addHelpText("after", `
 Options:
   --type <type>          Filter by type: all, calls, or any of the 18 log sources (skill, job, webhook, trigger, preprocessor, postprocessor, user_message, agent_response, agent_error, runtime, mcp, rag, device, device-trigger, model-resolver, workflow-step, workflow-script, workflow)
   --name <name>          Entity name to filter (requires --type, not for message types)
   --user-id <userId>     Filter logs by user ID
+  --channel <channel>    Filter logs by messaging channel (e.g. whatsapp, slack, integration:<type>)
   --agent-id <agentId>   View logs for a specific agent ID (admin access required, overrides the agent in lua.config.yaml)
   --limit <n>            Number of logs to show (default: 20)
   --page <n>             Page number for pagination
@@ -69853,6 +71411,7 @@ Examples:
   $ lua logs --type mcp                           View MCP tool execution logs
   $ lua logs --user-id user-123                   View all logs for a user
   $ lua logs --user-id user-123 --json > user-logs.json  Export user logs
+  $ lua logs --channel integration:lua_crm        Isolate one integration's wake-up turns
   $ lua logs --agent-id agent-abc123              Logs for a different agent you admin
   $ lua logs --type calls                         Recent voice calls (renders as table)
   $ lua logs --type calls --direction outbound    Outbound calls only
@@ -69868,6 +71427,28 @@ Notes:
   shift the window. --type calls reads voice calls and ignores --since/--until/--environment
   /--follow. --since is INCLUSIVE; the boundary row is de-duplicated by id while following.
 `).action(logsCommand);
+  logsGroup.command("export").description("\u{1F4E6} Export this organization's logs as gzip NDJSON (asynchronous job)").option("--since <when>", "Inclusive lower bound (REQUIRED): an ISO 8601 instant, or 24h | 7d").option("--until <when>", "Inclusive upper bound; same formats (default: now)").option("--type <type>", "Comma-separated log sources, or all (default: all)").option("--out <dir>", "Download the parts into this directory (created if missing)").option("--org <id>", "The organization to export (default: the project, or the key when it reaches one org)").option("--no-wait", "Start the export and print the job id without polling it").option("--json", "Output as JSON").addHelpText("after", `
+Options:
+  --since <when>         REQUIRED. Inclusive lower bound: an ISO 8601 instant, or 24h | 7d
+  --until <when>         Inclusive upper bound, same formats (default: now)
+  --type <type>          Comma-separated log sources, or all (default: all)
+  --out <dir>            Download every part into this local directory
+  --org <id>             The organization, when the key reaches more than one
+  --no-wait              Start it and print the job id; poll later
+  --json                 Output as JSON for scripting
+
+Examples:
+  $ lua logs export --since 7d --out ./export        A week, downloaded
+  $ lua logs export --since 30d --type skill,job     A month, two sources
+  $ lua logs export --since 24h --no-wait --json     Start it and return
+
+Notes:
+  The window is at most 31 days and the job at most 10 000 000 records; narrow the window
+  or the sources rather than raising either. One export runs per organization at a time \u2014
+  a second invocation FOLLOWS the running one instead of refusing. Download links expire
+  24 h after the export finishes and the files are removed after 7 days. Message bodies
+  are excluded unless the export was started with the logs:manage scope.
+`).action((options, command) => logsExportCommand(withGroupOptions(options ?? {}, command)));
   program2.command("skills [actionOrEnv] [action]").description("\u2699\uFE0F  Manage and view skills").option("--skill-name <name>", "Skill name").option("--skill-version <version>", "Version for deploy action (or 'latest')").addHelpText("after", `
 Arguments:
   actionOrEnv              Optional: environment ('sandbox', 'production') or action ('view', 'versions', 'deploy', 'delete')
@@ -69909,18 +71490,25 @@ Examples:
   $ lua webhooks subscribe --webhook-name myWebhook --event message.delivered    Subscribe to event
   $ lua webhooks unsubscribe --webhook-name myWebhook --event message.delivered  Unsubscribe from event
 `).action(webhooksCommand);
-  program2.command("drains [action] [id]").description("\u{1F6B0} Manage log drains (stream this organization's logs to your own destination)").option("--json", "Output as JSON").option("--yes", "Skip confirmation prompts (required with --include-content in CI)").option("--org <id>", "The organization to act on (default: the project, or the key when it reaches one org)").option("--name <name>", "Drain name (1-64 chars, unique per org)").option("--type <type>", "http | otlp | datadog | betterstack").option("--endpoint <url>", "Destination URL (http and otlp only; https, public host)").option("--site <site>", "Preset site/region, e.g. datadoghq.eu").option("--format <format>", "json | ndjson").option("--header <name>", "Custom header NAME (the value is prompted)", collect, []).option("--header-from-env <name=ENV_VAR>", "Custom header, value read from an env var (CI form)", collect, []).option("--sources <list>", "Comma-separated source selectors (default: the recommended set)").option("--min-severity <level>", "debug | info | warn | error (default info)").option("--agents <list>", "'all' or a comma-separated list of agent ids").option("--environments <list>", "production,sandbox (default production)").option("--sampling <spec>", "Head sampling, e.g. debug=0.1").option("--include-content", "Include user messages and agent responses (prints an acknowledgement)").option("--no-include-content", "update: stop sending message bodies (the drain keeps its sources)").option("--limit <n>", "deliveries: rows to return (max 100)").option("--kind <kind>", "deliveries: batch | test | verify | heartbeat | dropped | truncated").option("--reason <text>", "pause: why").option("--finalize", "rotate-secret: close an open rotation window early").addHelpText("after", `
+  program2.command("drains [action] [id] [batchId]").description("\u{1F6B0} Manage log drains (stream this organization's logs to your own destination)").option("--json", "Output as JSON").option("--yes", "Skip confirmation prompts (required with --include-content in CI)").option("--org <id>", "The organization to act on (default: the project, or the key when it reaches one org)").option("--name <name>", "Drain name (1-64 chars, unique per org)").option("--type <type>", "http | otlp | datadog | betterstack | splunk | loki | axiom | newrelic | sumologic | s3").option("--endpoint <url>", "Destination URL (http/otlp), or the S3-compatible endpoint for --type s3 on R2/GCS").option("--site <site>", "Preset site/region, e.g. datadoghq.eu").option("--provider <name>", "s3: aws | r2 | gcs (default aws)").option("--bucket <name>", "s3: the bucket name").option("--region <code>", "s3: the bucket's region (use 'auto' for R2)").option("--prefix <key>", "s3: key prefix under which objects are written").option("--credentials-from-env <KEY_ID_VAR=SECRET_VAR>", "s3: read the access key pair from two environment variables").option("--role-arn <arn>", "s3 (aws): assume this role instead of holding a key pair").option("--external-id <id>", "s3 (aws): the sts:ExternalId the role trust policy requires").option("--token <token>", "confirm: the token from the _lua-verify-<token> object in your bucket").option("--format <format>", "json | ndjson").option("--header <name>", "Custom header NAME (the value is prompted)", collect, []).option("--header-from-env <name=ENV_VAR>", "Custom header, value read from an env var (CI form)", collect, []).option("--sources <list>", "Comma-separated source selectors (default: the recommended set)").option("--min-severity <level>", "debug | info | warn | error (default info)").option("--agents <list>", "'all' or a comma-separated list of agent ids").option("--environments <list>", "production,sandbox (default production)").option("--sampling <spec>", "Head sampling, e.g. debug=0.1").option("--include-content", "Include user messages and agent responses (prints an acknowledgement)").option("--no-include-content", "update: stop sending message bodies (the drain keeps its sources)").option("--limit <n>", "deliveries: rows to return (max 100)").option("--kind <kind>", "deliveries: batch | test | verify | heartbeat | dropped | truncated").option("--reason <text>", "pause: why").option("--finalize", "rotate-secret: close an open rotation window early").addHelpText("after", `
 Arguments:
   action                   Optional: list (default), status, deliveries, create, update, delete,
-                           test, verify, pause, resume, rotate-secret
-  id                       The drain id, for every action but list, status and create
+                           test, verify, confirm, pause, resume, replay, rotate-secret
+  id                       The drain id, for every action but list and create. The READ verbs
+                           (status, deliveries) also accept a drain's exact name (PRO-2124);
+                           the mutating verbs, replay included, stay id-only
+  batchId                  replay only: the batch id from a delivery row
 
 Examples:
   $ lua drains                                                     List this org's drains
   $ lua drains status --json                                       Health + quota (exit 2 if any is failing)
+  $ lua drains deliveries prod-siem                                By name \u2014 read verbs resolve it to an id
   $ lua drains create --name prod-siem --type http --endpoint https://logs.example.com/lua
+  $ lua drains create --name archive --type s3 --bucket acme-logs --region eu-west-1       --prefix lua/logs --credentials-from-env AWS_KEY_ID=AWS_SECRET   Object storage (S3/R2/GCS)
   $ lua drains verify drn_...                                      Prove you own the endpoint
+  $ lua drains confirm drn_... --token <token>                     Settle a bucket ownership challenge
   $ lua drains deliveries drn_... --limit 20 --kind batch          Recent delivery attempts
+  $ lua drains replay drn_... 01J...                               Re-enqueue that batch's records
   $ lua drains rotate-secret drn_...                               New signing secret (shown once)
   $ lua drains rotate-secret drn_... --finalize                    Close the rotation window
   $ lua drains pause drn_... --reason "noisy vendor"               Stop delivering (buffering continues)
@@ -69929,7 +71517,16 @@ Examples:
 Notes:
   Secrets are never flags. --header takes a NAME and prompts for the value; in --ci mode use
   --header-from-env DD_API_KEY=DATADOG_KEY. The HMAC signing secret is minted by the server and
-  printed exactly once, at create and at rotate-secret.
+  printed exactly once, at create and at rotate-secret. An object-storage drain's secret access
+  key is the same: --credentials-from-env KEY_ID_VAR=SECRET_VAR, never a value on the command line.
+
+  A terminal refusal (a 4xx that is not 408/429) drops the whole batch. 'lua drains replay <id>
+  <batchId>' puts its records back in the queue, for as long as they are inside the six-hour
+  delivery horizon \u2014 after that they are gone and the command says so.
+
+  A bucket drain proves ownership by writing _lua-verify-<token> under its prefix. If the role can
+  read it back, 'lua drains verify' finishes on its own; if it is write-only \u2014 the grant we
+  recommend \u2014 list your prefix, find the object, and run 'lua drains confirm <id> --token <token>'.
 `).action(drainsCommand);
   program2.command("devices [action]").description("\u{1F4E1} Manage connected devices").option("--device-name <name>", "Device name").option("--group <group>", "Filter by device group").option("--payload <json>", "JSON payload for test/test-trigger", "{}").option("--timeout <ms>", "Timeout in milliseconds", "30000").option("--force", "Skip confirmation prompts").addHelpText("after", `
 Arguments: