@belvador/mcp 0.1.0 → 0.3.0

package/dist/cli.js

@@ -104,6 +104,7 @@ var API_ERROR_STATUS = {
   APPROVAL_EXPIRED: 410,
   APPROVAL_REJECTED: 403,
   APPROVAL_PARAMS_MISMATCH: 409,
+  APPROVAL_OUTCOME_UNKNOWN: 409,
   IDEMPOTENCY_KEY_REUSED: 422,
   IDEMPOTENCY_IN_PROGRESS: 409,
   PRECONDITION_REQUIRED: 428,
@@ -177,7 +178,7 @@ function cleanUntrustedText(raw, maxBytes = MCP_LIMITS.untrustedStringMaxBytes)
   const { text, cut } = cutUtf8(escaped, maxBytes);
   return { text, cut, suspicious };
 }
-var MCP_TOOLS_VERSION = 1;
+var MCP_TOOLS_VERSION = 3;
 var MCP_TOOLS = [
   { name: "get_workspace", toolset: "investigate", scope: "org:read", readOnly: true, destructive: false, idempotent: true },
   { name: "list_projects", toolset: "investigate", scope: "projects:read", readOnly: true, destructive: false, idempotent: true },
@@ -209,14 +210,7 @@ var MCP_TOOLS = [
 var MCP_TOOLS_PENDING = {
   query_metrics: "P14",
   release_health: "P15",
-  list_incidents: "P9",
-  get_incident: "P9",
-  get_coverage: "P10",
-  search_operations: "P7",
-  describe_operation: "P7",
-  plan_change: "P7",
-  apply_change: "P7",
-  get_operation: "P7"
+  get_coverage: "P10"
 };
 
 // ../src/shared/mcp/docs.ts
@@ -258,10 +252,10 @@ function docsFetcher(siteUrl, fetcher = fetch, now = () => Date.now()) {
 }
 
 // ../src/shared/mcp/server.ts
-import { McpServer } from "@modelcontextprotocol/server";
+import { CLIENT_CAPABILITIES_META_KEY, inputRequired, McpServer } from "@modelcontextprotocol/server";
 
 // ../src/shared/contracts/mcp-tools.ts
-import { z as z20 } from "zod";
+import { z as z24 } from "zod";
 
 // ../src/shared/contracts/api-ops/access.ts
 import { z as z3 } from "zod";
@@ -641,7 +635,16 @@ var UPTIME_TRIGGER = "uptime_problem";
 var SLO_TRIGGER = "slo_burn";
 var RULE_TRIGGERS = [...ALERT_TRIGGERS, INTEGRATION_TRIGGER, MONITOR_TRIGGER, UPTIME_TRIGGER, SLO_TRIGGER];
 var SOLO_TRIGGERS = [INTEGRATION_TRIGGER, MONITOR_TRIGGER, UPTIME_TRIGGER, SLO_TRIGGER];
-var MONITOR_RULE_KINDS = ["missed", "failed", "timeout", "unknown"];
+var MONITOR_RULE_KINDS = [
+  "missed",
+  "failed",
+  "timeout",
+  "unknown",
+  "count",
+  "assertion",
+  "deadline",
+  "stalled"
+];
 var SLO_RULE_SEVERITIES = ["page", "ticket"];
 function validRuleTriggers(triggers) {
   if (triggers.length === 1 && SOLO_TRIGGERS.includes(triggers[0]))
@@ -662,8 +665,9 @@ var ruleInputSchema = z4.object({
   isEnabled: z4.boolean(),
   notifyAll: z4.boolean(),
   destinationIds: z4.array(z4.guid()).max(20),
-  monitorKinds: z4.array(z4.enum(MONITOR_RULE_KINDS)).min(1).max(4).default([...MONITOR_RULE_KINDS]),
-  sloSeverities: z4.array(z4.enum(SLO_RULE_SEVERITIES)).min(1).max(2).default([...SLO_RULE_SEVERITIES])
+  monitorKinds: z4.array(z4.enum(MONITOR_RULE_KINDS)).min(1).max(MONITOR_RULE_KINDS.length).default([...MONITOR_RULE_KINDS]),
+  sloSeverities: z4.array(z4.enum(SLO_RULE_SEVERITIES)).min(1).max(2).default([...SLO_RULE_SEVERITIES]),
+  policyId: z4.guid().nullable().default(null)
 });
 
 // ../src/shared/contracts/api-ops/alerts.ts
@@ -680,7 +684,7 @@ var ALERT_INPUTS = {
   destinationOnly: z5.object({ destinationId: uuid }),
   createDestination: z5.object({
     workspaceId: uuid,
-    provider: z5.enum(["telegram", "slack", "email", "webhook"]),
+    provider: z5.enum(["telegram", "slack", "email", "webhook", "pagerduty", "incident_io"]),
     name,
     projectIds,
     locale
@@ -762,12 +766,14 @@ var ALERT_OPERATIONS = [
     idempotency: "required",
     status: 201,
     mcp: "configure",
-    summary: "Start adding a Telegram, Slack, email or webhook destination; a person enters its secrets.",
+    summary: "Start adding a Telegram, Slack, email, webhook, PagerDuty or incident.io destination; a person enters its secrets.",
     ui: [
       "alerts#createSlackDestination",
       "alerts#createWebhookDestination",
       "alerts#createTelegramDestination",
-      "alerts#createEmailDestination"
+      "alerts#createEmailDestination",
+      "alerts#createPagerDutyDestination",
+      "alerts#createIncidentIoDestination"
     ]
   }),
   op({
@@ -856,17 +862,78 @@ var ALERT_OPERATIONS = [
   })
 ];
 
-// ../src/shared/contracts/api-ops/monitors.ts
-import { z as z11 } from "zod";
+// ../src/shared/contracts/api-ops/incidents.ts
+import { z as z10 } from "zod";
 
-// ../src/shared/contracts/heartbeat.ts
+// ../src/shared/contracts/notifications.ts
+import { z as z9 } from "zod";
+
+// ../src/shared/contracts/maintenance.ts
+import { z as z6 } from "zod";
+var MAINTENANCE_SCOPES = ["workspace", "project", "monitor"];
+var MAINTENANCE_LIMITS = {
+  durationMinutesMin: 5,
+  durationMinutesMax: 1440,
+  reasonMax: 200,
+  idsMax: 50,
+  onceAheadDays: 366,
+  previewStarts: 3
+};
+var weekdaySchema = z6.number().int().min(1).max(7);
+var timeOfDay = z6.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/);
+var base = {
+  scope: z6.enum(MAINTENANCE_SCOPES),
+  projectIds: z6.array(z6.number().int().positive()).max(MAINTENANCE_LIMITS.idsMax),
+  monitorIds: z6.array(z6.guid()).max(MAINTENANCE_LIMITS.idsMax),
+  timezone: z6.string().trim().min(1).max(64),
+  durationMinutes: z6.number().int().min(MAINTENANCE_LIMITS.durationMinutesMin).max(MAINTENANCE_LIMITS.durationMinutesMax),
+  reason: z6.string().trim().max(MAINTENANCE_LIMITS.reasonMax).regex(/^[^\p{Cc}]*$/u)
+};
+var maintenanceInputSchema = z6.discriminatedUnion("kind", [
+  z6.object({ kind: z6.literal("once"), startsAt: z6.string().datetime({ offset: true }), ...base }),
+  z6.object({
+    kind: z6.literal("weekly"),
+    weekdays: z6.array(weekdaySchema).min(1).max(7),
+    startTime: timeOfDay,
+    ...base
+  })
+]).superRefine((w, ctx) => {
+  const bad = (path) => ctx.addIssue({ code: "custom", path: [path], message: "MAINTENANCE_INVALID" });
+  if (w.scope === "workspace" && (w.projectIds.length || w.monitorIds.length))
+    bad("scope");
+  if (w.scope === "project" && (!w.projectIds.length || w.monitorIds.length))
+    bad("projectIds");
+  if (w.scope === "monitor" && (!w.monitorIds.length || w.projectIds.length))
+    bad("monitorIds");
+  if (new Set(w.projectIds).size !== w.projectIds.length)
+    bad("projectIds");
+  if (new Set(w.monitorIds).size !== w.monitorIds.length)
+    bad("monitorIds");
+  if (w.kind === "weekly" && new Set(w.weekdays).size !== w.weekdays.length)
+    bad("weekdays");
+  if (!validTimeZone(w.timezone))
+    bad("timezone");
+});
+function validTimeZone(tz) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var fmtCache = new Map;
+
+// ../src/shared/contracts/signal-monitors.ts
 import { z as z8 } from "zod";
 
 // ../src/shared/contracts/monitors.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // ../src/shared/contracts/vocab/monitors.ts
 var MONITOR_MODES = ["check_in", "heartbeat"];
+var MONITOR_TYPES = ["job", "count", "assertion", "deadline", "progress"];
+var SIGNAL_MONITOR_TYPES = ["count", "assertion", "deadline", "progress"];
 
 // ../src/shared/contracts/monitors.ts
 var MONITOR_KINDS = ["crontab", "interval", "on_demand"];
@@ -876,8 +943,13 @@ var MONITOR_INCIDENT_CODES = [
   "MONITOR_MISSED",
   "MONITOR_FAILED",
   "MONITOR_TIMEOUT",
-  "MONITOR_UNKNOWN"
+  "MONITOR_UNKNOWN",
+  "MONITOR_COUNT",
+  "MONITOR_ASSERTION",
+  "MONITOR_DEADLINE_MISSED",
+  "MONITOR_STALLED"
 ];
+var FAILURE_INCIDENT_CODES = MONITOR_INCIDENT_CODES.filter((c) => c !== "MONITOR_UNKNOWN");
 var INCIDENT_EVENTS = ["opened", "updated", "resolved"];
 var UNOBSERVABLE_REASONS = [
   "node_offline",
@@ -928,100 +1000,112 @@ function crontabShapeOk(value) {
   const fields = value.trim().split(/\s+/);
   return value.length <= 120 && fields.length === 5 && fields.every((f) => /^[0-9A-Za-z*,/?#LW-]+$/.test(f));
 }
-var crontabScheduleSchema = z6.object({
-  type: z6.literal("crontab"),
-  value: z6.string().refine(crontabShapeOk, "crontab")
+var crontabScheduleSchema = z7.object({
+  type: z7.literal("crontab"),
+  value: z7.string().refine(crontabShapeOk, "crontab")
 });
-var intervalScheduleSchema = z6.object({
-  type: z6.literal("interval"),
-  value: z6.number().int().min(1).max(MONITOR_LIMITS.intervalValueMax),
-  unit: z6.enum(INTERVAL_UNITS)
+var intervalScheduleSchema = z7.object({
+  type: z7.literal("interval"),
+  value: z7.number().int().min(1).max(MONITOR_LIMITS.intervalValueMax),
+  unit: z7.enum(INTERVAL_UNITS)
 });
-var scheduleSchema = z6.discriminatedUnion("type", [
+var scheduleSchema = z7.discriminatedUnion("type", [
   crontabScheduleSchema,
   intervalScheduleSchema
 ]);
-var monitorSettingsSchema = z6.object({
+var monitorSettingsSchema = z7.object({
   schedule: scheduleSchema.nullable(),
-  timezone: z6.string().min(1).max(64),
-  checkin_margin: z6.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
-  max_runtime: z6.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
-  failure_issue_threshold: z6.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
-  recovery_threshold: z6.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax)
-});
-var iso = z6.string().datetime();
-var projectId2 = z6.number().int().positive();
-var envName = z6.string().min(1).max(MONITOR_LIMITS.environmentMax);
+  timezone: z7.string().min(1).max(64),
+  checkin_margin: z7.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
+  max_runtime: z7.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
+  failure_issue_threshold: z7.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  recovery_threshold: z7.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax)
+});
+var iso = z7.string().datetime();
+var projectId2 = z7.number().int().positive();
+var envName = z7.string().min(1).max(MONITOR_LIMITS.environmentMax);
 var monitorDefinitionSchema = monitorSettingsSchema.extend({
-  id: z6.guid(),
+  id: z7.guid(),
   project_id: projectId2,
-  slug: z6.string().regex(SLUG_RE),
-  kind: z6.enum(MONITOR_KINDS),
-  expected_environments: z6.array(envName).max(MONITOR_LIMITS.expectedEnvironmentsMax),
+  slug: z7.string().regex(SLUG_RE),
+  kind: z7.enum(MONITOR_KINDS),
+  expected_environments: z7.array(envName).max(MONITOR_LIMITS.expectedEnvironmentsMax),
   paused_until: iso.nullable(),
   created_at: iso,
-  config_source: z6.enum(CONFIG_SOURCES),
-  config_hash: z6.string().regex(/^[0-9a-f]{64}$/).nullable()
-});
-var outcomeCounts = z6.object({
-  ok: z6.number().int().nonnegative(),
-  skipped: z6.number().int().nonnegative(),
-  error: z6.number().int().nonnegative(),
-  timeout: z6.number().int().nonnegative(),
-  missed: z6.number().int().nonnegative(),
-  unknown: z6.number().int().nonnegative()
-});
-var monitorStatusSchema = z6.object({
-  monitor_id: z6.guid(),
+  config_source: z7.enum(CONFIG_SOURCES),
+  config_hash: z7.string().regex(/^[0-9a-f]{64}$/).nullable()
+});
+var outcomeCounts = z7.object({
+  ok: z7.number().int().nonnegative(),
+  skipped: z7.number().int().nonnegative(),
+  error: z7.number().int().nonnegative(),
+  timeout: z7.number().int().nonnegative(),
+  missed: z7.number().int().nonnegative(),
+  unknown: z7.number().int().nonnegative()
+});
+var signalStatusSchema = z7.object({
+  type: z7.enum(SIGNAL_MONITOR_TYPES),
+  value: z7.number().int().nonnegative().max(1e9).nullable(),
+  threshold: z7.number().int().nonnegative().max(1e9).nullable(),
+  window_end: iso.nullable(),
+  pending: z7.number().int().nonnegative().max(1e6).nullable(),
+  stalled: z7.number().int().nonnegative().max(1e6).nullable(),
+  refused_24h: z7.number().int().nonnegative().max(1e9).nullable()
+});
+var monitorStatusSchema = z7.object({
+  monitor_id: z7.guid(),
   project_id: projectId2,
   environment: envName,
-  open_failure: z6.enum(["MONITOR_MISSED", "MONITOR_FAILED", "MONITOR_TIMEOUT"]).nullable(),
-  open_unknown: z6.boolean(),
-  unobservable: z6.enum(UNOBSERVABLE_REASONS).nullable(),
-  last_outcome: z6.enum(RUN_OUTCOMES).nullable(),
+  open_failure: z7.enum(FAILURE_INCIDENT_CODES).nullable(),
+  open_unknown: z7.boolean(),
+  unobservable: z7.enum(UNOBSERVABLE_REASONS).nullable(),
+  last_outcome: z7.enum(RUN_OUTCOMES).nullable(),
   last_check_in_at: iso.nullable(),
   last_healthy_at: iso.nullable(),
   next_deadline_at: iso.nullable(),
   next_due_at: iso.nullable().optional(),
-  in_progress: z6.boolean(),
+  in_progress: z7.boolean(),
   counts_24h: outcomeCounts,
+  signal: signalStatusSchema.optional(),
   evaluated_at: iso
 });
-var monitorIncidentSchema = z6.object({
-  incident_id: z6.guid(),
-  monitor_id: z6.guid(),
+var monitorIncidentSchema = z7.object({
+  incident_id: z7.guid(),
+  monitor_id: z7.guid(),
   project_id: projectId2,
   environment: envName,
-  code: z6.enum(MONITOR_INCIDENT_CODES),
-  event: z6.enum(INCIDENT_EVENTS),
+  code: z7.enum(MONITOR_INCIDENT_CODES),
+  event: z7.enum(INCIDENT_EVENTS),
   occurred_at: iso,
-  detected_late: z6.boolean(),
-  reason: z6.string().regex(REASON_RE).nullable(),
-  duration_ms: z6.number().int().nonnegative().nullable(),
-  consecutive: z6.number().int().min(1).max(1e5),
-  reviewed_by: z6.guid().nullable()
+  detected_late: z7.boolean(),
+  reason: z7.string().regex(REASON_RE).nullable(),
+  duration_ms: z7.number().int().nonnegative().nullable(),
+  consecutive: z7.number().int().min(1).max(1e5),
+  reviewed_by: z7.guid().nullable(),
+  observed: z7.number().int().min(0).max(1e9).nullable().optional(),
+  threshold: z7.number().int().min(0).max(1e9).nullable().optional()
 });
-var monitorDiscoverySchema = z6.object({
+var monitorDiscoverySchema = z7.object({
   project_id: projectId2,
-  slug: z6.string().regex(SLUG_RE),
+  slug: z7.string().regex(SLUG_RE),
   settings: monitorSettingsSchema.nullable(),
-  config_hash: z6.string().regex(/^[0-9a-f]{64}$/).nullable(),
-  check_ins: z6.number().int().nonnegative(),
+  config_hash: z7.string().regex(/^[0-9a-f]{64}$/).nullable(),
+  check_ins: z7.number().int().nonnegative(),
   last_seen_at: iso
 });
 var MONITOR_NAME_MAX = MONITOR_LIMITS.nameMax;
-var environmentName = z6.string().trim().min(1).max(MONITOR_LIMITS.environmentMax).regex(/^[A-Za-z0-9._-]+$/);
-var monitorInputSchema = z6.object({
-  name: z6.string().trim().min(1).max(MONITOR_LIMITS.nameMax),
-  mode: z6.enum(MONITOR_MODES).default("check_in"),
-  kind: z6.enum(MONITOR_KINDS),
+var environmentName = z7.string().trim().min(1).max(MONITOR_LIMITS.environmentMax).regex(/^[A-Za-z0-9._-]+$/);
+var monitorInputSchema = z7.object({
+  name: z7.string().trim().min(1).max(MONITOR_LIMITS.nameMax),
+  mode: z7.enum(MONITOR_MODES).default("check_in"),
+  kind: z7.enum(MONITOR_KINDS),
   schedule: scheduleSchema.nullable(),
-  timezone: z6.string().trim().min(1).max(64),
-  checkinMarginMin: z6.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
-  maxRuntimeMin: z6.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
-  failureThreshold: z6.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
-  recoveryThreshold: z6.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
-  expectedEnvironments: z6.array(environmentName).min(1).max(MONITOR_LIMITS.expectedEnvironmentsMax)
+  timezone: z7.string().trim().min(1).max(64),
+  checkinMarginMin: z7.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
+  maxRuntimeMin: z7.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
+  failureThreshold: z7.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  recoveryThreshold: z7.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  expectedEnvironments: z7.array(environmentName).min(1).max(MONITOR_LIMITS.expectedEnvironmentsMax)
 }).refine((v) => v.kind === "on_demand" ? v.schedule === null : v.schedule?.type === v.kind, {
   path: ["schedule"],
   message: "schedule"
@@ -1036,98 +1120,601 @@ var MONITOR_INPUT_DEFAULTS = {
   recoveryThreshold: MONITOR_LIMITS.recoveryThresholdDefault,
   expectedEnvironments: [DEFAULT_CHECK_IN_ENVIRONMENT]
 };
-var runOutcome = z6.enum(RUN_OUTCOMES);
-var runFlags = z6.array(z6.string().max(32)).max(16);
-var monitorRunSchema = z6.object({
-  id: z6.number().int().positive(),
-  kind: z6.enum(["run", "missed"]),
+var runOutcome = z7.enum(RUN_OUTCOMES);
+var runFlags = z7.array(z7.string().max(32)).max(16);
+var monitorRunSchema = z7.object({
+  id: z7.number().int().positive(),
+  kind: z7.enum(["run", "missed"]),
   outcome: runOutcome,
   started_at: iso,
   ended_at: iso,
-  attempts: z6.number().int().nonnegative(),
-  duration_ms: z6.number().int().nonnegative().nullable(),
-  reason: z6.string().max(64).nullable(),
-  check_in_id: z6.string().max(64).nullable(),
-  trace_id: z6.string().max(32).nullable(),
-  release: z6.string().max(MONITOR_LIMITS.releaseMax).nullable(),
+  attempts: z7.number().int().nonnegative(),
+  duration_ms: z7.number().int().nonnegative().nullable(),
+  reason: z7.string().max(64).nullable(),
+  check_in_id: z7.string().max(64).nullable(),
+  trace_id: z7.string().max(32).nullable(),
+  release: z7.string().max(MONITOR_LIMITS.releaseMax).nullable(),
   flags: runFlags
 });
-var openAttemptSchema = z6.object({
-  check_in_id: z6.string().max(64),
-  run_key: z6.string().max(64),
-  attempt: z6.number().int().nonnegative(),
-  state: z6.string().max(16),
+var openAttemptSchema = z7.object({
+  check_in_id: z7.string().max(64),
+  run_key: z7.string().max(64),
+  attempt: z7.number().int().nonnegative(),
+  state: z7.string().max(16),
   started_at: iso,
   deadline_at: iso
 });
-var monitorRunsResponseSchema = z6.object({
-  open: z6.array(openAttemptSchema).max(100),
-  runs: z6.array(monitorRunSchema).max(MONITOR_LIMITS.runsPageSize),
-  next_cursor: z6.string().max(32).nullable()
+var monitorRunsResponseSchema = z7.object({
+  open: z7.array(openAttemptSchema).max(100),
+  runs: z7.array(monitorRunSchema).max(MONITOR_LIMITS.runsPageSize),
+  next_cursor: z7.string().max(32).nullable()
 });
-var timelineRunSchema = z6.object({
-  id: z6.number().int().positive(),
-  kind: z6.enum(["run", "missed"]),
+var timelineRunSchema = z7.object({
+  id: z7.number().int().positive(),
+  kind: z7.enum(["run", "missed"]),
   outcome: runOutcome,
   ended_at: iso,
   flags: runFlags
 });
-var monitorTimelineResponseSchema = z6.object({
-  runs: z6.array(timelineRunSchema).max(MONITOR_LIMITS.timelineRuns)
+var monitorTimelineResponseSchema = z7.object({
+  runs: z7.array(timelineRunSchema).max(MONITOR_LIMITS.timelineRuns)
 });
-var monitorStripsResponseSchema = z6.object({
-  strips: z6.array(z6.object({
-    monitor_id: z6.guid(),
+var monitorStripsResponseSchema = z7.object({
+  strips: z7.array(z7.object({
+    monitor_id: z7.guid(),
     environment: envName,
-    runs: z6.array(timelineRunSchema).max(MONITOR_LIMITS.listStripRuns)
+    runs: z7.array(timelineRunSchema).max(MONITOR_LIMITS.listStripRuns)
   })).max(5000)
 });
-var monitorDiagnosticSchema = z6.object({
-  id: z6.string().regex(/^\d{1,19}$/),
-  check_in_id: z6.string().max(64).nullable(),
-  signal: z6.string().max(16),
-  exit_code: z6.number().int().min(0).max(255).nullable(),
+var monitorDiagnosticSchema = z7.object({
+  id: z7.string().regex(/^\d{1,19}$/),
+  check_in_id: z7.string().max(64).nullable(),
+  signal: z7.string().max(16),
+  exit_code: z7.number().int().min(0).max(255).nullable(),
   received_at: iso,
-  body: z6.string().max(MONITOR_LIMITS.diagnosticMaxBytes * 2)
-});
-var monitorDiagnosticsResponseSchema = z6.object({
-  diagnostics: z6.array(monitorDiagnosticSchema).max(50),
-  next_cursor: z6.string().regex(/^\d{1,19}$/).nullable()
-});
-var checkInDetailSchema = z6.object({
-  run_key: z6.string().max(64),
-  attempts: z6.array(z6.object({
-    check_in_id: z6.string().max(64),
-    attempt: z6.number().int().nonnegative(),
-    result: z6.string().max(16),
+  body: z7.string().max(MONITOR_LIMITS.diagnosticMaxBytes * 2)
+});
+var monitorDiagnosticsResponseSchema = z7.object({
+  diagnostics: z7.array(monitorDiagnosticSchema).max(50),
+  next_cursor: z7.string().regex(/^\d{1,19}$/).nullable()
+});
+var checkInDetailSchema = z7.object({
+  run_key: z7.string().max(64),
+  attempts: z7.array(z7.object({
+    check_in_id: z7.string().max(64),
+    attempt: z7.number().int().nonnegative(),
+    result: z7.string().max(16),
     started_at: iso,
     ended_at: iso.nullable(),
-    duration_ms: z6.number().int().nonnegative().nullable(),
-    reason: z6.string().max(64).nullable(),
-    trace_id: z6.string().max(32).nullable(),
-    release: z6.string().max(MONITOR_LIMITS.releaseMax).nullable()
+    duration_ms: z7.number().int().nonnegative().nullable(),
+    reason: z7.string().max(64).nullable(),
+    trace_id: z7.string().max(32).nullable(),
+    release: z7.string().max(MONITOR_LIMITS.releaseMax).nullable()
   })).max(1000),
-  errors: z6.array(z6.object({
-    event_id: z6.string().max(64),
-    issue_id: z6.number().int().nonnegative(),
-    title: z6.string().max(1024),
-    level: z6.string().max(16),
+  errors: z7.array(z7.object({
+    event_id: z7.string().max(64),
+    issue_id: z7.number().int().nonnegative(),
+    title: z7.string().max(1024),
+    level: z7.string().max(16),
     timestamp: iso,
-    same_trace: z6.boolean()
+    same_trace: z7.boolean()
   })).max(50),
-  diagnostics: z6.array(monitorDiagnosticSchema).max(20).default([])
+  diagnostics: z7.array(monitorDiagnosticSchema).max(20).default([])
 });
-var incidentReviewSchema = z6.object({ incident_id: z6.guid() });
+var incidentReviewSchema = z7.object({ incident_id: z7.guid() });
+
+// ../src/shared/contracts/signal-monitors.ts
+var isSignalMonitorType = (t) => SIGNAL_MONITOR_TYPES.includes(t);
+var SIGNAL_KINDS = ["event", "check_in", "span", "log"];
+var SELECTOR_OPS = ["eq", "ne", "lt", "le", "gt", "ge", "in", "exists", "not_exists", "prefix"];
+var NUMERIC_OPS = new Set(["lt", "le", "gt", "ge"]);
+var VALUELESS_OPS = new Set(["exists", "not_exists"]);
+var COMPARATORS = ["lt", "gt", "outside"];
+var MISSING_DATA_POLICIES = ["alert", "keep", "resolve", "treat_as_zero"];
+var SEVERITIES = ["critical", "high", "medium", "low"];
+var OCCURRENCE_STATES = [
+  "pending",
+  "in_progress",
+  "success",
+  "late_success",
+  "missed",
+  "failed",
+  "cancelled"
+];
+var OCCURRENCE_OPEN = new Set(["pending", "in_progress"]);
+var SIGNAL_LIMITS = {
+  matchMax: 5,
+  assertMax: 5,
+  inValuesMax: 20,
+  valueMax: 256,
+  keyMax: 128,
+  environmentsMax: MONITOR_LIMITS.expectedEnvironmentsMax,
+  windowMinutesMin: 1,
+  windowMinutesMax: 1440,
+  thresholdMax: 1e6,
+  graceMinutesMax: 1440,
+  progressMinutesMin: 1,
+  progressMinutesMax: 1440,
+  occurrenceIdMax: 128,
+  occurrenceDueMaxDays: 35,
+  lateSuccessDays: 7,
+  evaluateEverySeconds: 15,
+  settleSeconds: 20,
+  countMaxDelayMinutes: 10,
+  countMinutesPerTick: 60,
+  windowsPerTick: 120,
+  monitorsPerQuery: 50,
+  bucketRowsPerQuery: 9000,
+  backtestDays: 30,
+  bucketRetentionMinutes: 2 * 1440 + 60,
+  occurrencesKeptFinished: 1000,
+  occurrencesPageSize: 50,
+  runIdsPerQuery: 500,
+  dueJudgedPerTick: 5000,
+  queryMaxSeconds: 5
+};
+var SELECTOR_KEY_RE = /^(?:tags\.[A-Za-z0-9_.:-]{1,100}|[A-Za-z_][A-Za-z0-9_.:-]{0,127})$/;
+var scalar = z8.union([z8.string().max(SIGNAL_LIMITS.valueMax), z8.number().finite(), z8.boolean()]);
+var selectorConditionSchema = z8.object({
+  key: z8.string().min(1).max(SIGNAL_LIMITS.keyMax).regex(SELECTOR_KEY_RE),
+  op: z8.enum(SELECTOR_OPS),
+  value: z8.union([scalar, z8.array(z8.string().max(SIGNAL_LIMITS.valueMax)).min(1).max(SIGNAL_LIMITS.inValuesMax)]).optional()
+}).superRefine((c, ctx) => {
+  const bad = (message) => ctx.addIssue({ code: "custom", path: ["value"], message });
+  if (VALUELESS_OPS.has(c.op)) {
+    if (c.value !== undefined)
+      bad("no_value");
+    return;
+  }
+  if (c.value === undefined)
+    return bad("value");
+  if (c.op === "in") {
+    if (!Array.isArray(c.value))
+      bad("list");
+    return;
+  }
+  if (Array.isArray(c.value))
+    return bad("scalar");
+  if (NUMERIC_OPS.has(c.op) && toNumber(c.value) === null)
+    bad("number");
+  if (c.op === "prefix" && (typeof c.value !== "string" || c.value.length === 0))
+    bad("text");
+});
+var environmentListSchema = z8.array(z8.string().trim().min(1).max(MONITOR_LIMITS.environmentMax).regex(/^[A-Za-z0-9._-]+$/)).min(1).max(SIGNAL_LIMITS.environmentsMax).refine((v) => new Set(v).size === v.length, "unique");
+var selectorSchema = z8.object({
+  signal: z8.enum(SIGNAL_KINDS),
+  match: z8.array(selectorConditionSchema).max(SIGNAL_LIMITS.matchMax)
+});
+function toNumber(v) {
+  if (typeof v === "number")
+    return Number.isFinite(v) ? v : null;
+  if (typeof v === "string" && v.trim() !== "" && v.length <= 64) {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : null;
+  }
+  return null;
+}
+var minutes = (min, max) => z8.number().int().min(min).max(max);
+var threshold = z8.number().int().min(0).max(SIGNAL_LIMITS.thresholdMax);
+var recovery = z8.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax);
+var common = {
+  environments: environmentListSchema,
+  severity: z8.enum(SEVERITIES),
+  recovery_threshold: recovery
+};
+var countSettingsSchema = z8.object({
+  type: z8.literal("count"),
+  selector: selectorSchema,
+  window_minutes: minutes(SIGNAL_LIMITS.windowMinutesMin, SIGNAL_LIMITS.windowMinutesMax),
+  comparator: z8.enum(COMPARATORS),
+  threshold,
+  threshold_high: threshold.nullable(),
+  missing_data: z8.enum(MISSING_DATA_POLICIES),
+  ...common
+}).superRefine((s, ctx) => {
+  if (s.comparator === "outside" && (s.threshold_high === null || s.threshold_high <= s.threshold)) {
+    ctx.addIssue({ code: "custom", path: ["threshold_high"], message: "threshold_high" });
+  }
+  if (s.comparator !== "outside" && s.threshold_high !== null) {
+    ctx.addIssue({ code: "custom", path: ["threshold_high"], message: "threshold_high" });
+  }
+  if (s.comparator === "lt" && s.threshold === 0) {
+    ctx.addIssue({ code: "custom", path: ["threshold"], message: "threshold" });
+  }
+});
+var assertionSettingsSchema = z8.object({
+  type: z8.literal("assertion"),
+  selector: selectorSchema,
+  assert: z8.array(selectorConditionSchema).min(1).max(SIGNAL_LIMITS.assertMax),
+  window_minutes: minutes(SIGNAL_LIMITS.windowMinutesMin, SIGNAL_LIMITS.windowMinutesMax),
+  threshold: z8.number().int().min(1).max(SIGNAL_LIMITS.thresholdMax),
+  missing_data: z8.enum(MISSING_DATA_POLICIES),
+  ...common
+});
+var deadlineSettingsSchema = z8.object({
+  type: z8.literal("deadline"),
+  occurrence_grace_minutes: minutes(0, SIGNAL_LIMITS.graceMinutesMax),
+  progress_timeout_minutes: minutes(SIGNAL_LIMITS.progressMinutesMin, SIGNAL_LIMITS.progressMinutesMax).nullable(),
+  ...common
+});
+var progressSettingsSchema = z8.object({
+  type: z8.literal("progress"),
+  progress_timeout_minutes: minutes(SIGNAL_LIMITS.progressMinutesMin, SIGNAL_LIMITS.progressMinutesMax),
+  ...common
+});
+var signalSettingsSchema = z8.discriminatedUnion("type", [
+  countSettingsSchema,
+  assertionSettingsSchema,
+  deadlineSettingsSchema,
+  progressSettingsSchema
+]);
+function settingsFromRow(row) {
+  if (!isSignalMonitorType(row.type) || !row.signal_settings || typeof row.signal_settings !== "object")
+    return null;
+  const r = signalSettingsSchema.safeParse({
+    ...row.signal_settings,
+    type: row.type,
+    environments: [...row.expected_environments],
+    severity: row.severity,
+    recovery_threshold: row.recovery_threshold
+  });
+  return r.success ? r.data : null;
+}
+var signalMonitorInputSchema = z8.object({
+  name: z8.string().trim().min(1).max(MONITOR_LIMITS.nameMax),
+  settings: signalSettingsSchema
+});
+var signalMonitorDefinitionSchema = z8.object({
+  id: z8.guid(),
+  project_id: z8.number().int().positive(),
+  slug: z8.string().regex(SLUG_RE),
+  settings: signalSettingsSchema,
+  paused_until: z8.string().datetime().nullable(),
+  created_at: z8.string().datetime(),
+  revision: z8.number().int().nonnegative()
+});
+var signalLimitsConfigSchema = z8.object({
+  pending_occurrences_per_monitor: z8.number().int().min(1).max(1e6),
+  pending_occurrences_per_project: z8.number().int().min(1).max(1e7)
+});
+var OCCURRENCE_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+var occurrenceInputSchema = z8.object({
+  monitor_slug: z8.string().regex(SLUG_RE),
+  occurrence_id: z8.string().regex(OCCURRENCE_ID_RE),
+  due_at: z8.string().datetime({ offset: true }),
+  environment: z8.string().trim().min(1).max(MONITOR_LIMITS.environmentMax).regex(/^[A-Za-z0-9._-]+$/).optional()
+});
+var occurrenceCancelSchema = occurrenceInputSchema.pick({ monitor_slug: true, occurrence_id: true, environment: true });
+var OCCURRENCE_PAST_SKEW_MS = 5 * 60000;
+var occurrenceRowSchema = z8.object({
+  occurrence_id: z8.string().max(SIGNAL_LIMITS.occurrenceIdMax),
+  environment: z8.string().max(MONITOR_LIMITS.environmentMax),
+  state: z8.enum(OCCURRENCE_STATES),
+  due_at: z8.string().datetime(),
+  deadline_at: z8.string().datetime(),
+  registered_at: z8.string().datetime(),
+  started_at: z8.string().datetime().nullable(),
+  last_signal_at: z8.string().datetime().nullable(),
+  ended_at: z8.string().datetime().nullable(),
+  stalled: z8.boolean()
+});
+var occurrencesResponseSchema = z8.object({
+  occurrences: z8.array(occurrenceRowSchema).max(SIGNAL_LIMITS.occurrencesPageSize),
+  pending: z8.number().int().nonnegative(),
+  next_due_at: z8.string().datetime().nullable(),
+  next_cursor: z8.string().max(64).nullable(),
+  refused_24h: z8.number().int().nonnegative()
+});
+var signalSeriesSchema = z8.object({
+  environment: z8.string().max(MONITOR_LIMITS.environmentMax),
+  buckets: z8.array(z8.object({ minute: z8.string().datetime(), matched: z8.number().int().nonnegative(), violations: z8.number().int().nonnegative(), lossy: z8.boolean() })).max(1440),
+  counted_through: z8.string().datetime().nullable()
+});
+var signalResponseSchema = z8.object({
+  series: z8.array(signalSeriesSchema).max(SIGNAL_LIMITS.environmentsMax),
+  runs: z8.array(z8.object({
+    run_id: z8.string().max(SIGNAL_LIMITS.occurrenceIdMax),
+    environment: z8.string().max(MONITOR_LIMITS.environmentMax),
+    started_at: z8.string().datetime(),
+    last_signal_at: z8.string().datetime(),
+    stalled: z8.boolean()
+  })).max(SIGNAL_LIMITS.occurrencesPageSize)
+});
+var backtestSettingsSchema = z8.union([countSettingsSchema, assertionSettingsSchema]);
+var backtestResponseSchema = z8.object({
+  alerts: z8.number().int().nonnegative(),
+  windows: z8.number().int().nonnegative(),
+  violated_windows: z8.number().int().nonnegative(),
+  first_at: z8.string().datetime().nullable(),
+  last_at: z8.string().datetime().nullable(),
+  days: z8.number().nonnegative(),
+  matched_total: z8.number().int().nonnegative(),
+  violations_total: z8.number().int().nonnegative()
+});
+
+// ../src/shared/contracts/notifications.ts
+var NOTIFY_LIMITS = {
+  policiesMax: 20,
+  nameMax: 80,
+  chainMax: 5,
+  escalateMinutesMin: 5,
+  escalateMinutesMax: 240,
+  digestRowsMax: 50,
+  slotSearchDays: 8
+};
+var HOLDABLE_SEVERITIES = ["medium", "low"];
+var DIGEST_MODES = ["off", "hourly", "daily"];
+var timeOfDay2 = z9.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/);
+var unique = (xs) => new Set(xs).size === xs.length;
+var quietHoursSchema = z9.object({
+  days: z9.array(weekdaySchema).min(1).max(7).refine(unique),
+  start: timeOfDay2,
+  end: timeOfDay2
+}).refine((q) => q.start !== q.end, { path: ["end"] });
+var policyInputSchema = z9.object({
+  name: z9.string().trim().min(1).max(NOTIFY_LIMITS.nameMax).regex(/^[^\p{Cc}]*$/u),
+  timezone: z9.string().trim().min(1).max(64).refine(validTimeZone),
+  quietHours: quietHoursSchema.nullable(),
+  quietSeverities: z9.array(z9.enum(HOLDABLE_SEVERITIES)).max(2).refine(unique),
+  digest: z9.enum(DIGEST_MODES),
+  digestAt: timeOfDay2.nullable(),
+  digestSeverities: z9.array(z9.enum(HOLDABLE_SEVERITIES)).max(2).refine(unique),
+  fallback: z9.array(z9.guid()).max(NOTIFY_LIMITS.chainMax).refine(unique),
+  escalateAfterMinutes: z9.number().int().min(NOTIFY_LIMITS.escalateMinutesMin).max(NOTIFY_LIMITS.escalateMinutesMax).nullable(),
+  escalation: z9.array(z9.guid()).max(NOTIFY_LIMITS.chainMax).refine(unique)
+}).superRefine((p, ctx) => {
+  if (p.digest === "daily" !== (p.digestAt !== null))
+    ctx.addIssue({ code: "custom", path: ["digestAt"], message: "digest_at" });
+  if (p.escalateAfterMinutes !== null !== p.escalation.length > 0)
+    ctx.addIssue({ code: "custom", path: ["escalation"], message: "escalation" });
+});
+var MIN = 60000;
+var HOUR = 60 * MIN;
+var DAY = 24 * HOUR;
+
+// ../src/shared/contracts/api-ops/incidents.ts
+var incidentOnly = z10.object({ workspaceId: uuid, incidentId: uuid });
+var note = z10.string().trim().min(1).max(2000).regex(/^[^\u0000-\u0008\u000b\u000c\u000e-\u001f]*$/);
+var INCIDENT_KINDS = ["monitor", "uptime", "slo", "issue"];
+var INCIDENT_GROUP_BY = ["monitor", "project_env"];
+var incidentRuleInputSchema = z10.object({
+  name: z10.string().trim().min(1).max(80).regex(/^[^\p{Cc}]*$/u),
+  isEnabled: z10.boolean(),
+  position: z10.number().int().min(0).max(1000).default(0),
+  projectIds: z10.array(z10.number().int().positive()).max(50),
+  environments: z10.array(z10.string().trim().min(1).max(64)).max(20),
+  kinds: z10.array(z10.enum(INCIDENT_KINDS)).min(1).max(4),
+  minSeverity: z10.enum(SEVERITIES),
+  groupBy: z10.enum(INCIDENT_GROUP_BY),
+  windowMinutes: z10.number().int().min(5).max(240),
+  recoveryHoldMinutes: z10.number().int().min(0).max(1440)
+});
+var INCIDENT_INPUTS = {
+  list: z10.object({
+    workspaceId: uuid,
+    limit: pageLimit,
+    cursor,
+    state: z10.enum(["active", "resolved", "all"]).default("all")
+  }),
+  incidentOnly,
+  resolve: incidentOnly.extend({ note: note.max(500) }),
+  note: incidentOnly.extend({ note }),
+  update: incidentOnly.extend({
+    title: z10.string().trim().min(1).max(120).regex(/^[^\p{Cc}]*$/u).optional(),
+    ownerUserId: uuid.nullable().optional()
+  }),
+  workspace: z10.object({ workspaceId: uuid }),
+  saveRule: z10.object({ workspaceId: uuid, ruleId: uuid.nullable(), input: incidentRuleInputSchema }),
+  ruleOnly: z10.object({ workspaceId: uuid, ruleId: uuid }),
+  savePolicy: z10.object({
+    workspaceId: uuid,
+    policyId: uuid.nullable(),
+    isDefault: z10.boolean(),
+    input: policyInputSchema
+  }),
+  policyOnly: z10.object({ workspaceId: uuid, policyId: uuid })
+};
+var I = INCIDENT_INPUTS;
+var w = "incidents:write";
+var INCIDENT_OPERATIONS = [
+  op({
+    id: "incidents.list",
+    method: "GET",
+    path: "/v1/incidents",
+    scope: "incidents:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_incidents"],
+    input: I.list,
+    workspace: true,
+    idempotency: "none",
+    paged: true,
+    mcp: "reliability",
+    summary: "Incidents (INC-n): state, severity and peak, owner, linked alert count; newest first.",
+    ui: []
+  }),
+  op({
+    id: "incidents.get",
+    method: "GET",
+    path: "/v1/incidents/{incident_id}",
+    scope: "incidents:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_incident"],
+    input: I.incidentOnly,
+    workspace: true,
+    idempotency: "none",
+    mcp: "reliability",
+    summary: "One incident with its linked alerts, timeline (notes included) and message deliveries (`accepted` = the provider took it; only a person acknowledges).",
+    ui: []
+  }),
+  op({
+    id: "incidents.acknowledge",
+    method: "POST",
+    path: "/v1/incidents/{incident_id}/ack",
+    scope: w,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["acknowledge_incident"],
+    input: I.incidentOnly,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Take ownership of an open incident; stops its escalation. Members and up.",
+    ui: ["incidents#acknowledgeIncident"]
+  }),
+  op({
+    id: "incidents.resolve",
+    method: "POST",
+    path: "/v1/incidents/{incident_id}/resolve",
+    scope: w,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["resolve_incident"],
+    input: I.resolve,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: 'Close an incident by hand with a reason (1–500 characters); it is labelled "not verified".',
+    ui: ["incidents#resolveIncident"]
+  }),
+  op({
+    id: "incidents.note",
+    method: "POST",
+    path: "/v1/incidents/{incident_id}/notes",
+    scope: w,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["add_incident_note"],
+    input: I.note,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Add a note to the incident timeline (plain text, ≤ 2,000 characters).",
+    ui: ["incidents#addIncidentNote"]
+  }),
+  op({
+    id: "incidents.update",
+    method: "PATCH",
+    path: "/v1/incidents/{incident_id}",
+    scope: w,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["update_incident"],
+    input: I.update,
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Rename an incident or assign it to a member (`owner_user_id: null` clears it).",
+    ui: ["incidents#updateIncident"]
+  }),
+  op({
+    id: "incident_rules.list",
+    method: "GET",
+    path: "/v1/incident-rules",
+    scope: "alerts:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_incident_rules"],
+    input: I.workspace,
+    workspace: true,
+    idempotency: "none",
+    mcp: "investigate",
+    summary: "Rules that turn alerts into incidents: match, grouping, window and recovery wait.",
+    ui: []
+  }),
+  op({
+    id: "incident_rules.save",
+    method: "POST",
+    path: "/v1/incident-rules",
+    scope: "alerts:write",
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["save_incident_rule"],
+    input: I.saveRule,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Create (`rule_id` null) or replace an incident rule. Admins.",
+    ui: ["incidents#saveIncidentRule"]
+  }),
+  op({
+    id: "incident_rules.delete",
+    method: "DELETE",
+    path: "/v1/incident-rules/{rule_id}",
+    scope: "alerts:write",
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["delete_incident_rule"],
+    input: I.ruleOnly,
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Delete an incident rule; open incidents stay as they are.",
+    ui: ["incidents#deleteIncidentRule"]
+  }),
+  op({
+    id: "notification_policies.list",
+    method: "GET",
+    path: "/v1/notification-policies",
+    scope: "alerts:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_notification_policies"],
+    input: I.workspace,
+    workspace: true,
+    idempotency: "none",
+    mcp: "investigate",
+    summary: "Notification policies: quiet hours, digest, fallback chain and escalation.",
+    ui: []
+  }),
+  op({
+    id: "notification_policies.save",
+    method: "POST",
+    path: "/v1/notification-policies",
+    scope: "alerts:write",
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["save_notification_policy"],
+    input: I.savePolicy,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Create (`policy_id` null) or replace a policy. Critical and high are never held; chains use existing destinations only. Admins.",
+    ui: ["incidents#saveNotificationPolicy"]
+  }),
+  op({
+    id: "notification_policies.delete",
+    method: "DELETE",
+    path: "/v1/notification-policies/{policy_id}",
+    scope: "alerts:write",
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["delete_notification_policy"],
+    input: I.policyOnly,
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Delete a policy (not the default); its rules fall back to the default policy.",
+    ui: ["incidents#deleteNotificationPolicy"]
+  })
+];
+
+// ../src/shared/contracts/api-ops/monitors.ts
+import { z as z15 } from "zod";
+
+// ../src/shared/contracts/heartbeat.ts
+import { z as z12 } from "zod";
 
 // ../src/shared/contracts/signed-message.ts
-import { z as z7 } from "zod";
-var nodeIdSchema = z7.guid();
-var signedEnvelopeSchema = z7.object({
+import { z as z11 } from "zod";
+var nodeIdSchema = z11.guid();
+var signedEnvelopeSchema = z11.object({
   node_id: nodeIdSchema,
-  ts: z7.number().int().positive(),
-  nonce: z7.string().regex(/^[A-Za-z0-9_-]{16,64}$/),
-  payload: z7.record(z7.string(), z7.unknown()),
-  sig: z7.string().regex(/^[A-Za-z0-9_-]{86}$/)
+  ts: z11.number().int().positive(),
+  nonce: z11.string().regex(/^[A-Za-z0-9_-]{16,64}$/),
+  payload: z11.record(z11.string(), z11.unknown()),
+  sig: z11.string().regex(/^[A-Za-z0-9_-]{86}$/)
 });
 
 // ../src/shared/contracts/heartbeat.ts
@@ -1165,78 +1752,78 @@ var HEARTBEAT_LIMITS = {
   diagnosticsPerRun: 5
 };
 var PAUSED_FOREVER_MS = Date.parse("9999-12-31T00:00:00.000Z");
-var uuid2 = z8.guid();
-var ms = z8.number().int().nonnegative();
-var hex64 = z8.string().regex(/^[0-9a-f]{64}$/);
-var envName2 = z8.string().min(1).max(MONITOR_LIMITS.environmentMax);
-var heartbeatMonitorConfigSchema = z8.object({
+var uuid2 = z12.guid();
+var ms = z12.number().int().nonnegative();
+var hex64 = z12.string().regex(/^[0-9a-f]{64}$/);
+var envName2 = z12.string().min(1).max(MONITOR_LIMITS.environmentMax);
+var heartbeatMonitorConfigSchema = z12.object({
   id: uuid2,
-  project_id: z8.number().int().positive(),
-  slug: z8.string().regex(SLUG_RE),
+  project_id: z12.number().int().positive(),
+  slug: z12.string().regex(SLUG_RE),
   environment: envName2,
   schedule: scheduleSchema,
-  timezone: z8.string().min(1).max(64),
-  grace_min: z8.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
-  max_runtime_min: z8.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
-  failure_threshold: z8.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
-  recovery_threshold: z8.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  timezone: z12.string().min(1).max(64),
+  grace_min: z12.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
+  max_runtime_min: z12.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
+  failure_threshold: z12.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  recovery_threshold: z12.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
   paused_until: ms.nullable(),
   created_at: ms
 });
-var heartbeatTokenConfigSchema = z8.object({
+var heartbeatTokenConfigSchema = z12.object({
   id: uuid2,
   monitor_id: uuid2,
   hash: hex64,
   expires_at: ms.nullable()
 });
-var heartbeatSyncSchema = z8.object({
-  v: z8.literal(1),
+var heartbeatSyncSchema = z12.object({
+  v: z12.literal(1),
   workspace_id: uuid2,
-  route: z8.string().regex(PING_ROUTE_RE),
-  revision: z8.number().int().positive(),
-  workspace_status: z8.enum(["active", "suspended", "deleting"]),
-  ingest_kill: z8.boolean(),
-  limits: z8.object({
-    check_in_rate_per_sec: z8.number().int().positive(),
-    check_in_burst: z8.number().int().positive(),
-    monthly_check_in_cap: z8.number().int().positive()
-  }),
-  projects: z8.array(z8.object({ id: z8.number().int().positive(), node_id: nodeIdSchema.nullable() })).max(1000),
-  monitors: z8.array(heartbeatMonitorConfigSchema).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace),
-  tokens: z8.array(heartbeatTokenConfigSchema).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace * 2)
-});
-var signedHeartbeatSyncSchema = z8.object({
-  body: z8.string().min(2).max(4 * 1024 * 1024),
-  ts: z8.number().int().positive(),
-  kid: z8.string().regex(/^[A-Za-z0-9_-]{1,40}$/),
-  sig: z8.string().regex(/^[A-Za-z0-9_-]{86}$/)
-});
-var heartbeatHourSchema = z8.object({
+  route: z12.string().regex(PING_ROUTE_RE),
+  revision: z12.number().int().positive(),
+  workspace_status: z12.enum(["active", "suspended", "deleting"]),
+  ingest_kill: z12.boolean(),
+  limits: z12.object({
+    check_in_rate_per_sec: z12.number().int().positive(),
+    check_in_burst: z12.number().int().positive(),
+    monthly_check_in_cap: z12.number().int().positive()
+  }),
+  projects: z12.array(z12.object({ id: z12.number().int().positive(), node_id: nodeIdSchema.nullable() })).max(1000),
+  monitors: z12.array(heartbeatMonitorConfigSchema).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace),
+  tokens: z12.array(heartbeatTokenConfigSchema).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace * 2)
+});
+var signedHeartbeatSyncSchema = z12.object({
+  body: z12.string().min(2).max(4 * 1024 * 1024),
+  ts: z12.number().int().positive(),
+  kid: z12.string().regex(/^[A-Za-z0-9_-]{1,40}$/),
+  sig: z12.string().regex(/^[A-Za-z0-9_-]{86}$/)
+});
+var heartbeatHourSchema = z12.object({
   monitor_id: uuid2,
-  hour: z8.string().datetime(),
-  ok: z8.number().int().nonnegative(),
-  failed: z8.number().int().nonnegative(),
-  started: z8.number().int().nonnegative(),
-  missed: z8.number().int().nonnegative(),
-  logs: z8.number().int().nonnegative()
-});
-var heartbeatReportSchema = z8.object({
-  v: z8.literal(1),
+  hour: z12.string().datetime(),
+  ok: z12.number().int().nonnegative(),
+  failed: z12.number().int().nonnegative(),
+  started: z12.number().int().nonnegative(),
+  missed: z12.number().int().nonnegative(),
+  logs: z12.number().int().nonnegative()
+});
+var heartbeatReportSchema = z12.object({
+  v: z12.literal(1),
   workspace_id: uuid2,
-  route: z8.string().regex(PING_ROUTE_RE),
-  revision: z8.number().int().nonnegative(),
-  sent_at: z8.string().datetime(),
-  incidents: z8.array(monitorIncidentSchema).max(HEARTBEAT_LIMITS.reportMaxIncidents),
-  statuses: z8.array(monitorStatusSchema).max(HEARTBEAT_LIMITS.reportMaxStatuses),
-  hours: z8.array(heartbeatHourSchema).max(HEARTBEAT_LIMITS.reportMaxHours),
-  token_uses: z8.array(z8.object({ token_id: uuid2, last_used_at: z8.string().datetime() })).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace * 2)
+  route: z12.string().regex(PING_ROUTE_RE),
+  revision: z12.number().int().nonnegative(),
+  sent_at: z12.string().datetime(),
+  incidents: z12.array(monitorIncidentSchema).max(HEARTBEAT_LIMITS.reportMaxIncidents),
+  statuses: z12.array(monitorStatusSchema).max(HEARTBEAT_LIMITS.reportMaxStatuses),
+  hours: z12.array(heartbeatHourSchema).max(HEARTBEAT_LIMITS.reportMaxHours),
+  token_uses: z12.array(z12.object({ token_id: uuid2, last_used_at: z12.string().datetime() })).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace * 2)
 });
 var ENCODER = new TextEncoder;
 var UTF8 = new TextDecoder("utf-8", { fatal: false, ignoreBOM: false });
 var TOKEN_IN_TEXT = new RegExp(PING_TOKEN_PATTERN, "g");
 
 // ../src/shared/contracts/slo.ts
-import { z as z9 } from "zod";
+import { z as z13 } from "zod";
 
 // ../src/shared/contracts/vocab/slo.ts
 var SLO_SOURCES = ["uptime", "monitor", "heartbeat", "spans"];
@@ -1268,17 +1855,17 @@ var SLO_SOURCE_META = {
   heartbeat: { provenance: "ping_token", estimated: false, slis: ["availability"], budgeting: "Occurrences" },
   spans: { provenance: "ingest_key", estimated: true, slis: ["availability", "latency"], budgeting: "Occurrences" }
 };
-var nodeSloSchema = z9.object({
-  slo_id: z9.guid(),
-  project_id: z9.number().int().positive(),
-  source: z9.enum(["monitor", "spans"]),
-  sli: z9.enum(SLO_SLIS),
-  monitor_id: z9.guid().optional(),
-  environment: z9.string().min(1).max(SLO_LIMITS.environmentMaxChars).optional(),
-  service: z9.string().min(1).max(128).optional(),
-  operation: z9.string().min(1).max(256).optional(),
-  latency_threshold_ms: z9.number().int().min(1).max(60000).optional(),
-  public_sources: z9.boolean()
+var nodeSloSchema = z13.object({
+  slo_id: z13.guid(),
+  project_id: z13.number().int().positive(),
+  source: z13.enum(["monitor", "spans"]),
+  sli: z13.enum(SLO_SLIS),
+  monitor_id: z13.guid().optional(),
+  environment: z13.string().min(1).max(SLO_LIMITS.environmentMaxChars).optional(),
+  service: z13.string().min(1).max(128).optional(),
+  operation: z13.string().min(1).max(256).optional(),
+  latency_threshold_ms: z13.number().int().min(1).max(60000).optional(),
+  public_sources: z13.boolean()
 }).superRefine((v, ctx) => {
   if (v.source === "monitor" && (!v.monitor_id || v.sli !== "availability"))
     ctx.addIssue({ code: "custom", path: ["monitor_id"], message: "INVALID_INPUT" });
@@ -1287,27 +1874,27 @@ var nodeSloSchema = z9.object({
   if (v.sli === "latency" !== (v.latency_threshold_ms !== undefined))
     ctx.addIssue({ code: "custom", path: ["latency_threshold_ms"], message: "INVALID_INPUT" });
 });
-var sliCountsSchema = z9.object({
-  minute: z9.string().datetime(),
-  items: z9.array(z9.object({ slo_id: z9.guid(), good: z9.number().int().min(0), total: z9.number().int().min(0) }).refine((x) => x.good <= x.total, { message: "INVALID_INPUT" })).max(SLO_LIMITS.sliItemsPerMessage)
-});
-var sloInputSchema = z9.object({
-  name: z9.string().trim().min(1).max(SLO_LIMITS.nameMaxChars),
-  description: z9.string().max(SLO_LIMITS.descriptionMaxChars).default(""),
-  source: z9.enum(SLO_SOURCES),
-  sourceRef: z9.object({
-    id: z9.guid().optional(),
-    projectId: z9.number().int().positive().optional(),
-    service: z9.string().max(128).optional(),
-    operation: z9.string().max(256).optional(),
-    environment: z9.string().max(SLO_LIMITS.environmentMaxChars).optional()
-  }),
-  sli: z9.enum(SLO_SLIS),
-  latencyThresholdMs: z9.number().int().min(1).max(60000).nullable(),
-  objective: z9.number().min(SLO_LIMITS.objectiveMin).max(SLO_LIMITS.objectiveMax),
-  windowDays: z9.union([z9.literal(7), z9.literal(28), z9.literal(30)]),
-  alertPolicy: z9.enum(SLO_ALERT_POLICIES),
-  allowPublicSources: z9.boolean().default(false)
+var sliCountsSchema = z13.object({
+  minute: z13.string().datetime(),
+  items: z13.array(z13.object({ slo_id: z13.guid(), good: z13.number().int().min(0), total: z13.number().int().min(0) }).refine((x) => x.good <= x.total, { message: "INVALID_INPUT" })).max(SLO_LIMITS.sliItemsPerMessage)
+});
+var sloInputSchema = z13.object({
+  name: z13.string().trim().min(1).max(SLO_LIMITS.nameMaxChars),
+  description: z13.string().max(SLO_LIMITS.descriptionMaxChars).default(""),
+  source: z13.enum(SLO_SOURCES),
+  sourceRef: z13.object({
+    id: z13.guid().optional(),
+    projectId: z13.number().int().positive().optional(),
+    service: z13.string().max(128).optional(),
+    operation: z13.string().max(256).optional(),
+    environment: z13.string().max(SLO_LIMITS.environmentMaxChars).optional()
+  }),
+  sli: z13.enum(SLO_SLIS),
+  latencyThresholdMs: z13.number().int().min(1).max(60000).nullable(),
+  objective: z13.number().min(SLO_LIMITS.objectiveMin).max(SLO_LIMITS.objectiveMax),
+  windowDays: z13.union([z13.literal(7), z13.literal(28), z13.literal(30)]),
+  alertPolicy: z13.enum(SLO_ALERT_POLICIES),
+  allowPublicSources: z13.boolean().default(false)
 }).superRefine((v, ctx) => {
   if (!SLO_SOURCE_META[v.source].slis.includes(v.sli))
     ctx.addIssue({ code: "custom", path: ["sli"], message: "INVALID_INPUT" });
@@ -1322,7 +1909,7 @@ var sloInputSchema = z9.object({
 });
 
 // ../src/shared/contracts/uptime.ts
-import { z as z10 } from "zod";
+import { z as z14 } from "zod";
 
 // ../src/shared/contracts/vocab/uptime.ts
 var UPTIME_STATUSES = ["up", "degraded", "down", "unknown", "paused", "pending"];
@@ -1395,51 +1982,51 @@ function isForbiddenHeader(name) {
   const n = name.trim().toLowerCase();
   return UPTIME_FORBIDDEN_HEADERS.includes(n) || n.startsWith("proxy-") || n.startsWith("sec-");
 }
-var text = z10.string().min(1).max(UPTIME_LIMITS.assertionTextMax);
-var statusRange = z10.string().regex(/^[1-5][0-9]{2}(-[1-5][0-9]{2})?$/);
-var assertionSchema = z10.discriminatedUnion("type", [
-  z10.object({ type: z10.literal("status"), in: z10.array(statusRange).min(1).max(10) }),
-  z10.object({ type: z10.literal("body_contains"), value: text, case_sensitive: z10.boolean().default(true) }),
-  z10.object({ type: z10.literal("body_not_contains"), value: text, case_sensitive: z10.boolean().default(true) }),
-  z10.object({
-    type: z10.literal("json_pointer"),
-    pointer: z10.string().max(256).regex(/^(\/([^~/]|~0|~1)*)*$/),
-    op: z10.enum(["exists", "equals", "type"]),
-    value: z10.string().max(UPTIME_LIMITS.assertionTextMax).optional()
-  }),
-  z10.object({
-    type: z10.literal("header"),
-    name: z10.string().min(1).max(UPTIME_LIMITS.headerNameMax).regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/),
-    op: z10.enum(["equals", "contains", "exists"]),
-    value: z10.string().max(UPTIME_LIMITS.assertionTextMax).optional()
-  }),
-  z10.object({ type: z10.literal("latency_ms"), lt: z10.number().int().min(1).max(60000) }),
-  z10.object({ type: z10.literal("tls_valid") })
+var text = z14.string().min(1).max(UPTIME_LIMITS.assertionTextMax);
+var statusRange = z14.string().regex(/^[1-5][0-9]{2}(-[1-5][0-9]{2})?$/);
+var assertionSchema = z14.discriminatedUnion("type", [
+  z14.object({ type: z14.literal("status"), in: z14.array(statusRange).min(1).max(10) }),
+  z14.object({ type: z14.literal("body_contains"), value: text, case_sensitive: z14.boolean().default(true) }),
+  z14.object({ type: z14.literal("body_not_contains"), value: text, case_sensitive: z14.boolean().default(true) }),
+  z14.object({
+    type: z14.literal("json_pointer"),
+    pointer: z14.string().max(256).regex(/^(\/([^~/]|~0|~1)*)*$/),
+    op: z14.enum(["exists", "equals", "type"]),
+    value: z14.string().max(UPTIME_LIMITS.assertionTextMax).optional()
+  }),
+  z14.object({
+    type: z14.literal("header"),
+    name: z14.string().min(1).max(UPTIME_LIMITS.headerNameMax).regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/),
+    op: z14.enum(["equals", "contains", "exists"]),
+    value: z14.string().max(UPTIME_LIMITS.assertionTextMax).optional()
+  }),
+  z14.object({ type: z14.literal("latency_ms"), lt: z14.number().int().min(1).max(60000) }),
+  z14.object({ type: z14.literal("tls_valid") })
 ]);
-var header = z10.object({
-  name: z10.string().min(1).max(UPTIME_LIMITS.headerNameMax).regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/),
-  value: z10.string().max(UPTIME_LIMITS.headerValueMax).regex(/^[^\r\n\u0000]*$/)
-});
-var uptimeCheckInputSchema = z10.object({
-  projectId: z10.number().int().positive(),
-  name: z10.string().trim().min(1).max(UPTIME_LIMITS.nameMaxChars),
-  kind: z10.enum(UPTIME_KINDS),
-  url: z10.string().max(UPTIME_LIMITS.urlMaxChars).nullable(),
-  host: z10.string().max(253).nullable(),
-  port: z10.number().int().min(1).max(65535).nullable(),
-  method: z10.enum(UPTIME_METHODS).default("GET"),
-  headers: z10.array(header).max(UPTIME_LIMITS.headersMax).default([]),
-  followRedirects: z10.boolean().default(false),
-  timeoutMs: z10.number().int().min(UPTIME_LIMITS.timeoutMs.min).max(UPTIME_LIMITS.timeoutMs.max),
-  intervalSeconds: z10.number().int().refine((n) => UPTIME_INTERVALS.includes(n)),
-  regions: z10.array(z10.enum(UPTIME_REGIONS)).min(UPTIME_LIMITS.minRegions).max(UPTIME_REGIONS.length),
-  assertions: z10.array(assertionSchema).max(UPTIME_LIMITS.assertionsMax).default([]),
-  failureThreshold: z10.number().int().min(1).max(5),
-  recoveryThreshold: z10.number().int().min(1).max(5),
-  certWarningDays: z10.number().int().min(1).max(60),
-  environment: z10.string().trim().max(64).default(""),
-  strictMetadata: z10.boolean().default(false),
-  evidenceOnFailure: z10.boolean().default(true)
+var header = z14.object({
+  name: z14.string().min(1).max(UPTIME_LIMITS.headerNameMax).regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/),
+  value: z14.string().max(UPTIME_LIMITS.headerValueMax).regex(/^[^\r\n\u0000]*$/)
+});
+var uptimeCheckInputSchema = z14.object({
+  projectId: z14.number().int().positive(),
+  name: z14.string().trim().min(1).max(UPTIME_LIMITS.nameMaxChars),
+  kind: z14.enum(UPTIME_KINDS),
+  url: z14.string().max(UPTIME_LIMITS.urlMaxChars).nullable(),
+  host: z14.string().max(253).nullable(),
+  port: z14.number().int().min(1).max(65535).nullable(),
+  method: z14.enum(UPTIME_METHODS).default("GET"),
+  headers: z14.array(header).max(UPTIME_LIMITS.headersMax).default([]),
+  followRedirects: z14.boolean().default(false),
+  timeoutMs: z14.number().int().min(UPTIME_LIMITS.timeoutMs.min).max(UPTIME_LIMITS.timeoutMs.max),
+  intervalSeconds: z14.number().int().refine((n) => UPTIME_INTERVALS.includes(n)),
+  regions: z14.array(z14.enum(UPTIME_REGIONS)).min(UPTIME_LIMITS.minRegions).max(UPTIME_REGIONS.length),
+  assertions: z14.array(assertionSchema).max(UPTIME_LIMITS.assertionsMax).default([]),
+  failureThreshold: z14.number().int().min(1).max(5),
+  recoveryThreshold: z14.number().int().min(1).max(5),
+  certWarningDays: z14.number().int().min(1).max(60),
+  environment: z14.string().trim().max(64).default(""),
+  strictMetadata: z14.boolean().default(false),
+  evidenceOnFailure: z14.boolean().default(true)
 }).superRefine((v, ctx) => {
   if (v.kind === "http" && !v.url)
     ctx.addIssue({ code: "custom", path: ["url"], message: "INVALID_INPUT" });
@@ -1450,237 +2037,243 @@ var uptimeCheckInputSchema = z10.object({
   if (v.headers.some((h) => isForbiddenHeader(h.name)))
     ctx.addIssue({ code: "custom", path: ["headers"], message: "UPTIME_HEADER_FORBIDDEN" });
 });
-var uptimeDefinitionSchema = z10.object({
-  check_id: z10.guid(),
-  workspace_id: z10.guid(),
-  project_id: z10.number().int().positive(),
-  revision: z10.number().int().nonnegative(),
-  kind: z10.enum(UPTIME_KINDS),
-  url: z10.string().max(UPTIME_LIMITS.urlMaxChars).nullable(),
-  host: z10.string().max(253).nullable(),
-  port: z10.number().int().min(1).max(65535).nullable(),
-  method: z10.enum(UPTIME_METHODS),
-  headers: z10.array(header).max(UPTIME_LIMITS.headersMax),
-  follow_redirects: z10.boolean(),
-  timeout_ms: z10.number().int().min(UPTIME_LIMITS.timeoutMs.min).max(UPTIME_LIMITS.timeoutMs.max),
-  interval_seconds: z10.number().int().positive(),
-  regions: z10.array(z10.enum(UPTIME_REGIONS)).min(1).max(3),
-  assertions: z10.array(assertionSchema).max(UPTIME_LIMITS.assertionsMax),
-  failure_threshold: z10.number().int().min(1).max(5),
-  recovery_threshold: z10.number().int().min(1).max(5),
-  cert_warning_days: z10.number().int().min(1).max(60),
-  strict_metadata: z10.boolean(),
-  evidence_on_failure: z10.boolean(),
-  paused_until: z10.string().nullable(),
-  muted_until: z10.string().nullable()
-});
-var timingsSchema = z10.object({
-  dns_ms: z10.number().nonnegative().max(60000).nullable(),
-  connect_ms: z10.number().nonnegative().max(60000).nullable(),
-  tls_ms: z10.number().nonnegative().max(60000).nullable(),
-  ttfb_ms: z10.number().nonnegative().max(60000).nullable(),
-  download_ms: z10.number().nonnegative().max(60000).nullable(),
-  total_ms: z10.number().nonnegative().max(60000)
-});
-var probeResultSchema = z10.object({
-  check_id: z10.guid(),
-  revision: z10.number().int().nonnegative(),
-  slot: z10.number().int().nonnegative(),
-  region: z10.enum(UPTIME_REGIONS),
-  run_now: z10.string().max(64).optional(),
-  scheduled_at: z10.number().int().positive(),
-  started_at: z10.number().int().positive(),
-  outcome: z10.enum(UPTIME_OUTCOMES),
-  reason: z10.enum(UPTIME_REASONS).nullable(),
-  reason_group: z10.enum(UPTIME_REASON_GROUPS).nullable(),
-  status_code: z10.number().int().min(100).max(599).nullable(),
+var uptimeDefinitionSchema = z14.object({
+  check_id: z14.guid(),
+  workspace_id: z14.guid(),
+  project_id: z14.number().int().positive(),
+  revision: z14.number().int().nonnegative(),
+  kind: z14.enum(UPTIME_KINDS),
+  url: z14.string().max(UPTIME_LIMITS.urlMaxChars).nullable(),
+  host: z14.string().max(253).nullable(),
+  port: z14.number().int().min(1).max(65535).nullable(),
+  method: z14.enum(UPTIME_METHODS),
+  headers: z14.array(header).max(UPTIME_LIMITS.headersMax),
+  follow_redirects: z14.boolean(),
+  timeout_ms: z14.number().int().min(UPTIME_LIMITS.timeoutMs.min).max(UPTIME_LIMITS.timeoutMs.max),
+  interval_seconds: z14.number().int().positive(),
+  regions: z14.array(z14.enum(UPTIME_REGIONS)).min(1).max(3),
+  assertions: z14.array(assertionSchema).max(UPTIME_LIMITS.assertionsMax),
+  failure_threshold: z14.number().int().min(1).max(5),
+  recovery_threshold: z14.number().int().min(1).max(5),
+  cert_warning_days: z14.number().int().min(1).max(60),
+  strict_metadata: z14.boolean(),
+  evidence_on_failure: z14.boolean(),
+  paused_until: z14.string().nullable(),
+  muted_until: z14.string().nullable()
+});
+var timingsSchema = z14.object({
+  dns_ms: z14.number().nonnegative().max(60000).nullable(),
+  connect_ms: z14.number().nonnegative().max(60000).nullable(),
+  tls_ms: z14.number().nonnegative().max(60000).nullable(),
+  ttfb_ms: z14.number().nonnegative().max(60000).nullable(),
+  download_ms: z14.number().nonnegative().max(60000).nullable(),
+  total_ms: z14.number().nonnegative().max(60000)
+});
+var probeResultSchema = z14.object({
+  check_id: z14.guid(),
+  revision: z14.number().int().nonnegative(),
+  slot: z14.number().int().nonnegative(),
+  region: z14.enum(UPTIME_REGIONS),
+  run_now: z14.string().max(64).optional(),
+  scheduled_at: z14.number().int().positive(),
+  started_at: z14.number().int().positive(),
+  outcome: z14.enum(UPTIME_OUTCOMES),
+  reason: z14.enum(UPTIME_REASONS).nullable(),
+  reason_group: z14.enum(UPTIME_REASON_GROUPS).nullable(),
+  status_code: z14.number().int().min(100).max(599).nullable(),
   timings: timingsSchema.nullable(),
-  ip_family: z10.enum(["v4", "v6"]).nullable(),
-  http_version: z10.string().max(8).nullable(),
-  cert_not_after: z10.number().int().positive().nullable(),
-  cert_issuer: z10.string().max(200).nullable(),
-  cert_expiring: z10.boolean(),
-  evidence_sealed: z10.string().max(16384).nullable()
-});
-var probeIdSchema = z10.string().regex(/^probe-(eu|us|ap)-[a-z0-9]{4,16}$/);
-var resultBatchSchema = z10.object({
-  v: z10.literal(1),
+  ip_family: z14.enum(["v4", "v6"]).nullable(),
+  http_version: z14.string().max(8).nullable(),
+  cert_not_after: z14.number().int().positive().nullable(),
+  cert_issuer: z14.string().max(200).nullable(),
+  cert_expiring: z14.boolean(),
+  evidence_sealed: z14.string().max(16384).nullable()
+});
+var probeIdSchema = z14.string().regex(/^probe-(eu|us|ap)-[a-z0-9]{4,16}$/);
+var resultBatchSchema = z14.object({
+  v: z14.literal(1),
   probe_id: probeIdSchema,
-  region: z10.enum(UPTIME_REGIONS),
-  version: z10.string().max(40),
-  sent_at: z10.number().int().positive(),
-  results: z10.array(probeResultSchema).max(UPTIME_LIMITS.resultsBatchMax),
-  stats: z10.object({ lag_p99_ms: z10.number().nonnegative(), checks_per_min: z10.number().nonnegative() })
+  region: z14.enum(UPTIME_REGIONS),
+  version: z14.string().max(40),
+  sent_at: z14.number().int().positive(),
+  results: z14.array(probeResultSchema).max(UPTIME_LIMITS.resultsBatchMax),
+  stats: z14.object({ lag_p99_ms: z14.number().nonnegative(), checks_per_min: z14.number().nonnegative() })
 });
 var assignmentSchema = uptimeDefinitionSchema.omit({ workspace_id: true, paused_until: true, muted_until: true }).extend({
-  seal_public_key: z10.string().regex(/^[A-Za-z0-9_-]{43}$/).nullable()
-});
-var assignmentsSchema = z10.object({
-  v: z10.literal(1),
-  region: z10.enum(UPTIME_REGIONS),
-  revision: z10.number().int().nonnegative(),
-  issued_at: z10.number().int().positive(),
-  checks: z10.array(assignmentSchema).max(50000),
-  denied_hosts: z10.array(z10.string().max(253)).max(1e4),
-  run_now: z10.array(z10.object({ id: z10.string().max(64), check_id: z10.guid(), expires_at: z10.number().int() })).max(500)
-});
-var uuid3 = z10.guid();
-var b64key = z10.string().regex(/^[A-Za-z0-9_-]{43}$/);
-var iso2 = z10.string().datetime();
-var uptimeSyncSchema = z10.object({
-  v: z10.literal(1),
+  seal_public_key: z14.string().regex(/^[A-Za-z0-9_-]{43}$/).nullable()
+});
+var assignmentsSchema = z14.object({
+  v: z14.literal(1),
+  region: z14.enum(UPTIME_REGIONS),
+  revision: z14.number().int().nonnegative(),
+  issued_at: z14.number().int().positive(),
+  checks: z14.array(assignmentSchema).max(50000),
+  denied_hosts: z14.array(z14.string().max(253)).max(1e4),
+  run_now: z14.array(z14.object({ id: z14.string().max(64), check_id: z14.guid(), expires_at: z14.number().int() })).max(500)
+});
+var uuid3 = z14.guid();
+var b64key = z14.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var iso2 = z14.string().datetime();
+var uptimeSyncSchema = z14.object({
+  v: z14.literal(1),
   workspace_id: uuid3,
-  revision: z10.number().int().positive(),
-  workspace_status: z10.enum(["active", "suspended", "deleting"]),
-  suspended: z10.boolean(),
-  checks: z10.array(uptimeDefinitionSchema).max(UPTIME_LIMITS.maxChecksPerWorkspace),
-  projects: z10.array(z10.object({ id: z10.number().int().positive(), node_id: z10.guid().nullable(), seal_public_key: b64key.nullable() })).max(1000)
-});
-var uptimeReconcileSchema = z10.object({
-  v: z10.literal(1),
-  as_of: z10.number().int().positive(),
-  workspace_ids: z10.array(uuid3).max(UPTIME_LIMITS.reconcileMaxWorkspaces),
-  heartbeat_routes: z10.array(z10.string().regex(PING_ROUTE_RE)).max(UPTIME_LIMITS.reconcileMaxWorkspaces).optional()
-});
-var probeDirectorySyncSchema = z10.object({
-  v: z10.literal(1),
-  revision: z10.number().int().positive(),
-  probes: z10.array(z10.object({ probe_id: probeIdSchema, region: z10.enum(UPTIME_REGIONS), public_key: b64key, status: z10.enum(["active", "revoked"]) })).max(30),
-  denied_hosts: z10.array(z10.string().min(1).max(253)).max(1e4)
-});
-var runNowRequestSchema = z10.object({ v: z10.literal(1), workspace_id: uuid3, check_id: uuid3, run_id: z10.string().regex(/^[A-Za-z0-9_-]{8,64}$/) });
-var signedAssignmentsSchema = z10.object({ assignments: assignmentsSchema, sig: z10.string().regex(/^[A-Za-z0-9_-]{86}$/) });
-var uptimeRegionStateSchema = z10.object({
-  region: z10.enum(UPTIME_REGIONS),
-  outcome: z10.enum(UPTIME_OUTCOMES),
-  reason: z10.enum(UPTIME_REASONS).nullable(),
-  status_code: z10.number().int().min(100).max(599).nullable(),
-  total_ms: z10.number().nonnegative().max(60000).nullable(),
+  revision: z14.number().int().positive(),
+  workspace_status: z14.enum(["active", "suspended", "deleting"]),
+  suspended: z14.boolean(),
+  checks: z14.array(uptimeDefinitionSchema).max(UPTIME_LIMITS.maxChecksPerWorkspace),
+  projects: z14.array(z14.object({ id: z14.number().int().positive(), node_id: z14.guid().nullable(), seal_public_key: b64key.nullable() })).max(1000)
+});
+var uptimeReconcileSchema = z14.object({
+  v: z14.literal(1),
+  as_of: z14.number().int().positive(),
+  workspace_ids: z14.array(uuid3).max(UPTIME_LIMITS.reconcileMaxWorkspaces),
+  heartbeat_routes: z14.array(z14.string().regex(PING_ROUTE_RE)).max(UPTIME_LIMITS.reconcileMaxWorkspaces).optional()
+});
+var probeDirectorySyncSchema = z14.object({
+  v: z14.literal(1),
+  revision: z14.number().int().positive(),
+  probes: z14.array(z14.object({ probe_id: probeIdSchema, region: z14.enum(UPTIME_REGIONS), public_key: b64key, status: z14.enum(["active", "revoked"]) })).max(30),
+  denied_hosts: z14.array(z14.string().min(1).max(253)).max(1e4)
+});
+var runNowRequestSchema = z14.object({ v: z14.literal(1), workspace_id: uuid3, check_id: uuid3, run_id: z14.string().regex(/^[A-Za-z0-9_-]{8,64}$/) });
+var signedAssignmentsSchema = z14.object({ assignments: assignmentsSchema, sig: z14.string().regex(/^[A-Za-z0-9_-]{86}$/) });
+var uptimeRegionStateSchema = z14.object({
+  region: z14.enum(UPTIME_REGIONS),
+  outcome: z14.enum(UPTIME_OUTCOMES),
+  reason: z14.enum(UPTIME_REASONS).nullable(),
+  status_code: z14.number().int().min(100).max(599).nullable(),
+  total_ms: z14.number().nonnegative().max(60000).nullable(),
   timings: timingsSchema.nullable().optional(),
   at: iso2
 });
-var uptimeStatusReportSchema = z10.object({
+var uptimeStatusReportSchema = z14.object({
   check_id: uuid3,
-  revision: z10.number().int().nonnegative(),
-  status: z10.enum(UPTIME_STATUSES),
-  last_verdict: z10.enum(SLOT_VERDICTS).nullable(),
+  revision: z14.number().int().nonnegative(),
+  status: z14.enum(UPTIME_STATUSES),
+  last_verdict: z14.enum(SLOT_VERDICTS).nullable(),
   last_slot_at: iso2.nullable(),
   incident_id: uuid3.nullable(),
-  down_streak: z10.number().int().nonnegative(),
-  up_streak: z10.number().int().nonnegative(),
-  regions: z10.array(uptimeRegionStateSchema).max(3),
-  unobserved_regions: z10.array(z10.enum(UPTIME_REGIONS)).max(3),
+  down_streak: z14.number().int().nonnegative(),
+  up_streak: z14.number().int().nonnegative(),
+  regions: z14.array(uptimeRegionStateSchema).max(3),
+  unobserved_regions: z14.array(z14.enum(UPTIME_REGIONS)).max(3),
   cert_not_after: iso2.nullable(),
-  cert_expiring: z10.boolean(),
-  run_now: z10.object({ run_id: z10.string().max(64), results: z10.array(uptimeRegionStateSchema).max(3) }).nullable()
+  cert_expiring: z14.boolean(),
+  run_now: z14.object({ run_id: z14.string().max(64), results: z14.array(uptimeRegionStateSchema).max(3) }).nullable()
 });
 var UPTIME_EVENT_KINDS = ["opened", "resolved", "cert_expiring"];
-var uptimeEventSchema = z10.object({
-  event_id: z10.string().regex(/^[A-Za-z0-9:_-]{8,96}$/),
+var uptimeEventSchema = z14.object({
+  event_id: z14.string().regex(/^[A-Za-z0-9:_-]{8,96}$/),
   check_id: uuid3,
-  kind: z10.enum(UPTIME_EVENT_KINDS),
+  kind: z14.enum(UPTIME_EVENT_KINDS),
   incident_id: uuid3.nullable(),
   at: iso2,
-  reason: z10.enum(UPTIME_REASONS).nullable(),
-  regions: z10.array(z10.enum(UPTIME_REGIONS)).max(3),
-  cert_days_left: z10.number().int().nullable()
+  reason: z14.enum(UPTIME_REASONS).nullable(),
+  regions: z14.array(z14.enum(UPTIME_REGIONS)).max(3),
+  cert_days_left: z14.number().int().nullable()
 });
-var uptimeMinuteSchema = z10.object({
+var uptimeMinuteSchema = z14.object({
   check_id: uuid3,
   minute: iso2,
-  up: z10.number().int().nonnegative(),
-  degraded: z10.number().int().nonnegative(),
-  down: z10.number().int().nonnegative(),
-  unknown: z10.number().int().nonnegative(),
-  latency: z10.array(z10.object({ region: z10.enum(UPTIME_REGIONS), n: z10.number().int().positive(), p50_ms: z10.number().nonnegative(), p95_ms: z10.number().nonnegative() })).max(3)
-});
-var uptimeReportSchema = z10.object({
-  v: z10.literal(1),
+  up: z14.number().int().nonnegative(),
+  degraded: z14.number().int().nonnegative(),
+  down: z14.number().int().nonnegative(),
+  unknown: z14.number().int().nonnegative(),
+  latency: z14.array(z14.object({ region: z14.enum(UPTIME_REGIONS), n: z14.number().int().positive(), p50_ms: z14.number().nonnegative(), p95_ms: z14.number().nonnegative() })).max(3)
+});
+var uptimeReportSchema = z14.object({
+  v: z14.literal(1),
   workspace_id: uuid3,
-  revision: z10.number().int().nonnegative(),
+  revision: z14.number().int().nonnegative(),
   sent_at: iso2,
-  events: z10.array(uptimeEventSchema).max(UPTIME_LIMITS.reportMaxEvents),
-  statuses: z10.array(uptimeStatusReportSchema).max(UPTIME_LIMITS.reportMaxStatuses),
-  minutes: z10.array(uptimeMinuteSchema).max(UPTIME_LIMITS.reportMaxMinutes)
+  events: z14.array(uptimeEventSchema).max(UPTIME_LIMITS.reportMaxEvents),
+  statuses: z14.array(uptimeStatusReportSchema).max(UPTIME_LIMITS.reportMaxStatuses),
+  minutes: z14.array(uptimeMinuteSchema).max(UPTIME_LIMITS.reportMaxMinutes)
 });
-var probeFleetReportSchema = z10.object({
-  v: z10.literal(1),
+var probeFleetReportSchema = z14.object({
+  v: z14.literal(1),
   sent_at: iso2,
-  probes: z10.array(z10.object({
+  probes: z14.array(z14.object({
     probe_id: probeIdSchema,
-    region: z10.enum(UPTIME_REGIONS),
-    version: z10.string().max(40).nullable(),
+    region: z14.enum(UPTIME_REGIONS),
+    version: z14.string().max(40).nullable(),
     last_seen_at: iso2.nullable(),
-    lag_p99_ms: z10.number().nonnegative().nullable(),
-    checks_per_min: z10.number().nonnegative().nullable()
+    lag_p99_ms: z14.number().nonnegative().nullable(),
+    checks_per_min: z14.number().nonnegative().nullable()
   })).max(30),
-  regions_alive: z10.array(z10.enum(UPTIME_REGIONS)).max(3)
+  regions_alive: z14.array(z14.enum(UPTIME_REGIONS)).max(3)
 });
-var probeEnrollSchema = z10.object({
-  v: z10.literal(1),
+var probeEnrollSchema = z14.object({
+  v: z14.literal(1),
   probe_id: probeIdSchema,
-  public_key: z10.string().regex(/^[A-Za-z0-9_-]{43}$/),
-  code: z10.string().regex(/^[A-Za-z0-9_-]{43}$/),
-  ts: z10.number().int().positive(),
-  sig: z10.string().regex(/^[A-Za-z0-9_-]{86}$/)
-});
-var uptimeEvidenceEnvelopeSchema = z10.object({
-  v: z10.literal(1),
-  check_id: z10.guid(),
-  slot: z10.number().int().nonnegative(),
-  region: z10.enum(UPTIME_REGIONS),
+  public_key: z14.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  code: z14.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  ts: z14.number().int().positive(),
+  sig: z14.string().regex(/^[A-Za-z0-9_-]{86}$/)
+});
+var uptimeEvidenceEnvelopeSchema = z14.object({
+  v: z14.literal(1),
+  check_id: z14.guid(),
+  slot: z14.number().int().nonnegative(),
+  region: z14.enum(UPTIME_REGIONS),
   probe_id: probeIdSchema,
-  at: z10.number().int().positive(),
-  sealed: z10.string().regex(/^[A-Za-z0-9_-]+$/).max(16384)
+  at: z14.number().int().positive(),
+  sealed: z14.string().regex(/^[A-Za-z0-9_-]+$/).max(16384)
 }).strict();
-var uptimeEvidenceSchema = z10.object({
-  v: z10.literal(1),
-  check_id: z10.guid(),
-  slot: z10.number().int().nonnegative(),
-  region: z10.enum(UPTIME_REGIONS),
-  at: z10.number().int().positive(),
-  reason: z10.enum(UPTIME_REASONS).nullable(),
-  status_line: z10.string().max(200).nullable(),
-  headers: z10.record(z10.string().max(64), z10.string().max(512)).refine((h) => Object.keys(h).length <= 20),
-  body: z10.string().max(UPTIME_LIMITS.evidenceMaxBytes * 4).nullable(),
-  body_truncated: z10.boolean(),
+var uptimeEvidenceSchema = z14.object({
+  v: z14.literal(1),
+  check_id: z14.guid(),
+  slot: z14.number().int().nonnegative(),
+  region: z14.enum(UPTIME_REGIONS),
+  at: z14.number().int().positive(),
+  reason: z14.enum(UPTIME_REASONS).nullable(),
+  status_line: z14.string().max(200).nullable(),
+  headers: z14.record(z14.string().max(64), z14.string().max(512)).refine((h) => Object.keys(h).length <= 20),
+  body: z14.string().max(UPTIME_LIMITS.evidenceMaxBytes * 4).nullable(),
+  body_truncated: z14.boolean(),
   timings: timingsSchema.nullable(),
-  ip: z10.string().max(64).nullable(),
-  error: z10.string().max(300).nullable()
+  ip: z14.string().max(64).nullable(),
+  error: z14.string().max(300).nullable()
 }).strict();
-var uptimeEvidenceListSchema = z10.object({
-  items: z10.array(uptimeEvidenceSchema.extend({ received_at: z10.number().int().positive() })).max(UPTIME_LIMITS.evidenceKeepPerCheck)
+var uptimeEvidenceListSchema = z14.object({
+  items: z14.array(uptimeEvidenceSchema.extend({ received_at: z14.number().int().positive() })).max(UPTIME_LIMITS.evidenceKeepPerCheck)
 });
 
 // ../src/shared/contracts/api-ops/monitors.ts
+var anyMonitorInputSchema = z15.union([monitorInputSchema, signalMonitorInputSchema]);
+var MAINTENANCE_INPUTS = {
+  create: z15.object({ workspaceId: uuid, input: maintenanceInputSchema }),
+  update: z15.object({ workspaceId: uuid, windowId: uuid, input: maintenanceInputSchema }),
+  delete: z15.object({ workspaceId: uuid, windowId: uuid })
+};
 var MONITOR_INPUTS = {
-  create: z11.object({ projectId, slug: z11.string().regex(SLUG_RE), input: monitorInputSchema }),
-  update: z11.object({ monitorId: uuid, input: monitorInputSchema }),
-  delete: z11.object({ monitorId: uuid, confirmSlug: z11.string().max(64) }),
-  setPause: z11.object({ monitorId: uuid, until: holdUntil }),
-  setMuted: z11.object({ monitorId: uuid, muted: z11.boolean() }),
-  dismissDiscovery: z11.object({ discoveryId: uuid }),
-  rotatePing: z11.object({
+  create: z15.object({ projectId, slug: z15.string().regex(SLUG_RE), input: anyMonitorInputSchema }),
+  update: z15.object({ monitorId: uuid, input: anyMonitorInputSchema }),
+  delete: z15.object({ monitorId: uuid, confirmSlug: z15.string().max(64) }),
+  setPause: z15.object({ monitorId: uuid, until: holdUntil }),
+  setMuted: z15.object({ monitorId: uuid, muted: z15.boolean() }),
+  dismissDiscovery: z15.object({ discoveryId: uuid }),
+  rotatePing: z15.object({
     monitorId: uuid,
-    graceHours: z11.number().int().refine((h) => HEARTBEAT_LIMITS.rotationGraceHoursChoices.includes(h))
+    graceHours: z15.number().int().refine((h) => HEARTBEAT_LIMITS.rotationGraceHoursChoices.includes(h))
   }),
-  monitorOnly: z11.object({ monitorId: uuid })
+  monitorOnly: z15.object({ monitorId: uuid })
 };
 var UPTIME_INPUTS = {
   create: uptimeCheckInputSchema,
-  update: z11.object({ checkId: uuid, input: uptimeCheckInputSchema }),
-  checkOnly: z11.object({ checkId: uuid }),
-  setHold: z11.object({ checkId: uuid, kind: z11.enum(["pause", "mute"]), until: holdUntil })
+  update: z15.object({ checkId: uuid, input: uptimeCheckInputSchema }),
+  checkOnly: z15.object({ checkId: uuid }),
+  setHold: z15.object({ checkId: uuid, kind: z15.enum(["pause", "mute"]), until: holdUntil })
 };
 var SLO_INPUTS = {
-  create: z11.object({ workspaceId: uuid, input: sloInputSchema }),
-  update: z11.object({ sloId: uuid, input: sloInputSchema }),
-  sloOnly: z11.object({ sloId: uuid }),
-  setHold: z11.object({ sloId: uuid, kind: z11.enum(["pause", "mute"]), until: holdUntil }),
-  import: z11.object({
+  create: z15.object({ workspaceId: uuid, input: sloInputSchema }),
+  update: z15.object({ sloId: uuid, input: sloInputSchema }),
+  sloOnly: z15.object({ sloId: uuid }),
+  setHold: z15.object({ sloId: uuid, kind: z15.enum(["pause", "mute"]), until: holdUntil }),
+  import: z15.object({
     workspaceId: uuid,
-    text: z11.string().max(SLO_LIMITS.openSloMaxBytes * 2),
-    dryRun: z11.boolean()
+    text: z15.string().max(SLO_LIMITS.openSloMaxBytes * 2),
+    dryRun: z15.boolean()
   })
 };
 var m = "monitors:write";
@@ -1692,13 +2285,13 @@ var MONITOR_OPERATIONS = [
     scope: m,
     sensitivity: "normal",
     kind: "write",
-    rpcs: ["create_monitor", "create_heartbeat_monitor"],
+    rpcs: ["create_monitor", "create_heartbeat_monitor", "create_signal_monitor"],
     input: MONITOR_INPUTS.create,
     bodyField: "input",
     idempotency: "required",
     status: 201,
     mcp: "configure",
-    summary: "Create a cron or heartbeat monitor. A heartbeat monitor returns its ping token once.",
+    summary: "Create a cron or heartbeat monitor, or a signal monitor (`settings.type`: count, assertion, deadline, progress). A heartbeat monitor returns its ping token once.",
     secretOutput: ["ping_token"],
     ui: ["monitors#createMonitor"]
   }),
@@ -1709,13 +2302,13 @@ var MONITOR_OPERATIONS = [
     scope: m,
     sensitivity: "normal",
     kind: "write",
-    rpcs: ["update_monitor"],
+    rpcs: ["update_monitor", "update_signal_monitor"],
     input: MONITOR_INPUTS.update,
     bodyField: "input",
     ifMatch: true,
     idempotency: "none",
     mcp: "configure",
-    summary: "Replace a monitor's schedule, margins and thresholds.",
+    summary: "Replace a monitor's schedule, margins and thresholds, or a signal monitor's settings (the type stays).",
     ui: ["monitors#updateMonitor"]
   }),
   op({
@@ -1970,23 +2563,71 @@ var MONITOR_OPERATIONS = [
     mcp: "configure",
     summary: "Import OpenSLO YAML, all or nothing; `dry_run` returns the plan without applying it.",
     ui: ["slos#importOpenSlo"]
+  }),
+  op({
+    id: "maintenance.create",
+    method: "POST",
+    path: "/v1/maintenance-windows",
+    scope: m,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["create_maintenance_window"],
+    input: MAINTENANCE_INPUTS.create,
+    bodyField: "input",
+    workspace: true,
+    idempotency: "required",
+    status: 201,
+    mcp: "configure",
+    summary: "Hold back monitor notifications during a one-off or weekly window (workspace, projects or monitors); monitors keep evaluating and recording.",
+    ui: ["maintenance#createMaintenanceWindow"]
+  }),
+  op({
+    id: "maintenance.update",
+    method: "PATCH",
+    path: "/v1/maintenance-windows/{window_id}",
+    scope: m,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["update_maintenance_window"],
+    input: MAINTENANCE_INPUTS.update,
+    bodyField: "input",
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Replace a maintenance window's scope, times and reason.",
+    ui: ["maintenance#updateMaintenanceWindow"]
+  }),
+  op({
+    id: "maintenance.delete",
+    method: "DELETE",
+    path: "/v1/maintenance-windows/{window_id}",
+    scope: m,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["delete_maintenance_window"],
+    input: MAINTENANCE_INPUTS.delete,
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Delete a maintenance window; notifications resume at once.",
+    ui: ["maintenance#deleteMaintenanceWindow"]
   })
 ];
 
 // ../src/shared/contracts/api-ops/node-data.ts
-import { z as z12 } from "zod";
-var issueId = z12.number().int().positive();
-var csv = z12.string().min(1).max(2000);
-var name2 = z12.string().min(1).max(256);
-var period = z12.enum(["1h", "24h", "7d", "14d", "30d"]);
-var nodeCursor = z12.string().min(1).max(600).optional();
+import { z as z16 } from "zod";
+var issueId = z16.number().int().positive();
+var csv = z16.string().min(1).max(2000);
+var name2 = z16.string().min(1).max(256);
+var period = z16.enum(["1h", "24h", "7d", "14d", "30d"]);
+var nodeCursor = z16.string().min(1).max(600).optional();
 var windowFields = {
-  start: z12.string().max(40).optional(),
-  end: z12.string().max(40).optional()
+  start: z16.string().max(40).optional(),
+  end: z16.string().max(40).optional()
 };
-var traceId = z12.string().regex(/^[0-9a-fA-F]{32}$/);
-var spanId = z12.string().regex(/^[0-9a-fA-F]{16}$/);
-var attrs = z12.string().max(2000).optional();
+var traceId = z16.string().regex(/^[0-9a-fA-F]{32}$/);
+var spanId = z16.string().regex(/^[0-9a-fA-F]{16}$/);
+var attrs = z16.string().max(2000).optional();
 var telemetryCommon = {
   ...windowFields,
   project: csv.optional(),
@@ -1994,91 +2635,112 @@ var telemetryCommon = {
   service: csv.optional(),
   attrs
 };
-var issueChange = z12.union([
-  z12.object({ action: z12.literal("resolve"), inNextRelease: z12.boolean().optional() }),
-  z12.object({ action: z12.literal("unresolve") }),
-  z12.object({ action: z12.literal("archive"), mode: z12.enum(["until_escalating", "forever"]) }),
-  z12.object({
-    action: z12.literal("archive"),
-    mode: z12.literal("until_condition"),
-    events: z12.number().int().min(1).max(1e6).optional(),
-    users: z12.number().int().min(1).max(1e5).optional(),
-    until: z12.string().datetime().optional()
-  }),
-  z12.object({ action: z12.literal("assign"), userId: z12.guid().nullable() }),
-  z12.object({ action: z12.literal("priority"), priority: z12.enum(["low", "medium", "high"]) })
+var issueChange = z16.union([
+  z16.object({ action: z16.literal("resolve"), inNextRelease: z16.boolean().optional() }),
+  z16.object({ action: z16.literal("unresolve") }),
+  z16.object({ action: z16.literal("archive"), mode: z16.enum(["until_escalating", "forever"]) }),
+  z16.object({
+    action: z16.literal("archive"),
+    mode: z16.literal("until_condition"),
+    events: z16.number().int().min(1).max(1e6).optional(),
+    users: z16.number().int().min(1).max(1e5).optional(),
+    until: z16.string().datetime().optional()
+  }),
+  z16.object({ action: z16.literal("assign"), userId: z16.guid().nullable() }),
+  z16.object({ action: z16.literal("priority"), priority: z16.enum(["low", "medium", "high"]) })
 ]);
 var NODE_INPUTS = {
-  issuesList: z12.object({
+  issuesList: z16.object({
     project: csv.optional(),
-    status: z12.enum(["unresolved", "resolved", "archived", "all"]).optional(),
+    status: z16.enum(["unresolved", "resolved", "archived", "all"]).optional(),
     level: csv.optional(),
     priority: csv.optional(),
     environment: csv.optional(),
     release: csv.optional(),
-    assignee: z12.string().max(64).optional(),
+    assignee: z16.string().max(64).optional(),
     period: period.optional(),
-    q: z12.string().max(200).optional(),
-    sort: z12.enum(["last_seen", "first_seen", "events", "users", "priority"]).optional(),
+    q: z16.string().max(200).optional(),
+    sort: z16.enum(["last_seen", "first_seen", "events", "users", "priority"]).optional(),
     cursor: nodeCursor,
-    limit: z12.number().int().min(1).max(100).optional()
+    limit: z16.number().int().min(1).max(100).optional()
   }),
-  issue: z12.object({ issueId }),
-  issueStats: z12.object({ issueId, range: z12.enum(["24h", "30d"]).optional() }),
-  issueEvents: z12.object({ issueId, cursor: nodeCursor }),
-  issueEvent: z12.object({
+  issue: z16.object({ issueId }),
+  issueStats: z16.object({ issueId, range: z16.enum(["24h", "30d"]).optional() }),
+  issueEvents: z16.object({ issueId, cursor: nodeCursor }),
+  issueEvent: z16.object({
     issueId,
-    eventId: z12.string().regex(/^([0-9a-f]{32}|latest|oldest)$/)
+    eventId: z16.string().regex(/^([0-9a-f]{32}|latest|oldest)$/)
   }),
-  issueUpdate: z12.object({ issueId, change: issueChange }),
-  issuesBulk: z12.object({
-    issueIds: z12.array(issueId).min(1).max(100),
+  issueUpdate: z16.object({ issueId, change: issueChange }),
+  issuesBulk: z16.object({
+    issueIds: z16.array(issueId).min(1).max(100),
     action: issueChange
   }),
-  spansList: z12.object({
+  spansList: z16.object({
     ...telemetryCommon,
-    operation: z12.string().min(1).max(1024).optional(),
-    status: z12.enum(["unset", "ok", "error"]).optional(),
-    kind: z12.enum(["internal", "server", "client", "producer", "consumer"]).optional(),
-    minDurationMs: z12.number().min(0).max(86400000).optional(),
-    maxDurationMs: z12.number().min(0).max(86400000).optional(),
-    mode: z12.enum(["spans", "traces"]).optional(),
+    operation: z16.string().min(1).max(1024).optional(),
+    status: z16.enum(["unset", "ok", "error"]).optional(),
+    kind: z16.enum(["internal", "server", "client", "producer", "consumer"]).optional(),
+    minDurationMs: z16.number().min(0).max(86400000).optional(),
+    maxDurationMs: z16.number().min(0).max(86400000).optional(),
+    mode: z16.enum(["spans", "traces"]).optional(),
     cursor: nodeCursor
   }),
-  spansHistogram: z12.object({
+  spansHistogram: z16.object({
     ...telemetryCommon,
-    operation: z12.string().min(1).max(1024).optional(),
-    status: z12.enum(["unset", "ok", "error"]).optional()
+    operation: z16.string().min(1).max(1024).optional(),
+    status: z16.enum(["unset", "ok", "error"]).optional()
   }),
-  trace: z12.object({ traceId }),
-  traceSpans: z12.object({ traceId, errorsOnly: z12.enum(["1"]).optional(), ...windowFields }),
-  span: z12.object({ traceId, spanId, ...windowFields }),
-  logsList: z12.object({
+  trace: z16.object({ traceId }),
+  traceSpans: z16.object({ traceId, errorsOnly: z16.enum(["1"]).optional(), ...windowFields }),
+  span: z16.object({ traceId, spanId, ...windowFields }),
+  logsList: z16.object({
     ...telemetryCommon,
-    severityMin: z12.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
+    severityMin: z16.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
     traceId: traceId.optional(),
     spanId: spanId.optional(),
-    q: z12.string().max(500).optional(),
-    order: z12.enum(["asc", "desc"]).optional(),
+    q: z16.string().max(500).optional(),
+    order: z16.enum(["asc", "desc"]).optional(),
     cursor: nodeCursor
   }),
-  logsFacets: z12.object({
+  logsFacets: z16.object({
     ...telemetryCommon,
-    severityMin: z12.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
-    q: z12.string().max(500).optional()
+    severityMin: z16.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
+    q: z16.string().max(500).optional()
   }),
-  logAround: z12.object({
+  logAround: z16.object({
     logId: name2,
-    at: z12.string().max(40),
-    same: z12.enum(["service", "trace"]).optional(),
-    before: z12.number().int().min(0).max(200).optional(),
-    after: z12.number().int().min(0).max(200).optional()
-  }),
-  telemetryUsage: z12.object({ project: csv.optional(), days: z12.number().int().min(1).max(31).optional() }),
-  ticket: z12.object({
-    scope: z12.enum(["read", "write"]).default("read"),
-    project: z12.number().int().positive().optional(),
-    environment: z12.string().min(1).max(64).optional()
+    at: z16.string().max(40),
+    same: z16.enum(["service", "trace"]).optional(),
+    before: z16.number().int().min(0).max(200).optional(),
+    after: z16.number().int().min(0).max(200).optional()
+  }),
+  telemetryUsage: z16.object({ project: csv.optional(), days: z16.number().int().min(1).max(31).optional() }),
+  monitorSignal: z16.object({ monitorId: z16.guid(), hours: z16.number().int().min(1).max(24).optional() }),
+  monitorOccurrences: z16.object({
+    monitorId: z16.guid(),
+    state: z16.enum(["open", "finished", "all"]).optional(),
+    environment: z16.string().min(1).max(64).optional(),
+    cursor: nodeCursor
+  }),
+  monitorBacktest: z16.object({ project: z16.number().int().positive(), settings: backtestSettingsSchema }),
+  occurrenceCreate: z16.object({
+    project: z16.number().int().positive(),
+    monitorSlug: occurrenceInputSchema.shape.monitor_slug,
+    occurrenceId: occurrenceInputSchema.shape.occurrence_id,
+    dueAt: occurrenceInputSchema.shape.due_at,
+    environment: occurrenceInputSchema.shape.environment
+  }),
+  occurrenceCancel: z16.object({
+    project: z16.number().int().positive(),
+    monitorSlug: z16.string().regex(SLUG_RE),
+    occurrenceId: z16.string().regex(OCCURRENCE_ID_RE),
+    environment: z16.string().min(1).max(64).optional()
+  }),
+  ticket: z16.object({
+    scope: z16.enum(["read", "write"]).default("read"),
+    project: z16.number().int().positive().optional(),
+    environment: z16.string().min(1).max(64).optional()
   })
 };
 var N = NODE_INPUTS;
@@ -2249,6 +2911,60 @@ var NODE_OPERATIONS = [
     node: { path: "q/telemetry/usage" },
     summary: "Stored spans and logs per day and project on the node."
   }),
+  op({
+    ...read,
+    id: "monitors.signal",
+    path: "/v1/monitors/{monitor_id}/signal",
+    scope: "monitors:read",
+    input: N.monitorSignal,
+    node: { path: "q/monitors/{monitor_id}/signal" },
+    mcp: "reliability",
+    summary: "A signal monitor's minute counts (count/assertion) for up to 24 h per environment, and its open runs (progress, deadline)."
+  }),
+  op({
+    ...read,
+    id: "monitors.occurrences",
+    path: "/v1/monitors/{monitor_id}/occurrences",
+    scope: "monitors:read",
+    input: N.monitorOccurrences,
+    node: { path: "q/monitors/{monitor_id}/occurrences", list: "occurrences" },
+    paged: true,
+    mcp: "reliability",
+    summary: "Occurrences of a deadline monitor (pending, on time, late, missed, failed, cancelled), newest due first."
+  }),
+  op({
+    ...read,
+    id: "monitors.backtest",
+    method: "POST",
+    path: "/v1/monitors/backtest",
+    scope: "monitors:read",
+    input: N.monitorBacktest,
+    node: { path: "q/monitors/backtest" },
+    mcp: "reliability",
+    summary: "How often count/assertion settings would have alerted over the last 30 days of stored data (same rule as the live evaluator)."
+  }),
+  op({
+    ...read,
+    id: "occurrences.create",
+    method: "POST",
+    path: "/v1/occurrences",
+    scope: "monitors:write",
+    input: N.occurrenceCreate,
+    node: { path: "w/monitors/occurrences", body: "*" },
+    mcp: "configure",
+    summary: "Register one run a deadline monitor expects (`due_at` within 35 days); the same id again moves its due time while it is pending."
+  }),
+  op({
+    ...read,
+    id: "occurrences.cancel",
+    method: "DELETE",
+    path: "/v1/occurrences/{monitor_slug}/{occurrence_id}",
+    scope: "monitors:write",
+    input: N.occurrenceCancel,
+    node: { path: "w/monitors/occurrences/cancel", body: "*" },
+    mcp: "configure",
+    summary: "Cancel a pending occurrence (the app moved or dropped the job); a cancelled occurrence never alerts."
+  }),
   op({
     ...read,
     id: "issues.update",
@@ -2286,10 +3002,10 @@ var NODE_OPERATIONS = [
 ];
 
 // ../src/shared/contracts/api-ops/projects.ts
-import { z as z17 } from "zod";
+import { z as z21 } from "zod";
 
 // ../src/shared/contracts/ingest-keys.ts
-import { z as z13 } from "zod";
+import { z as z17 } from "zod";
 var INGEST_KEY_SCOPES = ["traces", "logs", "errors", "monitors"];
 var INGEST_KEY_STATES = ["active", "revoked"];
 var INGEST_KEY_LIMITS = {
@@ -2299,51 +3015,51 @@ var INGEST_KEY_LIMITS = {
   edgeCacheSeconds: 60
 };
 var CHECKIN_AUTH_MODES = ["public_or_key", "key_only"];
-var ingestKeyConfigSchema = z13.object({
-  v: z13.literal(1),
-  key_id: z13.guid(),
-  project_public_id: z13.number().int().positive(),
-  project_id: z13.number().int().positive(),
-  workspace_id: z13.guid(),
+var ingestKeyConfigSchema = z17.object({
+  v: z17.literal(1),
+  key_id: z17.guid(),
+  project_public_id: z17.number().int().positive(),
+  project_id: z17.number().int().positive(),
+  workspace_id: z17.guid(),
   node_id: nodeIdSchema,
-  scopes: z13.array(z13.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
-  environments: z13.array(z13.string().max(INGEST_KEY_LIMITS.environmentMaxChars)).max(INGEST_KEY_LIMITS.environmentsMax),
-  expires_at: z13.string().datetime({ offset: true }).nullable(),
-  state: z13.enum(INGEST_KEY_STATES),
-  workspace_status: z13.enum(["active", "suspended", "deleting"]),
-  ingest_kill: z13.boolean(),
-  telemetry_kill: z13.boolean(),
-  telemetry_rate_bytes_per_sec: z13.number().int().positive(),
-  telemetry_burst_bytes: z13.number().int().positive(),
-  traces_monthly_bytes: z13.number().int().positive(),
-  logs_monthly_bytes: z13.number().int().positive(),
-  telemetry_buffer_minutes: z13.number().int().min(1).max(1440),
-  revision: z13.number().int().nonnegative()
-});
-var createIngestKeyInputSchema = z13.object({
-  projectId: z13.number().int().positive(),
-  name: z13.string().trim().min(1).max(INGEST_KEY_LIMITS.nameMaxChars).refine((s) => !/[\u0000-\u001f\u007f]/.test(s)),
-  scopes: z13.array(z13.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
-  environments: z13.array(z13.string().trim().min(1).max(INGEST_KEY_LIMITS.environmentMaxChars).regex(/^[^\s/\u0000-\u001f]+$/)).max(INGEST_KEY_LIMITS.environmentsMax),
-  expiresAt: z13.string().datetime({ offset: true }).nullable()
-});
-var ingestKeyRowSchema = z13.object({
-  id: z13.guid(),
-  project_id: z13.number().int().positive(),
-  name: z13.string(),
-  prefix: z13.string(),
-  scopes: z13.array(z13.enum(INGEST_KEY_SCOPES)),
-  environments: z13.array(z13.string()),
-  expires_at: z13.string().nullable(),
-  state: z13.enum(INGEST_KEY_STATES),
-  created_by: z13.guid().nullable(),
-  created_at: z13.string(),
-  revoked_at: z13.string().nullable(),
-  last_used_at: z13.string().nullable()
+  scopes: z17.array(z17.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
+  environments: z17.array(z17.string().max(INGEST_KEY_LIMITS.environmentMaxChars)).max(INGEST_KEY_LIMITS.environmentsMax),
+  expires_at: z17.string().datetime({ offset: true }).nullable(),
+  state: z17.enum(INGEST_KEY_STATES),
+  workspace_status: z17.enum(["active", "suspended", "deleting"]),
+  ingest_kill: z17.boolean(),
+  telemetry_kill: z17.boolean(),
+  telemetry_rate_bytes_per_sec: z17.number().int().positive(),
+  telemetry_burst_bytes: z17.number().int().positive(),
+  traces_monthly_bytes: z17.number().int().positive(),
+  logs_monthly_bytes: z17.number().int().positive(),
+  telemetry_buffer_minutes: z17.number().int().min(1).max(1440),
+  revision: z17.number().int().nonnegative()
+});
+var createIngestKeyInputSchema = z17.object({
+  projectId: z17.number().int().positive(),
+  name: z17.string().trim().min(1).max(INGEST_KEY_LIMITS.nameMaxChars).refine((s) => !/[\u0000-\u001f\u007f]/.test(s)),
+  scopes: z17.array(z17.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
+  environments: z17.array(z17.string().trim().min(1).max(INGEST_KEY_LIMITS.environmentMaxChars).regex(/^[^\s/\u0000-\u001f]+$/)).max(INGEST_KEY_LIMITS.environmentsMax),
+  expiresAt: z17.string().datetime({ offset: true }).nullable()
+});
+var ingestKeyRowSchema = z17.object({
+  id: z17.guid(),
+  project_id: z17.number().int().positive(),
+  name: z17.string(),
+  prefix: z17.string(),
+  scopes: z17.array(z17.enum(INGEST_KEY_SCOPES)),
+  environments: z17.array(z17.string()),
+  expires_at: z17.string().nullable(),
+  state: z17.enum(INGEST_KEY_STATES),
+  created_by: z17.guid().nullable(),
+  created_at: z17.string(),
+  revoked_at: z17.string().nullable(),
+  last_used_at: z17.string().nullable()
 });
 
 // ../src/shared/contracts/integration-health.ts
-import { z as z14 } from "zod";
+import { z as z18 } from "zod";
 
 // ../src/shared/contracts/platforms.ts
 var PLATFORMS = [
@@ -2357,116 +3073,116 @@ var PLATFORMS = [
 
 // ../src/shared/contracts/integration-health.ts
 var VERIFICATION_ID_RE = /^bv1_[0-9a-f]{32}$/;
-var verificationIdSchema = z14.string().regex(VERIFICATION_ID_RE);
+var verificationIdSchema = z18.string().regex(VERIFICATION_ID_RE);
 var SURFACES = ["browser", "server"];
 var RECEIPT_SURFACES = ["browser", "server", "belvador"];
 var CHECKS = ["delivery", "uncaught", "pipeline"];
 var HOOK_STATES = ["ok", "missing", "unknown"];
-var verificationContextSchema = z14.object({
-  v: z14.literal(1),
-  surface: z14.enum(RECEIPT_SURFACES),
-  check: z14.enum(CHECKS),
-  hook: z14.enum(HOOK_STATES).optional(),
-  uncaught_expected: z14.boolean().optional()
-});
-var iso3 = z14.string().datetime();
-var projectId3 = z14.number().int().positive();
-var verificationReceiptSchema = z14.object({
+var verificationContextSchema = z18.object({
+  v: z18.literal(1),
+  surface: z18.enum(RECEIPT_SURFACES),
+  check: z18.enum(CHECKS),
+  hook: z18.enum(HOOK_STATES).optional(),
+  uncaught_expected: z18.boolean().optional()
+});
+var iso3 = z18.string().datetime();
+var projectId3 = z18.number().int().positive();
+var verificationReceiptSchema = z18.object({
   project_id: projectId3,
   verification_id: verificationIdSchema,
-  surface: z14.enum(RECEIPT_SURFACES),
-  check: z14.enum(CHECKS),
-  hook: z14.enum(HOOK_STATES),
-  uncaught_expected: z14.boolean(),
-  sdk_name: z14.string().max(80),
-  sdk_version: z14.string().max(40),
-  environment: z14.string().max(64),
-  release: z14.string().max(200),
-  source_host: z14.string().max(253),
+  surface: z18.enum(RECEIPT_SURFACES),
+  check: z18.enum(CHECKS),
+  hook: z18.enum(HOOK_STATES),
+  uncaught_expected: z18.boolean(),
+  sdk_name: z18.string().max(80),
+  sdk_version: z18.string().max(40),
+  environment: z18.string().max(64),
+  release: z18.string().max(200),
+  source_host: z18.string().max(253),
   received_at: iso3
 });
 var SDK_DELIVERY_DROP_REASONS = ["network_error", "queue_overflow", "send_error"];
-var clientDiscardSchema = z14.object({
+var clientDiscardSchema = z18.object({
   hour: iso3,
-  reason: z14.enum(SDK_DELIVERY_DROP_REASONS),
-  n: z14.number().int().nonnegative()
+  reason: z18.enum(SDK_DELIVERY_DROP_REASONS),
+  n: z18.number().int().nonnegative()
 });
-var edgeVerificationRequestSchema = z14.object({
-  v: z14.literal(1),
+var edgeVerificationRequestSchema = z18.object({
+  v: z18.literal(1),
   project_id: projectId3,
   verification_id: verificationIdSchema
 });
-var readbackCheckSchema = z14.object({
-  surface: z14.enum(RECEIPT_SURFACES),
-  check: z14.enum(CHECKS),
-  hook: z14.enum(HOOK_STATES),
+var readbackCheckSchema = z18.object({
+  surface: z18.enum(RECEIPT_SURFACES),
+  check: z18.enum(CHECKS),
+  hook: z18.enum(HOOK_STATES),
   received_at: iso3
 });
-var edgeVerificationResponseSchema = z14.object({
-  checks: z14.array(readbackCheckSchema).max(8)
+var edgeVerificationResponseSchema = z18.object({
+  checks: z18.array(readbackCheckSchema).max(8)
 });
-var readbackResponseSchema = z14.object({
-  v: z14.literal(1),
+var readbackResponseSchema = z18.object({
+  v: z18.literal(1),
   verification_id: verificationIdSchema,
-  node: z14.enum(["connected", "offline"]),
-  checks: z14.array(readbackCheckSchema).max(8)
+  node: z18.enum(["connected", "offline"]),
+  checks: z18.array(readbackCheckSchema).max(8)
 });
 var ENVIRONMENT_RE = /^[^\u0000-\u001f]{1,64}$/;
-var projectRuntimeSchema = z14.object({
+var projectRuntimeSchema = z18.object({
   project_id: projectId3,
-  environment: z14.string().max(64),
-  surface: z14.enum(SURFACES),
-  sdk_name: z14.string().max(80),
-  sdk_version: z14.string().max(40),
-  latest_release: z14.string().max(200),
+  environment: z18.string().max(64),
+  surface: z18.enum(SURFACES),
+  sdk_name: z18.string().max(80),
+  sdk_version: z18.string().max(40),
+  latest_release: z18.string().max(200),
   first_seen: iso3,
   last_seen: iso3,
-  events_24h: z14.number().int().nonnegative(),
-  check_ins_24h: z14.number().int().nonnegative()
+  events_24h: z18.number().int().nonnegative(),
+  check_ins_24h: z18.number().int().nonnegative()
 });
 
 // ../src/shared/contracts/node-config.ts
-import { z as z16 } from "zod";
+import { z as z20 } from "zod";
 
 // ../src/shared/contracts/backup.ts
-import { z as z15 } from "zod";
+import { z as z19 } from "zod";
 var BACKUP_KINDS = ["daily", "weekly", "manual", "pre_upgrade"];
-var ageRecipient = z15.string().regex(/^age1[02-9ac-hj-np-z]{58}$/);
-var backupIdSchema = z15.string().regex(/^[a-z0-9-]{8,64}$/);
-var nodeBackupConfigSchema = z15.object({
-  enabled: z15.boolean(),
-  hour_utc: z15.number().int().min(0).max(23),
-  weekly_day: z15.number().int().min(1).max(7),
+var ageRecipient = z19.string().regex(/^age1[02-9ac-hj-np-z]{58}$/);
+var backupIdSchema = z19.string().regex(/^[a-z0-9-]{8,64}$/);
+var nodeBackupConfigSchema = z19.object({
+  enabled: z19.boolean(),
+  hour_utc: z19.number().int().min(0).max(23),
+  weekly_day: z19.number().int().min(1).max(7),
   workspace_recipient: ageRecipient
 });
-var backupCredentialsRequestSchema = z15.object({
-  mode: z15.enum(["upload", "download"]),
+var backupCredentialsRequestSchema = z19.object({
+  mode: z19.enum(["upload", "download"]),
   backup_id: backupIdSchema,
-  source_node_id: z15.guid().optional()
-});
-var backupCredentialsSchema = z15.object({
-  endpoint: z15.string().url(),
-  bucket: z15.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/),
-  prefix: z15.string().regex(/^backups\/[0-9a-f-]{36}\/$/),
-  access_key_id: z15.string().min(8).max(200),
-  secret_access_key: z15.string().min(8).max(200),
-  session_token: z15.string().min(8).max(4000),
-  expires_at: z15.string().datetime()
-});
-var rowCountsSchema = z15.record(z15.string().regex(/^[a-z_][a-z0-9_]{0,63}$/), z15.number().int().nonnegative());
-var backupManifestSchema = z15.object({
-  v: z15.literal(1),
+  source_node_id: z19.guid().optional()
+});
+var backupCredentialsSchema = z19.object({
+  endpoint: z19.string().url(),
+  bucket: z19.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/),
+  prefix: z19.string().regex(/^backups\/[0-9a-f-]{36}\/$/),
+  access_key_id: z19.string().min(8).max(200),
+  secret_access_key: z19.string().min(8).max(200),
+  session_token: z19.string().min(8).max(4000),
+  expires_at: z19.string().datetime()
+});
+var rowCountsSchema = z19.record(z19.string().regex(/^[a-z_][a-z0-9_]{0,63}$/), z19.number().int().nonnegative());
+var backupManifestSchema = z19.object({
+  v: z19.literal(1),
   backup_id: backupIdSchema,
-  node_id: z15.guid(),
-  kind: z15.enum(BACKUP_KINDS),
-  created_at: z15.string().datetime(),
-  object_key: z15.string(),
-  size_bytes: z15.number().int().nonnegative(),
-  sha256: z15.string().regex(/^[0-9a-f]{64}$/),
-  clickhouse_version: z15.string().max(40),
-  schema_version: z15.number().int().nonnegative(),
+  node_id: z19.guid(),
+  kind: z19.enum(BACKUP_KINDS),
+  created_at: z19.string().datetime(),
+  object_key: z19.string(),
+  size_bytes: z19.number().int().nonnegative(),
+  sha256: z19.string().regex(/^[0-9a-f]{64}$/),
+  clickhouse_version: z19.string().max(40),
+  schema_version: z19.number().int().nonnegative(),
   row_counts: rowCountsSchema,
-  recipients: z15.array(z15.string().regex(/^[0-9a-f]{8}$/)).min(1).max(4)
+  recipients: z19.array(z19.string().regex(/^[0-9a-f]{8}$/)).min(1).max(4)
 });
 var BACKUP_ERROR_CODES = [
   "CLICKHOUSE_BACKUP_FAILED",
@@ -2480,48 +3196,48 @@ var BACKUP_ERROR_CODES = [
   "RESTORE_FAILED",
   "ROW_COUNT_MISMATCH"
 ];
-var backupReportSchema = z15.object({
+var backupReportSchema = z19.object({
   backup_id: backupIdSchema,
-  kind: z15.enum(BACKUP_KINDS),
-  status: z15.enum(["succeeded", "failed"]),
-  started_at: z15.string().datetime(),
-  finished_at: z15.string().datetime(),
+  kind: z19.enum(BACKUP_KINDS),
+  status: z19.enum(["succeeded", "failed"]),
+  started_at: z19.string().datetime(),
+  finished_at: z19.string().datetime(),
   manifest: backupManifestSchema.nullable(),
-  error_code: z15.enum(BACKUP_ERROR_CODES).nullable()
+  error_code: z19.enum(BACKUP_ERROR_CODES).nullable()
 });
-var drillReportSchema = z15.object({
+var drillReportSchema = z19.object({
   backup_id: backupIdSchema,
-  kind: z15.enum(["weekly_local", "monthly_new_machine"]),
-  status: z15.enum(["passed", "failed"]),
-  finished_at: z15.string().datetime(),
-  detail: z15.string().max(300),
-  error_code: z15.enum(BACKUP_ERROR_CODES).nullable()
-});
-var nodeIdentityEscrowSchema = z15.object({
-  v: z15.literal(1),
-  node_id: z15.guid(),
-  seal: z15.object({
-    publicKey: z15.string().regex(/^[A-Za-z0-9_-]{43}$/),
-    privateKey: z15.string().regex(/^[A-Za-z0-9_-]{43}$/)
-  }),
-  created_at: z15.string().datetime()
-});
-var restoreArgsSchema = z15.object({
-  job_id: z15.guid(),
-  workspace_id: z15.guid(),
-  source_node_id: z15.guid(),
+  kind: z19.enum(["weekly_local", "monthly_new_machine"]),
+  status: z19.enum(["passed", "failed"]),
+  finished_at: z19.string().datetime(),
+  detail: z19.string().max(300),
+  error_code: z19.enum(BACKUP_ERROR_CODES).nullable()
+});
+var nodeIdentityEscrowSchema = z19.object({
+  v: z19.literal(1),
+  node_id: z19.guid(),
+  seal: z19.object({
+    publicKey: z19.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    privateKey: z19.string().regex(/^[A-Za-z0-9_-]{43}$/)
+  }),
+  created_at: z19.string().datetime()
+});
+var restoreArgsSchema = z19.object({
+  job_id: z19.guid(),
+  workspace_id: z19.guid(),
+  source_node_id: z19.guid(),
   manifest: backupManifestSchema,
-  sealed_identity: z15.string().regex(/^[A-Za-z0-9_-]{40,2000}$/),
-  mode: z15.enum(["rebuild", "drill"])
+  sealed_identity: z19.string().regex(/^[A-Za-z0-9_-]{40,2000}$/),
+  mode: z19.enum(["rebuild", "drill"])
 });
-var restoreReportSchema = z15.object({
-  job_id: z15.guid(),
+var restoreReportSchema = z19.object({
+  job_id: z19.guid(),
   backup_id: backupIdSchema,
-  mode: z15.enum(["rebuild", "drill"]),
-  status: z15.enum(["succeeded", "failed"]),
-  finished_at: z15.string().datetime(),
-  detail: z15.string().max(300),
-  error_code: z15.enum(BACKUP_ERROR_CODES).nullable()
+  mode: z19.enum(["rebuild", "drill"]),
+  status: z19.enum(["succeeded", "failed"]),
+  finished_at: z19.string().datetime(),
+  detail: z19.string().max(300),
+  error_code: z19.enum(BACKUP_ERROR_CODES).nullable()
 });
 
 // ../src/shared/contracts/node-config.ts
@@ -2535,79 +3251,81 @@ var SCRUB_GROUPS = [
   "headers"
 ];
 var MAX_NODE_MONITORS = 5000;
-var kid = z16.string().regex(/^[A-Za-z0-9_-]{1,40}$/);
-var publicKey = z16.string().regex(/^[A-Za-z0-9_-]{43}$/);
-var nodeConfigSchema = z16.object({
-  v: z16.literal(1),
-  config_version: z16.number().int().positive(),
-  node_id: z16.guid(),
-  workspace_id: z16.guid(),
-  workspace_status: z16.enum(["active", "suspended"]),
-  issued_at: z16.string().datetime(),
-  retention_days: z16.number().int().min(1).max(3650),
-  channel: z16.enum(["stable", "canary"]).optional(),
-  projects: z16.array(z16.object({
-    project_id: z16.number().int().positive(),
-    slug: z16.string().max(64),
-    short_prefix: z16.string().regex(/^[A-Z0-9]{1,12}$/),
-    user_id_salt: z16.string().regex(/^[A-Za-z0-9_-]{22,64}$/),
-    scrub_disabled: z16.array(z16.enum(SCRUB_GROUPS)).max(SCRUB_GROUPS.length),
-    upload_tokens: z16.array(z16.object({
-      hash: z16.string().regex(/^[a-f0-9]{64}$/),
-      expires_at: z16.string().datetime()
+var kid = z20.string().regex(/^[A-Za-z0-9_-]{1,40}$/);
+var publicKey = z20.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var nodeConfigSchema = z20.object({
+  v: z20.literal(1),
+  config_version: z20.number().int().positive(),
+  node_id: z20.guid(),
+  workspace_id: z20.guid(),
+  workspace_status: z20.enum(["active", "suspended"]),
+  issued_at: z20.string().datetime(),
+  retention_days: z20.number().int().min(1).max(3650),
+  channel: z20.enum(["stable", "canary"]).optional(),
+  projects: z20.array(z20.object({
+    project_id: z20.number().int().positive(),
+    slug: z20.string().max(64),
+    short_prefix: z20.string().regex(/^[A-Z0-9]{1,12}$/),
+    user_id_salt: z20.string().regex(/^[A-Za-z0-9_-]{22,64}$/),
+    scrub_disabled: z20.array(z20.enum(SCRUB_GROUPS)).max(SCRUB_GROUPS.length),
+    upload_tokens: z20.array(z20.object({
+      hash: z20.string().regex(/^[a-f0-9]{64}$/),
+      expires_at: z20.string().datetime()
     })).max(10).optional()
   })).max(1000),
-  ticket_keys: z16.array(z16.object({ kid, public_key: publicKey, not_after: z16.string().datetime() })).min(1).max(5),
-  control_ops_keys: z16.array(z16.object({ kid, public_key: publicKey })).min(1).max(5),
-  kill_switches: z16.object({ ingest: z16.boolean(), alerts: z16.boolean() }),
+  ticket_keys: z20.array(z20.object({ kid, public_key: publicKey, not_after: z20.string().datetime() })).min(1).max(5),
+  control_ops_keys: z20.array(z20.object({ kid, public_key: publicKey })).min(1).max(5),
+  kill_switches: z20.object({ ingest: z20.boolean(), alerts: z20.boolean() }),
   backup: nodeBackupConfigSchema.optional(),
-  purged_projects: z16.array(z16.number().int().positive()).max(1000).optional(),
-  monitors: z16.array(monitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
-  purged_monitors: z16.array(z16.guid()).max(5000).optional(),
-  telemetry: z16.object({
-    traces_retention_days: z16.number().int().min(1).max(90),
-    logs_retention_days: z16.number().int().min(1).max(90),
-    traces_disk_share: z16.number().min(0.2).max(0.8)
+  purged_projects: z20.array(z20.number().int().positive()).max(1000).optional(),
+  monitors: z20.array(monitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
+  purged_monitors: z20.array(z20.guid()).max(5000).optional(),
+  telemetry: z20.object({
+    traces_retention_days: z20.number().int().min(1).max(90),
+    logs_retention_days: z20.number().int().min(1).max(90),
+    traces_disk_share: z20.number().min(0.2).max(0.8)
   }).optional(),
-  slos: z16.array(nodeSloSchema).max(SLO_LIMITS.maxNodeSlos).optional()
+  slos: z20.array(nodeSloSchema).max(SLO_LIMITS.maxNodeSlos).optional(),
+  signal_monitors: z20.array(signalMonitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
+  signal_limits: signalLimitsConfigSchema.optional()
 });
-var signedNodeConfigSchema = z16.object({ config: nodeConfigSchema, kid, sig: z16.string() });
+var signedNodeConfigSchema = z20.object({ config: nodeConfigSchema, kid, sig: z20.string() });
 
 // ../src/shared/contracts/api-ops/projects.ts
-var slug = z17.string().regex(/^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$/);
-var name3 = z17.string().trim().min(1).max(60);
-var label = z17.string().trim().min(1).max(40);
-var platform = z17.enum(PLATFORMS);
-var origin = z17.string().trim().toLowerCase().regex(/^https?:\/\/[a-z0-9.-]+(:[0-9]{1,5})?$/).max(200);
-var keyId = z17.number().int().positive();
+var slug = z21.string().regex(/^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$/);
+var name3 = z21.string().trim().min(1).max(60);
+var label = z21.string().trim().min(1).max(40);
+var platform = z21.enum(PLATFORMS);
+var origin = z21.string().trim().toLowerCase().regex(/^https?:\/\/[a-z0-9.-]+(:[0-9]{1,5})?$/).max(200);
+var keyId = z21.number().int().positive();
 var PROJECT_INPUTS = {
-  create: z17.object({ workspaceId: uuid, name: name3, slug, platform }),
-  update: z17.object({ projectId, name: name3, platform, isPinned: z17.boolean() }),
-  updateIntake: z17.object({
+  create: z21.object({ workspaceId: uuid, name: name3, slug, platform }),
+  update: z21.object({ projectId, name: name3, platform, isPinned: z21.boolean() }),
+  updateIntake: z21.object({
     projectId,
-    rateLimit: z17.number().int().positive().nullable(),
-    burst: z17.number().int().positive().nullable(),
-    allowedOrigins: z17.array(origin).max(50)
+    rateLimit: z21.number().int().positive().nullable(),
+    burst: z21.number().int().positive().nullable(),
+    allowedOrigins: z21.array(origin).max(50)
   }),
-  updateObservability: z17.object({
+  updateObservability: z21.object({
     projectId,
-    primaryEnvironment: z17.string().trim().min(1).max(64).refine((v) => v !== "*" && ENVIRONMENT_RE.test(v)),
-    allowCodeMonitors: z17.boolean()
+    primaryEnvironment: z21.string().trim().min(1).max(64).refine((v) => v !== "*" && ENVIRONMENT_RE.test(v)),
+    allowCodeMonitors: z21.boolean()
   }),
-  setScrub: z17.object({ projectId, group: z17.enum(SCRUB_GROUPS), enabled: z17.boolean() }),
-  setCheckinAuth: z17.object({ projectId, mode: z17.enum(CHECKIN_AUTH_MODES) }),
-  setEnvironmentHidden: z17.object({
+  setScrub: z21.object({ projectId, group: z21.enum(SCRUB_GROUPS), enabled: z21.boolean() }),
+  setCheckinAuth: z21.object({ projectId, mode: z21.enum(CHECKIN_AUTH_MODES) }),
+  setEnvironmentHidden: z21.object({
     projectId,
-    name: z17.string().min(1).max(64),
-    hidden: z17.boolean()
-  }),
-  scheduleDeletion: z17.object({ projectId, confirmSlug: slug }),
-  projectOnly: z17.object({ projectId }),
-  labelled: z17.object({ projectId, label }),
-  keyOnly: z17.object({ keyId }),
-  tokenOnly: z17.object({ tokenId: keyId }),
+    name: z21.string().min(1).max(64),
+    hidden: z21.boolean()
+  }),
+  scheduleDeletion: z21.object({ projectId, confirmSlug: slug }),
+  projectOnly: z21.object({ projectId }),
+  labelled: z21.object({ projectId, label }),
+  keyOnly: z21.object({ keyId }),
+  tokenOnly: z21.object({ tokenId: keyId }),
   createIngestKey: createIngestKeyInputSchema,
-  ingestKeyOnly: z17.object({ keyId: uuid })
+  ingestKeyOnly: z21.object({ keyId: uuid })
 };
 var P = PROJECT_INPUTS;
 var PROJECT_OPERATIONS = [
@@ -2862,23 +3580,28 @@ var PROJECT_OPERATIONS = [
 ];
 
 // ../src/shared/contracts/api-ops/reads.ts
-import { z as z18 } from "zod";
-var list = z18.object({ workspaceId: uuid, limit: pageLimit, cursor });
+import { z as z22 } from "zod";
+var list = z22.object({ workspaceId: uuid, limit: pageLimit, cursor });
 var READ_INPUTS = {
-  workspace: z18.object({ workspaceId: uuid }),
+  workspace: z22.object({ workspaceId: uuid }),
   list,
-  projectsGet: z18.object({ workspaceId: uuid, projectId }),
+  projectsGet: z22.object({ workspaceId: uuid, projectId }),
   monitorsList: list.extend({ projectId: projectId.optional() }),
-  monitorsGet: z18.object({ workspaceId: uuid, monitorId: uuid }),
-  uptimeGet: z18.object({ workspaceId: uuid, checkId: uuid }),
-  slosGet: z18.object({ workspaceId: uuid, sloId: uuid }),
+  monitorsGet: z22.object({ workspaceId: uuid, monitorId: uuid }),
+  uptimeGet: z22.object({ workspaceId: uuid, checkId: uuid }),
+  slosGet: z22.object({ workspaceId: uuid, sloId: uuid }),
   alertsList: list.extend({
-    state: z18.enum(["open", "resolved", "all"]).default("all"),
+    state: z22.enum(["open", "resolved", "all"]).default("all"),
     monitorId: uuid.optional()
+  }),
+  approvalsGet: z22.object({ workspaceId: uuid, approvalId: uuid }),
+  monitorsListTyped: list.extend({
+    projectId: projectId.optional(),
+    type: z22.enum(MONITOR_TYPES).optional()
   })
 };
 var R = READ_INPUTS;
-var base = {
+var base2 = {
   sensitivity: "normal",
   kind: "read",
   method: "GET",
@@ -2888,7 +3611,7 @@ var base = {
 };
 var READ_OPERATIONS = [
   op({
-    ...base,
+    ...base2,
     id: "workspace.get",
     path: "/v1/workspace",
     scope: "org:read",
@@ -2898,7 +3621,7 @@ var READ_OPERATIONS = [
     summary: "The token's workspace, plan and the caller's role."
   }),
   op({
-    ...base,
+    ...base2,
     id: "members.list",
     path: "/v1/members",
     scope: "members:read",
@@ -2909,7 +3632,7 @@ var READ_OPERATIONS = [
     summary: "Workspace members and their roles."
   }),
   op({
-    ...base,
+    ...base2,
     id: "projects.list",
     path: "/v1/projects",
     scope: "projects:read",
@@ -2920,7 +3643,7 @@ var READ_OPERATIONS = [
     summary: "Projects the token can see."
   }),
   op({
-    ...base,
+    ...base2,
     id: "projects.get",
     path: "/v1/projects/{project_id}",
     scope: "projects:read",
@@ -2930,18 +3653,18 @@ var READ_OPERATIONS = [
     summary: "One project."
   }),
   op({
-    ...base,
+    ...base2,
     id: "monitors.list",
     path: "/v1/monitors",
     scope: "monitors:read",
     rpcs: ["api_read_monitors"],
-    input: R.monitorsList,
+    input: R.monitorsListTyped,
     paged: true,
     mcp: "investigate",
-    summary: "Cron and heartbeat monitors."
+    summary: "Monitors of every type (cron, heartbeat, count, assertion, deadline, progress); `type` narrows the list."
   }),
   op({
-    ...base,
+    ...base2,
     id: "monitors.get",
     path: "/v1/monitors/{monitor_id}",
     scope: "monitors:read",
@@ -2951,7 +3674,7 @@ var READ_OPERATIONS = [
     summary: "One monitor with its ETag."
   }),
   op({
-    ...base,
+    ...base2,
     id: "uptime.list",
     path: "/v1/uptime-checks",
     scope: "monitors:read",
@@ -2962,7 +3685,7 @@ var READ_OPERATIONS = [
     summary: "Uptime checks (header values are never returned)."
   }),
   op({
-    ...base,
+    ...base2,
     id: "uptime.get",
     path: "/v1/uptime-checks/{check_id}",
     scope: "monitors:read",
@@ -2972,7 +3695,7 @@ var READ_OPERATIONS = [
     summary: "One uptime check."
   }),
   op({
-    ...base,
+    ...base2,
     id: "slos.list",
     path: "/v1/slos",
     scope: "monitors:read",
@@ -2983,7 +3706,7 @@ var READ_OPERATIONS = [
     summary: "SLO definitions."
   }),
   op({
-    ...base,
+    ...base2,
     id: "slos.get",
     path: "/v1/slos/{slo_id}",
     scope: "monitors:read",
@@ -2993,7 +3716,7 @@ var READ_OPERATIONS = [
     summary: "One SLO definition."
   }),
   op({
-    ...base,
+    ...base2,
     id: "alert_rules.list",
     path: "/v1/alert-rules",
     scope: "alerts:read",
@@ -3004,7 +3727,7 @@ var READ_OPERATIONS = [
     summary: "Alert rules."
   }),
   op({
-    ...base,
+    ...base2,
     id: "destinations.list",
     path: "/v1/destinations",
     scope: "alerts:read",
@@ -3015,7 +3738,7 @@ var READ_OPERATIONS = [
     summary: "Alert destinations with a masked hint; secrets never leave the server."
   }),
   op({
-    ...base,
+    ...base2,
     id: "alerts.list",
     path: "/v1/alerts",
     scope: "alerts:read",
@@ -3026,7 +3749,18 @@ var READ_OPERATIONS = [
     summary: "Alerts: one row per violation episode of a monitor, open or resolved."
   }),
   op({
-    ...base,
+    ...base2,
+    id: "maintenance.list",
+    path: "/v1/maintenance-windows",
+    scope: "monitors:read",
+    rpcs: ["api_read_maintenance_windows"],
+    input: R.list,
+    paged: true,
+    mcp: "reliability",
+    summary: "Maintenance windows and whether each is active now."
+  }),
+  op({
+    ...base2,
     id: "node.get",
     path: "/v1/node",
     scope: "org:read",
@@ -3036,7 +3770,7 @@ var READ_OPERATIONS = [
     summary: "The node's state, versions and last heartbeat (null before provisioning)."
   }),
   op({
-    ...base,
+    ...base2,
     id: "usage.get",
     path: "/v1/usage",
     scope: "usage:read",
@@ -3046,7 +3780,7 @@ var READ_OPERATIONS = [
     summary: "The workspace's plan and limits."
   }),
   op({
-    ...base,
+    ...base2,
     id: "audit.list",
     path: "/v1/audit-log",
     scope: "audit:read",
@@ -3055,6 +3789,16 @@ var READ_OPERATIONS = [
     paged: true,
     mcp: "investigate",
     summary: "Audit log, newest first (admins)."
+  }),
+  op({
+    ...base2,
+    id: "approvals.get",
+    path: "/v1/approvals/{approval_id}",
+    scope: "org:read",
+    rpcs: ["api_read_approval"],
+    input: R.approvalsGet,
+    mcp: "configure",
+    summary: "State of an approval this token asked for (admins: any in the workspace): pending, approved, executed, rejected, expired or failed, with its result ids."
   })
 ];
 
@@ -3064,6 +3808,7 @@ var API_OPERATIONS = [
   ...PROJECT_OPERATIONS,
   ...MONITOR_OPERATIONS,
   ...ALERT_OPERATIONS,
+  ...INCIDENT_OPERATIONS,
   ...ACCESS_OPERATIONS,
   ...NODE_OPERATIONS
 ];
@@ -3071,13 +3816,279 @@ var BY_ID = new Map(API_OPERATIONS.map((o) => [o.id, o]));
 function apiOperation(id) {
   return BY_ID.get(id);
 }
+function pathParams(path) {
+  return [...path.matchAll(/\{([a-z_]+)\}/g)].map((m) => m[1]);
+}
+
+// ../src/shared/contracts/approvals.ts
+var APPROVAL_STATES = ["pending", "approved", "executed", "rejected", "expired", "failed"];
+var APPROVAL_LIMITS = {
+  ttlMinutes: 15,
+  stepUpMaxAgeSeconds: 600,
+  pendingPerWorkspace: 20,
+  paramsMaxBytes: 16 * 1024,
+  decisionNoteMax: 500,
+  notifyMaxRecipients: 10
+};
+var APPROVAL_APPROVER = {
+  "projects.set_checkin_auth": "admin",
+  "projects.schedule_deletion": "admin",
+  "project_keys.create": "member",
+  "project_keys.rotate": "member",
+  "project_keys.revoke": "member",
+  "upload_tokens.create": "member",
+  "upload_tokens.revoke": "member",
+  "ingest_keys.create": "admin",
+  "ingest_keys.revoke": "admin",
+  "ping_tokens.rotate": "admin",
+  "ping_tokens.revoke_previous": "admin",
+  "ping_tokens.reset": "admin",
+  "destinations.create": "admin",
+  "destinations.update": "admin",
+  "destinations.update_connection": "admin",
+  "destinations.delete": "admin",
+  "destinations.set_recipients": "admin",
+  "members.change_role": "admin",
+  "members.remove": "admin",
+  "invites.create": "admin",
+  "tokens.create_personal": "self",
+  "tokens.create_service": "admin",
+  "tokens.set_policy": "admin",
+  "service_principals.create": "admin",
+  "service_principals.update": "admin",
+  "node.provision": "admin",
+  "node.resize": "admin",
+  "node.schedule_deletion": "owner",
+  "node.set_backup_custody": "owner",
+  "node.rebuild": "owner",
+  "node.submit_recovery_kit": "owner"
+};
+var APPROVAL_HUMAN_FIELDS = {
+  "projects.schedule_deletion": ["confirmSlug"],
+  "node.schedule_deletion": ["confirmName"],
+  "node.rebuild": ["confirmName"]
+};
+var APPROVAL_SETUP_OPS = ["destinations.create", "destinations.update_connection"];
+function approvalRequestSchema(operationId, input) {
+  const human = APPROVAL_HUMAN_FIELDS[operationId] ?? [];
+  if (!human.length)
+    return input;
+  return input.omit(Object.fromEntries(human.map((k) => [k, true])));
+}
 
 // ../src/shared/contracts/api-ops/wire.ts
-import { z as z19 } from "zod";
+import { z as z23 } from "zod";
 var toSnake = (s) => s.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
+var toCamel = (s) => s.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
 var schemaCache = new WeakMap;
+function inputJsonSchema(op) {
+  let js = schemaCache.get(op.input);
+  if (!js) {
+    js = z23.toJSONSchema(op.input, { io: "input", unrepresentable: "any" });
+    schemaCache.set(op.input, js);
+  }
+  return js;
+}
+function variants(js) {
+  return [js, ...js.anyOf ?? [], ...js.oneOf ?? [], ...js.allOf ?? []];
+}
+function propertyMap(js) {
+  const out = new Map;
+  if (!js)
+    return out;
+  for (const v of variants(js)) {
+    for (const [name, schema] of Object.entries(v.properties ?? {}))
+      out.set(toSnake(name), { name, schema });
+  }
+  return out;
+}
+function itemSchema(js) {
+  if (!js)
+    return;
+  for (const v of variants(js)) {
+    if (v.items && !Array.isArray(v.items))
+      return v.items;
+  }
+  return;
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function camelize(value, js) {
+  if (Array.isArray(value))
+    return value.map((v) => camelize(v, itemSchema(js)));
+  if (!isPlainObject(value))
+    return value;
+  const props = propertyMap(js);
+  if (props.size === 0)
+    return value;
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    const p = props.get(k);
+    out[p ? p.name : k] = p ? camelize(v, p.schema) : v;
+  }
+  return out;
+}
+function snakeSchema(js, drop = []) {
+  const out = { ...js };
+  if (js.properties) {
+    out.properties = Object.fromEntries(Object.entries(js.properties).filter(([k]) => !drop.includes(k)).map(([k, v]) => [toSnake(k), snakeSchema(v)]));
+    if (js.required)
+      out.required = js.required.filter((k) => !drop.includes(k)).map(toSnake);
+    if (out.required && !out.required.length)
+      delete out.required;
+  }
+  if (js.items && !Array.isArray(js.items))
+    out.items = snakeSchema(js.items);
+  for (const key of ["anyOf", "oneOf", "allOf"]) {
+    if (js[key])
+      out[key] = js[key].map((v) => snakeSchema(v, drop));
+  }
+  if (isPlainObject(js.additionalProperties))
+    out.additionalProperties = snakeSchema(js.additionalProperties);
+  return out;
+}
+function scalarType(js) {
+  if (!js)
+    return;
+  for (const v of variants(js)) {
+    const t = Array.isArray(v.type) ? v.type.find((x) => x !== "null") : v.type;
+    if (t)
+      return t;
+  }
+  return;
+}
+function coerce(raw, js) {
+  const t = scalarType(js);
+  if ((t === "integer" || t === "number") && /^-?\d+(\.\d+)?$/.test(raw))
+    return Number(raw);
+  if (t === "boolean" && (raw === "true" || raw === "false"))
+    return raw === "true";
+  return raw;
+}
+function buildOpInput(op, req, workspaceId) {
+  const js = inputJsonSchema(op);
+  const top = propertyMap(js);
+  const out = {};
+  const nested = {};
+  const bodyKey = op.bodyField ? toSnake(op.bodyField) : null;
+  const body = isPlainObject(req.body) ? req.body : req.body === undefined || req.body === null ? {} : null;
+  if (body === null) {
+    out["__invalidBody"] = true;
+    return out;
+  }
+  for (const [k, v] of Object.entries(body)) {
+    const p = top.get(k);
+    if (p && k !== bodyKey)
+      out[p.name] = camelize(v, p.schema);
+    else if (bodyKey)
+      nested[k] = v;
+    else
+      out[k] = v;
+  }
+  if (op.bodyField)
+    out[op.bodyField] = camelize(nested, top.get(bodyKey)?.schema);
+  for (const [k, raw] of Object.entries(req.query)) {
+    const p = top.get(k);
+    if (p)
+      out[p.name] = coerce(raw, p.schema);
+  }
+  for (const name of pathParams(op.path)) {
+    const p = top.get(name);
+    const raw = req.path[name];
+    if (p && raw !== undefined)
+      out[p.name] = coerce(raw, p.schema);
+  }
+  if (op.workspace)
+    out["workspaceId"] = workspaceId;
+  return out;
+}
+function wirePointer(op, path) {
+  const segs = path.map((p) => typeof p === "string" ? toSnake(p) : String(p));
+  if (op.bodyField && segs[0] === toSnake(op.bodyField))
+    segs.shift();
+  return `/${segs.map((s) => s.replace(/~/g, "~0").replace(/\//g, "~1")).join("/")}`;
+}
+var WIRE_ERRORS_MAX = 20;
+function wireErrors(op, error) {
+  const flat = (issues, prefix) => issues.flatMap((i) => {
+    if (i.code === "invalid_union" && i.errors && i.errors.length > 0) {
+      const best = i.errors.reduce((a, b) => b.length < a.length ? b : a);
+      if (best.length > 0)
+        return flat(best, [...prefix, ...i.path]);
+    }
+    return [{ ...i, path: [...prefix, ...i.path] }];
+  });
+  return flat(error.issues, []).slice(0, WIRE_ERRORS_MAX).map((i) => ({ pointer: wirePointer(op, i.path), code: i.code }));
+}
+
+// ../src/shared/contracts/api-ops/openapi.ts
+function clean(js) {
+  const { $schema: _drop, ...rest } = js;
+  return rest;
+}
+function propertyOf(js, camel) {
+  return clean(snakeSchema(js.properties?.[camel] ?? {}));
+}
+function requestSchema(op) {
+  const js = inputJsonSchema(op);
+  const path = pathParams(op.path).map(toCamel);
+  const drop = ["workspaceId", ...path];
+  if (!op.bodyField) {
+    const s = clean(snakeSchema(js, drop));
+    return s.properties && Object.keys(s.properties).length === 0 && !s.anyOf && !s.oneOf ? null : s;
+  }
+  const outer = clean(snakeSchema(js, [...drop, op.bodyField]));
+  const inner = clean(snakeSchema(js.properties?.[op.bodyField] ?? {}));
+  if (!inner.properties)
+    return { allOf: [outer, inner] };
+  return {
+    ...inner,
+    properties: { ...outer.properties ?? {}, ...inner.properties },
+    required: [...outer.required ?? [], ...inner.required ?? []]
+  };
+}
+function operationArgsSchema(op, drop = []) {
+  const js = inputJsonSchema(op);
+  const path = pathParams(op.path);
+  const pathProps = Object.fromEntries(path.map((n) => [n, propertyOf(js, toCamel(n))]));
+  const rest = op.method === "GET" ? (() => {
+    const s = clean(snakeSchema(js, ["workspaceId", ...path.map(toCamel)]));
+    return { ...s, required: [] };
+  })() : requestSchema(op);
+  if (rest && !rest.properties) {
+    return { type: "object", properties: pathProps, required: path, allOf: [rest] };
+  }
+  const props = { ...pathProps, ...rest?.properties ?? {} };
+  for (const d of drop)
+    delete props[d];
+  const required = [...path, ...rest?.required ?? []].filter((k) => !drop.includes(k));
+  return {
+    type: "object",
+    properties: props,
+    ...required.length ? { required: [...new Set(required)] } : {},
+    additionalProperties: false
+  };
+}
 
 // ../src/shared/contracts/mcp-tools.ts
+function wireFromArgs(op, args) {
+  const names = new Set(pathParams(op.path));
+  const path = {};
+  const query = {};
+  const body = {};
+  for (const [k, v] of Object.entries(args)) {
+    if (v === undefined || v === null)
+      continue;
+    if (names.has(k))
+      path[k] = String(v);
+    else if (op.method === "GET")
+      query[k] = typeof v === "string" ? v : JSON.stringify(v);
+    else
+      body[k] = v;
+  }
+  return { path, query, body: op.method === "GET" ? undefined : body };
+}
 function wireInput(operationId, opts = {}) {
   const op = apiOperation(operationId);
   if (!op)
@@ -3087,7 +4098,7 @@ function wireInput(operationId, opts = {}) {
   for (const [k, v] of Object.entries(op.input.shape))
     if (!omit.has(k))
       shape[toSnake(k)] = v;
-  return z20.object(shape);
+  return z24.object(shape);
 }
 var BUDGETS = [
   { stringBytes: MCP_LIMITS.untrustedStringMaxBytes, listMax: MCP_LIMITS.listMax },
@@ -3177,27 +4188,40 @@ function errorResult(o) {
     }
   };
 }
-var TOOL_OUTPUT_SCHEMA = z20.object({
-  untrusted: z20.object({
-    data: z20.unknown(),
-    provenance: z20.object({
-      source: z20.enum(["node", "control_plane", "docs"]),
-      operations: z20.array(z20.string())
+var TOOL_OUTPUT_SCHEMA = z24.object({
+  untrusted: z24.object({
+    data: z24.unknown(),
+    provenance: z24.object({
+      source: z24.enum(["node", "control_plane", "docs"]),
+      operations: z24.array(z24.string())
     })
   }).optional(),
-  doc: z20.object({ slug: z20.string(), locale: z20.enum(["en", "vi"]), url: z20.string(), markdown: z20.string(), truncated: z20.boolean() }).optional(),
-  results: z20.array(z20.object({ slug: z20.string(), title: z20.string(), description: z20.string(), section: z20.string(), url: z20.string() })).optional(),
-  next_cursor: z20.string().nullable().optional(),
-  complete: z20.boolean().optional(),
-  omitted: z20.array(z20.object({ part: z20.string(), reason: z20.string(), scope: z20.string().optional() })).optional(),
-  truncated: z20.literal(true).optional(),
-  suspicious_unicode: z20.literal(true).optional(),
-  error: z20.object({
-    code: z20.string(),
-    status: z20.number(),
-    detail: z20.string().optional(),
-    scope: z20.string().optional(),
-    retry_after: z20.number().optional()
+  doc: z24.object({ slug: z24.string(), locale: z24.enum(["en", "vi"]), url: z24.string(), markdown: z24.string(), truncated: z24.boolean() }).optional(),
+  results: z24.array(z24.object({ slug: z24.string(), title: z24.string(), description: z24.string(), section: z24.string(), url: z24.string() })).optional(),
+  next_cursor: z24.string().nullable().optional(),
+  complete: z24.boolean().optional(),
+  omitted: z24.array(z24.object({ part: z24.string(), reason: z24.string(), scope: z24.string().optional() })).optional(),
+  truncated: z24.literal(true).optional(),
+  suspicious_unicode: z24.literal(true).optional(),
+  error: z24.object({
+    code: z24.string(),
+    status: z24.number(),
+    detail: z24.string().optional(),
+    scope: z24.string().optional(),
+    retry_after: z24.number().optional()
+  }).optional(),
+  operations: z24.array(z24.record(z24.string(), z24.unknown())).optional(),
+  operation: z24.record(z24.string(), z24.unknown()).optional(),
+  plan: z24.record(z24.string(), z24.unknown()).optional(),
+  status: z24.enum(["done", "approval_required", "approval_pending", ...APPROVAL_STATES]).optional(),
+  approval: z24.object({
+    approval_id: z24.string(),
+    approval_url: z24.string(),
+    expires_at: z24.string(),
+    state: z24.enum(APPROVAL_STATES),
+    result_code: z24.string().nullable().optional(),
+    result: z24.record(z24.string(), z24.unknown()).optional(),
+    next: z24.string().optional()
   }).optional()
 });
 var spec = (name) => {
@@ -3243,22 +4267,95 @@ var has = (rt, operationId) => {
   return !!op && rt.scopes.includes(op.scope);
 };
 var isoWindow = {
-  start: z20.string().max(40).describe("RFC 3339 start of the window, e.g. 2026-10-26T00:00:00Z. Required with end."),
-  end: z20.string().max(40).describe("RFC 3339 end of the window. The plan limits its length.")
+  start: z24.string().max(40).describe("RFC 3339 start of the window, e.g. 2026-10-26T00:00:00Z. Required with end."),
+  end: z24.string().max(40).describe("RFC 3339 end of the window. The plan limits its length.")
 };
-var traceIdSchema = z20.string().regex(/^[0-9a-fA-F]{32}$/);
+var traceIdSchema = z24.string().regex(/^[0-9a-fA-F]{32}$/);
 var MONITOR_KINDS2 = {
   cron: { list: "monitors.list", get: "monitors.get", idField: "monitor_id" },
   uptime: { list: "uptime.list", get: "uptime.get", idField: "check_id" },
   slo: { list: "slos.list", get: "slos.get", idField: "slo_id" }
 };
+var DESTRUCTIVE_VERBS = new Set([
+  "delete",
+  "revoke",
+  "remove",
+  "schedule_deletion",
+  "rotate",
+  "reset",
+  "revoke_previous",
+  "rebuild",
+  "change_role"
+]);
+function configureOperations() {
+  return API_OPERATIONS.filter((o) => o.mcp === "configure");
+}
+function configureOp(id) {
+  if (typeof id !== "string")
+    return null;
+  const op = apiOperation(id);
+  return op && op.mcp === "configure" ? op : null;
+}
+function isDestructiveOperation(op) {
+  return op.method === "DELETE" || DESTRUCTIVE_VERBS.has(op.id.slice(op.id.indexOf(".") + 1));
+}
+var humanWire = (op) => (APPROVAL_HUMAN_FIELDS[op.id] ?? []).map(toSnake);
+function resourceRead(op) {
+  if (op.method === "GET")
+    return null;
+  return API_OPERATIONS.find((o) => o.method === "GET" && o.path === op.path && o.kind !== "node") ?? null;
+}
+var PLACEHOLDER_WS = "00000000-0000-0000-0000-000000000000";
+function validateConfigure(op, params) {
+  for (const f of humanWire(op))
+    if (f in params)
+      return { ok: false, errors: [{ pointer: `/${f}`, code: "typed_by_approver" }] };
+  const input = buildOpInput(op, wireFromArgs(op, params), PLACEHOLDER_WS);
+  if (input["__invalidBody"])
+    return { ok: false, errors: [{ pointer: "", code: "object_expected" }] };
+  const schema = op.sensitivity === "approval" ? approvalRequestSchema(op.id, op.input) : op.input;
+  const r = schema.safeParse(input);
+  if (r.success)
+    return { ok: true };
+  return {
+    ok: false,
+    errors: wireErrors(op, r.error)
+  };
+}
+function describe(op, scopes) {
+  return {
+    operation_id: op.id,
+    summary: op.summary,
+    method: op.method,
+    path: op.path,
+    scope: op.scope,
+    scope_held: scopes.includes(op.scope),
+    requires_approval: op.sensitivity === "approval",
+    destructive: isDestructiveOperation(op)
+  };
+}
+var params = z24.record(z24.string(), z24.unknown()).default({}).describe("Operation fields in wire names (snake_case), as describe_operation's args_schema shows.");
+var operationIdArg = z24.string().min(3).max(80).describe("An operation id from search_operations, e.g. `monitors.update`.");
+function approvalBlock(t, next) {
+  return {
+    approval_id: t.approval_id,
+    approval_url: t.approval_url,
+    expires_at: t.expires_at,
+    state: t.state,
+    ...t.result_code !== undefined ? { result_code: t.result_code } : {},
+    ...t.result !== undefined ? { result: t.result } : {},
+    next
+  };
+}
+var NEXT_PENDING = "A person with the right role must approve this on belvador.dev (open approval_url; it needs their authenticator code). Nothing has changed yet. Show the link to the user, then call get_operation with approval_id, or apply_change again with the same idempotency_key to get the result.";
+var NEXT_SETUP = "The approving person also types the secret (bot token, webhook URL, password) on that page; it never passes through the agent.";
 var MCP_TOOL_DEFS = [
   {
     ...spec("get_workspace"),
     title: "Workspace and node",
     description: "The workspace this token belongs to (name, plan, limits) and the state of its node, the server that stores errors, traces and logs. Start here to learn what the token can reach.",
     operations: ["workspace.get", "node.get"],
-    input: z20.object({}),
+    input: z24.object({}),
     async run(_args, rt) {
       const [ws, node] = await Promise.all([rt.call("workspace.get", {}), rt.call("node.get", {})]);
       if (!ws.ok)
@@ -3276,9 +4373,9 @@ var MCP_TOOL_DEFS = [
     title: "Get an issue",
     description: "One issue with its 24 h and 30 d counts and, when the token can read events, its latest event (stack trace, request, breadcrumbs — scrubbed on the node).",
     operations: ["issues.get", "events.get"],
-    input: z20.object({
-      issue_id: z20.number().int().positive().describe("Issue id from search_issues."),
-      include_latest_event: z20.boolean().default(true)
+    input: z24.object({
+      issue_id: z24.number().int().positive().describe("Issue id from search_issues."),
+      include_latest_event: z24.boolean().default(true)
     }),
     async run(args, rt) {
       const omitted = [];
@@ -3306,9 +4403,9 @@ var MCP_TOOL_DEFS = [
     title: "Get a trace",
     description: "Summary of one distributed trace (services, duration, errors) by its 32-hex trace id, and optionally its spans (errors only, or the first page).",
     operations: ["traces.get", "traces.spans"],
-    input: z20.object({
+    input: z24.object({
       trace_id: traceIdSchema.describe("W3C trace id, 32 hex characters."),
-      spans: z20.enum(["none", "errors", "all"]).default("none")
+      spans: z24.enum(["none", "errors", "all"]).default("none")
     }),
     async run(args, rt) {
       const sum = await rt.call("traces.get", { trace_id: args["trace_id"] });
@@ -3336,11 +4433,11 @@ var MCP_TOOL_DEFS = [
     title: "Correlate by trace or run",
     description: "Everything that shares one W3C trace id or one Belvador run id (`belvador.run.id`, set by job monitors) in a time window: the trace summary, its error spans and the logs. Give exactly one of trace_id or run_id.",
     operations: ["traces.get", "traces.spans", "spans.list", "logs.list"],
-    input: z20.object({
+    input: z24.object({
       trace_id: traceIdSchema.optional(),
-      run_id: z20.string().min(1).max(128).optional(),
+      run_id: z24.string().min(1).max(128).optional(),
       ...isoWindow,
-      project: z20.string().max(2000).optional().describe("Comma-separated project ids.")
+      project: z24.string().max(2000).optional().describe("Comma-separated project ids.")
     }),
     async run(args, rt) {
       const trace = args["trace_id"];
@@ -3383,12 +4480,12 @@ var MCP_TOOL_DEFS = [
   {
     ...spec("list_monitors"),
     title: "List monitors",
-    description: "Cron/heartbeat monitors, uptime checks and SLOs with their current status. `kind` narrows to one family; `project_id` to one project (cron and uptime).",
+    description: "Monitors (cron, heartbeat, count, assertion, deadline, progress), uptime checks and SLOs with their current status. `kind` narrows to one family; `project_id` to one project (cron and uptime).",
     operations: ["monitors.list", "uptime.list", "slos.list"],
-    input: z20.object({
-      kind: z20.enum(["all", "cron", "uptime", "slo"]).default("all"),
-      project_id: z20.number().int().positive().optional(),
-      limit: z20.number().int().min(1).max(200).default(50)
+    input: z24.object({
+      kind: z24.enum(["all", "cron", "uptime", "slo"]).default("all"),
+      project_id: z24.number().int().positive().optional(),
+      limit: z24.number().int().min(1).max(200).default(50)
     }),
     async run(args, rt) {
       const kinds = args["kind"] && args["kind"] !== "all" ? [args["kind"]] : ["cron", "uptime", "slo"];
@@ -3414,26 +4511,69 @@ var MCP_TOOL_DEFS = [
   {
     ...spec("get_monitor_status"),
     title: "Get a monitor",
-    description: "One cron monitor, uptime check or SLO by id: settings, current status and recent results.",
-    operations: ["monitors.get", "uptime.get", "slos.get"],
-    input: z20.object({ kind: z20.enum(["cron", "uptime", "slo"]), id: z20.guid() }),
+    description: "One monitor (any type), uptime check or SLO by id: settings, current status and recent results. For count, assertion, deadline and progress monitors it adds the last 24 h of minute counts or runs from the node, and for deadline monitors the newest occurrences. `backtest: true` (count/assertion only) also replays the current settings over the last 30 days: how often it would have alerted.",
+    operations: ["monitors.get", "uptime.get", "slos.get", "monitors.signal", "monitors.occurrences", "monitors.backtest"],
+    input: z24.object({
+      kind: z24.enum(["cron", "uptime", "slo"]),
+      id: z24.guid(),
+      backtest: z24.boolean().default(false)
+    }),
     async run(args, rt) {
       const k = MONITOR_KINDS2[args["kind"]];
       const r = await rt.call(k.get, { [k.idField]: args["id"] });
       if (!r.ok)
         return errorResult(r);
-      return wrapResult({ data: r.body, operations: [k.get], source: "control_plane" });
+      const row = r.body ?? {};
+      const type = typeof row["type"] === "string" ? row["type"] : "job";
+      if (k.get !== "monitors.get" || !isSignalMonitorType(type)) {
+        return wrapResult({ data: r.body, operations: [k.get], source: "control_plane" });
+      }
+      const ops = [k.get, "monitors.signal"];
+      const calls = [
+        rt.call("monitors.signal", { monitor_id: args["id"], hours: 24 })
+      ];
+      const parts = ["signal"];
+      if (type === "deadline") {
+        ops.push("monitors.occurrences");
+        parts.push("occurrences");
+        calls.push(rt.call("monitors.occurrences", { monitor_id: args["id"], state: "all" }));
+      }
+      const settings = args["backtest"] === true && (type === "count" || type === "assertion") ? settingsFromRow({
+        type,
+        signal_settings: row["signal_settings"],
+        expected_environments: Array.isArray(row["expected_environments"]) ? row["expected_environments"] : [],
+        severity: String(row["severity"] ?? "medium"),
+        recovery_threshold: Number(row["recovery_threshold"] ?? 1)
+      }) : null;
+      if (settings) {
+        ops.push("monitors.backtest");
+        parts.push("backtest");
+        calls.push(rt.call("monitors.backtest", { project: row["project_id"], settings }));
+      }
+      const answers = await Promise.all(calls);
+      const data = { monitor: r.body };
+      const omitted = [];
+      for (const [i, part] of parts.entries()) {
+        const a = answers[i];
+        if (a.ok)
+          data[part] = part === "occurrences" ? withoutPaging(a.body) : a.body;
+        else
+          omitted.push({ part, reason: a.code });
+      }
+      return wrapResult({ data, operations: ops, source: omitted.length === parts.length ? "control_plane" : "node" }, { omitted });
     }
   },
   single("list_alerts", "alerts.list", "List alerts", "Alerts Belvador raised (open, resolved or all), newest first, optionally for one monitor."),
+  single("list_incidents", "incidents.list", "List incidents", "Incidents (INC-n): related alerts grouped into one piece of work. State (open, acknowledged, monitoring, resolved), severity and peak, owner, linked and still-firing alert counts; newest first. `state` = active, resolved or all. Returns ids for get_incident."),
+  single("get_incident", "incidents.get", "Get an incident", "One incident by id: its linked alerts (monitor, uptime, SLO, issue) with ids for get_monitor_status or get_issue, the timeline (opened, joined, acknowledged, notes, escalation, resolution) and each message's delivery state. `accepted` means the service took the message; only `acknowledged: true` means a person took the incident."),
   {
     ...spec("verify_integration"),
     title: "Send a test event",
     description: "Asks the node to send one tagged test error through the public intake of a project, proving the path real errors take. Not read-only: it creates one test event (reuse idempotency_key to retry without a second one).",
     operations: ["projects.send_test_event"],
-    input: z20.object({
-      project_id: z20.number().int().positive(),
-      idempotency_key: z20.string().min(8).max(255).optional()
+    input: z24.object({
+      project_id: z24.number().int().positive(),
+      idempotency_key: z24.string().min(8).max(255).optional()
     }),
     async run(args, rt) {
       const r = await rt.call("projects.send_test_event", { project_id: args["project_id"] }, { idempotencyKey: args["idempotency_key"] ?? rt.newKey() });
@@ -3442,15 +4582,198 @@ var MCP_TOOL_DEFS = [
       return wrapResult({ data: r.body, operations: ["projects.send_test_event"], source: "control_plane" });
     }
   },
+  {
+    ...spec("search_operations"),
+    title: "Find a configuration change",
+    description: "Searches what this token can change in its Belvador workspace: projects, keys and tokens, monitors of every type, maintenance windows, occurrences, uptime checks, SLOs, alert rules and destinations, members, service accounts and the node. Returns operation ids for describe_operation and plan_change, whether a person must approve the change, and whether this token holds the scope.",
+    operations: [],
+    input: z24.object({
+      query: z24.string().min(1).max(200).describe("Words such as `rotate dsn key`, `heartbeat monitor`, `slack alert`."),
+      limit: z24.number().int().min(1).max(20).default(10)
+    }),
+    async run(args, rt) {
+      const q = words(String(args["query"]));
+      const scored = configureOperations().filter((o) => o.method !== "GET").map((o) => {
+        const id = words(o.id.replace(/[._]/g, " "));
+        const rest = words(`${o.summary} ${o.path}`);
+        let score = 0;
+        for (const w of q) {
+          if (id.some((t) => t === w))
+            score += 4;
+          else if (id.some((t) => t.startsWith(w)))
+            score += 2;
+          if (rest.some((t) => t === w))
+            score += 2;
+          else if (rest.some((t) => t.startsWith(w)))
+            score += 1;
+        }
+        return { o, score };
+      }).filter((x) => x.score > 0).sort((a, b) => b.score - a.score || a.o.id.localeCompare(b.o.id)).slice(0, Number(args["limit"] ?? 10));
+      return { structuredContent: { operations: scored.map((x) => describe(x.o, rt.scopes)) } };
+    }
+  },
+  {
+    ...spec("describe_operation"),
+    title: "Describe a configuration change",
+    description: "Everything needed to call one operation: its fields (JSON Schema, wire names), the scope, whether it needs If-Match (call plan_change for the current ETag), an idempotency key, or a person's approval, and which fields the approving person types on belvador.dev instead of the agent.",
+    operations: [],
+    input: z24.object({ operation_id: operationIdArg }),
+    async run(args, rt) {
+      const op = configureOp(args["operation_id"]);
+      if (!op || op.method === "GET")
+        return errorResult({ ok: false, status: 404, code: "NOT_FOUND" });
+      const approval = op.sensitivity === "approval";
+      return {
+        structuredContent: {
+          operation: {
+            ...describe(op, rt.scopes),
+            idempotency: op.idempotency,
+            if_match_required: !!op.ifMatch,
+            args_schema: operationArgsSchema(op, humanWire(op)),
+            ...approval ? {
+              approver: APPROVAL_APPROVER[op.id] ?? "admin",
+              typed_by_approver: humanWire(op),
+              secrets_typed_by_approver: APPROVAL_SETUP_OPS.includes(op.id)
+            } : {},
+            ...op.secretOutput?.length ? { secret_output: [...op.secretOutput] } : {}
+          }
+        }
+      };
+    }
+  },
+  {
+    ...spec("plan_change"),
+    title: "Check a change before applying it",
+    description: "Validates params for one operation without changing anything: field errors, missing scope, whether a person must approve, and — when the resource can be read — its current state, the fields that would change and the ETag to pass as if_match.",
+    operations: [],
+    input: z24.object({ operation_id: operationIdArg, params }),
+    async run(args, rt) {
+      const op = configureOp(args["operation_id"]);
+      if (!op || op.method === "GET")
+        return errorResult({ ok: false, status: 404, code: "NOT_FOUND" });
+      const p = args["params"] ?? {};
+      const v = validateConfigure(op, p);
+      const scopeMissing = rt.scopes.includes(op.scope) ? [] : [op.scope];
+      let etag = null;
+      let current = undefined;
+      const read = resourceRead(op);
+      const ids = read ? Object.fromEntries(pathParams(read.path).map((n) => [n, p[n]])) : {};
+      if (read && rt.scopes.includes(read.scope) && Object.values(ids).every((x) => x != null && x !== "")) {
+        const r = await rt.call(read.id, ids);
+        if (r.ok) {
+          etag = r.etag ?? null;
+          current = r.body;
+        }
+      }
+      const changes = Object.entries(p).filter(([k]) => !pathParams(op.path).includes(k)).map(([field, to]) => {
+        const cur = current && typeof current === "object" && !Array.isArray(current) ? current : null;
+        return cur && field in cur ? { field, from: cur[field], to } : { field, to };
+      });
+      const plan = {
+        operation_id: op.id,
+        valid: v.ok,
+        ...v.ok ? {} : { errors: v.errors },
+        scope: op.scope,
+        scope_missing: scopeMissing,
+        requires_approval: op.sensitivity === "approval",
+        ...op.sensitivity === "approval" ? { approver: APPROVAL_APPROVER[op.id] ?? "admin" } : {},
+        destructive: isDestructiveOperation(op),
+        idempotency: op.idempotency,
+        if_match_required: !!op.ifMatch,
+        etag
+      };
+      const out = wrapResult({
+        data: { changes, ...current !== undefined ? { current } : {} },
+        operations: read && current !== undefined ? [read.id] : [],
+        source: "control_plane"
+      });
+      return { structuredContent: { plan, ...out.structuredContent } };
+    }
+  },
+  {
+    ...spec("apply_change"),
+    title: "Apply a configuration change",
+    description: "Runs one operation with params (validate first with plan_change). Always send idempotency_key: repeating a call with the same key never applies it twice. Sensitive operations answer approval_required with an approval_url a person opens on belvador.dev; nothing changes until they approve with their authenticator code.",
+    operations: [],
+    input: z24.object({
+      operation_id: operationIdArg,
+      params,
+      idempotency_key: z24.string().min(8).max(255).describe("Unique per change; reuse it to retry or to fetch the result."),
+      if_match: z24.string().max(200).optional().describe("ETag from plan_change, for operations that need it.")
+    }),
+    async run(args, rt) {
+      const op = configureOp(args["operation_id"]);
+      if (!op || op.method === "GET")
+        return errorResult({ ok: false, status: 404, code: "NOT_FOUND" });
+      const p = args["params"] ?? {};
+      for (const f of humanWire(op))
+        if (f in p)
+          return errorResult({ ok: false, status: 400, code: "INVALID_INPUT", detail: `${f} is typed by the approving person` });
+      const opts = { idempotencyKey: String(args["idempotency_key"]) };
+      if (typeof args["if_match"] === "string" && args["if_match"])
+        opts.ifMatch = args["if_match"];
+      const r = await rt.call(op.id, p, opts);
+      if (r.ok) {
+        const body = r.body;
+        if (op.sensitivity === "approval" && body && typeof body["approval_id"] === "string") {
+          return {
+            structuredContent: {
+              status: "executed",
+              approval: approvalBlock(body, "Approved and run once by a person; result holds the ids.")
+            }
+          };
+        }
+        const out = wrapResult({ data: r.body, operations: [op.id], source: sourceOf(op.id) });
+        return { structuredContent: { status: "done", ...out.structuredContent } };
+      }
+      if (r.approval && r.approval.state === "pending") {
+        const next = APPROVAL_SETUP_OPS.includes(op.id) ? `${NEXT_PENDING} ${NEXT_SETUP}` : NEXT_PENDING;
+        return {
+          structuredContent: { status: "approval_required", approval: approvalBlock(r.approval, next) },
+          approval: r.approval
+        };
+      }
+      if (r.approval) {
+        return {
+          isError: true,
+          structuredContent: {
+            ...errorResult(r).structuredContent,
+            approval: approvalBlock(r.approval, "This request is closed; send a new one with a new idempotency_key if the change is still wanted.")
+          }
+        };
+      }
+      return errorResult(r);
+    }
+  },
+  {
+    ...spec("get_operation"),
+    title: "Follow an approval",
+    description: "State of a change waiting for a person's approval: pending, approved, executed (with the ids it produced), rejected, expired or failed (with the error code).",
+    operations: ["approvals.get"],
+    input: z24.object({ approval_id: z24.guid().describe("approval_id from apply_change.") }),
+    async run(args, rt) {
+      const r = await rt.call("approvals.get", { approval_id: args["approval_id"] });
+      if (!r.ok)
+        return errorResult(r);
+      const b = r.body;
+      const next = b.state === "pending" ? NEXT_PENDING : b.state === "executed" ? "Done: the change ran once." : b.state === "approved" ? "Approved; the change is running or waits for the person to finish the form." : "Closed without a change.";
+      return {
+        structuredContent: {
+          status: b.state,
+          approval: approvalBlock({ ...b, approval_url: b.approval_url ?? "" }, next)
+        }
+      };
+    }
+  },
   {
     ...spec("search_docs"),
     title: "Search Belvador docs",
     description: "Searches the public Belvador documentation (titles and summaries) and returns the best pages with their slugs for get_doc.",
     operations: [],
-    input: z20.object({
-      query: z20.string().min(1).max(200),
-      locale: z20.enum(["en", "vi"]).default("en"),
-      limit: z20.number().int().min(1).max(10).default(5)
+    input: z24.object({
+      query: z24.string().min(1).max(200),
+      locale: z24.enum(["en", "vi"]).default("en"),
+      limit: z24.number().int().min(1).max(10).default(5)
     }),
     async run(args, rt) {
       const locale = args["locale"] ?? "en";
@@ -3466,9 +4789,9 @@ var MCP_TOOL_DEFS = [
     title: "Read a docs page",
     description: "The Markdown of one public Belvador docs page by slug (e.g. `quickstart`, `sdk/react`, `reference/api`).",
     operations: [],
-    input: z20.object({
-      slug: z20.string().regex(/^[a-z0-9][a-z0-9/-]{0,120}$/),
-      locale: z20.enum(["en", "vi"]).default("en")
+    input: z24.object({
+      slug: z24.string().regex(/^[a-z0-9][a-z0-9/-]{0,120}$/),
+      locale: z24.enum(["en", "vi"]).default("en")
     }),
     async run(args, rt) {
       const locale = args["locale"] ?? "en";
@@ -3542,6 +4865,12 @@ function toolsFor(toolsets, scopes) {
 
 // ../src/shared/mcp/server.ts
 var MCP_SERVER_VERSION = `1.${MCP_TOOLS_VERSION}.0`;
+var APPROVAL_ELICIT_MESSAGE = "Belvador needs a person to approve this change. Open the link, review it and confirm with your authenticator code; then the agent continues.";
+function wantsApprovalLink(ctx) {
+  const env = ctx?.mcpReq.envelope;
+  const caps = env?.[CLIENT_CAPABILITIES_META_KEY];
+  return !!caps?.elicitation?.url && !ctx?.mcpReq.inputResponses?.["approval"];
+}
 function buildMcpServer(rt, toolsets) {
   const server = new McpServer({ name: "belvador", title: "Belvador", version: MCP_SERVER_VERSION }, { instructions: MCP_SERVER_INSTRUCTIONS });
   for (const t of toolsFor([...toolsets], rt.scopes)) {
@@ -3557,8 +4886,15 @@ function buildMcpServer(rt, toolsets) {
         idempotentHint: t.idempotent,
         openWorldHint: false
       }
-    }, async (args) => {
+    }, async (args, ctx) => {
       const r = await t.run(args, rt);
+      if (r.approval && r.approval.state === "pending" && wantsApprovalLink(ctx)) {
+        return inputRequired({
+          inputRequests: {
+            approval: inputRequired.elicitUrl({ message: APPROVAL_ELICIT_MESSAGE, url: r.approval.approval_url })
+          }
+        });
+      }
       return {
         content: [{ type: "text", text: JSON.stringify(r.structuredContent) }],
         structuredContent: r.structuredContent,
@@ -3579,7 +4915,15 @@ function outcomeOfError(e) {
       code: e.code === "ABORTED" ? "UNAVAILABLE" : e.code,
       ...e.detail ? { detail: e.detail } : {},
       ...e.scope ? { scope: e.scope } : {},
-      ...e.retryAfter ? { retryAfter: e.retryAfter } : {}
+      ...e.retryAfter ? { retryAfter: e.retryAfter } : {},
+      ...e.approval ? {
+        approval: {
+          approval_id: e.approval.id,
+          approval_url: e.approval.url,
+          expires_at: e.approval.expiresAt,
+          state: e.approval.state
+        }
+      } : {}
     };
   return { ok: false, status: 503, code: "UNAVAILABLE" };
 }
@@ -3591,8 +4935,13 @@ function clientRuntime(client, scopes, docs) {
     async call(operationId, args, opts) {
       try {
         const call = client.call.bind(client);
-        const r = await call(operationId, args, opts?.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {});
-        return { ok: true, status: r.status, body: r.data };
+        const o = {};
+        if (opts?.idempotencyKey)
+          o.idempotencyKey = opts.idempotencyKey;
+        if (opts?.ifMatch)
+          o.ifMatch = opts.ifMatch;
+        const r = await call(operationId, args, o);
+        return { ok: true, status: r.status, body: r.data, etag: r.etag };
       } catch (e) {
         return outcomeOfError(e);
       }
@@ -3624,7 +4973,7 @@ function findToken(env = process.env, keychain = keychainToken) {
 }
 
 // packages/mcp/src/cli.ts
-var PACKAGE_VERSION = "0.1.0";
+var PACKAGE_VERSION = "0.3.0";
 var HELP = `belvador-mcp ${PACKAGE_VERSION} — Belvador MCP server (stdio)
 
 Usage: npx -y @belvador/mcp [--toolsets=${MCP_DEFAULT_TOOLSETS.join(",")}]