@belvador/mcp 0.2.0 → 0.4.0

package/dist/cli.js

@@ -124,8 +124,12 @@ var API_ERROR_STATUS = {
   INCIDENT_STATE_INVALID: 409,
   NOTIFICATION_POLICY_INVALID: 400,
   COVERAGE_EXPECTATION_INVALID: 400,
+  COVERAGE_SIGNAL_UNAVAILABLE: 400,
+  COVERAGE_CODE_OWNED: 409,
+  COVERAGE_LIMIT: 409,
   PRIVACY_RULE_INVALID: 400,
   PRIVACY_REGEX_UNSAFE: 400,
+  PRIVACY_VERSION_CONFLICT: 409,
   METRIC_CARDINALITY_LIMIT: 429,
   RELEASE_NOT_FOUND: 404,
   PUBLIC_API_PAUSED: 503,
@@ -178,7 +182,7 @@ function cleanUntrustedText(raw, maxBytes = MCP_LIMITS.untrustedStringMaxBytes)
   const { text, cut } = cutUtf8(escaped, maxBytes);
   return { text, cut, suspicious };
 }
-var MCP_TOOLS_VERSION = 2;
+var MCP_TOOLS_VERSION = 4;
 var MCP_TOOLS = [
   { name: "get_workspace", toolset: "investigate", scope: "org:read", readOnly: true, destructive: false, idempotent: true },
   { name: "list_projects", toolset: "investigate", scope: "projects:read", readOnly: true, destructive: false, idempotent: true },
@@ -209,10 +213,7 @@ var MCP_TOOLS = [
 ];
 var MCP_TOOLS_PENDING = {
   query_metrics: "P14",
-  release_health: "P15",
-  list_incidents: "P9",
-  get_incident: "P9",
-  get_coverage: "P10"
+  release_health: "P15"
 };
 
 // ../src/shared/mcp/docs.ts
@@ -257,7 +258,7 @@ function docsFetcher(siteUrl, fetcher = fetch, now = () => Date.now()) {
 import { CLIENT_CAPABILITIES_META_KEY, inputRequired, McpServer } from "@modelcontextprotocol/server";
 
 // ../src/shared/contracts/mcp-tools.ts
-import { z as z20 } from "zod";
+import { z as z28 } from "zod";
 
 // ../src/shared/contracts/api-ops/access.ts
 import { z as z3 } from "zod";
@@ -637,7 +638,16 @@ var UPTIME_TRIGGER = "uptime_problem";
 var SLO_TRIGGER = "slo_burn";
 var RULE_TRIGGERS = [...ALERT_TRIGGERS, INTEGRATION_TRIGGER, MONITOR_TRIGGER, UPTIME_TRIGGER, SLO_TRIGGER];
 var SOLO_TRIGGERS = [INTEGRATION_TRIGGER, MONITOR_TRIGGER, UPTIME_TRIGGER, SLO_TRIGGER];
-var MONITOR_RULE_KINDS = ["missed", "failed", "timeout", "unknown"];
+var MONITOR_RULE_KINDS = [
+  "missed",
+  "failed",
+  "timeout",
+  "unknown",
+  "count",
+  "assertion",
+  "deadline",
+  "stalled"
+];
 var SLO_RULE_SEVERITIES = ["page", "ticket"];
 function validRuleTriggers(triggers) {
   if (triggers.length === 1 && SOLO_TRIGGERS.includes(triggers[0]))
@@ -658,8 +668,9 @@ var ruleInputSchema = z4.object({
   isEnabled: z4.boolean(),
   notifyAll: z4.boolean(),
   destinationIds: z4.array(z4.guid()).max(20),
-  monitorKinds: z4.array(z4.enum(MONITOR_RULE_KINDS)).min(1).max(4).default([...MONITOR_RULE_KINDS]),
-  sloSeverities: z4.array(z4.enum(SLO_RULE_SEVERITIES)).min(1).max(2).default([...SLO_RULE_SEVERITIES])
+  monitorKinds: z4.array(z4.enum(MONITOR_RULE_KINDS)).min(1).max(MONITOR_RULE_KINDS.length).default([...MONITOR_RULE_KINDS]),
+  sloSeverities: z4.array(z4.enum(SLO_RULE_SEVERITIES)).min(1).max(2).default([...SLO_RULE_SEVERITIES]),
+  policyId: z4.guid().nullable().default(null)
 });
 
 // ../src/shared/contracts/api-ops/alerts.ts
@@ -676,7 +687,7 @@ var ALERT_INPUTS = {
   destinationOnly: z5.object({ destinationId: uuid }),
   createDestination: z5.object({
     workspaceId: uuid,
-    provider: z5.enum(["telegram", "slack", "email", "webhook"]),
+    provider: z5.enum(["telegram", "slack", "email", "webhook", "pagerduty", "incident_io"]),
     name,
     projectIds,
     locale
@@ -758,12 +769,14 @@ var ALERT_OPERATIONS = [
     idempotency: "required",
     status: 201,
     mcp: "configure",
-    summary: "Start adding a Telegram, Slack, email or webhook destination; a person enters its secrets.",
+    summary: "Start adding a Telegram, Slack, email, webhook, PagerDuty or incident.io destination; a person enters its secrets.",
     ui: [
       "alerts#createSlackDestination",
       "alerts#createWebhookDestination",
       "alerts#createTelegramDestination",
-      "alerts#createEmailDestination"
+      "alerts#createEmailDestination",
+      "alerts#createPagerDutyDestination",
+      "alerts#createIncidentIoDestination"
     ]
   }),
   op({
@@ -852,17 +865,361 @@ var ALERT_OPERATIONS = [
   })
 ];
 
-// ../src/shared/contracts/api-ops/monitors.ts
-import { z as z11 } from "zod";
-
-// ../src/shared/contracts/heartbeat.ts
+// ../src/shared/contracts/api-ops/coverage.ts
 import { z as z8 } from "zod";
 
-// ../src/shared/contracts/monitors.ts
+// ../src/shared/contracts/coverage.ts
+import { z as z7 } from "zod";
+
+// ../src/shared/contracts/integration-health.ts
 import { z as z6 } from "zod";
 
+// ../src/shared/contracts/platforms.ts
+var PLATFORMS = [
+  "javascript-browser",
+  "react",
+  "node",
+  "python",
+  "tanstack-start",
+  "other"
+];
+
+// ../src/shared/contracts/integration-health.ts
+var VERIFICATION_ID_RE = /^bv1_[0-9a-f]{32}$/;
+var verificationIdSchema = z6.string().regex(VERIFICATION_ID_RE);
+var SURFACES = ["browser", "server"];
+var RECEIPT_SURFACES = ["browser", "server", "belvador"];
+var CHECKS = ["delivery", "uncaught", "pipeline"];
+var HOOK_STATES = ["ok", "missing", "unknown"];
+var verificationContextSchema = z6.object({
+  v: z6.literal(1),
+  surface: z6.enum(RECEIPT_SURFACES),
+  check: z6.enum(CHECKS),
+  hook: z6.enum(HOOK_STATES).optional(),
+  uncaught_expected: z6.boolean().optional()
+});
+var iso = z6.string().datetime();
+var projectId2 = z6.number().int().positive();
+var verificationReceiptSchema = z6.object({
+  project_id: projectId2,
+  verification_id: verificationIdSchema,
+  surface: z6.enum(RECEIPT_SURFACES),
+  check: z6.enum(CHECKS),
+  hook: z6.enum(HOOK_STATES),
+  uncaught_expected: z6.boolean(),
+  sdk_name: z6.string().max(80),
+  sdk_version: z6.string().max(40),
+  environment: z6.string().max(64),
+  release: z6.string().max(200),
+  source_host: z6.string().max(253),
+  received_at: iso
+});
+var SDK_DELIVERY_DROP_REASONS = ["network_error", "queue_overflow", "send_error"];
+var clientDiscardSchema = z6.object({
+  hour: iso,
+  reason: z6.enum(SDK_DELIVERY_DROP_REASONS),
+  n: z6.number().int().nonnegative()
+});
+var edgeVerificationRequestSchema = z6.object({
+  v: z6.literal(1),
+  project_id: projectId2,
+  verification_id: verificationIdSchema
+});
+var readbackCheckSchema = z6.object({
+  surface: z6.enum(RECEIPT_SURFACES),
+  check: z6.enum(CHECKS),
+  hook: z6.enum(HOOK_STATES),
+  received_at: iso
+});
+var edgeVerificationResponseSchema = z6.object({
+  checks: z6.array(readbackCheckSchema).max(8)
+});
+var readbackResponseSchema = z6.object({
+  v: z6.literal(1),
+  verification_id: verificationIdSchema,
+  node: z6.enum(["connected", "offline"]),
+  checks: z6.array(readbackCheckSchema).max(8)
+});
+var ENVIRONMENT_RE = /^[^\u0000-\u001f]{1,64}$/;
+var projectRuntimeSchema = z6.object({
+  project_id: projectId2,
+  environment: z6.string().max(64),
+  surface: z6.enum(SURFACES),
+  sdk_name: z6.string().max(80),
+  sdk_version: z6.string().max(40),
+  latest_release: z6.string().max(200),
+  first_seen: iso,
+  last_seen: iso,
+  events_24h: z6.number().int().nonnegative(),
+  check_ins_24h: z6.number().int().nonnegative()
+});
+
+// ../src/shared/contracts/vocab/coverage.ts
+var COVERAGE_SURFACES = [
+  "browser",
+  "server",
+  "worker",
+  "job",
+  "edge_function",
+  "database",
+  "uptime"
+];
+var COVERAGE_SIGNALS = [
+  "errors",
+  "traces",
+  "logs",
+  "metrics",
+  "check_ins",
+  "web_vitals",
+  "probes"
+];
+var COVERAGE_STATUSES = ["verified", "stale", "problem", "unknown"];
+var COVERAGE_SOURCES = ["ui", "code"];
+
+// ../src/shared/contracts/coverage.ts
+var SURFACE_SIGNALS = {
+  browser: ["errors", "traces", "logs", "web_vitals"],
+  server: ["errors", "traces", "logs", "metrics"],
+  worker: ["errors", "traces", "logs", "metrics"],
+  edge_function: ["errors", "traces", "logs", "metrics"],
+  job: ["check_ins", "errors", "traces", "logs"],
+  database: ["traces", "metrics"],
+  uptime: ["probes"]
+};
+function coveragePairOk(surface, signal) {
+  return SURFACE_SIGNALS[surface].includes(signal);
+}
+var COVERAGE_RULES = {
+  staleAfterHoursDefault: 168,
+  staleAfterHoursMin: 1,
+  staleAfterHoursMax: 720,
+  noteMax: 200,
+  evidenceRowsPerProject: 256,
+  undeclaredDays: 30,
+  resendMs: 3600000,
+  newKeyFlushMs: 60000,
+  backfillErrorsDays: 30,
+  backfillTelemetryDays: 7,
+  setMaxItems: 1000
+};
+var FAAS_CLOUD_PLATFORMS = new Set([
+  "aws_lambda",
+  "azure_functions",
+  "gcp_cloud_functions",
+  "alibaba_cloud_fc",
+  "tencent_cloud_scf"
+]);
+var FUNCTION_RUNTIMES = new Set(["cloudflare", "workerd", "vercel-edge", "edge-light"]);
+var seconds = z7.number().int().positive();
+var coverageSeenRowSchema = z7.object({
+  environment: z7.string().max(64),
+  surface: z7.enum(COVERAGE_SURFACES),
+  signal: z7.enum(COVERAGE_SIGNALS),
+  last_seen: seconds,
+  last_verified: seconds.nullable()
+}).strict();
+var coverageSeenReportSchema = z7.object({
+  project_id: z7.number().int().positive(),
+  rows: z7.array(coverageSeenRowSchema).max(COVERAGE_RULES.evidenceRowsPerProject)
+}).strict();
+var environment = z7.string().trim().regex(ENVIRONMENT_RE);
+var note = z7.string().trim().max(COVERAGE_RULES.noteMax).regex(/^[^\p{Cc}]*$/u);
+var coverageExpectationInputSchema = z7.object({
+  environment,
+  surface: z7.enum(COVERAGE_SURFACES),
+  signals: z7.array(z7.enum(COVERAGE_SIGNALS)).min(1).max(COVERAGE_SIGNALS.length),
+  staleAfterHours: z7.number().int().min(COVERAGE_RULES.staleAfterHoursMin).max(COVERAGE_RULES.staleAfterHoursMax).default(COVERAGE_RULES.staleAfterHoursDefault),
+  note: note.default("")
+}).superRefine((e, ctx) => {
+  const seen = new Set;
+  for (const s of e.signals) {
+    if (seen.has(s))
+      ctx.addIssue({ code: "custom", path: ["signals"], message: "duplicate" });
+    seen.add(s);
+    if (!coveragePairOk(e.surface, s))
+      ctx.addIssue({ code: "custom", path: ["signals"], message: `not_for_${e.surface}` });
+  }
+});
+var coverageExpectationListSchema = z7.array(coverageExpectationInputSchema).max(COVERAGE_RULES.setMaxItems).superRefine((list, ctx) => {
+  const keys = new Set;
+  list.forEach((e, i) => {
+    const k = `${e.environment}\x00${e.surface}`;
+    if (keys.has(k))
+      ctx.addIssue({ code: "custom", path: [i, "surface"], message: "duplicate" });
+    keys.add(k);
+  });
+});
+var iso2 = z7.string();
+var count = z7.number().int().nonnegative();
+var coverageCellSchema = z7.object({
+  expectation_id: z7.string(),
+  project_id: z7.number().int().positive(),
+  environment: z7.string(),
+  surface: z7.enum(COVERAGE_SURFACES),
+  signal: z7.enum(COVERAGE_SIGNALS),
+  status: z7.enum(COVERAGE_STATUSES),
+  source: z7.enum(["receipt", "signal"]).nullable(),
+  last_seen_at: iso2.nullable(),
+  last_verified_at: iso2.nullable(),
+  problem_code: z7.string().nullable()
+});
+var coverageExpectationRowSchema = z7.object({
+  expectation_id: z7.string(),
+  project_id: z7.number().int().positive(),
+  environment: z7.string(),
+  surface: z7.enum(COVERAGE_SURFACES),
+  signals: z7.array(z7.enum(COVERAGE_SIGNALS)),
+  stale_after_hours: z7.number().int(),
+  note: z7.string(),
+  config_source: z7.enum(COVERAGE_SOURCES),
+  revision: z7.number().int(),
+  updated_at: iso2
+});
+var coverageReportSchema = z7.object({
+  generated_at: iso2,
+  expectations_max: z7.number().int().nonnegative(),
+  summary: z7.object({ total: count, verified: count, stale: count, problem: count, unknown: count }),
+  projects: z7.array(z7.object({
+    project_id: z7.number().int().positive(),
+    slug: z7.string(),
+    name: z7.string(),
+    platform: z7.string(),
+    primary_environment: z7.string(),
+    config_source: z7.enum(COVERAGE_SOURCES).nullable()
+  })),
+  expectations: z7.array(coverageExpectationRowSchema),
+  cells: z7.array(coverageCellSchema),
+  undeclared: z7.array(z7.object({
+    project_id: z7.number().int().positive(),
+    environment: z7.string(),
+    surface: z7.enum(COVERAGE_SURFACES),
+    signal: z7.enum(COVERAGE_SIGNALS),
+    last_seen_at: iso2
+  })),
+  environments: z7.array(z7.string()),
+  node_agent_version: z7.string().nullable()
+});
+
+// ../src/shared/contracts/api-ops/coverage.ts
+var COVERAGE_INPUTS = {
+  get: z8.object({
+    workspaceId: uuid,
+    projectId: projectId.optional(),
+    environment: z8.string().trim().regex(ENVIRONMENT_RE).optional()
+  }),
+  set: z8.object({
+    workspaceId: uuid,
+    projectId,
+    configSource: z8.enum(COVERAGE_SOURCES).default("ui"),
+    expectations: coverageExpectationListSchema
+  })
+};
+var C = COVERAGE_INPUTS;
+var COVERAGE_OPERATIONS = [
+  op({
+    id: "coverage.get",
+    method: "GET",
+    path: "/v1/coverage",
+    scope: "coverage:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_coverage"],
+    input: C.get,
+    workspace: true,
+    idempotency: "none",
+    mcp: "reliability",
+    summary: "What each app is expected to send (surface × signal × environment) against what Belvador saw: `verified`, `stale`, `problem` or `unknown`, the verified rate, and signals seen but not declared. Same numbers as the Coverage page.",
+    ui: []
+  }),
+  op({
+    id: "coverage.set",
+    method: "PUT",
+    path: "/v1/projects/{project_id}/coverage-expectations",
+    scope: "coverage:write",
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["set_coverage_expectations"],
+    input: C.set,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Replace a project's coverage expectations (one per environment × surface). `config_source: code` locks them in the app; send `ui` once to hand them back. Members and up.",
+    ui: ["coverage#setCoverageExpectations"]
+  })
+];
+
+// ../src/shared/contracts/api-ops/incidents.ts
+import { z as z13 } from "zod";
+
+// ../src/shared/contracts/notifications.ts
+import { z as z12 } from "zod";
+
+// ../src/shared/contracts/maintenance.ts
+import { z as z9 } from "zod";
+var MAINTENANCE_SCOPES = ["workspace", "project", "monitor"];
+var MAINTENANCE_LIMITS = {
+  durationMinutesMin: 5,
+  durationMinutesMax: 1440,
+  reasonMax: 200,
+  idsMax: 50,
+  onceAheadDays: 366,
+  previewStarts: 3
+};
+var weekdaySchema = z9.number().int().min(1).max(7);
+var timeOfDay = z9.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/);
+var base = {
+  scope: z9.enum(MAINTENANCE_SCOPES),
+  projectIds: z9.array(z9.number().int().positive()).max(MAINTENANCE_LIMITS.idsMax),
+  monitorIds: z9.array(z9.guid()).max(MAINTENANCE_LIMITS.idsMax),
+  timezone: z9.string().trim().min(1).max(64),
+  durationMinutes: z9.number().int().min(MAINTENANCE_LIMITS.durationMinutesMin).max(MAINTENANCE_LIMITS.durationMinutesMax),
+  reason: z9.string().trim().max(MAINTENANCE_LIMITS.reasonMax).regex(/^[^\p{Cc}]*$/u)
+};
+var maintenanceInputSchema = z9.discriminatedUnion("kind", [
+  z9.object({ kind: z9.literal("once"), startsAt: z9.string().datetime({ offset: true }), ...base }),
+  z9.object({
+    kind: z9.literal("weekly"),
+    weekdays: z9.array(weekdaySchema).min(1).max(7),
+    startTime: timeOfDay,
+    ...base
+  })
+]).superRefine((w, ctx) => {
+  const bad = (path) => ctx.addIssue({ code: "custom", path: [path], message: "MAINTENANCE_INVALID" });
+  if (w.scope === "workspace" && (w.projectIds.length || w.monitorIds.length))
+    bad("scope");
+  if (w.scope === "project" && (!w.projectIds.length || w.monitorIds.length))
+    bad("projectIds");
+  if (w.scope === "monitor" && (!w.monitorIds.length || w.projectIds.length))
+    bad("monitorIds");
+  if (new Set(w.projectIds).size !== w.projectIds.length)
+    bad("projectIds");
+  if (new Set(w.monitorIds).size !== w.monitorIds.length)
+    bad("monitorIds");
+  if (w.kind === "weekly" && new Set(w.weekdays).size !== w.weekdays.length)
+    bad("weekdays");
+  if (!validTimeZone(w.timezone))
+    bad("timezone");
+});
+function validTimeZone(tz) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var fmtCache = new Map;
+
+// ../src/shared/contracts/signal-monitors.ts
+import { z as z11 } from "zod";
+
+// ../src/shared/contracts/monitors.ts
+import { z as z10 } from "zod";
+
 // ../src/shared/contracts/vocab/monitors.ts
 var MONITOR_MODES = ["check_in", "heartbeat"];
+var MONITOR_TYPES = ["job", "count", "assertion", "deadline", "progress"];
+var SIGNAL_MONITOR_TYPES = ["count", "assertion", "deadline", "progress"];
 
 // ../src/shared/contracts/monitors.ts
 var MONITOR_KINDS = ["crontab", "interval", "on_demand"];
@@ -872,8 +1229,13 @@ var MONITOR_INCIDENT_CODES = [
   "MONITOR_MISSED",
   "MONITOR_FAILED",
   "MONITOR_TIMEOUT",
-  "MONITOR_UNKNOWN"
+  "MONITOR_UNKNOWN",
+  "MONITOR_COUNT",
+  "MONITOR_ASSERTION",
+  "MONITOR_DEADLINE_MISSED",
+  "MONITOR_STALLED"
 ];
+var FAILURE_INCIDENT_CODES = MONITOR_INCIDENT_CODES.filter((c) => c !== "MONITOR_UNKNOWN");
 var INCIDENT_EVENTS = ["opened", "updated", "resolved"];
 var UNOBSERVABLE_REASONS = [
   "node_offline",
@@ -924,100 +1286,112 @@ function crontabShapeOk(value) {
   const fields = value.trim().split(/\s+/);
   return value.length <= 120 && fields.length === 5 && fields.every((f) => /^[0-9A-Za-z*,/?#LW-]+$/.test(f));
 }
-var crontabScheduleSchema = z6.object({
-  type: z6.literal("crontab"),
-  value: z6.string().refine(crontabShapeOk, "crontab")
+var crontabScheduleSchema = z10.object({
+  type: z10.literal("crontab"),
+  value: z10.string().refine(crontabShapeOk, "crontab")
 });
-var intervalScheduleSchema = z6.object({
-  type: z6.literal("interval"),
-  value: z6.number().int().min(1).max(MONITOR_LIMITS.intervalValueMax),
-  unit: z6.enum(INTERVAL_UNITS)
+var intervalScheduleSchema = z10.object({
+  type: z10.literal("interval"),
+  value: z10.number().int().min(1).max(MONITOR_LIMITS.intervalValueMax),
+  unit: z10.enum(INTERVAL_UNITS)
 });
-var scheduleSchema = z6.discriminatedUnion("type", [
+var scheduleSchema = z10.discriminatedUnion("type", [
   crontabScheduleSchema,
   intervalScheduleSchema
 ]);
-var monitorSettingsSchema = z6.object({
+var monitorSettingsSchema = z10.object({
   schedule: scheduleSchema.nullable(),
-  timezone: z6.string().min(1).max(64),
-  checkin_margin: z6.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
-  max_runtime: z6.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
-  failure_issue_threshold: z6.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
-  recovery_threshold: z6.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax)
+  timezone: z10.string().min(1).max(64),
+  checkin_margin: z10.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
+  max_runtime: z10.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
+  failure_issue_threshold: z10.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  recovery_threshold: z10.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax)
 });
-var iso = z6.string().datetime();
-var projectId2 = z6.number().int().positive();
-var envName = z6.string().min(1).max(MONITOR_LIMITS.environmentMax);
+var iso3 = z10.string().datetime();
+var projectId3 = z10.number().int().positive();
+var envName = z10.string().min(1).max(MONITOR_LIMITS.environmentMax);
 var monitorDefinitionSchema = monitorSettingsSchema.extend({
-  id: z6.guid(),
-  project_id: projectId2,
-  slug: z6.string().regex(SLUG_RE),
-  kind: z6.enum(MONITOR_KINDS),
-  expected_environments: z6.array(envName).max(MONITOR_LIMITS.expectedEnvironmentsMax),
-  paused_until: iso.nullable(),
-  created_at: iso,
-  config_source: z6.enum(CONFIG_SOURCES),
-  config_hash: z6.string().regex(/^[0-9a-f]{64}$/).nullable()
+  id: z10.guid(),
+  project_id: projectId3,
+  slug: z10.string().regex(SLUG_RE),
+  kind: z10.enum(MONITOR_KINDS),
+  expected_environments: z10.array(envName).max(MONITOR_LIMITS.expectedEnvironmentsMax),
+  paused_until: iso3.nullable(),
+  created_at: iso3,
+  config_source: z10.enum(CONFIG_SOURCES),
+  config_hash: z10.string().regex(/^[0-9a-f]{64}$/).nullable()
 });
-var outcomeCounts = z6.object({
-  ok: z6.number().int().nonnegative(),
-  skipped: z6.number().int().nonnegative(),
-  error: z6.number().int().nonnegative(),
-  timeout: z6.number().int().nonnegative(),
-  missed: z6.number().int().nonnegative(),
-  unknown: z6.number().int().nonnegative()
+var outcomeCounts = z10.object({
+  ok: z10.number().int().nonnegative(),
+  skipped: z10.number().int().nonnegative(),
+  error: z10.number().int().nonnegative(),
+  timeout: z10.number().int().nonnegative(),
+  missed: z10.number().int().nonnegative(),
+  unknown: z10.number().int().nonnegative()
 });
-var monitorStatusSchema = z6.object({
-  monitor_id: z6.guid(),
-  project_id: projectId2,
+var signalStatusSchema = z10.object({
+  type: z10.enum(SIGNAL_MONITOR_TYPES),
+  value: z10.number().int().nonnegative().max(1e9).nullable(),
+  threshold: z10.number().int().nonnegative().max(1e9).nullable(),
+  window_end: iso3.nullable(),
+  pending: z10.number().int().nonnegative().max(1e6).nullable(),
+  stalled: z10.number().int().nonnegative().max(1e6).nullable(),
+  refused_24h: z10.number().int().nonnegative().max(1e9).nullable()
+});
+var monitorStatusSchema = z10.object({
+  monitor_id: z10.guid(),
+  project_id: projectId3,
   environment: envName,
-  open_failure: z6.enum(["MONITOR_MISSED", "MONITOR_FAILED", "MONITOR_TIMEOUT"]).nullable(),
-  open_unknown: z6.boolean(),
-  unobservable: z6.enum(UNOBSERVABLE_REASONS).nullable(),
-  last_outcome: z6.enum(RUN_OUTCOMES).nullable(),
-  last_check_in_at: iso.nullable(),
-  last_healthy_at: iso.nullable(),
-  next_deadline_at: iso.nullable(),
-  next_due_at: iso.nullable().optional(),
-  in_progress: z6.boolean(),
+  open_failure: z10.enum(FAILURE_INCIDENT_CODES).nullable(),
+  open_unknown: z10.boolean(),
+  unobservable: z10.enum(UNOBSERVABLE_REASONS).nullable(),
+  last_outcome: z10.enum(RUN_OUTCOMES).nullable(),
+  last_check_in_at: iso3.nullable(),
+  last_healthy_at: iso3.nullable(),
+  next_deadline_at: iso3.nullable(),
+  next_due_at: iso3.nullable().optional(),
+  in_progress: z10.boolean(),
   counts_24h: outcomeCounts,
-  evaluated_at: iso
+  signal: signalStatusSchema.optional(),
+  evaluated_at: iso3
 });
-var monitorIncidentSchema = z6.object({
-  incident_id: z6.guid(),
-  monitor_id: z6.guid(),
-  project_id: projectId2,
+var monitorIncidentSchema = z10.object({
+  incident_id: z10.guid(),
+  monitor_id: z10.guid(),
+  project_id: projectId3,
   environment: envName,
-  code: z6.enum(MONITOR_INCIDENT_CODES),
-  event: z6.enum(INCIDENT_EVENTS),
-  occurred_at: iso,
-  detected_late: z6.boolean(),
-  reason: z6.string().regex(REASON_RE).nullable(),
-  duration_ms: z6.number().int().nonnegative().nullable(),
-  consecutive: z6.number().int().min(1).max(1e5),
-  reviewed_by: z6.guid().nullable()
+  code: z10.enum(MONITOR_INCIDENT_CODES),
+  event: z10.enum(INCIDENT_EVENTS),
+  occurred_at: iso3,
+  detected_late: z10.boolean(),
+  reason: z10.string().regex(REASON_RE).nullable(),
+  duration_ms: z10.number().int().nonnegative().nullable(),
+  consecutive: z10.number().int().min(1).max(1e5),
+  reviewed_by: z10.guid().nullable(),
+  observed: z10.number().int().min(0).max(1e9).nullable().optional(),
+  threshold: z10.number().int().min(0).max(1e9).nullable().optional()
 });
-var monitorDiscoverySchema = z6.object({
-  project_id: projectId2,
-  slug: z6.string().regex(SLUG_RE),
+var monitorDiscoverySchema = z10.object({
+  project_id: projectId3,
+  slug: z10.string().regex(SLUG_RE),
   settings: monitorSettingsSchema.nullable(),
-  config_hash: z6.string().regex(/^[0-9a-f]{64}$/).nullable(),
-  check_ins: z6.number().int().nonnegative(),
-  last_seen_at: iso
+  config_hash: z10.string().regex(/^[0-9a-f]{64}$/).nullable(),
+  check_ins: z10.number().int().nonnegative(),
+  last_seen_at: iso3
 });
 var MONITOR_NAME_MAX = MONITOR_LIMITS.nameMax;
-var environmentName = z6.string().trim().min(1).max(MONITOR_LIMITS.environmentMax).regex(/^[A-Za-z0-9._-]+$/);
-var monitorInputSchema = z6.object({
-  name: z6.string().trim().min(1).max(MONITOR_LIMITS.nameMax),
-  mode: z6.enum(MONITOR_MODES).default("check_in"),
-  kind: z6.enum(MONITOR_KINDS),
+var environmentName = z10.string().trim().min(1).max(MONITOR_LIMITS.environmentMax).regex(/^[A-Za-z0-9._-]+$/);
+var monitorInputSchema = z10.object({
+  name: z10.string().trim().min(1).max(MONITOR_LIMITS.nameMax),
+  mode: z10.enum(MONITOR_MODES).default("check_in"),
+  kind: z10.enum(MONITOR_KINDS),
   schedule: scheduleSchema.nullable(),
-  timezone: z6.string().trim().min(1).max(64),
-  checkinMarginMin: z6.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
-  maxRuntimeMin: z6.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
-  failureThreshold: z6.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
-  recoveryThreshold: z6.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
-  expectedEnvironments: z6.array(environmentName).min(1).max(MONITOR_LIMITS.expectedEnvironmentsMax)
+  timezone: z10.string().trim().min(1).max(64),
+  checkinMarginMin: z10.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
+  maxRuntimeMin: z10.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
+  failureThreshold: z10.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  recoveryThreshold: z10.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  expectedEnvironments: z10.array(environmentName).min(1).max(MONITOR_LIMITS.expectedEnvironmentsMax)
 }).refine((v) => v.kind === "on_demand" ? v.schedule === null : v.schedule?.type === v.kind, {
   path: ["schedule"],
   message: "schedule"
@@ -1032,98 +1406,601 @@ var MONITOR_INPUT_DEFAULTS = {
   recoveryThreshold: MONITOR_LIMITS.recoveryThresholdDefault,
   expectedEnvironments: [DEFAULT_CHECK_IN_ENVIRONMENT]
 };
-var runOutcome = z6.enum(RUN_OUTCOMES);
-var runFlags = z6.array(z6.string().max(32)).max(16);
-var monitorRunSchema = z6.object({
-  id: z6.number().int().positive(),
-  kind: z6.enum(["run", "missed"]),
+var runOutcome = z10.enum(RUN_OUTCOMES);
+var runFlags = z10.array(z10.string().max(32)).max(16);
+var monitorRunSchema = z10.object({
+  id: z10.number().int().positive(),
+  kind: z10.enum(["run", "missed"]),
   outcome: runOutcome,
-  started_at: iso,
-  ended_at: iso,
-  attempts: z6.number().int().nonnegative(),
-  duration_ms: z6.number().int().nonnegative().nullable(),
-  reason: z6.string().max(64).nullable(),
-  check_in_id: z6.string().max(64).nullable(),
-  trace_id: z6.string().max(32).nullable(),
-  release: z6.string().max(MONITOR_LIMITS.releaseMax).nullable(),
+  started_at: iso3,
+  ended_at: iso3,
+  attempts: z10.number().int().nonnegative(),
+  duration_ms: z10.number().int().nonnegative().nullable(),
+  reason: z10.string().max(64).nullable(),
+  check_in_id: z10.string().max(64).nullable(),
+  trace_id: z10.string().max(32).nullable(),
+  release: z10.string().max(MONITOR_LIMITS.releaseMax).nullable(),
   flags: runFlags
 });
-var openAttemptSchema = z6.object({
-  check_in_id: z6.string().max(64),
-  run_key: z6.string().max(64),
-  attempt: z6.number().int().nonnegative(),
-  state: z6.string().max(16),
-  started_at: iso,
-  deadline_at: iso
+var openAttemptSchema = z10.object({
+  check_in_id: z10.string().max(64),
+  run_key: z10.string().max(64),
+  attempt: z10.number().int().nonnegative(),
+  state: z10.string().max(16),
+  started_at: iso3,
+  deadline_at: iso3
 });
-var monitorRunsResponseSchema = z6.object({
-  open: z6.array(openAttemptSchema).max(100),
-  runs: z6.array(monitorRunSchema).max(MONITOR_LIMITS.runsPageSize),
-  next_cursor: z6.string().max(32).nullable()
+var monitorRunsResponseSchema = z10.object({
+  open: z10.array(openAttemptSchema).max(100),
+  runs: z10.array(monitorRunSchema).max(MONITOR_LIMITS.runsPageSize),
+  next_cursor: z10.string().max(32).nullable()
 });
-var timelineRunSchema = z6.object({
-  id: z6.number().int().positive(),
-  kind: z6.enum(["run", "missed"]),
+var timelineRunSchema = z10.object({
+  id: z10.number().int().positive(),
+  kind: z10.enum(["run", "missed"]),
   outcome: runOutcome,
-  ended_at: iso,
+  ended_at: iso3,
   flags: runFlags
 });
-var monitorTimelineResponseSchema = z6.object({
-  runs: z6.array(timelineRunSchema).max(MONITOR_LIMITS.timelineRuns)
+var monitorTimelineResponseSchema = z10.object({
+  runs: z10.array(timelineRunSchema).max(MONITOR_LIMITS.timelineRuns)
 });
-var monitorStripsResponseSchema = z6.object({
-  strips: z6.array(z6.object({
-    monitor_id: z6.guid(),
+var monitorStripsResponseSchema = z10.object({
+  strips: z10.array(z10.object({
+    monitor_id: z10.guid(),
     environment: envName,
-    runs: z6.array(timelineRunSchema).max(MONITOR_LIMITS.listStripRuns)
+    runs: z10.array(timelineRunSchema).max(MONITOR_LIMITS.listStripRuns)
   })).max(5000)
 });
-var monitorDiagnosticSchema = z6.object({
-  id: z6.string().regex(/^\d{1,19}$/),
-  check_in_id: z6.string().max(64).nullable(),
-  signal: z6.string().max(16),
-  exit_code: z6.number().int().min(0).max(255).nullable(),
-  received_at: iso,
-  body: z6.string().max(MONITOR_LIMITS.diagnosticMaxBytes * 2)
+var monitorDiagnosticSchema = z10.object({
+  id: z10.string().regex(/^\d{1,19}$/),
+  check_in_id: z10.string().max(64).nullable(),
+  signal: z10.string().max(16),
+  exit_code: z10.number().int().min(0).max(255).nullable(),
+  received_at: iso3,
+  body: z10.string().max(MONITOR_LIMITS.diagnosticMaxBytes * 2)
 });
-var monitorDiagnosticsResponseSchema = z6.object({
-  diagnostics: z6.array(monitorDiagnosticSchema).max(50),
-  next_cursor: z6.string().regex(/^\d{1,19}$/).nullable()
+var monitorDiagnosticsResponseSchema = z10.object({
+  diagnostics: z10.array(monitorDiagnosticSchema).max(50),
+  next_cursor: z10.string().regex(/^\d{1,19}$/).nullable()
 });
-var checkInDetailSchema = z6.object({
-  run_key: z6.string().max(64),
-  attempts: z6.array(z6.object({
-    check_in_id: z6.string().max(64),
-    attempt: z6.number().int().nonnegative(),
-    result: z6.string().max(16),
-    started_at: iso,
-    ended_at: iso.nullable(),
-    duration_ms: z6.number().int().nonnegative().nullable(),
-    reason: z6.string().max(64).nullable(),
-    trace_id: z6.string().max(32).nullable(),
-    release: z6.string().max(MONITOR_LIMITS.releaseMax).nullable()
+var checkInDetailSchema = z10.object({
+  run_key: z10.string().max(64),
+  attempts: z10.array(z10.object({
+    check_in_id: z10.string().max(64),
+    attempt: z10.number().int().nonnegative(),
+    result: z10.string().max(16),
+    started_at: iso3,
+    ended_at: iso3.nullable(),
+    duration_ms: z10.number().int().nonnegative().nullable(),
+    reason: z10.string().max(64).nullable(),
+    trace_id: z10.string().max(32).nullable(),
+    release: z10.string().max(MONITOR_LIMITS.releaseMax).nullable()
   })).max(1000),
-  errors: z6.array(z6.object({
-    event_id: z6.string().max(64),
-    issue_id: z6.number().int().nonnegative(),
-    title: z6.string().max(1024),
-    level: z6.string().max(16),
-    timestamp: iso,
-    same_trace: z6.boolean()
+  errors: z10.array(z10.object({
+    event_id: z10.string().max(64),
+    issue_id: z10.number().int().nonnegative(),
+    title: z10.string().max(1024),
+    level: z10.string().max(16),
+    timestamp: iso3,
+    same_trace: z10.boolean()
   })).max(50),
-  diagnostics: z6.array(monitorDiagnosticSchema).max(20).default([])
+  diagnostics: z10.array(monitorDiagnosticSchema).max(20).default([])
+});
+var incidentReviewSchema = z10.object({ incident_id: z10.guid() });
+
+// ../src/shared/contracts/signal-monitors.ts
+var isSignalMonitorType = (t) => SIGNAL_MONITOR_TYPES.includes(t);
+var SIGNAL_KINDS = ["event", "check_in", "span", "log"];
+var SELECTOR_OPS = ["eq", "ne", "lt", "le", "gt", "ge", "in", "exists", "not_exists", "prefix"];
+var NUMERIC_OPS = new Set(["lt", "le", "gt", "ge"]);
+var VALUELESS_OPS = new Set(["exists", "not_exists"]);
+var COMPARATORS = ["lt", "gt", "outside"];
+var MISSING_DATA_POLICIES = ["alert", "keep", "resolve", "treat_as_zero"];
+var SEVERITIES = ["critical", "high", "medium", "low"];
+var OCCURRENCE_STATES = [
+  "pending",
+  "in_progress",
+  "success",
+  "late_success",
+  "missed",
+  "failed",
+  "cancelled"
+];
+var OCCURRENCE_OPEN = new Set(["pending", "in_progress"]);
+var SIGNAL_LIMITS = {
+  matchMax: 5,
+  assertMax: 5,
+  inValuesMax: 20,
+  valueMax: 256,
+  keyMax: 128,
+  environmentsMax: MONITOR_LIMITS.expectedEnvironmentsMax,
+  windowMinutesMin: 1,
+  windowMinutesMax: 1440,
+  thresholdMax: 1e6,
+  graceMinutesMax: 1440,
+  progressMinutesMin: 1,
+  progressMinutesMax: 1440,
+  occurrenceIdMax: 128,
+  occurrenceDueMaxDays: 35,
+  lateSuccessDays: 7,
+  evaluateEverySeconds: 15,
+  settleSeconds: 20,
+  countMaxDelayMinutes: 10,
+  countMinutesPerTick: 60,
+  windowsPerTick: 120,
+  monitorsPerQuery: 50,
+  bucketRowsPerQuery: 9000,
+  backtestDays: 30,
+  bucketRetentionMinutes: 2 * 1440 + 60,
+  occurrencesKeptFinished: 1000,
+  occurrencesPageSize: 50,
+  runIdsPerQuery: 500,
+  dueJudgedPerTick: 5000,
+  queryMaxSeconds: 5
+};
+var SELECTOR_KEY_RE = /^(?:tags\.[A-Za-z0-9_.:-]{1,100}|[A-Za-z_][A-Za-z0-9_.:-]{0,127})$/;
+var scalar = z11.union([z11.string().max(SIGNAL_LIMITS.valueMax), z11.number().finite(), z11.boolean()]);
+var selectorConditionSchema = z11.object({
+  key: z11.string().min(1).max(SIGNAL_LIMITS.keyMax).regex(SELECTOR_KEY_RE),
+  op: z11.enum(SELECTOR_OPS),
+  value: z11.union([scalar, z11.array(z11.string().max(SIGNAL_LIMITS.valueMax)).min(1).max(SIGNAL_LIMITS.inValuesMax)]).optional()
+}).superRefine((c, ctx) => {
+  const bad = (message) => ctx.addIssue({ code: "custom", path: ["value"], message });
+  if (VALUELESS_OPS.has(c.op)) {
+    if (c.value !== undefined)
+      bad("no_value");
+    return;
+  }
+  if (c.value === undefined)
+    return bad("value");
+  if (c.op === "in") {
+    if (!Array.isArray(c.value))
+      bad("list");
+    return;
+  }
+  if (Array.isArray(c.value))
+    return bad("scalar");
+  if (NUMERIC_OPS.has(c.op) && toNumber(c.value) === null)
+    bad("number");
+  if (c.op === "prefix" && (typeof c.value !== "string" || c.value.length === 0))
+    bad("text");
+});
+var environmentListSchema = z11.array(z11.string().trim().min(1).max(MONITOR_LIMITS.environmentMax).regex(/^[A-Za-z0-9._-]+$/)).min(1).max(SIGNAL_LIMITS.environmentsMax).refine((v) => new Set(v).size === v.length, "unique");
+var selectorSchema = z11.object({
+  signal: z11.enum(SIGNAL_KINDS),
+  match: z11.array(selectorConditionSchema).max(SIGNAL_LIMITS.matchMax)
+});
+function toNumber(v) {
+  if (typeof v === "number")
+    return Number.isFinite(v) ? v : null;
+  if (typeof v === "string" && v.trim() !== "" && v.length <= 64) {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : null;
+  }
+  return null;
+}
+var minutes = (min, max) => z11.number().int().min(min).max(max);
+var threshold = z11.number().int().min(0).max(SIGNAL_LIMITS.thresholdMax);
+var recovery = z11.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax);
+var common = {
+  environments: environmentListSchema,
+  severity: z11.enum(SEVERITIES),
+  recovery_threshold: recovery
+};
+var countSettingsSchema = z11.object({
+  type: z11.literal("count"),
+  selector: selectorSchema,
+  window_minutes: minutes(SIGNAL_LIMITS.windowMinutesMin, SIGNAL_LIMITS.windowMinutesMax),
+  comparator: z11.enum(COMPARATORS),
+  threshold,
+  threshold_high: threshold.nullable(),
+  missing_data: z11.enum(MISSING_DATA_POLICIES),
+  ...common
+}).superRefine((s, ctx) => {
+  if (s.comparator === "outside" && (s.threshold_high === null || s.threshold_high <= s.threshold)) {
+    ctx.addIssue({ code: "custom", path: ["threshold_high"], message: "threshold_high" });
+  }
+  if (s.comparator !== "outside" && s.threshold_high !== null) {
+    ctx.addIssue({ code: "custom", path: ["threshold_high"], message: "threshold_high" });
+  }
+  if (s.comparator === "lt" && s.threshold === 0) {
+    ctx.addIssue({ code: "custom", path: ["threshold"], message: "threshold" });
+  }
+});
+var assertionSettingsSchema = z11.object({
+  type: z11.literal("assertion"),
+  selector: selectorSchema,
+  assert: z11.array(selectorConditionSchema).min(1).max(SIGNAL_LIMITS.assertMax),
+  window_minutes: minutes(SIGNAL_LIMITS.windowMinutesMin, SIGNAL_LIMITS.windowMinutesMax),
+  threshold: z11.number().int().min(1).max(SIGNAL_LIMITS.thresholdMax),
+  missing_data: z11.enum(MISSING_DATA_POLICIES),
+  ...common
 });
-var incidentReviewSchema = z6.object({ incident_id: z6.guid() });
+var deadlineSettingsSchema = z11.object({
+  type: z11.literal("deadline"),
+  occurrence_grace_minutes: minutes(0, SIGNAL_LIMITS.graceMinutesMax),
+  progress_timeout_minutes: minutes(SIGNAL_LIMITS.progressMinutesMin, SIGNAL_LIMITS.progressMinutesMax).nullable(),
+  ...common
+});
+var progressSettingsSchema = z11.object({
+  type: z11.literal("progress"),
+  progress_timeout_minutes: minutes(SIGNAL_LIMITS.progressMinutesMin, SIGNAL_LIMITS.progressMinutesMax),
+  ...common
+});
+var signalSettingsSchema = z11.discriminatedUnion("type", [
+  countSettingsSchema,
+  assertionSettingsSchema,
+  deadlineSettingsSchema,
+  progressSettingsSchema
+]);
+function settingsFromRow(row) {
+  if (!isSignalMonitorType(row.type) || !row.signal_settings || typeof row.signal_settings !== "object")
+    return null;
+  const r = signalSettingsSchema.safeParse({
+    ...row.signal_settings,
+    type: row.type,
+    environments: [...row.expected_environments],
+    severity: row.severity,
+    recovery_threshold: row.recovery_threshold
+  });
+  return r.success ? r.data : null;
+}
+var signalMonitorInputSchema = z11.object({
+  name: z11.string().trim().min(1).max(MONITOR_LIMITS.nameMax),
+  settings: signalSettingsSchema
+});
+var signalMonitorDefinitionSchema = z11.object({
+  id: z11.guid(),
+  project_id: z11.number().int().positive(),
+  slug: z11.string().regex(SLUG_RE),
+  settings: signalSettingsSchema,
+  paused_until: z11.string().datetime().nullable(),
+  created_at: z11.string().datetime(),
+  revision: z11.number().int().nonnegative()
+});
+var signalLimitsConfigSchema = z11.object({
+  pending_occurrences_per_monitor: z11.number().int().min(1).max(1e6),
+  pending_occurrences_per_project: z11.number().int().min(1).max(1e7)
+});
+var OCCURRENCE_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+var occurrenceInputSchema = z11.object({
+  monitor_slug: z11.string().regex(SLUG_RE),
+  occurrence_id: z11.string().regex(OCCURRENCE_ID_RE),
+  due_at: z11.string().datetime({ offset: true }),
+  environment: z11.string().trim().min(1).max(MONITOR_LIMITS.environmentMax).regex(/^[A-Za-z0-9._-]+$/).optional()
+});
+var occurrenceCancelSchema = occurrenceInputSchema.pick({ monitor_slug: true, occurrence_id: true, environment: true });
+var OCCURRENCE_PAST_SKEW_MS = 5 * 60000;
+var occurrenceRowSchema = z11.object({
+  occurrence_id: z11.string().max(SIGNAL_LIMITS.occurrenceIdMax),
+  environment: z11.string().max(MONITOR_LIMITS.environmentMax),
+  state: z11.enum(OCCURRENCE_STATES),
+  due_at: z11.string().datetime(),
+  deadline_at: z11.string().datetime(),
+  registered_at: z11.string().datetime(),
+  started_at: z11.string().datetime().nullable(),
+  last_signal_at: z11.string().datetime().nullable(),
+  ended_at: z11.string().datetime().nullable(),
+  stalled: z11.boolean()
+});
+var occurrencesResponseSchema = z11.object({
+  occurrences: z11.array(occurrenceRowSchema).max(SIGNAL_LIMITS.occurrencesPageSize),
+  pending: z11.number().int().nonnegative(),
+  next_due_at: z11.string().datetime().nullable(),
+  next_cursor: z11.string().max(64).nullable(),
+  refused_24h: z11.number().int().nonnegative()
+});
+var signalSeriesSchema = z11.object({
+  environment: z11.string().max(MONITOR_LIMITS.environmentMax),
+  buckets: z11.array(z11.object({ minute: z11.string().datetime(), matched: z11.number().int().nonnegative(), violations: z11.number().int().nonnegative(), lossy: z11.boolean() })).max(1440),
+  counted_through: z11.string().datetime().nullable()
+});
+var signalResponseSchema = z11.object({
+  series: z11.array(signalSeriesSchema).max(SIGNAL_LIMITS.environmentsMax),
+  runs: z11.array(z11.object({
+    run_id: z11.string().max(SIGNAL_LIMITS.occurrenceIdMax),
+    environment: z11.string().max(MONITOR_LIMITS.environmentMax),
+    started_at: z11.string().datetime(),
+    last_signal_at: z11.string().datetime(),
+    stalled: z11.boolean()
+  })).max(SIGNAL_LIMITS.occurrencesPageSize)
+});
+var backtestSettingsSchema = z11.union([countSettingsSchema, assertionSettingsSchema]);
+var backtestResponseSchema = z11.object({
+  alerts: z11.number().int().nonnegative(),
+  windows: z11.number().int().nonnegative(),
+  violated_windows: z11.number().int().nonnegative(),
+  first_at: z11.string().datetime().nullable(),
+  last_at: z11.string().datetime().nullable(),
+  days: z11.number().nonnegative(),
+  matched_total: z11.number().int().nonnegative(),
+  violations_total: z11.number().int().nonnegative()
+});
+
+// ../src/shared/contracts/notifications.ts
+var NOTIFY_LIMITS = {
+  policiesMax: 20,
+  nameMax: 80,
+  chainMax: 5,
+  escalateMinutesMin: 5,
+  escalateMinutesMax: 240,
+  digestRowsMax: 50,
+  slotSearchDays: 8
+};
+var HOLDABLE_SEVERITIES = ["medium", "low"];
+var DIGEST_MODES = ["off", "hourly", "daily"];
+var timeOfDay2 = z12.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/);
+var unique = (xs) => new Set(xs).size === xs.length;
+var quietHoursSchema = z12.object({
+  days: z12.array(weekdaySchema).min(1).max(7).refine(unique),
+  start: timeOfDay2,
+  end: timeOfDay2
+}).refine((q) => q.start !== q.end, { path: ["end"] });
+var policyInputSchema = z12.object({
+  name: z12.string().trim().min(1).max(NOTIFY_LIMITS.nameMax).regex(/^[^\p{Cc}]*$/u),
+  timezone: z12.string().trim().min(1).max(64).refine(validTimeZone),
+  quietHours: quietHoursSchema.nullable(),
+  quietSeverities: z12.array(z12.enum(HOLDABLE_SEVERITIES)).max(2).refine(unique),
+  digest: z12.enum(DIGEST_MODES),
+  digestAt: timeOfDay2.nullable(),
+  digestSeverities: z12.array(z12.enum(HOLDABLE_SEVERITIES)).max(2).refine(unique),
+  fallback: z12.array(z12.guid()).max(NOTIFY_LIMITS.chainMax).refine(unique),
+  escalateAfterMinutes: z12.number().int().min(NOTIFY_LIMITS.escalateMinutesMin).max(NOTIFY_LIMITS.escalateMinutesMax).nullable(),
+  escalation: z12.array(z12.guid()).max(NOTIFY_LIMITS.chainMax).refine(unique)
+}).superRefine((p, ctx) => {
+  if (p.digest === "daily" !== (p.digestAt !== null))
+    ctx.addIssue({ code: "custom", path: ["digestAt"], message: "digest_at" });
+  if (p.escalateAfterMinutes !== null !== p.escalation.length > 0)
+    ctx.addIssue({ code: "custom", path: ["escalation"], message: "escalation" });
+});
+var MIN = 60000;
+var HOUR = 60 * MIN;
+var DAY = 24 * HOUR;
+
+// ../src/shared/contracts/api-ops/incidents.ts
+var incidentOnly = z13.object({ workspaceId: uuid, incidentId: uuid });
+var note2 = z13.string().trim().min(1).max(2000).regex(/^[^\u0000-\u0008\u000b\u000c\u000e-\u001f]*$/);
+var INCIDENT_KINDS = ["monitor", "uptime", "slo", "issue"];
+var INCIDENT_GROUP_BY = ["monitor", "project_env"];
+var incidentRuleInputSchema = z13.object({
+  name: z13.string().trim().min(1).max(80).regex(/^[^\p{Cc}]*$/u),
+  isEnabled: z13.boolean(),
+  position: z13.number().int().min(0).max(1000).default(0),
+  projectIds: z13.array(z13.number().int().positive()).max(50),
+  environments: z13.array(z13.string().trim().min(1).max(64)).max(20),
+  kinds: z13.array(z13.enum(INCIDENT_KINDS)).min(1).max(4),
+  minSeverity: z13.enum(SEVERITIES),
+  groupBy: z13.enum(INCIDENT_GROUP_BY),
+  windowMinutes: z13.number().int().min(5).max(240),
+  recoveryHoldMinutes: z13.number().int().min(0).max(1440)
+});
+var INCIDENT_INPUTS = {
+  list: z13.object({
+    workspaceId: uuid,
+    limit: pageLimit,
+    cursor,
+    state: z13.enum(["active", "resolved", "all"]).default("all")
+  }),
+  incidentOnly,
+  resolve: incidentOnly.extend({ note: note2.max(500) }),
+  note: incidentOnly.extend({ note: note2 }),
+  update: incidentOnly.extend({
+    title: z13.string().trim().min(1).max(120).regex(/^[^\p{Cc}]*$/u).optional(),
+    ownerUserId: uuid.nullable().optional()
+  }),
+  workspace: z13.object({ workspaceId: uuid }),
+  saveRule: z13.object({ workspaceId: uuid, ruleId: uuid.nullable(), input: incidentRuleInputSchema }),
+  ruleOnly: z13.object({ workspaceId: uuid, ruleId: uuid }),
+  savePolicy: z13.object({
+    workspaceId: uuid,
+    policyId: uuid.nullable(),
+    isDefault: z13.boolean(),
+    input: policyInputSchema
+  }),
+  policyOnly: z13.object({ workspaceId: uuid, policyId: uuid })
+};
+var I = INCIDENT_INPUTS;
+var w = "incidents:write";
+var INCIDENT_OPERATIONS = [
+  op({
+    id: "incidents.list",
+    method: "GET",
+    path: "/v1/incidents",
+    scope: "incidents:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_incidents"],
+    input: I.list,
+    workspace: true,
+    idempotency: "none",
+    paged: true,
+    mcp: "reliability",
+    summary: "Incidents (INC-n): state, severity and peak, owner, linked alert count; newest first.",
+    ui: []
+  }),
+  op({
+    id: "incidents.get",
+    method: "GET",
+    path: "/v1/incidents/{incident_id}",
+    scope: "incidents:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_incident"],
+    input: I.incidentOnly,
+    workspace: true,
+    idempotency: "none",
+    mcp: "reliability",
+    summary: "One incident with its linked alerts, timeline (notes included) and message deliveries (`accepted` = the provider took it; only a person acknowledges).",
+    ui: []
+  }),
+  op({
+    id: "incidents.acknowledge",
+    method: "POST",
+    path: "/v1/incidents/{incident_id}/ack",
+    scope: w,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["acknowledge_incident"],
+    input: I.incidentOnly,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Take ownership of an open incident; stops its escalation. Members and up.",
+    ui: ["incidents#acknowledgeIncident"]
+  }),
+  op({
+    id: "incidents.resolve",
+    method: "POST",
+    path: "/v1/incidents/{incident_id}/resolve",
+    scope: w,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["resolve_incident"],
+    input: I.resolve,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: 'Close an incident by hand with a reason (1–500 characters); it is labelled "not verified".',
+    ui: ["incidents#resolveIncident"]
+  }),
+  op({
+    id: "incidents.note",
+    method: "POST",
+    path: "/v1/incidents/{incident_id}/notes",
+    scope: w,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["add_incident_note"],
+    input: I.note,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Add a note to the incident timeline (plain text, ≤ 2,000 characters).",
+    ui: ["incidents#addIncidentNote"]
+  }),
+  op({
+    id: "incidents.update",
+    method: "PATCH",
+    path: "/v1/incidents/{incident_id}",
+    scope: w,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["update_incident"],
+    input: I.update,
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Rename an incident or assign it to a member (`owner_user_id: null` clears it).",
+    ui: ["incidents#updateIncident"]
+  }),
+  op({
+    id: "incident_rules.list",
+    method: "GET",
+    path: "/v1/incident-rules",
+    scope: "alerts:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_incident_rules"],
+    input: I.workspace,
+    workspace: true,
+    idempotency: "none",
+    mcp: "investigate",
+    summary: "Rules that turn alerts into incidents: match, grouping, window and recovery wait.",
+    ui: []
+  }),
+  op({
+    id: "incident_rules.save",
+    method: "POST",
+    path: "/v1/incident-rules",
+    scope: "alerts:write",
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["save_incident_rule"],
+    input: I.saveRule,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Create (`rule_id` null) or replace an incident rule. Admins.",
+    ui: ["incidents#saveIncidentRule"]
+  }),
+  op({
+    id: "incident_rules.delete",
+    method: "DELETE",
+    path: "/v1/incident-rules/{rule_id}",
+    scope: "alerts:write",
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["delete_incident_rule"],
+    input: I.ruleOnly,
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Delete an incident rule; open incidents stay as they are.",
+    ui: ["incidents#deleteIncidentRule"]
+  }),
+  op({
+    id: "notification_policies.list",
+    method: "GET",
+    path: "/v1/notification-policies",
+    scope: "alerts:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_notification_policies"],
+    input: I.workspace,
+    workspace: true,
+    idempotency: "none",
+    mcp: "investigate",
+    summary: "Notification policies: quiet hours, digest, fallback chain and escalation.",
+    ui: []
+  }),
+  op({
+    id: "notification_policies.save",
+    method: "POST",
+    path: "/v1/notification-policies",
+    scope: "alerts:write",
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["save_notification_policy"],
+    input: I.savePolicy,
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Create (`policy_id` null) or replace a policy. Critical and high are never held; chains use existing destinations only. Admins.",
+    ui: ["incidents#saveNotificationPolicy"]
+  }),
+  op({
+    id: "notification_policies.delete",
+    method: "DELETE",
+    path: "/v1/notification-policies/{policy_id}",
+    scope: "alerts:write",
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["delete_notification_policy"],
+    input: I.policyOnly,
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Delete a policy (not the default); its rules fall back to the default policy.",
+    ui: ["incidents#deleteNotificationPolicy"]
+  })
+];
+
+// ../src/shared/contracts/api-ops/monitors.ts
+import { z as z18 } from "zod";
+
+// ../src/shared/contracts/heartbeat.ts
+import { z as z15 } from "zod";
 
 // ../src/shared/contracts/signed-message.ts
-import { z as z7 } from "zod";
-var nodeIdSchema = z7.guid();
-var signedEnvelopeSchema = z7.object({
+import { z as z14 } from "zod";
+var nodeIdSchema = z14.guid();
+var signedEnvelopeSchema = z14.object({
   node_id: nodeIdSchema,
-  ts: z7.number().int().positive(),
-  nonce: z7.string().regex(/^[A-Za-z0-9_-]{16,64}$/),
-  payload: z7.record(z7.string(), z7.unknown()),
-  sig: z7.string().regex(/^[A-Za-z0-9_-]{86}$/)
+  ts: z14.number().int().positive(),
+  nonce: z14.string().regex(/^[A-Za-z0-9_-]{16,64}$/),
+  payload: z14.record(z14.string(), z14.unknown()),
+  sig: z14.string().regex(/^[A-Za-z0-9_-]{86}$/)
 });
 
 // ../src/shared/contracts/heartbeat.ts
@@ -1161,78 +2038,78 @@ var HEARTBEAT_LIMITS = {
   diagnosticsPerRun: 5
 };
 var PAUSED_FOREVER_MS = Date.parse("9999-12-31T00:00:00.000Z");
-var uuid2 = z8.guid();
-var ms = z8.number().int().nonnegative();
-var hex64 = z8.string().regex(/^[0-9a-f]{64}$/);
-var envName2 = z8.string().min(1).max(MONITOR_LIMITS.environmentMax);
-var heartbeatMonitorConfigSchema = z8.object({
+var uuid2 = z15.guid();
+var ms = z15.number().int().nonnegative();
+var hex64 = z15.string().regex(/^[0-9a-f]{64}$/);
+var envName2 = z15.string().min(1).max(MONITOR_LIMITS.environmentMax);
+var heartbeatMonitorConfigSchema = z15.object({
   id: uuid2,
-  project_id: z8.number().int().positive(),
-  slug: z8.string().regex(SLUG_RE),
+  project_id: z15.number().int().positive(),
+  slug: z15.string().regex(SLUG_RE),
   environment: envName2,
   schedule: scheduleSchema,
-  timezone: z8.string().min(1).max(64),
-  grace_min: z8.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
-  max_runtime_min: z8.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
-  failure_threshold: z8.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
-  recovery_threshold: z8.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  timezone: z15.string().min(1).max(64),
+  grace_min: z15.number().int().min(MONITOR_LIMITS.checkinMarginMin).max(MONITOR_LIMITS.checkinMarginMax),
+  max_runtime_min: z15.number().int().min(MONITOR_LIMITS.maxRuntimeMin).max(MONITOR_LIMITS.maxRuntimeMax),
+  failure_threshold: z15.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
+  recovery_threshold: z15.number().int().min(MONITOR_LIMITS.thresholdMin).max(MONITOR_LIMITS.thresholdMax),
   paused_until: ms.nullable(),
   created_at: ms
 });
-var heartbeatTokenConfigSchema = z8.object({
+var heartbeatTokenConfigSchema = z15.object({
   id: uuid2,
   monitor_id: uuid2,
   hash: hex64,
   expires_at: ms.nullable()
 });
-var heartbeatSyncSchema = z8.object({
-  v: z8.literal(1),
+var heartbeatSyncSchema = z15.object({
+  v: z15.literal(1),
   workspace_id: uuid2,
-  route: z8.string().regex(PING_ROUTE_RE),
-  revision: z8.number().int().positive(),
-  workspace_status: z8.enum(["active", "suspended", "deleting"]),
-  ingest_kill: z8.boolean(),
-  limits: z8.object({
-    check_in_rate_per_sec: z8.number().int().positive(),
-    check_in_burst: z8.number().int().positive(),
-    monthly_check_in_cap: z8.number().int().positive()
-  }),
-  projects: z8.array(z8.object({ id: z8.number().int().positive(), node_id: nodeIdSchema.nullable() })).max(1000),
-  monitors: z8.array(heartbeatMonitorConfigSchema).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace),
-  tokens: z8.array(heartbeatTokenConfigSchema).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace * 2)
+  route: z15.string().regex(PING_ROUTE_RE),
+  revision: z15.number().int().positive(),
+  workspace_status: z15.enum(["active", "suspended", "deleting"]),
+  ingest_kill: z15.boolean(),
+  limits: z15.object({
+    check_in_rate_per_sec: z15.number().int().positive(),
+    check_in_burst: z15.number().int().positive(),
+    monthly_check_in_cap: z15.number().int().positive()
+  }),
+  projects: z15.array(z15.object({ id: z15.number().int().positive(), node_id: nodeIdSchema.nullable() })).max(1000),
+  monitors: z15.array(heartbeatMonitorConfigSchema).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace),
+  tokens: z15.array(heartbeatTokenConfigSchema).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace * 2)
 });
-var signedHeartbeatSyncSchema = z8.object({
-  body: z8.string().min(2).max(4 * 1024 * 1024),
-  ts: z8.number().int().positive(),
-  kid: z8.string().regex(/^[A-Za-z0-9_-]{1,40}$/),
-  sig: z8.string().regex(/^[A-Za-z0-9_-]{86}$/)
+var signedHeartbeatSyncSchema = z15.object({
+  body: z15.string().min(2).max(4 * 1024 * 1024),
+  ts: z15.number().int().positive(),
+  kid: z15.string().regex(/^[A-Za-z0-9_-]{1,40}$/),
+  sig: z15.string().regex(/^[A-Za-z0-9_-]{86}$/)
 });
-var heartbeatHourSchema = z8.object({
+var heartbeatHourSchema = z15.object({
   monitor_id: uuid2,
-  hour: z8.string().datetime(),
-  ok: z8.number().int().nonnegative(),
-  failed: z8.number().int().nonnegative(),
-  started: z8.number().int().nonnegative(),
-  missed: z8.number().int().nonnegative(),
-  logs: z8.number().int().nonnegative()
+  hour: z15.string().datetime(),
+  ok: z15.number().int().nonnegative(),
+  failed: z15.number().int().nonnegative(),
+  started: z15.number().int().nonnegative(),
+  missed: z15.number().int().nonnegative(),
+  logs: z15.number().int().nonnegative()
 });
-var heartbeatReportSchema = z8.object({
-  v: z8.literal(1),
+var heartbeatReportSchema = z15.object({
+  v: z15.literal(1),
   workspace_id: uuid2,
-  route: z8.string().regex(PING_ROUTE_RE),
-  revision: z8.number().int().nonnegative(),
-  sent_at: z8.string().datetime(),
-  incidents: z8.array(monitorIncidentSchema).max(HEARTBEAT_LIMITS.reportMaxIncidents),
-  statuses: z8.array(monitorStatusSchema).max(HEARTBEAT_LIMITS.reportMaxStatuses),
-  hours: z8.array(heartbeatHourSchema).max(HEARTBEAT_LIMITS.reportMaxHours),
-  token_uses: z8.array(z8.object({ token_id: uuid2, last_used_at: z8.string().datetime() })).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace * 2)
+  route: z15.string().regex(PING_ROUTE_RE),
+  revision: z15.number().int().nonnegative(),
+  sent_at: z15.string().datetime(),
+  incidents: z15.array(monitorIncidentSchema).max(HEARTBEAT_LIMITS.reportMaxIncidents),
+  statuses: z15.array(monitorStatusSchema).max(HEARTBEAT_LIMITS.reportMaxStatuses),
+  hours: z15.array(heartbeatHourSchema).max(HEARTBEAT_LIMITS.reportMaxHours),
+  token_uses: z15.array(z15.object({ token_id: uuid2, last_used_at: z15.string().datetime() })).max(HEARTBEAT_LIMITS.maxMonitorsPerWorkspace * 2)
 });
 var ENCODER = new TextEncoder;
 var UTF8 = new TextDecoder("utf-8", { fatal: false, ignoreBOM: false });
 var TOKEN_IN_TEXT = new RegExp(PING_TOKEN_PATTERN, "g");
 
 // ../src/shared/contracts/slo.ts
-import { z as z9 } from "zod";
+import { z as z16 } from "zod";
 
 // ../src/shared/contracts/vocab/slo.ts
 var SLO_SOURCES = ["uptime", "monitor", "heartbeat", "spans"];
@@ -1264,17 +2141,17 @@ var SLO_SOURCE_META = {
   heartbeat: { provenance: "ping_token", estimated: false, slis: ["availability"], budgeting: "Occurrences" },
   spans: { provenance: "ingest_key", estimated: true, slis: ["availability", "latency"], budgeting: "Occurrences" }
 };
-var nodeSloSchema = z9.object({
-  slo_id: z9.guid(),
-  project_id: z9.number().int().positive(),
-  source: z9.enum(["monitor", "spans"]),
-  sli: z9.enum(SLO_SLIS),
-  monitor_id: z9.guid().optional(),
-  environment: z9.string().min(1).max(SLO_LIMITS.environmentMaxChars).optional(),
-  service: z9.string().min(1).max(128).optional(),
-  operation: z9.string().min(1).max(256).optional(),
-  latency_threshold_ms: z9.number().int().min(1).max(60000).optional(),
-  public_sources: z9.boolean()
+var nodeSloSchema = z16.object({
+  slo_id: z16.guid(),
+  project_id: z16.number().int().positive(),
+  source: z16.enum(["monitor", "spans"]),
+  sli: z16.enum(SLO_SLIS),
+  monitor_id: z16.guid().optional(),
+  environment: z16.string().min(1).max(SLO_LIMITS.environmentMaxChars).optional(),
+  service: z16.string().min(1).max(128).optional(),
+  operation: z16.string().min(1).max(256).optional(),
+  latency_threshold_ms: z16.number().int().min(1).max(60000).optional(),
+  public_sources: z16.boolean()
 }).superRefine((v, ctx) => {
   if (v.source === "monitor" && (!v.monitor_id || v.sli !== "availability"))
     ctx.addIssue({ code: "custom", path: ["monitor_id"], message: "INVALID_INPUT" });
@@ -1283,27 +2160,27 @@ var nodeSloSchema = z9.object({
   if (v.sli === "latency" !== (v.latency_threshold_ms !== undefined))
     ctx.addIssue({ code: "custom", path: ["latency_threshold_ms"], message: "INVALID_INPUT" });
 });
-var sliCountsSchema = z9.object({
-  minute: z9.string().datetime(),
-  items: z9.array(z9.object({ slo_id: z9.guid(), good: z9.number().int().min(0), total: z9.number().int().min(0) }).refine((x) => x.good <= x.total, { message: "INVALID_INPUT" })).max(SLO_LIMITS.sliItemsPerMessage)
+var sliCountsSchema = z16.object({
+  minute: z16.string().datetime(),
+  items: z16.array(z16.object({ slo_id: z16.guid(), good: z16.number().int().min(0), total: z16.number().int().min(0) }).refine((x) => x.good <= x.total, { message: "INVALID_INPUT" })).max(SLO_LIMITS.sliItemsPerMessage)
 });
-var sloInputSchema = z9.object({
-  name: z9.string().trim().min(1).max(SLO_LIMITS.nameMaxChars),
-  description: z9.string().max(SLO_LIMITS.descriptionMaxChars).default(""),
-  source: z9.enum(SLO_SOURCES),
-  sourceRef: z9.object({
-    id: z9.guid().optional(),
-    projectId: z9.number().int().positive().optional(),
-    service: z9.string().max(128).optional(),
-    operation: z9.string().max(256).optional(),
-    environment: z9.string().max(SLO_LIMITS.environmentMaxChars).optional()
-  }),
-  sli: z9.enum(SLO_SLIS),
-  latencyThresholdMs: z9.number().int().min(1).max(60000).nullable(),
-  objective: z9.number().min(SLO_LIMITS.objectiveMin).max(SLO_LIMITS.objectiveMax),
-  windowDays: z9.union([z9.literal(7), z9.literal(28), z9.literal(30)]),
-  alertPolicy: z9.enum(SLO_ALERT_POLICIES),
-  allowPublicSources: z9.boolean().default(false)
+var sloInputSchema = z16.object({
+  name: z16.string().trim().min(1).max(SLO_LIMITS.nameMaxChars),
+  description: z16.string().max(SLO_LIMITS.descriptionMaxChars).default(""),
+  source: z16.enum(SLO_SOURCES),
+  sourceRef: z16.object({
+    id: z16.guid().optional(),
+    projectId: z16.number().int().positive().optional(),
+    service: z16.string().max(128).optional(),
+    operation: z16.string().max(256).optional(),
+    environment: z16.string().max(SLO_LIMITS.environmentMaxChars).optional()
+  }),
+  sli: z16.enum(SLO_SLIS),
+  latencyThresholdMs: z16.number().int().min(1).max(60000).nullable(),
+  objective: z16.number().min(SLO_LIMITS.objectiveMin).max(SLO_LIMITS.objectiveMax),
+  windowDays: z16.union([z16.literal(7), z16.literal(28), z16.literal(30)]),
+  alertPolicy: z16.enum(SLO_ALERT_POLICIES),
+  allowPublicSources: z16.boolean().default(false)
 }).superRefine((v, ctx) => {
   if (!SLO_SOURCE_META[v.source].slis.includes(v.sli))
     ctx.addIssue({ code: "custom", path: ["sli"], message: "INVALID_INPUT" });
@@ -1318,7 +2195,7 @@ var sloInputSchema = z9.object({
 });
 
 // ../src/shared/contracts/uptime.ts
-import { z as z10 } from "zod";
+import { z as z17 } from "zod";
 
 // ../src/shared/contracts/vocab/uptime.ts
 var UPTIME_STATUSES = ["up", "degraded", "down", "unknown", "paused", "pending"];
@@ -1391,51 +2268,51 @@ function isForbiddenHeader(name) {
   const n = name.trim().toLowerCase();
   return UPTIME_FORBIDDEN_HEADERS.includes(n) || n.startsWith("proxy-") || n.startsWith("sec-");
 }
-var text = z10.string().min(1).max(UPTIME_LIMITS.assertionTextMax);
-var statusRange = z10.string().regex(/^[1-5][0-9]{2}(-[1-5][0-9]{2})?$/);
-var assertionSchema = z10.discriminatedUnion("type", [
-  z10.object({ type: z10.literal("status"), in: z10.array(statusRange).min(1).max(10) }),
-  z10.object({ type: z10.literal("body_contains"), value: text, case_sensitive: z10.boolean().default(true) }),
-  z10.object({ type: z10.literal("body_not_contains"), value: text, case_sensitive: z10.boolean().default(true) }),
-  z10.object({
-    type: z10.literal("json_pointer"),
-    pointer: z10.string().max(256).regex(/^(\/([^~/]|~0|~1)*)*$/),
-    op: z10.enum(["exists", "equals", "type"]),
-    value: z10.string().max(UPTIME_LIMITS.assertionTextMax).optional()
-  }),
-  z10.object({
-    type: z10.literal("header"),
-    name: z10.string().min(1).max(UPTIME_LIMITS.headerNameMax).regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/),
-    op: z10.enum(["equals", "contains", "exists"]),
-    value: z10.string().max(UPTIME_LIMITS.assertionTextMax).optional()
-  }),
-  z10.object({ type: z10.literal("latency_ms"), lt: z10.number().int().min(1).max(60000) }),
-  z10.object({ type: z10.literal("tls_valid") })
+var text = z17.string().min(1).max(UPTIME_LIMITS.assertionTextMax);
+var statusRange = z17.string().regex(/^[1-5][0-9]{2}(-[1-5][0-9]{2})?$/);
+var assertionSchema = z17.discriminatedUnion("type", [
+  z17.object({ type: z17.literal("status"), in: z17.array(statusRange).min(1).max(10) }),
+  z17.object({ type: z17.literal("body_contains"), value: text, case_sensitive: z17.boolean().default(true) }),
+  z17.object({ type: z17.literal("body_not_contains"), value: text, case_sensitive: z17.boolean().default(true) }),
+  z17.object({
+    type: z17.literal("json_pointer"),
+    pointer: z17.string().max(256).regex(/^(\/([^~/]|~0|~1)*)*$/),
+    op: z17.enum(["exists", "equals", "type"]),
+    value: z17.string().max(UPTIME_LIMITS.assertionTextMax).optional()
+  }),
+  z17.object({
+    type: z17.literal("header"),
+    name: z17.string().min(1).max(UPTIME_LIMITS.headerNameMax).regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/),
+    op: z17.enum(["equals", "contains", "exists"]),
+    value: z17.string().max(UPTIME_LIMITS.assertionTextMax).optional()
+  }),
+  z17.object({ type: z17.literal("latency_ms"), lt: z17.number().int().min(1).max(60000) }),
+  z17.object({ type: z17.literal("tls_valid") })
 ]);
-var header = z10.object({
-  name: z10.string().min(1).max(UPTIME_LIMITS.headerNameMax).regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/),
-  value: z10.string().max(UPTIME_LIMITS.headerValueMax).regex(/^[^\r\n\u0000]*$/)
+var header = z17.object({
+  name: z17.string().min(1).max(UPTIME_LIMITS.headerNameMax).regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/),
+  value: z17.string().max(UPTIME_LIMITS.headerValueMax).regex(/^[^\r\n\u0000]*$/)
 });
-var uptimeCheckInputSchema = z10.object({
-  projectId: z10.number().int().positive(),
-  name: z10.string().trim().min(1).max(UPTIME_LIMITS.nameMaxChars),
-  kind: z10.enum(UPTIME_KINDS),
-  url: z10.string().max(UPTIME_LIMITS.urlMaxChars).nullable(),
-  host: z10.string().max(253).nullable(),
-  port: z10.number().int().min(1).max(65535).nullable(),
-  method: z10.enum(UPTIME_METHODS).default("GET"),
-  headers: z10.array(header).max(UPTIME_LIMITS.headersMax).default([]),
-  followRedirects: z10.boolean().default(false),
-  timeoutMs: z10.number().int().min(UPTIME_LIMITS.timeoutMs.min).max(UPTIME_LIMITS.timeoutMs.max),
-  intervalSeconds: z10.number().int().refine((n) => UPTIME_INTERVALS.includes(n)),
-  regions: z10.array(z10.enum(UPTIME_REGIONS)).min(UPTIME_LIMITS.minRegions).max(UPTIME_REGIONS.length),
-  assertions: z10.array(assertionSchema).max(UPTIME_LIMITS.assertionsMax).default([]),
-  failureThreshold: z10.number().int().min(1).max(5),
-  recoveryThreshold: z10.number().int().min(1).max(5),
-  certWarningDays: z10.number().int().min(1).max(60),
-  environment: z10.string().trim().max(64).default(""),
-  strictMetadata: z10.boolean().default(false),
-  evidenceOnFailure: z10.boolean().default(true)
+var uptimeCheckInputSchema = z17.object({
+  projectId: z17.number().int().positive(),
+  name: z17.string().trim().min(1).max(UPTIME_LIMITS.nameMaxChars),
+  kind: z17.enum(UPTIME_KINDS),
+  url: z17.string().max(UPTIME_LIMITS.urlMaxChars).nullable(),
+  host: z17.string().max(253).nullable(),
+  port: z17.number().int().min(1).max(65535).nullable(),
+  method: z17.enum(UPTIME_METHODS).default("GET"),
+  headers: z17.array(header).max(UPTIME_LIMITS.headersMax).default([]),
+  followRedirects: z17.boolean().default(false),
+  timeoutMs: z17.number().int().min(UPTIME_LIMITS.timeoutMs.min).max(UPTIME_LIMITS.timeoutMs.max),
+  intervalSeconds: z17.number().int().refine((n) => UPTIME_INTERVALS.includes(n)),
+  regions: z17.array(z17.enum(UPTIME_REGIONS)).min(UPTIME_LIMITS.minRegions).max(UPTIME_REGIONS.length),
+  assertions: z17.array(assertionSchema).max(UPTIME_LIMITS.assertionsMax).default([]),
+  failureThreshold: z17.number().int().min(1).max(5),
+  recoveryThreshold: z17.number().int().min(1).max(5),
+  certWarningDays: z17.number().int().min(1).max(60),
+  environment: z17.string().trim().max(64).default(""),
+  strictMetadata: z17.boolean().default(false),
+  evidenceOnFailure: z17.boolean().default(true)
 }).superRefine((v, ctx) => {
   if (v.kind === "http" && !v.url)
     ctx.addIssue({ code: "custom", path: ["url"], message: "INVALID_INPUT" });
@@ -1446,237 +2323,243 @@ var uptimeCheckInputSchema = z10.object({
   if (v.headers.some((h) => isForbiddenHeader(h.name)))
     ctx.addIssue({ code: "custom", path: ["headers"], message: "UPTIME_HEADER_FORBIDDEN" });
 });
-var uptimeDefinitionSchema = z10.object({
-  check_id: z10.guid(),
-  workspace_id: z10.guid(),
-  project_id: z10.number().int().positive(),
-  revision: z10.number().int().nonnegative(),
-  kind: z10.enum(UPTIME_KINDS),
-  url: z10.string().max(UPTIME_LIMITS.urlMaxChars).nullable(),
-  host: z10.string().max(253).nullable(),
-  port: z10.number().int().min(1).max(65535).nullable(),
-  method: z10.enum(UPTIME_METHODS),
-  headers: z10.array(header).max(UPTIME_LIMITS.headersMax),
-  follow_redirects: z10.boolean(),
-  timeout_ms: z10.number().int().min(UPTIME_LIMITS.timeoutMs.min).max(UPTIME_LIMITS.timeoutMs.max),
-  interval_seconds: z10.number().int().positive(),
-  regions: z10.array(z10.enum(UPTIME_REGIONS)).min(1).max(3),
-  assertions: z10.array(assertionSchema).max(UPTIME_LIMITS.assertionsMax),
-  failure_threshold: z10.number().int().min(1).max(5),
-  recovery_threshold: z10.number().int().min(1).max(5),
-  cert_warning_days: z10.number().int().min(1).max(60),
-  strict_metadata: z10.boolean(),
-  evidence_on_failure: z10.boolean(),
-  paused_until: z10.string().nullable(),
-  muted_until: z10.string().nullable()
+var uptimeDefinitionSchema = z17.object({
+  check_id: z17.guid(),
+  workspace_id: z17.guid(),
+  project_id: z17.number().int().positive(),
+  revision: z17.number().int().nonnegative(),
+  kind: z17.enum(UPTIME_KINDS),
+  url: z17.string().max(UPTIME_LIMITS.urlMaxChars).nullable(),
+  host: z17.string().max(253).nullable(),
+  port: z17.number().int().min(1).max(65535).nullable(),
+  method: z17.enum(UPTIME_METHODS),
+  headers: z17.array(header).max(UPTIME_LIMITS.headersMax),
+  follow_redirects: z17.boolean(),
+  timeout_ms: z17.number().int().min(UPTIME_LIMITS.timeoutMs.min).max(UPTIME_LIMITS.timeoutMs.max),
+  interval_seconds: z17.number().int().positive(),
+  regions: z17.array(z17.enum(UPTIME_REGIONS)).min(1).max(3),
+  assertions: z17.array(assertionSchema).max(UPTIME_LIMITS.assertionsMax),
+  failure_threshold: z17.number().int().min(1).max(5),
+  recovery_threshold: z17.number().int().min(1).max(5),
+  cert_warning_days: z17.number().int().min(1).max(60),
+  strict_metadata: z17.boolean(),
+  evidence_on_failure: z17.boolean(),
+  paused_until: z17.string().nullable(),
+  muted_until: z17.string().nullable()
 });
-var timingsSchema = z10.object({
-  dns_ms: z10.number().nonnegative().max(60000).nullable(),
-  connect_ms: z10.number().nonnegative().max(60000).nullable(),
-  tls_ms: z10.number().nonnegative().max(60000).nullable(),
-  ttfb_ms: z10.number().nonnegative().max(60000).nullable(),
-  download_ms: z10.number().nonnegative().max(60000).nullable(),
-  total_ms: z10.number().nonnegative().max(60000)
+var timingsSchema = z17.object({
+  dns_ms: z17.number().nonnegative().max(60000).nullable(),
+  connect_ms: z17.number().nonnegative().max(60000).nullable(),
+  tls_ms: z17.number().nonnegative().max(60000).nullable(),
+  ttfb_ms: z17.number().nonnegative().max(60000).nullable(),
+  download_ms: z17.number().nonnegative().max(60000).nullable(),
+  total_ms: z17.number().nonnegative().max(60000)
 });
-var probeResultSchema = z10.object({
-  check_id: z10.guid(),
-  revision: z10.number().int().nonnegative(),
-  slot: z10.number().int().nonnegative(),
-  region: z10.enum(UPTIME_REGIONS),
-  run_now: z10.string().max(64).optional(),
-  scheduled_at: z10.number().int().positive(),
-  started_at: z10.number().int().positive(),
-  outcome: z10.enum(UPTIME_OUTCOMES),
-  reason: z10.enum(UPTIME_REASONS).nullable(),
-  reason_group: z10.enum(UPTIME_REASON_GROUPS).nullable(),
-  status_code: z10.number().int().min(100).max(599).nullable(),
+var probeResultSchema = z17.object({
+  check_id: z17.guid(),
+  revision: z17.number().int().nonnegative(),
+  slot: z17.number().int().nonnegative(),
+  region: z17.enum(UPTIME_REGIONS),
+  run_now: z17.string().max(64).optional(),
+  scheduled_at: z17.number().int().positive(),
+  started_at: z17.number().int().positive(),
+  outcome: z17.enum(UPTIME_OUTCOMES),
+  reason: z17.enum(UPTIME_REASONS).nullable(),
+  reason_group: z17.enum(UPTIME_REASON_GROUPS).nullable(),
+  status_code: z17.number().int().min(100).max(599).nullable(),
   timings: timingsSchema.nullable(),
-  ip_family: z10.enum(["v4", "v6"]).nullable(),
-  http_version: z10.string().max(8).nullable(),
-  cert_not_after: z10.number().int().positive().nullable(),
-  cert_issuer: z10.string().max(200).nullable(),
-  cert_expiring: z10.boolean(),
-  evidence_sealed: z10.string().max(16384).nullable()
+  ip_family: z17.enum(["v4", "v6"]).nullable(),
+  http_version: z17.string().max(8).nullable(),
+  cert_not_after: z17.number().int().positive().nullable(),
+  cert_issuer: z17.string().max(200).nullable(),
+  cert_expiring: z17.boolean(),
+  evidence_sealed: z17.string().max(16384).nullable()
 });
-var probeIdSchema = z10.string().regex(/^probe-(eu|us|ap)-[a-z0-9]{4,16}$/);
-var resultBatchSchema = z10.object({
-  v: z10.literal(1),
+var probeIdSchema = z17.string().regex(/^probe-(eu|us|ap)-[a-z0-9]{4,16}$/);
+var resultBatchSchema = z17.object({
+  v: z17.literal(1),
   probe_id: probeIdSchema,
-  region: z10.enum(UPTIME_REGIONS),
-  version: z10.string().max(40),
-  sent_at: z10.number().int().positive(),
-  results: z10.array(probeResultSchema).max(UPTIME_LIMITS.resultsBatchMax),
-  stats: z10.object({ lag_p99_ms: z10.number().nonnegative(), checks_per_min: z10.number().nonnegative() })
+  region: z17.enum(UPTIME_REGIONS),
+  version: z17.string().max(40),
+  sent_at: z17.number().int().positive(),
+  results: z17.array(probeResultSchema).max(UPTIME_LIMITS.resultsBatchMax),
+  stats: z17.object({ lag_p99_ms: z17.number().nonnegative(), checks_per_min: z17.number().nonnegative() })
 });
 var assignmentSchema = uptimeDefinitionSchema.omit({ workspace_id: true, paused_until: true, muted_until: true }).extend({
-  seal_public_key: z10.string().regex(/^[A-Za-z0-9_-]{43}$/).nullable()
+  seal_public_key: z17.string().regex(/^[A-Za-z0-9_-]{43}$/).nullable()
 });
-var assignmentsSchema = z10.object({
-  v: z10.literal(1),
-  region: z10.enum(UPTIME_REGIONS),
-  revision: z10.number().int().nonnegative(),
-  issued_at: z10.number().int().positive(),
-  checks: z10.array(assignmentSchema).max(50000),
-  denied_hosts: z10.array(z10.string().max(253)).max(1e4),
-  run_now: z10.array(z10.object({ id: z10.string().max(64), check_id: z10.guid(), expires_at: z10.number().int() })).max(500)
+var assignmentsSchema = z17.object({
+  v: z17.literal(1),
+  region: z17.enum(UPTIME_REGIONS),
+  revision: z17.number().int().nonnegative(),
+  issued_at: z17.number().int().positive(),
+  checks: z17.array(assignmentSchema).max(50000),
+  denied_hosts: z17.array(z17.string().max(253)).max(1e4),
+  run_now: z17.array(z17.object({ id: z17.string().max(64), check_id: z17.guid(), expires_at: z17.number().int() })).max(500)
 });
-var uuid3 = z10.guid();
-var b64key = z10.string().regex(/^[A-Za-z0-9_-]{43}$/);
-var iso2 = z10.string().datetime();
-var uptimeSyncSchema = z10.object({
-  v: z10.literal(1),
+var uuid3 = z17.guid();
+var b64key = z17.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var iso4 = z17.string().datetime();
+var uptimeSyncSchema = z17.object({
+  v: z17.literal(1),
   workspace_id: uuid3,
-  revision: z10.number().int().positive(),
-  workspace_status: z10.enum(["active", "suspended", "deleting"]),
-  suspended: z10.boolean(),
-  checks: z10.array(uptimeDefinitionSchema).max(UPTIME_LIMITS.maxChecksPerWorkspace),
-  projects: z10.array(z10.object({ id: z10.number().int().positive(), node_id: z10.guid().nullable(), seal_public_key: b64key.nullable() })).max(1000)
+  revision: z17.number().int().positive(),
+  workspace_status: z17.enum(["active", "suspended", "deleting"]),
+  suspended: z17.boolean(),
+  checks: z17.array(uptimeDefinitionSchema).max(UPTIME_LIMITS.maxChecksPerWorkspace),
+  projects: z17.array(z17.object({ id: z17.number().int().positive(), node_id: z17.guid().nullable(), seal_public_key: b64key.nullable() })).max(1000)
 });
-var uptimeReconcileSchema = z10.object({
-  v: z10.literal(1),
-  as_of: z10.number().int().positive(),
-  workspace_ids: z10.array(uuid3).max(UPTIME_LIMITS.reconcileMaxWorkspaces),
-  heartbeat_routes: z10.array(z10.string().regex(PING_ROUTE_RE)).max(UPTIME_LIMITS.reconcileMaxWorkspaces).optional()
+var uptimeReconcileSchema = z17.object({
+  v: z17.literal(1),
+  as_of: z17.number().int().positive(),
+  workspace_ids: z17.array(uuid3).max(UPTIME_LIMITS.reconcileMaxWorkspaces),
+  heartbeat_routes: z17.array(z17.string().regex(PING_ROUTE_RE)).max(UPTIME_LIMITS.reconcileMaxWorkspaces).optional()
 });
-var probeDirectorySyncSchema = z10.object({
-  v: z10.literal(1),
-  revision: z10.number().int().positive(),
-  probes: z10.array(z10.object({ probe_id: probeIdSchema, region: z10.enum(UPTIME_REGIONS), public_key: b64key, status: z10.enum(["active", "revoked"]) })).max(30),
-  denied_hosts: z10.array(z10.string().min(1).max(253)).max(1e4)
+var probeDirectorySyncSchema = z17.object({
+  v: z17.literal(1),
+  revision: z17.number().int().positive(),
+  probes: z17.array(z17.object({ probe_id: probeIdSchema, region: z17.enum(UPTIME_REGIONS), public_key: b64key, status: z17.enum(["active", "revoked"]) })).max(30),
+  denied_hosts: z17.array(z17.string().min(1).max(253)).max(1e4)
 });
-var runNowRequestSchema = z10.object({ v: z10.literal(1), workspace_id: uuid3, check_id: uuid3, run_id: z10.string().regex(/^[A-Za-z0-9_-]{8,64}$/) });
-var signedAssignmentsSchema = z10.object({ assignments: assignmentsSchema, sig: z10.string().regex(/^[A-Za-z0-9_-]{86}$/) });
-var uptimeRegionStateSchema = z10.object({
-  region: z10.enum(UPTIME_REGIONS),
-  outcome: z10.enum(UPTIME_OUTCOMES),
-  reason: z10.enum(UPTIME_REASONS).nullable(),
-  status_code: z10.number().int().min(100).max(599).nullable(),
-  total_ms: z10.number().nonnegative().max(60000).nullable(),
+var runNowRequestSchema = z17.object({ v: z17.literal(1), workspace_id: uuid3, check_id: uuid3, run_id: z17.string().regex(/^[A-Za-z0-9_-]{8,64}$/) });
+var signedAssignmentsSchema = z17.object({ assignments: assignmentsSchema, sig: z17.string().regex(/^[A-Za-z0-9_-]{86}$/) });
+var uptimeRegionStateSchema = z17.object({
+  region: z17.enum(UPTIME_REGIONS),
+  outcome: z17.enum(UPTIME_OUTCOMES),
+  reason: z17.enum(UPTIME_REASONS).nullable(),
+  status_code: z17.number().int().min(100).max(599).nullable(),
+  total_ms: z17.number().nonnegative().max(60000).nullable(),
   timings: timingsSchema.nullable().optional(),
-  at: iso2
+  at: iso4
 });
-var uptimeStatusReportSchema = z10.object({
+var uptimeStatusReportSchema = z17.object({
   check_id: uuid3,
-  revision: z10.number().int().nonnegative(),
-  status: z10.enum(UPTIME_STATUSES),
-  last_verdict: z10.enum(SLOT_VERDICTS).nullable(),
-  last_slot_at: iso2.nullable(),
+  revision: z17.number().int().nonnegative(),
+  status: z17.enum(UPTIME_STATUSES),
+  last_verdict: z17.enum(SLOT_VERDICTS).nullable(),
+  last_slot_at: iso4.nullable(),
   incident_id: uuid3.nullable(),
-  down_streak: z10.number().int().nonnegative(),
-  up_streak: z10.number().int().nonnegative(),
-  regions: z10.array(uptimeRegionStateSchema).max(3),
-  unobserved_regions: z10.array(z10.enum(UPTIME_REGIONS)).max(3),
-  cert_not_after: iso2.nullable(),
-  cert_expiring: z10.boolean(),
-  run_now: z10.object({ run_id: z10.string().max(64), results: z10.array(uptimeRegionStateSchema).max(3) }).nullable()
+  down_streak: z17.number().int().nonnegative(),
+  up_streak: z17.number().int().nonnegative(),
+  regions: z17.array(uptimeRegionStateSchema).max(3),
+  unobserved_regions: z17.array(z17.enum(UPTIME_REGIONS)).max(3),
+  cert_not_after: iso4.nullable(),
+  cert_expiring: z17.boolean(),
+  run_now: z17.object({ run_id: z17.string().max(64), results: z17.array(uptimeRegionStateSchema).max(3) }).nullable()
 });
 var UPTIME_EVENT_KINDS = ["opened", "resolved", "cert_expiring"];
-var uptimeEventSchema = z10.object({
-  event_id: z10.string().regex(/^[A-Za-z0-9:_-]{8,96}$/),
+var uptimeEventSchema = z17.object({
+  event_id: z17.string().regex(/^[A-Za-z0-9:_-]{8,96}$/),
   check_id: uuid3,
-  kind: z10.enum(UPTIME_EVENT_KINDS),
+  kind: z17.enum(UPTIME_EVENT_KINDS),
   incident_id: uuid3.nullable(),
-  at: iso2,
-  reason: z10.enum(UPTIME_REASONS).nullable(),
-  regions: z10.array(z10.enum(UPTIME_REGIONS)).max(3),
-  cert_days_left: z10.number().int().nullable()
+  at: iso4,
+  reason: z17.enum(UPTIME_REASONS).nullable(),
+  regions: z17.array(z17.enum(UPTIME_REGIONS)).max(3),
+  cert_days_left: z17.number().int().nullable()
 });
-var uptimeMinuteSchema = z10.object({
+var uptimeMinuteSchema = z17.object({
   check_id: uuid3,
-  minute: iso2,
-  up: z10.number().int().nonnegative(),
-  degraded: z10.number().int().nonnegative(),
-  down: z10.number().int().nonnegative(),
-  unknown: z10.number().int().nonnegative(),
-  latency: z10.array(z10.object({ region: z10.enum(UPTIME_REGIONS), n: z10.number().int().positive(), p50_ms: z10.number().nonnegative(), p95_ms: z10.number().nonnegative() })).max(3)
+  minute: iso4,
+  up: z17.number().int().nonnegative(),
+  degraded: z17.number().int().nonnegative(),
+  down: z17.number().int().nonnegative(),
+  unknown: z17.number().int().nonnegative(),
+  latency: z17.array(z17.object({ region: z17.enum(UPTIME_REGIONS), n: z17.number().int().positive(), p50_ms: z17.number().nonnegative(), p95_ms: z17.number().nonnegative() })).max(3)
 });
-var uptimeReportSchema = z10.object({
-  v: z10.literal(1),
+var uptimeReportSchema = z17.object({
+  v: z17.literal(1),
   workspace_id: uuid3,
-  revision: z10.number().int().nonnegative(),
-  sent_at: iso2,
-  events: z10.array(uptimeEventSchema).max(UPTIME_LIMITS.reportMaxEvents),
-  statuses: z10.array(uptimeStatusReportSchema).max(UPTIME_LIMITS.reportMaxStatuses),
-  minutes: z10.array(uptimeMinuteSchema).max(UPTIME_LIMITS.reportMaxMinutes)
+  revision: z17.number().int().nonnegative(),
+  sent_at: iso4,
+  events: z17.array(uptimeEventSchema).max(UPTIME_LIMITS.reportMaxEvents),
+  statuses: z17.array(uptimeStatusReportSchema).max(UPTIME_LIMITS.reportMaxStatuses),
+  minutes: z17.array(uptimeMinuteSchema).max(UPTIME_LIMITS.reportMaxMinutes)
 });
-var probeFleetReportSchema = z10.object({
-  v: z10.literal(1),
-  sent_at: iso2,
-  probes: z10.array(z10.object({
+var probeFleetReportSchema = z17.object({
+  v: z17.literal(1),
+  sent_at: iso4,
+  probes: z17.array(z17.object({
     probe_id: probeIdSchema,
-    region: z10.enum(UPTIME_REGIONS),
-    version: z10.string().max(40).nullable(),
-    last_seen_at: iso2.nullable(),
-    lag_p99_ms: z10.number().nonnegative().nullable(),
-    checks_per_min: z10.number().nonnegative().nullable()
+    region: z17.enum(UPTIME_REGIONS),
+    version: z17.string().max(40).nullable(),
+    last_seen_at: iso4.nullable(),
+    lag_p99_ms: z17.number().nonnegative().nullable(),
+    checks_per_min: z17.number().nonnegative().nullable()
   })).max(30),
-  regions_alive: z10.array(z10.enum(UPTIME_REGIONS)).max(3)
+  regions_alive: z17.array(z17.enum(UPTIME_REGIONS)).max(3)
 });
-var probeEnrollSchema = z10.object({
-  v: z10.literal(1),
+var probeEnrollSchema = z17.object({
+  v: z17.literal(1),
   probe_id: probeIdSchema,
-  public_key: z10.string().regex(/^[A-Za-z0-9_-]{43}$/),
-  code: z10.string().regex(/^[A-Za-z0-9_-]{43}$/),
-  ts: z10.number().int().positive(),
-  sig: z10.string().regex(/^[A-Za-z0-9_-]{86}$/)
+  public_key: z17.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  code: z17.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  ts: z17.number().int().positive(),
+  sig: z17.string().regex(/^[A-Za-z0-9_-]{86}$/)
 });
-var uptimeEvidenceEnvelopeSchema = z10.object({
-  v: z10.literal(1),
-  check_id: z10.guid(),
-  slot: z10.number().int().nonnegative(),
-  region: z10.enum(UPTIME_REGIONS),
+var uptimeEvidenceEnvelopeSchema = z17.object({
+  v: z17.literal(1),
+  check_id: z17.guid(),
+  slot: z17.number().int().nonnegative(),
+  region: z17.enum(UPTIME_REGIONS),
   probe_id: probeIdSchema,
-  at: z10.number().int().positive(),
-  sealed: z10.string().regex(/^[A-Za-z0-9_-]+$/).max(16384)
+  at: z17.number().int().positive(),
+  sealed: z17.string().regex(/^[A-Za-z0-9_-]+$/).max(16384)
 }).strict();
-var uptimeEvidenceSchema = z10.object({
-  v: z10.literal(1),
-  check_id: z10.guid(),
-  slot: z10.number().int().nonnegative(),
-  region: z10.enum(UPTIME_REGIONS),
-  at: z10.number().int().positive(),
-  reason: z10.enum(UPTIME_REASONS).nullable(),
-  status_line: z10.string().max(200).nullable(),
-  headers: z10.record(z10.string().max(64), z10.string().max(512)).refine((h) => Object.keys(h).length <= 20),
-  body: z10.string().max(UPTIME_LIMITS.evidenceMaxBytes * 4).nullable(),
-  body_truncated: z10.boolean(),
+var uptimeEvidenceSchema = z17.object({
+  v: z17.literal(1),
+  check_id: z17.guid(),
+  slot: z17.number().int().nonnegative(),
+  region: z17.enum(UPTIME_REGIONS),
+  at: z17.number().int().positive(),
+  reason: z17.enum(UPTIME_REASONS).nullable(),
+  status_line: z17.string().max(200).nullable(),
+  headers: z17.record(z17.string().max(64), z17.string().max(512)).refine((h) => Object.keys(h).length <= 20),
+  body: z17.string().max(UPTIME_LIMITS.evidenceMaxBytes * 4).nullable(),
+  body_truncated: z17.boolean(),
   timings: timingsSchema.nullable(),
-  ip: z10.string().max(64).nullable(),
-  error: z10.string().max(300).nullable()
+  ip: z17.string().max(64).nullable(),
+  error: z17.string().max(300).nullable()
 }).strict();
-var uptimeEvidenceListSchema = z10.object({
-  items: z10.array(uptimeEvidenceSchema.extend({ received_at: z10.number().int().positive() })).max(UPTIME_LIMITS.evidenceKeepPerCheck)
+var uptimeEvidenceListSchema = z17.object({
+  items: z17.array(uptimeEvidenceSchema.extend({ received_at: z17.number().int().positive() })).max(UPTIME_LIMITS.evidenceKeepPerCheck)
 });
 
 // ../src/shared/contracts/api-ops/monitors.ts
+var anyMonitorInputSchema = z18.union([monitorInputSchema, signalMonitorInputSchema]);
+var MAINTENANCE_INPUTS = {
+  create: z18.object({ workspaceId: uuid, input: maintenanceInputSchema }),
+  update: z18.object({ workspaceId: uuid, windowId: uuid, input: maintenanceInputSchema }),
+  delete: z18.object({ workspaceId: uuid, windowId: uuid })
+};
 var MONITOR_INPUTS = {
-  create: z11.object({ projectId, slug: z11.string().regex(SLUG_RE), input: monitorInputSchema }),
-  update: z11.object({ monitorId: uuid, input: monitorInputSchema }),
-  delete: z11.object({ monitorId: uuid, confirmSlug: z11.string().max(64) }),
-  setPause: z11.object({ monitorId: uuid, until: holdUntil }),
-  setMuted: z11.object({ monitorId: uuid, muted: z11.boolean() }),
-  dismissDiscovery: z11.object({ discoveryId: uuid }),
-  rotatePing: z11.object({
+  create: z18.object({ projectId, slug: z18.string().regex(SLUG_RE), input: anyMonitorInputSchema }),
+  update: z18.object({ monitorId: uuid, input: anyMonitorInputSchema }),
+  delete: z18.object({ monitorId: uuid, confirmSlug: z18.string().max(64) }),
+  setPause: z18.object({ monitorId: uuid, until: holdUntil }),
+  setMuted: z18.object({ monitorId: uuid, muted: z18.boolean() }),
+  dismissDiscovery: z18.object({ discoveryId: uuid }),
+  rotatePing: z18.object({
     monitorId: uuid,
-    graceHours: z11.number().int().refine((h) => HEARTBEAT_LIMITS.rotationGraceHoursChoices.includes(h))
+    graceHours: z18.number().int().refine((h) => HEARTBEAT_LIMITS.rotationGraceHoursChoices.includes(h))
   }),
-  monitorOnly: z11.object({ monitorId: uuid })
+  monitorOnly: z18.object({ monitorId: uuid })
 };
 var UPTIME_INPUTS = {
   create: uptimeCheckInputSchema,
-  update: z11.object({ checkId: uuid, input: uptimeCheckInputSchema }),
-  checkOnly: z11.object({ checkId: uuid }),
-  setHold: z11.object({ checkId: uuid, kind: z11.enum(["pause", "mute"]), until: holdUntil })
+  update: z18.object({ checkId: uuid, input: uptimeCheckInputSchema }),
+  checkOnly: z18.object({ checkId: uuid }),
+  setHold: z18.object({ checkId: uuid, kind: z18.enum(["pause", "mute"]), until: holdUntil })
 };
 var SLO_INPUTS = {
-  create: z11.object({ workspaceId: uuid, input: sloInputSchema }),
-  update: z11.object({ sloId: uuid, input: sloInputSchema }),
-  sloOnly: z11.object({ sloId: uuid }),
-  setHold: z11.object({ sloId: uuid, kind: z11.enum(["pause", "mute"]), until: holdUntil }),
-  import: z11.object({
+  create: z18.object({ workspaceId: uuid, input: sloInputSchema }),
+  update: z18.object({ sloId: uuid, input: sloInputSchema }),
+  sloOnly: z18.object({ sloId: uuid }),
+  setHold: z18.object({ sloId: uuid, kind: z18.enum(["pause", "mute"]), until: holdUntil }),
+  import: z18.object({
     workspaceId: uuid,
-    text: z11.string().max(SLO_LIMITS.openSloMaxBytes * 2),
-    dryRun: z11.boolean()
+    text: z18.string().max(SLO_LIMITS.openSloMaxBytes * 2),
+    dryRun: z18.boolean()
   })
 };
 var m = "monitors:write";
@@ -1688,13 +2571,13 @@ var MONITOR_OPERATIONS = [
     scope: m,
     sensitivity: "normal",
     kind: "write",
-    rpcs: ["create_monitor", "create_heartbeat_monitor"],
+    rpcs: ["create_monitor", "create_heartbeat_monitor", "create_signal_monitor"],
     input: MONITOR_INPUTS.create,
     bodyField: "input",
     idempotency: "required",
     status: 201,
     mcp: "configure",
-    summary: "Create a cron or heartbeat monitor. A heartbeat monitor returns its ping token once.",
+    summary: "Create a cron or heartbeat monitor, or a signal monitor (`settings.type`: count, assertion, deadline, progress). A heartbeat monitor returns its ping token once.",
     secretOutput: ["ping_token"],
     ui: ["monitors#createMonitor"]
   }),
@@ -1705,13 +2588,13 @@ var MONITOR_OPERATIONS = [
     scope: m,
     sensitivity: "normal",
     kind: "write",
-    rpcs: ["update_monitor"],
+    rpcs: ["update_monitor", "update_signal_monitor"],
     input: MONITOR_INPUTS.update,
     bodyField: "input",
     ifMatch: true,
     idempotency: "none",
     mcp: "configure",
-    summary: "Replace a monitor's schedule, margins and thresholds.",
+    summary: "Replace a monitor's schedule, margins and thresholds, or a signal monitor's settings (the type stays).",
     ui: ["monitors#updateMonitor"]
   }),
   op({
@@ -1966,23 +2849,71 @@ var MONITOR_OPERATIONS = [
     mcp: "configure",
     summary: "Import OpenSLO YAML, all or nothing; `dry_run` returns the plan without applying it.",
     ui: ["slos#importOpenSlo"]
+  }),
+  op({
+    id: "maintenance.create",
+    method: "POST",
+    path: "/v1/maintenance-windows",
+    scope: m,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["create_maintenance_window"],
+    input: MAINTENANCE_INPUTS.create,
+    bodyField: "input",
+    workspace: true,
+    idempotency: "required",
+    status: 201,
+    mcp: "configure",
+    summary: "Hold back monitor notifications during a one-off or weekly window (workspace, projects or monitors); monitors keep evaluating and recording.",
+    ui: ["maintenance#createMaintenanceWindow"]
+  }),
+  op({
+    id: "maintenance.update",
+    method: "PATCH",
+    path: "/v1/maintenance-windows/{window_id}",
+    scope: m,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["update_maintenance_window"],
+    input: MAINTENANCE_INPUTS.update,
+    bodyField: "input",
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Replace a maintenance window's scope, times and reason.",
+    ui: ["maintenance#updateMaintenanceWindow"]
+  }),
+  op({
+    id: "maintenance.delete",
+    method: "DELETE",
+    path: "/v1/maintenance-windows/{window_id}",
+    scope: m,
+    sensitivity: "normal",
+    kind: "write",
+    rpcs: ["delete_maintenance_window"],
+    input: MAINTENANCE_INPUTS.delete,
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "Delete a maintenance window; notifications resume at once.",
+    ui: ["maintenance#deleteMaintenanceWindow"]
   })
 ];
 
 // ../src/shared/contracts/api-ops/node-data.ts
-import { z as z12 } from "zod";
-var issueId = z12.number().int().positive();
-var csv = z12.string().min(1).max(2000);
-var name2 = z12.string().min(1).max(256);
-var period = z12.enum(["1h", "24h", "7d", "14d", "30d"]);
-var nodeCursor = z12.string().min(1).max(600).optional();
+import { z as z19 } from "zod";
+var issueId = z19.number().int().positive();
+var csv = z19.string().min(1).max(2000);
+var name2 = z19.string().min(1).max(256);
+var period = z19.enum(["1h", "24h", "7d", "14d", "30d"]);
+var nodeCursor = z19.string().min(1).max(600).optional();
 var windowFields = {
-  start: z12.string().max(40).optional(),
-  end: z12.string().max(40).optional()
+  start: z19.string().max(40).optional(),
+  end: z19.string().max(40).optional()
 };
-var traceId = z12.string().regex(/^[0-9a-fA-F]{32}$/);
-var spanId = z12.string().regex(/^[0-9a-fA-F]{16}$/);
-var attrs = z12.string().max(2000).optional();
+var traceId = z19.string().regex(/^[0-9a-fA-F]{32}$/);
+var spanId = z19.string().regex(/^[0-9a-fA-F]{16}$/);
+var attrs = z19.string().max(2000).optional();
 var telemetryCommon = {
   ...windowFields,
   project: csv.optional(),
@@ -1990,91 +2921,112 @@ var telemetryCommon = {
   service: csv.optional(),
   attrs
 };
-var issueChange = z12.union([
-  z12.object({ action: z12.literal("resolve"), inNextRelease: z12.boolean().optional() }),
-  z12.object({ action: z12.literal("unresolve") }),
-  z12.object({ action: z12.literal("archive"), mode: z12.enum(["until_escalating", "forever"]) }),
-  z12.object({
-    action: z12.literal("archive"),
-    mode: z12.literal("until_condition"),
-    events: z12.number().int().min(1).max(1e6).optional(),
-    users: z12.number().int().min(1).max(1e5).optional(),
-    until: z12.string().datetime().optional()
-  }),
-  z12.object({ action: z12.literal("assign"), userId: z12.guid().nullable() }),
-  z12.object({ action: z12.literal("priority"), priority: z12.enum(["low", "medium", "high"]) })
+var issueChange = z19.union([
+  z19.object({ action: z19.literal("resolve"), inNextRelease: z19.boolean().optional() }),
+  z19.object({ action: z19.literal("unresolve") }),
+  z19.object({ action: z19.literal("archive"), mode: z19.enum(["until_escalating", "forever"]) }),
+  z19.object({
+    action: z19.literal("archive"),
+    mode: z19.literal("until_condition"),
+    events: z19.number().int().min(1).max(1e6).optional(),
+    users: z19.number().int().min(1).max(1e5).optional(),
+    until: z19.string().datetime().optional()
+  }),
+  z19.object({ action: z19.literal("assign"), userId: z19.guid().nullable() }),
+  z19.object({ action: z19.literal("priority"), priority: z19.enum(["low", "medium", "high"]) })
 ]);
 var NODE_INPUTS = {
-  issuesList: z12.object({
+  issuesList: z19.object({
     project: csv.optional(),
-    status: z12.enum(["unresolved", "resolved", "archived", "all"]).optional(),
+    status: z19.enum(["unresolved", "resolved", "archived", "all"]).optional(),
     level: csv.optional(),
     priority: csv.optional(),
     environment: csv.optional(),
     release: csv.optional(),
-    assignee: z12.string().max(64).optional(),
+    assignee: z19.string().max(64).optional(),
     period: period.optional(),
-    q: z12.string().max(200).optional(),
-    sort: z12.enum(["last_seen", "first_seen", "events", "users", "priority"]).optional(),
+    q: z19.string().max(200).optional(),
+    sort: z19.enum(["last_seen", "first_seen", "events", "users", "priority"]).optional(),
     cursor: nodeCursor,
-    limit: z12.number().int().min(1).max(100).optional()
+    limit: z19.number().int().min(1).max(100).optional()
   }),
-  issue: z12.object({ issueId }),
-  issueStats: z12.object({ issueId, range: z12.enum(["24h", "30d"]).optional() }),
-  issueEvents: z12.object({ issueId, cursor: nodeCursor }),
-  issueEvent: z12.object({
+  issue: z19.object({ issueId }),
+  issueStats: z19.object({ issueId, range: z19.enum(["24h", "30d"]).optional() }),
+  issueEvents: z19.object({ issueId, cursor: nodeCursor }),
+  issueEvent: z19.object({
     issueId,
-    eventId: z12.string().regex(/^([0-9a-f]{32}|latest|oldest)$/)
+    eventId: z19.string().regex(/^([0-9a-f]{32}|latest|oldest)$/)
   }),
-  issueUpdate: z12.object({ issueId, change: issueChange }),
-  issuesBulk: z12.object({
-    issueIds: z12.array(issueId).min(1).max(100),
+  issueUpdate: z19.object({ issueId, change: issueChange }),
+  issuesBulk: z19.object({
+    issueIds: z19.array(issueId).min(1).max(100),
     action: issueChange
   }),
-  spansList: z12.object({
+  spansList: z19.object({
     ...telemetryCommon,
-    operation: z12.string().min(1).max(1024).optional(),
-    status: z12.enum(["unset", "ok", "error"]).optional(),
-    kind: z12.enum(["internal", "server", "client", "producer", "consumer"]).optional(),
-    minDurationMs: z12.number().min(0).max(86400000).optional(),
-    maxDurationMs: z12.number().min(0).max(86400000).optional(),
-    mode: z12.enum(["spans", "traces"]).optional(),
+    operation: z19.string().min(1).max(1024).optional(),
+    status: z19.enum(["unset", "ok", "error"]).optional(),
+    kind: z19.enum(["internal", "server", "client", "producer", "consumer"]).optional(),
+    minDurationMs: z19.number().min(0).max(86400000).optional(),
+    maxDurationMs: z19.number().min(0).max(86400000).optional(),
+    mode: z19.enum(["spans", "traces"]).optional(),
     cursor: nodeCursor
   }),
-  spansHistogram: z12.object({
+  spansHistogram: z19.object({
     ...telemetryCommon,
-    operation: z12.string().min(1).max(1024).optional(),
-    status: z12.enum(["unset", "ok", "error"]).optional()
+    operation: z19.string().min(1).max(1024).optional(),
+    status: z19.enum(["unset", "ok", "error"]).optional()
   }),
-  trace: z12.object({ traceId }),
-  traceSpans: z12.object({ traceId, errorsOnly: z12.enum(["1"]).optional(), ...windowFields }),
-  span: z12.object({ traceId, spanId, ...windowFields }),
-  logsList: z12.object({
+  trace: z19.object({ traceId }),
+  traceSpans: z19.object({ traceId, errorsOnly: z19.enum(["1"]).optional(), ...windowFields }),
+  span: z19.object({ traceId, spanId, ...windowFields }),
+  logsList: z19.object({
     ...telemetryCommon,
-    severityMin: z12.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
+    severityMin: z19.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
     traceId: traceId.optional(),
     spanId: spanId.optional(),
-    q: z12.string().max(500).optional(),
-    order: z12.enum(["asc", "desc"]).optional(),
+    q: z19.string().max(500).optional(),
+    order: z19.enum(["asc", "desc"]).optional(),
     cursor: nodeCursor
   }),
-  logsFacets: z12.object({
+  logsFacets: z19.object({
     ...telemetryCommon,
-    severityMin: z12.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
-    q: z12.string().max(500).optional()
+    severityMin: z19.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
+    q: z19.string().max(500).optional()
   }),
-  logAround: z12.object({
+  logAround: z19.object({
     logId: name2,
-    at: z12.string().max(40),
-    same: z12.enum(["service", "trace"]).optional(),
-    before: z12.number().int().min(0).max(200).optional(),
-    after: z12.number().int().min(0).max(200).optional()
-  }),
-  telemetryUsage: z12.object({ project: csv.optional(), days: z12.number().int().min(1).max(31).optional() }),
-  ticket: z12.object({
-    scope: z12.enum(["read", "write"]).default("read"),
-    project: z12.number().int().positive().optional(),
-    environment: z12.string().min(1).max(64).optional()
+    at: z19.string().max(40),
+    same: z19.enum(["service", "trace"]).optional(),
+    before: z19.number().int().min(0).max(200).optional(),
+    after: z19.number().int().min(0).max(200).optional()
+  }),
+  telemetryUsage: z19.object({ project: csv.optional(), days: z19.number().int().min(1).max(31).optional() }),
+  monitorSignal: z19.object({ monitorId: z19.guid(), hours: z19.number().int().min(1).max(24).optional() }),
+  monitorOccurrences: z19.object({
+    monitorId: z19.guid(),
+    state: z19.enum(["open", "finished", "all"]).optional(),
+    environment: z19.string().min(1).max(64).optional(),
+    cursor: nodeCursor
+  }),
+  monitorBacktest: z19.object({ project: z19.number().int().positive(), settings: backtestSettingsSchema }),
+  occurrenceCreate: z19.object({
+    project: z19.number().int().positive(),
+    monitorSlug: occurrenceInputSchema.shape.monitor_slug,
+    occurrenceId: occurrenceInputSchema.shape.occurrence_id,
+    dueAt: occurrenceInputSchema.shape.due_at,
+    environment: occurrenceInputSchema.shape.environment
+  }),
+  occurrenceCancel: z19.object({
+    project: z19.number().int().positive(),
+    monitorSlug: z19.string().regex(SLUG_RE),
+    occurrenceId: z19.string().regex(OCCURRENCE_ID_RE),
+    environment: z19.string().min(1).max(64).optional()
+  }),
+  ticket: z19.object({
+    scope: z19.enum(["read", "write"]).default("read"),
+    project: z19.number().int().positive().optional(),
+    environment: z19.string().min(1).max(64).optional()
   })
 };
 var N = NODE_INPUTS;
@@ -2245,6 +3197,60 @@ var NODE_OPERATIONS = [
     node: { path: "q/telemetry/usage" },
     summary: "Stored spans and logs per day and project on the node."
   }),
+  op({
+    ...read,
+    id: "monitors.signal",
+    path: "/v1/monitors/{monitor_id}/signal",
+    scope: "monitors:read",
+    input: N.monitorSignal,
+    node: { path: "q/monitors/{monitor_id}/signal" },
+    mcp: "reliability",
+    summary: "A signal monitor's minute counts (count/assertion) for up to 24 h per environment, and its open runs (progress, deadline)."
+  }),
+  op({
+    ...read,
+    id: "monitors.occurrences",
+    path: "/v1/monitors/{monitor_id}/occurrences",
+    scope: "monitors:read",
+    input: N.monitorOccurrences,
+    node: { path: "q/monitors/{monitor_id}/occurrences", list: "occurrences" },
+    paged: true,
+    mcp: "reliability",
+    summary: "Occurrences of a deadline monitor (pending, on time, late, missed, failed, cancelled), newest due first."
+  }),
+  op({
+    ...read,
+    id: "monitors.backtest",
+    method: "POST",
+    path: "/v1/monitors/backtest",
+    scope: "monitors:read",
+    input: N.monitorBacktest,
+    node: { path: "q/monitors/backtest" },
+    mcp: "reliability",
+    summary: "How often count/assertion settings would have alerted over the last 30 days of stored data (same rule as the live evaluator)."
+  }),
+  op({
+    ...read,
+    id: "occurrences.create",
+    method: "POST",
+    path: "/v1/occurrences",
+    scope: "monitors:write",
+    input: N.occurrenceCreate,
+    node: { path: "w/monitors/occurrences", body: "*" },
+    mcp: "configure",
+    summary: "Register one run a deadline monitor expects (`due_at` within 35 days); the same id again moves its due time while it is pending."
+  }),
+  op({
+    ...read,
+    id: "occurrences.cancel",
+    method: "DELETE",
+    path: "/v1/occurrences/{monitor_slug}/{occurrence_id}",
+    scope: "monitors:write",
+    input: N.occurrenceCancel,
+    node: { path: "w/monitors/occurrences/cancel", body: "*" },
+    mcp: "configure",
+    summary: "Cancel a pending occurrence (the app moved or dropped the job); a cancelled occurrence never alerts."
+  }),
   op({
     ...read,
     id: "issues.update",
@@ -2281,11 +3287,121 @@ var NODE_OPERATIONS = [
   })
 ];
 
+// ../src/shared/contracts/api-ops/privacy.ts
+import { z as z21 } from "zod";
+
+// ../src/shared/contracts/privacy.ts
+import { z as z20 } from "zod";
+
+// ../src/shared/privacy/rules.ts
+var PRIVACY_SCHEMA = 1;
+var PRIVACY_LIMITS = {
+  rules: 100,
+  allowlist: 100,
+  selector: 256,
+  pattern: 256,
+  replaceWith: 32,
+  ruleId: 64,
+  stringChars: 16384,
+  quantifierMax: 1000,
+  matches: 500,
+  depth: 32
+};
+var PRIVACY_MODES = ["standard", "strict"];
+var PRIVACY_RULE_TYPES = ["pattern", "anything", "creditcard", "ip", "email", "phone_e164"];
+var PRIVACY_METHODS = ["remove", "replace", "mask", "hash"];
+var AUTH_HEADER_KEYS = new Set(["authorization", "proxy-authorization", "x-api-key", "x-auth-token", "x-sentry-auth", "x-amz-security-token"]);
+var COOKIE_KEYS = new Set(["cookie", "cookies", "set-cookie"]);
+var BODY_KEYS = new Set(["body", "request_body", "response_body", "raw_body", "message_body", "html_body"]);
+var CARD_KEYS = new Set(["card_number", "cardnumber", "cc_number", "ccnum", "cvv", "cvc", "pan"]);
+var OCTET = "(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
+var IPV4_RE = new RegExp(`(^|[^\\d.])(${OCTET}(?:\\.${OCTET}){3})(?![\\d.])`, "g");
+var H = "[0-9A-Fa-f]{1,4}";
+var IPV6_RE = new RegExp(`(^|[^0-9A-Fa-f:])((?:${H}:){7}${H}|(?:${H}:){1,6}:(?:${H}(?::${H}){0,5})?|::(?:${H}(?::${H}){0,6})?)(?![0-9A-Fa-f:])`, "g");
+var REMOVE = Symbol("remove");
+
+// ../src/shared/contracts/privacy.ts
+var ruleId = z20.string().regex(/^[A-Za-z0-9_-]{1,64}$/);
+var privacyRuleInputSchema = z20.object({
+  id: ruleId,
+  selector: z20.string().min(1).max(PRIVACY_LIMITS.selector),
+  type: z20.enum(PRIVACY_RULE_TYPES),
+  method: z20.enum(PRIVACY_METHODS),
+  pattern: z20.string().min(1).max(PRIVACY_LIMITS.pattern).optional(),
+  ignoreCase: z20.boolean().optional(),
+  replaceWith: z20.string().max(PRIVACY_LIMITS.replaceWith).optional(),
+  enabled: z20.boolean().optional()
+});
+var privacyPolicyInputSchema = z20.object({
+  mode: z20.enum(PRIVACY_MODES),
+  rules: z20.array(privacyRuleInputSchema).max(PRIVACY_LIMITS.rules),
+  allowlist: z20.array(z20.string().min(1).max(PRIVACY_LIMITS.selector)).max(PRIVACY_LIMITS.allowlist)
+});
+var storedPolicySchema = z20.object({
+  schema: z20.literal(PRIVACY_SCHEMA),
+  version: z20.number().int().min(0),
+  mode: z20.enum(PRIVACY_MODES),
+  rules: z20.array(z20.record(z20.string(), z20.unknown())).max(PRIVACY_LIMITS.rules),
+  allowlist: z20.array(z20.string()).max(PRIVACY_LIMITS.allowlist)
+});
+var nodePrivacyBlockSchema = z20.array(z20.object({ project_id: z20.number().int().positive(), policy: z20.unknown() })).max(1000);
+var privacyRollupSchema = z20.object({
+  applied_version: z20.number().int().min(0).nullable(),
+  policy_missing_24h: z20.number().int().nonnegative(),
+  budget_exceeded_24h: z20.number().int().nonnegative(),
+  sdk_versions: z20.array(z20.object({ version: z20.number().int().min(0), last_seen_at: z20.string().datetime() })).max(5)
+});
+
+// ../src/shared/contracts/api-ops/privacy.ts
+var PRIVACY_INPUTS = {
+  get: z21.object({ workspaceId: uuid, projectId }),
+  set: z21.object({
+    workspaceId: uuid,
+    projectId,
+    expectedVersion: z21.number().int().min(0),
+    policy: privacyPolicyInputSchema
+  })
+};
+var P = PRIVACY_INPUTS;
+var PRIVACY_OPERATIONS = [
+  op({
+    id: "privacy.get",
+    method: "GET",
+    path: "/v1/projects/{project_id}/privacy",
+    scope: "projects:read",
+    sensitivity: "normal",
+    kind: "read",
+    rpcs: ["api_read_privacy"],
+    input: P.get,
+    workspace: true,
+    idempotency: "none",
+    mcp: "configure",
+    summary: "A project's privacy policy (mode, rules, strict allowlist, version), the built-in detectors that are off, whether user ids are pseudonymised, the last 20 versions and what the node applies and counted in the last 24 h.",
+    ui: []
+  }),
+  op({
+    id: "privacy.set",
+    method: "PUT",
+    path: "/v1/projects/{project_id}/privacy",
+    scope: "privacy:write",
+    sensitivity: "approval",
+    kind: "write",
+    rpcs: ["set_privacy_policy"],
+    input: P.set,
+    bodyField: "policy",
+    workspace: true,
+    idempotency: "optional",
+    mcp: "configure",
+    summary: "Replace a project's privacy policy (rules are applied in order on the node before anything is stored). Always needs an admin's approval; loosening (a rule removed or changed, strict off, allowlist grown) also needs their fresh authenticator code and emails owners.",
+    ui: ["privacy#setPrivacyPolicy"]
+  })
+];
+
 // ../src/shared/contracts/api-ops/projects.ts
-import { z as z17 } from "zod";
+import { z as z25 } from "zod";
 
 // ../src/shared/contracts/ingest-keys.ts
-import { z as z13 } from "zod";
+import { z as z22 } from "zod";
 var INGEST_KEY_SCOPES = ["traces", "logs", "errors", "monitors"];
 var INGEST_KEY_STATES = ["active", "revoked"];
 var INGEST_KEY_LIMITS = {
@@ -2295,174 +3411,91 @@ var INGEST_KEY_LIMITS = {
   edgeCacheSeconds: 60
 };
 var CHECKIN_AUTH_MODES = ["public_or_key", "key_only"];
-var ingestKeyConfigSchema = z13.object({
-  v: z13.literal(1),
-  key_id: z13.guid(),
-  project_public_id: z13.number().int().positive(),
-  project_id: z13.number().int().positive(),
-  workspace_id: z13.guid(),
+var ingestKeyConfigSchema = z22.object({
+  v: z22.literal(1),
+  key_id: z22.guid(),
+  project_public_id: z22.number().int().positive(),
+  project_id: z22.number().int().positive(),
+  workspace_id: z22.guid(),
   node_id: nodeIdSchema,
-  scopes: z13.array(z13.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
-  environments: z13.array(z13.string().max(INGEST_KEY_LIMITS.environmentMaxChars)).max(INGEST_KEY_LIMITS.environmentsMax),
-  expires_at: z13.string().datetime({ offset: true }).nullable(),
-  state: z13.enum(INGEST_KEY_STATES),
-  workspace_status: z13.enum(["active", "suspended", "deleting"]),
-  ingest_kill: z13.boolean(),
-  telemetry_kill: z13.boolean(),
-  telemetry_rate_bytes_per_sec: z13.number().int().positive(),
-  telemetry_burst_bytes: z13.number().int().positive(),
-  traces_monthly_bytes: z13.number().int().positive(),
-  logs_monthly_bytes: z13.number().int().positive(),
-  telemetry_buffer_minutes: z13.number().int().min(1).max(1440),
-  revision: z13.number().int().nonnegative()
-});
-var createIngestKeyInputSchema = z13.object({
-  projectId: z13.number().int().positive(),
-  name: z13.string().trim().min(1).max(INGEST_KEY_LIMITS.nameMaxChars).refine((s) => !/[\u0000-\u001f\u007f]/.test(s)),
-  scopes: z13.array(z13.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
-  environments: z13.array(z13.string().trim().min(1).max(INGEST_KEY_LIMITS.environmentMaxChars).regex(/^[^\s/\u0000-\u001f]+$/)).max(INGEST_KEY_LIMITS.environmentsMax),
-  expiresAt: z13.string().datetime({ offset: true }).nullable()
-});
-var ingestKeyRowSchema = z13.object({
-  id: z13.guid(),
-  project_id: z13.number().int().positive(),
-  name: z13.string(),
-  prefix: z13.string(),
-  scopes: z13.array(z13.enum(INGEST_KEY_SCOPES)),
-  environments: z13.array(z13.string()),
-  expires_at: z13.string().nullable(),
-  state: z13.enum(INGEST_KEY_STATES),
-  created_by: z13.guid().nullable(),
-  created_at: z13.string(),
-  revoked_at: z13.string().nullable(),
-  last_used_at: z13.string().nullable()
-});
-
-// ../src/shared/contracts/integration-health.ts
-import { z as z14 } from "zod";
-
-// ../src/shared/contracts/platforms.ts
-var PLATFORMS = [
-  "javascript-browser",
-  "react",
-  "node",
-  "python",
-  "tanstack-start",
-  "other"
-];
-
-// ../src/shared/contracts/integration-health.ts
-var VERIFICATION_ID_RE = /^bv1_[0-9a-f]{32}$/;
-var verificationIdSchema = z14.string().regex(VERIFICATION_ID_RE);
-var SURFACES = ["browser", "server"];
-var RECEIPT_SURFACES = ["browser", "server", "belvador"];
-var CHECKS = ["delivery", "uncaught", "pipeline"];
-var HOOK_STATES = ["ok", "missing", "unknown"];
-var verificationContextSchema = z14.object({
-  v: z14.literal(1),
-  surface: z14.enum(RECEIPT_SURFACES),
-  check: z14.enum(CHECKS),
-  hook: z14.enum(HOOK_STATES).optional(),
-  uncaught_expected: z14.boolean().optional()
+  scopes: z22.array(z22.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
+  environments: z22.array(z22.string().max(INGEST_KEY_LIMITS.environmentMaxChars)).max(INGEST_KEY_LIMITS.environmentsMax),
+  expires_at: z22.string().datetime({ offset: true }).nullable(),
+  state: z22.enum(INGEST_KEY_STATES),
+  workspace_status: z22.enum(["active", "suspended", "deleting"]),
+  ingest_kill: z22.boolean(),
+  telemetry_kill: z22.boolean(),
+  telemetry_rate_bytes_per_sec: z22.number().int().positive(),
+  telemetry_burst_bytes: z22.number().int().positive(),
+  traces_monthly_bytes: z22.number().int().positive(),
+  logs_monthly_bytes: z22.number().int().positive(),
+  telemetry_buffer_minutes: z22.number().int().min(1).max(1440),
+  revision: z22.number().int().nonnegative()
 });
-var iso3 = z14.string().datetime();
-var projectId3 = z14.number().int().positive();
-var verificationReceiptSchema = z14.object({
-  project_id: projectId3,
-  verification_id: verificationIdSchema,
-  surface: z14.enum(RECEIPT_SURFACES),
-  check: z14.enum(CHECKS),
-  hook: z14.enum(HOOK_STATES),
-  uncaught_expected: z14.boolean(),
-  sdk_name: z14.string().max(80),
-  sdk_version: z14.string().max(40),
-  environment: z14.string().max(64),
-  release: z14.string().max(200),
-  source_host: z14.string().max(253),
-  received_at: iso3
-});
-var SDK_DELIVERY_DROP_REASONS = ["network_error", "queue_overflow", "send_error"];
-var clientDiscardSchema = z14.object({
-  hour: iso3,
-  reason: z14.enum(SDK_DELIVERY_DROP_REASONS),
-  n: z14.number().int().nonnegative()
-});
-var edgeVerificationRequestSchema = z14.object({
-  v: z14.literal(1),
-  project_id: projectId3,
-  verification_id: verificationIdSchema
+var createIngestKeyInputSchema = z22.object({
+  projectId: z22.number().int().positive(),
+  name: z22.string().trim().min(1).max(INGEST_KEY_LIMITS.nameMaxChars).refine((s) => !/[\u0000-\u001f\u007f]/.test(s)),
+  scopes: z22.array(z22.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
+  environments: z22.array(z22.string().trim().min(1).max(INGEST_KEY_LIMITS.environmentMaxChars).regex(/^[^\s/\u0000-\u001f]+$/)).max(INGEST_KEY_LIMITS.environmentsMax),
+  expiresAt: z22.string().datetime({ offset: true }).nullable()
 });
-var readbackCheckSchema = z14.object({
-  surface: z14.enum(RECEIPT_SURFACES),
-  check: z14.enum(CHECKS),
-  hook: z14.enum(HOOK_STATES),
-  received_at: iso3
-});
-var edgeVerificationResponseSchema = z14.object({
-  checks: z14.array(readbackCheckSchema).max(8)
-});
-var readbackResponseSchema = z14.object({
-  v: z14.literal(1),
-  verification_id: verificationIdSchema,
-  node: z14.enum(["connected", "offline"]),
-  checks: z14.array(readbackCheckSchema).max(8)
-});
-var ENVIRONMENT_RE = /^[^\u0000-\u001f]{1,64}$/;
-var projectRuntimeSchema = z14.object({
-  project_id: projectId3,
-  environment: z14.string().max(64),
-  surface: z14.enum(SURFACES),
-  sdk_name: z14.string().max(80),
-  sdk_version: z14.string().max(40),
-  latest_release: z14.string().max(200),
-  first_seen: iso3,
-  last_seen: iso3,
-  events_24h: z14.number().int().nonnegative(),
-  check_ins_24h: z14.number().int().nonnegative()
+var ingestKeyRowSchema = z22.object({
+  id: z22.guid(),
+  project_id: z22.number().int().positive(),
+  name: z22.string(),
+  prefix: z22.string(),
+  scopes: z22.array(z22.enum(INGEST_KEY_SCOPES)),
+  environments: z22.array(z22.string()),
+  expires_at: z22.string().nullable(),
+  state: z22.enum(INGEST_KEY_STATES),
+  created_by: z22.guid().nullable(),
+  created_at: z22.string(),
+  revoked_at: z22.string().nullable(),
+  last_used_at: z22.string().nullable()
 });
 
 // ../src/shared/contracts/node-config.ts
-import { z as z16 } from "zod";
+import { z as z24 } from "zod";
 
 // ../src/shared/contracts/backup.ts
-import { z as z15 } from "zod";
+import { z as z23 } from "zod";
 var BACKUP_KINDS = ["daily", "weekly", "manual", "pre_upgrade"];
-var ageRecipient = z15.string().regex(/^age1[02-9ac-hj-np-z]{58}$/);
-var backupIdSchema = z15.string().regex(/^[a-z0-9-]{8,64}$/);
-var nodeBackupConfigSchema = z15.object({
-  enabled: z15.boolean(),
-  hour_utc: z15.number().int().min(0).max(23),
-  weekly_day: z15.number().int().min(1).max(7),
+var ageRecipient = z23.string().regex(/^age1[02-9ac-hj-np-z]{58}$/);
+var backupIdSchema = z23.string().regex(/^[a-z0-9-]{8,64}$/);
+var nodeBackupConfigSchema = z23.object({
+  enabled: z23.boolean(),
+  hour_utc: z23.number().int().min(0).max(23),
+  weekly_day: z23.number().int().min(1).max(7),
   workspace_recipient: ageRecipient
 });
-var backupCredentialsRequestSchema = z15.object({
-  mode: z15.enum(["upload", "download"]),
+var backupCredentialsRequestSchema = z23.object({
+  mode: z23.enum(["upload", "download"]),
   backup_id: backupIdSchema,
-  source_node_id: z15.guid().optional()
+  source_node_id: z23.guid().optional()
 });
-var backupCredentialsSchema = z15.object({
-  endpoint: z15.string().url(),
-  bucket: z15.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/),
-  prefix: z15.string().regex(/^backups\/[0-9a-f-]{36}\/$/),
-  access_key_id: z15.string().min(8).max(200),
-  secret_access_key: z15.string().min(8).max(200),
-  session_token: z15.string().min(8).max(4000),
-  expires_at: z15.string().datetime()
+var backupCredentialsSchema = z23.object({
+  endpoint: z23.string().url(),
+  bucket: z23.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/),
+  prefix: z23.string().regex(/^backups\/[0-9a-f-]{36}\/$/),
+  access_key_id: z23.string().min(8).max(200),
+  secret_access_key: z23.string().min(8).max(200),
+  session_token: z23.string().min(8).max(4000),
+  expires_at: z23.string().datetime()
 });
-var rowCountsSchema = z15.record(z15.string().regex(/^[a-z_][a-z0-9_]{0,63}$/), z15.number().int().nonnegative());
-var backupManifestSchema = z15.object({
-  v: z15.literal(1),
+var rowCountsSchema = z23.record(z23.string().regex(/^[a-z_][a-z0-9_]{0,63}$/), z23.number().int().nonnegative());
+var backupManifestSchema = z23.object({
+  v: z23.literal(1),
   backup_id: backupIdSchema,
-  node_id: z15.guid(),
-  kind: z15.enum(BACKUP_KINDS),
-  created_at: z15.string().datetime(),
-  object_key: z15.string(),
-  size_bytes: z15.number().int().nonnegative(),
-  sha256: z15.string().regex(/^[0-9a-f]{64}$/),
-  clickhouse_version: z15.string().max(40),
-  schema_version: z15.number().int().nonnegative(),
+  node_id: z23.guid(),
+  kind: z23.enum(BACKUP_KINDS),
+  created_at: z23.string().datetime(),
+  object_key: z23.string(),
+  size_bytes: z23.number().int().nonnegative(),
+  sha256: z23.string().regex(/^[0-9a-f]{64}$/),
+  clickhouse_version: z23.string().max(40),
+  schema_version: z23.number().int().nonnegative(),
   row_counts: rowCountsSchema,
-  recipients: z15.array(z15.string().regex(/^[0-9a-f]{8}$/)).min(1).max(4)
+  recipients: z23.array(z23.string().regex(/^[0-9a-f]{8}$/)).min(1).max(4)
 });
 var BACKUP_ERROR_CODES = [
   "CLICKHOUSE_BACKUP_FAILED",
@@ -2476,48 +3509,48 @@ var BACKUP_ERROR_CODES = [
   "RESTORE_FAILED",
   "ROW_COUNT_MISMATCH"
 ];
-var backupReportSchema = z15.object({
+var backupReportSchema = z23.object({
   backup_id: backupIdSchema,
-  kind: z15.enum(BACKUP_KINDS),
-  status: z15.enum(["succeeded", "failed"]),
-  started_at: z15.string().datetime(),
-  finished_at: z15.string().datetime(),
+  kind: z23.enum(BACKUP_KINDS),
+  status: z23.enum(["succeeded", "failed"]),
+  started_at: z23.string().datetime(),
+  finished_at: z23.string().datetime(),
   manifest: backupManifestSchema.nullable(),
-  error_code: z15.enum(BACKUP_ERROR_CODES).nullable()
+  error_code: z23.enum(BACKUP_ERROR_CODES).nullable()
 });
-var drillReportSchema = z15.object({
+var drillReportSchema = z23.object({
   backup_id: backupIdSchema,
-  kind: z15.enum(["weekly_local", "monthly_new_machine"]),
-  status: z15.enum(["passed", "failed"]),
-  finished_at: z15.string().datetime(),
-  detail: z15.string().max(300),
-  error_code: z15.enum(BACKUP_ERROR_CODES).nullable()
+  kind: z23.enum(["weekly_local", "monthly_new_machine"]),
+  status: z23.enum(["passed", "failed"]),
+  finished_at: z23.string().datetime(),
+  detail: z23.string().max(300),
+  error_code: z23.enum(BACKUP_ERROR_CODES).nullable()
 });
-var nodeIdentityEscrowSchema = z15.object({
-  v: z15.literal(1),
-  node_id: z15.guid(),
-  seal: z15.object({
-    publicKey: z15.string().regex(/^[A-Za-z0-9_-]{43}$/),
-    privateKey: z15.string().regex(/^[A-Za-z0-9_-]{43}$/)
+var nodeIdentityEscrowSchema = z23.object({
+  v: z23.literal(1),
+  node_id: z23.guid(),
+  seal: z23.object({
+    publicKey: z23.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    privateKey: z23.string().regex(/^[A-Za-z0-9_-]{43}$/)
   }),
-  created_at: z15.string().datetime()
+  created_at: z23.string().datetime()
 });
-var restoreArgsSchema = z15.object({
-  job_id: z15.guid(),
-  workspace_id: z15.guid(),
-  source_node_id: z15.guid(),
+var restoreArgsSchema = z23.object({
+  job_id: z23.guid(),
+  workspace_id: z23.guid(),
+  source_node_id: z23.guid(),
   manifest: backupManifestSchema,
-  sealed_identity: z15.string().regex(/^[A-Za-z0-9_-]{40,2000}$/),
-  mode: z15.enum(["rebuild", "drill"])
+  sealed_identity: z23.string().regex(/^[A-Za-z0-9_-]{40,2000}$/),
+  mode: z23.enum(["rebuild", "drill"])
 });
-var restoreReportSchema = z15.object({
-  job_id: z15.guid(),
+var restoreReportSchema = z23.object({
+  job_id: z23.guid(),
   backup_id: backupIdSchema,
-  mode: z15.enum(["rebuild", "drill"]),
-  status: z15.enum(["succeeded", "failed"]),
-  finished_at: z15.string().datetime(),
-  detail: z15.string().max(300),
-  error_code: z15.enum(BACKUP_ERROR_CODES).nullable()
+  mode: z23.enum(["rebuild", "drill"]),
+  status: z23.enum(["succeeded", "failed"]),
+  finished_at: z23.string().datetime(),
+  detail: z23.string().max(300),
+  error_code: z23.enum(BACKUP_ERROR_CODES).nullable()
 });
 
 // ../src/shared/contracts/node-config.ts
@@ -2531,81 +3564,84 @@ var SCRUB_GROUPS = [
   "headers"
 ];
 var MAX_NODE_MONITORS = 5000;
-var kid = z16.string().regex(/^[A-Za-z0-9_-]{1,40}$/);
-var publicKey = z16.string().regex(/^[A-Za-z0-9_-]{43}$/);
-var nodeConfigSchema = z16.object({
-  v: z16.literal(1),
-  config_version: z16.number().int().positive(),
-  node_id: z16.guid(),
-  workspace_id: z16.guid(),
-  workspace_status: z16.enum(["active", "suspended"]),
-  issued_at: z16.string().datetime(),
-  retention_days: z16.number().int().min(1).max(3650),
-  channel: z16.enum(["stable", "canary"]).optional(),
-  projects: z16.array(z16.object({
-    project_id: z16.number().int().positive(),
-    slug: z16.string().max(64),
-    short_prefix: z16.string().regex(/^[A-Z0-9]{1,12}$/),
-    user_id_salt: z16.string().regex(/^[A-Za-z0-9_-]{22,64}$/),
-    scrub_disabled: z16.array(z16.enum(SCRUB_GROUPS)).max(SCRUB_GROUPS.length),
-    upload_tokens: z16.array(z16.object({
-      hash: z16.string().regex(/^[a-f0-9]{64}$/),
-      expires_at: z16.string().datetime()
+var kid = z24.string().regex(/^[A-Za-z0-9_-]{1,40}$/);
+var publicKey = z24.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var nodeConfigSchema = z24.object({
+  v: z24.literal(1),
+  config_version: z24.number().int().positive(),
+  node_id: z24.guid(),
+  workspace_id: z24.guid(),
+  workspace_status: z24.enum(["active", "suspended"]),
+  issued_at: z24.string().datetime(),
+  retention_days: z24.number().int().min(1).max(3650),
+  channel: z24.enum(["stable", "canary"]).optional(),
+  projects: z24.array(z24.object({
+    project_id: z24.number().int().positive(),
+    slug: z24.string().max(64),
+    short_prefix: z24.string().regex(/^[A-Z0-9]{1,12}$/),
+    user_id_salt: z24.string().regex(/^[A-Za-z0-9_-]{22,64}$/),
+    scrub_disabled: z24.array(z24.enum(SCRUB_GROUPS)).max(SCRUB_GROUPS.length),
+    upload_tokens: z24.array(z24.object({
+      hash: z24.string().regex(/^[a-f0-9]{64}$/),
+      expires_at: z24.string().datetime()
     })).max(10).optional()
   })).max(1000),
-  ticket_keys: z16.array(z16.object({ kid, public_key: publicKey, not_after: z16.string().datetime() })).min(1).max(5),
-  control_ops_keys: z16.array(z16.object({ kid, public_key: publicKey })).min(1).max(5),
-  kill_switches: z16.object({ ingest: z16.boolean(), alerts: z16.boolean() }),
+  ticket_keys: z24.array(z24.object({ kid, public_key: publicKey, not_after: z24.string().datetime() })).min(1).max(5),
+  control_ops_keys: z24.array(z24.object({ kid, public_key: publicKey })).min(1).max(5),
+  kill_switches: z24.object({ ingest: z24.boolean(), alerts: z24.boolean() }),
   backup: nodeBackupConfigSchema.optional(),
-  purged_projects: z16.array(z16.number().int().positive()).max(1000).optional(),
-  monitors: z16.array(monitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
-  purged_monitors: z16.array(z16.guid()).max(5000).optional(),
-  telemetry: z16.object({
-    traces_retention_days: z16.number().int().min(1).max(90),
-    logs_retention_days: z16.number().int().min(1).max(90),
-    traces_disk_share: z16.number().min(0.2).max(0.8)
+  purged_projects: z24.array(z24.number().int().positive()).max(1000).optional(),
+  monitors: z24.array(monitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
+  purged_monitors: z24.array(z24.guid()).max(5000).optional(),
+  telemetry: z24.object({
+    traces_retention_days: z24.number().int().min(1).max(90),
+    logs_retention_days: z24.number().int().min(1).max(90),
+    traces_disk_share: z24.number().min(0.2).max(0.8)
   }).optional(),
-  slos: z16.array(nodeSloSchema).max(SLO_LIMITS.maxNodeSlos).optional()
+  slos: z24.array(nodeSloSchema).max(SLO_LIMITS.maxNodeSlos).optional(),
+  signal_monitors: z24.array(signalMonitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
+  signal_limits: signalLimitsConfigSchema.optional(),
+  privacy: nodePrivacyBlockSchema.optional()
 });
-var signedNodeConfigSchema = z16.object({ config: nodeConfigSchema, kid, sig: z16.string() });
+var signedNodeConfigSchema = z24.object({ config: nodeConfigSchema, kid, sig: z24.string() });
 
 // ../src/shared/contracts/api-ops/projects.ts
-var slug = z17.string().regex(/^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$/);
-var name3 = z17.string().trim().min(1).max(60);
-var label = z17.string().trim().min(1).max(40);
-var platform = z17.enum(PLATFORMS);
-var origin = z17.string().trim().toLowerCase().regex(/^https?:\/\/[a-z0-9.-]+(:[0-9]{1,5})?$/).max(200);
-var keyId = z17.number().int().positive();
+var slug = z25.string().regex(/^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$/);
+var name3 = z25.string().trim().min(1).max(60);
+var label = z25.string().trim().min(1).max(40);
+var platform = z25.enum(PLATFORMS);
+var origin = z25.string().trim().toLowerCase().regex(/^https?:\/\/[a-z0-9.-]+(:[0-9]{1,5})?$/).max(200);
+var keyId = z25.number().int().positive();
 var PROJECT_INPUTS = {
-  create: z17.object({ workspaceId: uuid, name: name3, slug, platform }),
-  update: z17.object({ projectId, name: name3, platform, isPinned: z17.boolean() }),
-  updateIntake: z17.object({
+  create: z25.object({ workspaceId: uuid, name: name3, slug, platform }),
+  update: z25.object({ projectId, name: name3, platform, isPinned: z25.boolean() }),
+  updateIntake: z25.object({
     projectId,
-    rateLimit: z17.number().int().positive().nullable(),
-    burst: z17.number().int().positive().nullable(),
-    allowedOrigins: z17.array(origin).max(50)
+    rateLimit: z25.number().int().positive().nullable(),
+    burst: z25.number().int().positive().nullable(),
+    allowedOrigins: z25.array(origin).max(50)
   }),
-  updateObservability: z17.object({
+  updateObservability: z25.object({
     projectId,
-    primaryEnvironment: z17.string().trim().min(1).max(64).refine((v) => v !== "*" && ENVIRONMENT_RE.test(v)),
-    allowCodeMonitors: z17.boolean()
+    primaryEnvironment: z25.string().trim().min(1).max(64).refine((v) => v !== "*" && ENVIRONMENT_RE.test(v)),
+    allowCodeMonitors: z25.boolean()
   }),
-  setScrub: z17.object({ projectId, group: z17.enum(SCRUB_GROUPS), enabled: z17.boolean() }),
-  setCheckinAuth: z17.object({ projectId, mode: z17.enum(CHECKIN_AUTH_MODES) }),
-  setEnvironmentHidden: z17.object({
+  setScrub: z25.object({ projectId, group: z25.enum(SCRUB_GROUPS), enabled: z25.boolean() }),
+  setCheckinAuth: z25.object({ projectId, mode: z25.enum(CHECKIN_AUTH_MODES) }),
+  setEnvironmentHidden: z25.object({
     projectId,
-    name: z17.string().min(1).max(64),
-    hidden: z17.boolean()
-  }),
-  scheduleDeletion: z17.object({ projectId, confirmSlug: slug }),
-  projectOnly: z17.object({ projectId }),
-  labelled: z17.object({ projectId, label }),
-  keyOnly: z17.object({ keyId }),
-  tokenOnly: z17.object({ tokenId: keyId }),
+    name: z25.string().min(1).max(64),
+    hidden: z25.boolean()
+  }),
+  scheduleDeletion: z25.object({ projectId, confirmSlug: slug }),
+  projectOnly: z25.object({ projectId }),
+  labelled: z25.object({ projectId, label }),
+  keyOnly: z25.object({ keyId }),
+  tokenOnly: z25.object({ tokenId: keyId }),
   createIngestKey: createIngestKeyInputSchema,
-  ingestKeyOnly: z17.object({ keyId: uuid })
+  ingestKeyOnly: z25.object({ keyId: uuid })
 };
-var P = PROJECT_INPUTS;
+var P2 = PROJECT_INPUTS;
 var PROJECT_OPERATIONS = [
   op({
     id: "projects.create",
@@ -2615,7 +3651,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "normal",
     kind: "write",
     rpcs: ["create_project"],
-    input: P.create,
+    input: P2.create,
     workspace: true,
     idempotency: "required",
     status: 201,
@@ -2631,7 +3667,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "normal",
     kind: "write",
     rpcs: ["update_project"],
-    input: P.update,
+    input: P2.update,
     ifMatch: true,
     idempotency: "none",
     mcp: "configure",
@@ -2646,7 +3682,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "normal",
     kind: "write",
     rpcs: ["update_project_intake"],
-    input: P.updateIntake,
+    input: P2.updateIntake,
     ifMatch: true,
     idempotency: "none",
     mcp: "configure",
@@ -2661,7 +3697,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "normal",
     kind: "write",
     rpcs: ["update_project_observability"],
-    input: P.updateObservability,
+    input: P2.updateObservability,
     ifMatch: true,
     idempotency: "none",
     mcp: "configure",
@@ -2673,10 +3709,10 @@ var PROJECT_OPERATIONS = [
     method: "PUT",
     path: "/v1/projects/{project_id}/scrub/{group}",
     scope: "privacy:write",
-    sensitivity: "normal",
+    sensitivity: "approval",
     kind: "write",
     rpcs: ["set_project_scrub"],
-    input: P.setScrub,
+    input: P2.setScrub,
     idempotency: "none",
     mcp: "configure",
     summary: "Turn one built-in scrubbing group on or off.",
@@ -2690,7 +3726,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "approval",
     kind: "write",
     rpcs: ["set_project_checkin_auth"],
-    input: P.setCheckinAuth,
+    input: P2.setCheckinAuth,
     idempotency: "none",
     mcp: "configure",
     summary: "Choose which credentials may send check-ins.",
@@ -2704,7 +3740,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "normal",
     kind: "write",
     rpcs: ["set_environment_hidden"],
-    input: P.setEnvironmentHidden,
+    input: P2.setEnvironmentHidden,
     idempotency: "none",
     mcp: "configure",
     summary: "Hide or show an environment in lists.",
@@ -2718,7 +3754,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "approval",
     kind: "write",
     rpcs: ["schedule_project_deletion"],
-    input: P.scheduleDeletion,
+    input: P2.scheduleDeletion,
     idempotency: "none",
     mcp: "configure",
     summary: "Schedule the project's deletion; `confirm_slug` must repeat its slug.",
@@ -2732,7 +3768,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "normal",
     kind: "write",
     rpcs: ["cancel_project_deletion"],
-    input: P.projectOnly,
+    input: P2.projectOnly,
     idempotency: "optional",
     mcp: "configure",
     summary: "Cancel a scheduled project deletion.",
@@ -2746,7 +3782,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "normal",
     kind: "write",
     rpcs: ["request_test_event"],
-    input: P.projectOnly,
+    input: P2.projectOnly,
     idempotency: "optional",
     mcp: "reliability",
     summary: "Ask the node to send one test event through the public intake.",
@@ -2760,7 +3796,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "approval",
     kind: "write",
     rpcs: ["create_project_key"],
-    input: P.labelled,
+    input: P2.labelled,
     idempotency: "required",
     status: 201,
     mcp: "configure",
@@ -2775,7 +3811,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "approval",
     kind: "write",
     rpcs: ["rotate_project_key"],
-    input: P.keyOnly,
+    input: P2.keyOnly,
     idempotency: "optional",
     mcp: "configure",
     summary: "Replace a DSN key.",
@@ -2789,7 +3825,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "approval",
     kind: "write",
     rpcs: ["revoke_project_key"],
-    input: P.keyOnly,
+    input: P2.keyOnly,
     idempotency: "none",
     mcp: "configure",
     summary: "Revoke a DSN key.",
@@ -2803,7 +3839,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "approval",
     kind: "write",
     rpcs: ["create_upload_token"],
-    input: P.labelled,
+    input: P2.labelled,
     idempotency: "required",
     status: 201,
     mcp: "configure",
@@ -2819,7 +3855,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "approval",
     kind: "write",
     rpcs: ["revoke_upload_token"],
-    input: P.tokenOnly,
+    input: P2.tokenOnly,
     idempotency: "none",
     mcp: "configure",
     summary: "Revoke a source map upload token.",
@@ -2833,7 +3869,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "approval",
     kind: "write",
     rpcs: ["create_ingest_key"],
-    input: P.createIngestKey,
+    input: P2.createIngestKey,
     idempotency: "required",
     status: 201,
     mcp: "configure",
@@ -2849,7 +3885,7 @@ var PROJECT_OPERATIONS = [
     sensitivity: "approval",
     kind: "write",
     rpcs: ["revoke_ingest_key"],
-    input: P.ingestKeyOnly,
+    input: P2.ingestKeyOnly,
     idempotency: "none",
     mcp: "configure",
     summary: "Revoke an OTLP ingest key.",
@@ -2858,24 +3894,28 @@ var PROJECT_OPERATIONS = [
 ];
 
 // ../src/shared/contracts/api-ops/reads.ts
-import { z as z18 } from "zod";
-var list = z18.object({ workspaceId: uuid, limit: pageLimit, cursor });
+import { z as z26 } from "zod";
+var list = z26.object({ workspaceId: uuid, limit: pageLimit, cursor });
 var READ_INPUTS = {
-  workspace: z18.object({ workspaceId: uuid }),
+  workspace: z26.object({ workspaceId: uuid }),
   list,
-  projectsGet: z18.object({ workspaceId: uuid, projectId }),
+  projectsGet: z26.object({ workspaceId: uuid, projectId }),
   monitorsList: list.extend({ projectId: projectId.optional() }),
-  monitorsGet: z18.object({ workspaceId: uuid, monitorId: uuid }),
-  uptimeGet: z18.object({ workspaceId: uuid, checkId: uuid }),
-  slosGet: z18.object({ workspaceId: uuid, sloId: uuid }),
+  monitorsGet: z26.object({ workspaceId: uuid, monitorId: uuid }),
+  uptimeGet: z26.object({ workspaceId: uuid, checkId: uuid }),
+  slosGet: z26.object({ workspaceId: uuid, sloId: uuid }),
   alertsList: list.extend({
-    state: z18.enum(["open", "resolved", "all"]).default("all"),
+    state: z26.enum(["open", "resolved", "all"]).default("all"),
     monitorId: uuid.optional()
   }),
-  approvalsGet: z18.object({ workspaceId: uuid, approvalId: uuid })
+  approvalsGet: z26.object({ workspaceId: uuid, approvalId: uuid }),
+  monitorsListTyped: list.extend({
+    projectId: projectId.optional(),
+    type: z26.enum(MONITOR_TYPES).optional()
+  })
 };
 var R = READ_INPUTS;
-var base = {
+var base2 = {
   sensitivity: "normal",
   kind: "read",
   method: "GET",
@@ -2885,7 +3925,7 @@ var base = {
 };
 var READ_OPERATIONS = [
   op({
-    ...base,
+    ...base2,
     id: "workspace.get",
     path: "/v1/workspace",
     scope: "org:read",
@@ -2895,7 +3935,7 @@ var READ_OPERATIONS = [
     summary: "The token's workspace, plan and the caller's role."
   }),
   op({
-    ...base,
+    ...base2,
     id: "members.list",
     path: "/v1/members",
     scope: "members:read",
@@ -2906,7 +3946,7 @@ var READ_OPERATIONS = [
     summary: "Workspace members and their roles."
   }),
   op({
-    ...base,
+    ...base2,
     id: "projects.list",
     path: "/v1/projects",
     scope: "projects:read",
@@ -2917,7 +3957,7 @@ var READ_OPERATIONS = [
     summary: "Projects the token can see."
   }),
   op({
-    ...base,
+    ...base2,
     id: "projects.get",
     path: "/v1/projects/{project_id}",
     scope: "projects:read",
@@ -2927,18 +3967,18 @@ var READ_OPERATIONS = [
     summary: "One project."
   }),
   op({
-    ...base,
+    ...base2,
     id: "monitors.list",
     path: "/v1/monitors",
     scope: "monitors:read",
     rpcs: ["api_read_monitors"],
-    input: R.monitorsList,
+    input: R.monitorsListTyped,
     paged: true,
     mcp: "investigate",
-    summary: "Cron and heartbeat monitors."
+    summary: "Monitors of every type (cron, heartbeat, count, assertion, deadline, progress); `type` narrows the list."
   }),
   op({
-    ...base,
+    ...base2,
     id: "monitors.get",
     path: "/v1/monitors/{monitor_id}",
     scope: "monitors:read",
@@ -2948,7 +3988,7 @@ var READ_OPERATIONS = [
     summary: "One monitor with its ETag."
   }),
   op({
-    ...base,
+    ...base2,
     id: "uptime.list",
     path: "/v1/uptime-checks",
     scope: "monitors:read",
@@ -2959,7 +3999,7 @@ var READ_OPERATIONS = [
     summary: "Uptime checks (header values are never returned)."
   }),
   op({
-    ...base,
+    ...base2,
     id: "uptime.get",
     path: "/v1/uptime-checks/{check_id}",
     scope: "monitors:read",
@@ -2969,7 +4009,7 @@ var READ_OPERATIONS = [
     summary: "One uptime check."
   }),
   op({
-    ...base,
+    ...base2,
     id: "slos.list",
     path: "/v1/slos",
     scope: "monitors:read",
@@ -2980,7 +4020,7 @@ var READ_OPERATIONS = [
     summary: "SLO definitions."
   }),
   op({
-    ...base,
+    ...base2,
     id: "slos.get",
     path: "/v1/slos/{slo_id}",
     scope: "monitors:read",
@@ -2990,7 +4030,7 @@ var READ_OPERATIONS = [
     summary: "One SLO definition."
   }),
   op({
-    ...base,
+    ...base2,
     id: "alert_rules.list",
     path: "/v1/alert-rules",
     scope: "alerts:read",
@@ -3001,7 +4041,7 @@ var READ_OPERATIONS = [
     summary: "Alert rules."
   }),
   op({
-    ...base,
+    ...base2,
     id: "destinations.list",
     path: "/v1/destinations",
     scope: "alerts:read",
@@ -3012,7 +4052,7 @@ var READ_OPERATIONS = [
     summary: "Alert destinations with a masked hint; secrets never leave the server."
   }),
   op({
-    ...base,
+    ...base2,
     id: "alerts.list",
     path: "/v1/alerts",
     scope: "alerts:read",
@@ -3023,7 +4063,18 @@ var READ_OPERATIONS = [
     summary: "Alerts: one row per violation episode of a monitor, open or resolved."
   }),
   op({
-    ...base,
+    ...base2,
+    id: "maintenance.list",
+    path: "/v1/maintenance-windows",
+    scope: "monitors:read",
+    rpcs: ["api_read_maintenance_windows"],
+    input: R.list,
+    paged: true,
+    mcp: "reliability",
+    summary: "Maintenance windows and whether each is active now."
+  }),
+  op({
+    ...base2,
     id: "node.get",
     path: "/v1/node",
     scope: "org:read",
@@ -3033,7 +4084,7 @@ var READ_OPERATIONS = [
     summary: "The node's state, versions and last heartbeat (null before provisioning)."
   }),
   op({
-    ...base,
+    ...base2,
     id: "usage.get",
     path: "/v1/usage",
     scope: "usage:read",
@@ -3043,7 +4094,7 @@ var READ_OPERATIONS = [
     summary: "The workspace's plan and limits."
   }),
   op({
-    ...base,
+    ...base2,
     id: "audit.list",
     path: "/v1/audit-log",
     scope: "audit:read",
@@ -3054,7 +4105,7 @@ var READ_OPERATIONS = [
     summary: "Audit log, newest first (admins)."
   }),
   op({
-    ...base,
+    ...base2,
     id: "approvals.get",
     path: "/v1/approvals/{approval_id}",
     scope: "org:read",
@@ -3071,6 +4122,9 @@ var API_OPERATIONS = [
   ...PROJECT_OPERATIONS,
   ...MONITOR_OPERATIONS,
   ...ALERT_OPERATIONS,
+  ...INCIDENT_OPERATIONS,
+  ...COVERAGE_OPERATIONS,
+  ...PRIVACY_OPERATIONS,
   ...ACCESS_OPERATIONS,
   ...NODE_OPERATIONS
 ];
@@ -3095,6 +4149,8 @@ var APPROVAL_LIMITS = {
 var APPROVAL_APPROVER = {
   "projects.set_checkin_auth": "admin",
   "projects.schedule_deletion": "admin",
+  "projects.set_scrub": "admin",
+  "privacy.set": "admin",
   "project_keys.create": "member",
   "project_keys.rotate": "member",
   "project_keys.revoke": "member",
@@ -3139,14 +4195,14 @@ function approvalRequestSchema(operationId, input) {
 }
 
 // ../src/shared/contracts/api-ops/wire.ts
-import { z as z19 } from "zod";
+import { z as z27 } from "zod";
 var toSnake = (s) => s.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
 var toCamel = (s) => s.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
 var schemaCache = new WeakMap;
 function inputJsonSchema(op) {
   let js = schemaCache.get(op.input);
   if (!js) {
-    js = z19.toJSONSchema(op.input, { io: "input", unrepresentable: "any" });
+    js = z27.toJSONSchema(op.input, { io: "input", unrepresentable: "any" });
     schemaCache.set(op.input, js);
   }
   return js;
@@ -3271,6 +4327,18 @@ function wirePointer(op, path) {
     segs.shift();
   return `/${segs.map((s) => s.replace(/~/g, "~0").replace(/\//g, "~1")).join("/")}`;
 }
+var WIRE_ERRORS_MAX = 20;
+function wireErrors(op, error) {
+  const flat = (issues, prefix) => issues.flatMap((i) => {
+    if (i.code === "invalid_union" && i.errors && i.errors.length > 0) {
+      const best = i.errors.reduce((a, b) => b.length < a.length ? b : a);
+      if (best.length > 0)
+        return flat(best, [...prefix, ...i.path]);
+    }
+    return [{ ...i, path: [...prefix, ...i.path] }];
+  });
+  return flat(error.issues, []).slice(0, WIRE_ERRORS_MAX).map((i) => ({ pointer: wirePointer(op, i.path), code: i.code }));
+}
 
 // ../src/shared/contracts/api-ops/openapi.ts
 function clean(js) {
@@ -3348,7 +4416,7 @@ function wireInput(operationId, opts = {}) {
   for (const [k, v] of Object.entries(op.input.shape))
     if (!omit.has(k))
       shape[toSnake(k)] = v;
-  return z20.object(shape);
+  return z28.object(shape);
 }
 var BUDGETS = [
   { stringBytes: MCP_LIMITS.untrustedStringMaxBytes, listMax: MCP_LIMITS.listMax },
@@ -3438,40 +4506,40 @@ function errorResult(o) {
     }
   };
 }
-var TOOL_OUTPUT_SCHEMA = z20.object({
-  untrusted: z20.object({
-    data: z20.unknown(),
-    provenance: z20.object({
-      source: z20.enum(["node", "control_plane", "docs"]),
-      operations: z20.array(z20.string())
+var TOOL_OUTPUT_SCHEMA = z28.object({
+  untrusted: z28.object({
+    data: z28.unknown(),
+    provenance: z28.object({
+      source: z28.enum(["node", "control_plane", "docs"]),
+      operations: z28.array(z28.string())
     })
   }).optional(),
-  doc: z20.object({ slug: z20.string(), locale: z20.enum(["en", "vi"]), url: z20.string(), markdown: z20.string(), truncated: z20.boolean() }).optional(),
-  results: z20.array(z20.object({ slug: z20.string(), title: z20.string(), description: z20.string(), section: z20.string(), url: z20.string() })).optional(),
-  next_cursor: z20.string().nullable().optional(),
-  complete: z20.boolean().optional(),
-  omitted: z20.array(z20.object({ part: z20.string(), reason: z20.string(), scope: z20.string().optional() })).optional(),
-  truncated: z20.literal(true).optional(),
-  suspicious_unicode: z20.literal(true).optional(),
-  error: z20.object({
-    code: z20.string(),
-    status: z20.number(),
-    detail: z20.string().optional(),
-    scope: z20.string().optional(),
-    retry_after: z20.number().optional()
+  doc: z28.object({ slug: z28.string(), locale: z28.enum(["en", "vi"]), url: z28.string(), markdown: z28.string(), truncated: z28.boolean() }).optional(),
+  results: z28.array(z28.object({ slug: z28.string(), title: z28.string(), description: z28.string(), section: z28.string(), url: z28.string() })).optional(),
+  next_cursor: z28.string().nullable().optional(),
+  complete: z28.boolean().optional(),
+  omitted: z28.array(z28.object({ part: z28.string(), reason: z28.string(), scope: z28.string().optional() })).optional(),
+  truncated: z28.literal(true).optional(),
+  suspicious_unicode: z28.literal(true).optional(),
+  error: z28.object({
+    code: z28.string(),
+    status: z28.number(),
+    detail: z28.string().optional(),
+    scope: z28.string().optional(),
+    retry_after: z28.number().optional()
   }).optional(),
-  operations: z20.array(z20.record(z20.string(), z20.unknown())).optional(),
-  operation: z20.record(z20.string(), z20.unknown()).optional(),
-  plan: z20.record(z20.string(), z20.unknown()).optional(),
-  status: z20.enum(["done", "approval_required", "approval_pending", ...APPROVAL_STATES]).optional(),
-  approval: z20.object({
-    approval_id: z20.string(),
-    approval_url: z20.string(),
-    expires_at: z20.string(),
-    state: z20.enum(APPROVAL_STATES),
-    result_code: z20.string().nullable().optional(),
-    result: z20.record(z20.string(), z20.unknown()).optional(),
-    next: z20.string().optional()
+  operations: z28.array(z28.record(z28.string(), z28.unknown())).optional(),
+  operation: z28.record(z28.string(), z28.unknown()).optional(),
+  plan: z28.record(z28.string(), z28.unknown()).optional(),
+  status: z28.enum(["done", "approval_required", "approval_pending", ...APPROVAL_STATES]).optional(),
+  approval: z28.object({
+    approval_id: z28.string(),
+    approval_url: z28.string(),
+    expires_at: z28.string(),
+    state: z28.enum(APPROVAL_STATES),
+    result_code: z28.string().nullable().optional(),
+    result: z28.record(z28.string(), z28.unknown()).optional(),
+    next: z28.string().optional()
   }).optional()
 });
 var spec = (name) => {
@@ -3517,10 +4585,10 @@ var has = (rt, operationId) => {
   return !!op && rt.scopes.includes(op.scope);
 };
 var isoWindow = {
-  start: z20.string().max(40).describe("RFC 3339 start of the window, e.g. 2026-10-26T00:00:00Z. Required with end."),
-  end: z20.string().max(40).describe("RFC 3339 end of the window. The plan limits its length.")
+  start: z28.string().max(40).describe("RFC 3339 start of the window, e.g. 2026-10-26T00:00:00Z. Required with end."),
+  end: z28.string().max(40).describe("RFC 3339 end of the window. The plan limits its length.")
 };
-var traceIdSchema = z20.string().regex(/^[0-9a-fA-F]{32}$/);
+var traceIdSchema = z28.string().regex(/^[0-9a-fA-F]{32}$/);
 var MONITOR_KINDS2 = {
   cron: { list: "monitors.list", get: "monitors.get", idField: "monitor_id" },
   uptime: { list: "uptime.list", get: "uptime.get", idField: "check_id" },
@@ -3569,7 +4637,7 @@ function validateConfigure(op, params) {
     return { ok: true };
   return {
     ok: false,
-    errors: r.error.issues.slice(0, 20).map((i) => ({ pointer: wirePointer(op, i.path), code: i.code }))
+    errors: wireErrors(op, r.error)
   };
 }
 function describe(op, scopes) {
@@ -3584,8 +4652,8 @@ function describe(op, scopes) {
     destructive: isDestructiveOperation(op)
   };
 }
-var params = z20.record(z20.string(), z20.unknown()).default({}).describe("Operation fields in wire names (snake_case), as describe_operation's args_schema shows.");
-var operationIdArg = z20.string().min(3).max(80).describe("An operation id from search_operations, e.g. `monitors.update`.");
+var params = z28.record(z28.string(), z28.unknown()).default({}).describe("Operation fields in wire names (snake_case), as describe_operation's args_schema shows.");
+var operationIdArg = z28.string().min(3).max(80).describe("An operation id from search_operations, e.g. `monitors.update`.");
 function approvalBlock(t, next) {
   return {
     approval_id: t.approval_id,
@@ -3605,7 +4673,7 @@ var MCP_TOOL_DEFS = [
     title: "Workspace and node",
     description: "The workspace this token belongs to (name, plan, limits) and the state of its node, the server that stores errors, traces and logs. Start here to learn what the token can reach.",
     operations: ["workspace.get", "node.get"],
-    input: z20.object({}),
+    input: z28.object({}),
     async run(_args, rt) {
       const [ws, node] = await Promise.all([rt.call("workspace.get", {}), rt.call("node.get", {})]);
       if (!ws.ok)
@@ -3623,9 +4691,9 @@ var MCP_TOOL_DEFS = [
     title: "Get an issue",
     description: "One issue with its 24 h and 30 d counts and, when the token can read events, its latest event (stack trace, request, breadcrumbs — scrubbed on the node).",
     operations: ["issues.get", "events.get"],
-    input: z20.object({
-      issue_id: z20.number().int().positive().describe("Issue id from search_issues."),
-      include_latest_event: z20.boolean().default(true)
+    input: z28.object({
+      issue_id: z28.number().int().positive().describe("Issue id from search_issues."),
+      include_latest_event: z28.boolean().default(true)
     }),
     async run(args, rt) {
       const omitted = [];
@@ -3653,9 +4721,9 @@ var MCP_TOOL_DEFS = [
     title: "Get a trace",
     description: "Summary of one distributed trace (services, duration, errors) by its 32-hex trace id, and optionally its spans (errors only, or the first page).",
     operations: ["traces.get", "traces.spans"],
-    input: z20.object({
+    input: z28.object({
       trace_id: traceIdSchema.describe("W3C trace id, 32 hex characters."),
-      spans: z20.enum(["none", "errors", "all"]).default("none")
+      spans: z28.enum(["none", "errors", "all"]).default("none")
     }),
     async run(args, rt) {
       const sum = await rt.call("traces.get", { trace_id: args["trace_id"] });
@@ -3683,11 +4751,11 @@ var MCP_TOOL_DEFS = [
     title: "Correlate by trace or run",
     description: "Everything that shares one W3C trace id or one Belvador run id (`belvador.run.id`, set by job monitors) in a time window: the trace summary, its error spans and the logs. Give exactly one of trace_id or run_id.",
     operations: ["traces.get", "traces.spans", "spans.list", "logs.list"],
-    input: z20.object({
+    input: z28.object({
       trace_id: traceIdSchema.optional(),
-      run_id: z20.string().min(1).max(128).optional(),
+      run_id: z28.string().min(1).max(128).optional(),
       ...isoWindow,
-      project: z20.string().max(2000).optional().describe("Comma-separated project ids.")
+      project: z28.string().max(2000).optional().describe("Comma-separated project ids.")
     }),
     async run(args, rt) {
       const trace = args["trace_id"];
@@ -3730,12 +4798,12 @@ var MCP_TOOL_DEFS = [
   {
     ...spec("list_monitors"),
     title: "List monitors",
-    description: "Cron/heartbeat monitors, uptime checks and SLOs with their current status. `kind` narrows to one family; `project_id` to one project (cron and uptime).",
+    description: "Monitors (cron, heartbeat, count, assertion, deadline, progress), uptime checks and SLOs with their current status. `kind` narrows to one family; `project_id` to one project (cron and uptime).",
     operations: ["monitors.list", "uptime.list", "slos.list"],
-    input: z20.object({
-      kind: z20.enum(["all", "cron", "uptime", "slo"]).default("all"),
-      project_id: z20.number().int().positive().optional(),
-      limit: z20.number().int().min(1).max(200).default(50)
+    input: z28.object({
+      kind: z28.enum(["all", "cron", "uptime", "slo"]).default("all"),
+      project_id: z28.number().int().positive().optional(),
+      limit: z28.number().int().min(1).max(200).default(50)
     }),
     async run(args, rt) {
       const kinds = args["kind"] && args["kind"] !== "all" ? [args["kind"]] : ["cron", "uptime", "slo"];
@@ -3761,26 +4829,70 @@ var MCP_TOOL_DEFS = [
   {
     ...spec("get_monitor_status"),
     title: "Get a monitor",
-    description: "One cron monitor, uptime check or SLO by id: settings, current status and recent results.",
-    operations: ["monitors.get", "uptime.get", "slos.get"],
-    input: z20.object({ kind: z20.enum(["cron", "uptime", "slo"]), id: z20.guid() }),
+    description: "One monitor (any type), uptime check or SLO by id: settings, current status and recent results. For count, assertion, deadline and progress monitors it adds the last 24 h of minute counts or runs from the node, and for deadline monitors the newest occurrences. `backtest: true` (count/assertion only) also replays the current settings over the last 30 days: how often it would have alerted.",
+    operations: ["monitors.get", "uptime.get", "slos.get", "monitors.signal", "monitors.occurrences", "monitors.backtest"],
+    input: z28.object({
+      kind: z28.enum(["cron", "uptime", "slo"]),
+      id: z28.guid(),
+      backtest: z28.boolean().default(false)
+    }),
     async run(args, rt) {
       const k = MONITOR_KINDS2[args["kind"]];
       const r = await rt.call(k.get, { [k.idField]: args["id"] });
       if (!r.ok)
         return errorResult(r);
-      return wrapResult({ data: r.body, operations: [k.get], source: "control_plane" });
+      const row = r.body ?? {};
+      const type = typeof row["type"] === "string" ? row["type"] : "job";
+      if (k.get !== "monitors.get" || !isSignalMonitorType(type)) {
+        return wrapResult({ data: r.body, operations: [k.get], source: "control_plane" });
+      }
+      const ops = [k.get, "monitors.signal"];
+      const calls = [
+        rt.call("monitors.signal", { monitor_id: args["id"], hours: 24 })
+      ];
+      const parts = ["signal"];
+      if (type === "deadline") {
+        ops.push("monitors.occurrences");
+        parts.push("occurrences");
+        calls.push(rt.call("monitors.occurrences", { monitor_id: args["id"], state: "all" }));
+      }
+      const settings = args["backtest"] === true && (type === "count" || type === "assertion") ? settingsFromRow({
+        type,
+        signal_settings: row["signal_settings"],
+        expected_environments: Array.isArray(row["expected_environments"]) ? row["expected_environments"] : [],
+        severity: String(row["severity"] ?? "medium"),
+        recovery_threshold: Number(row["recovery_threshold"] ?? 1)
+      }) : null;
+      if (settings) {
+        ops.push("monitors.backtest");
+        parts.push("backtest");
+        calls.push(rt.call("monitors.backtest", { project: row["project_id"], settings }));
+      }
+      const answers = await Promise.all(calls);
+      const data = { monitor: r.body };
+      const omitted = [];
+      for (const [i, part] of parts.entries()) {
+        const a = answers[i];
+        if (a.ok)
+          data[part] = part === "occurrences" ? withoutPaging(a.body) : a.body;
+        else
+          omitted.push({ part, reason: a.code });
+      }
+      return wrapResult({ data, operations: ops, source: omitted.length === parts.length ? "control_plane" : "node" }, { omitted });
     }
   },
   single("list_alerts", "alerts.list", "List alerts", "Alerts Belvador raised (open, resolved or all), newest first, optionally for one monitor."),
+  single("list_incidents", "incidents.list", "List incidents", "Incidents (INC-n): related alerts grouped into one piece of work. State (open, acknowledged, monitoring, resolved), severity and peak, owner, linked and still-firing alert counts; newest first. `state` = active, resolved or all. Returns ids for get_incident."),
+  single("get_incident", "incidents.get", "Get an incident", "One incident by id: its linked alerts (monitor, uptime, SLO, issue) with ids for get_monitor_status or get_issue, the timeline (opened, joined, acknowledged, notes, escalation, resolution) and each message's delivery state. `accepted` means the service took the message; only `acknowledged: true` means a person took the incident."),
+  single("get_coverage", "coverage.get", "Get coverage", "What each app is expected to send (part of the app × signal × environment) against what Belvador really received: `verified` (fresh evidence or verification receipt), `stale`, `problem` (open connection problem) or `unknown` (never seen). Same numbers as the Coverage page. `undeclared` lists signals seen without an expectation; they do not count. Optional `project_id` and `environment` narrow it."),
   {
     ...spec("verify_integration"),
     title: "Send a test event",
     description: "Asks the node to send one tagged test error through the public intake of a project, proving the path real errors take. Not read-only: it creates one test event (reuse idempotency_key to retry without a second one).",
     operations: ["projects.send_test_event"],
-    input: z20.object({
-      project_id: z20.number().int().positive(),
-      idempotency_key: z20.string().min(8).max(255).optional()
+    input: z28.object({
+      project_id: z28.number().int().positive(),
+      idempotency_key: z28.string().min(8).max(255).optional()
     }),
     async run(args, rt) {
       const r = await rt.call("projects.send_test_event", { project_id: args["project_id"] }, { idempotencyKey: args["idempotency_key"] ?? rt.newKey() });
@@ -3792,11 +4904,11 @@ var MCP_TOOL_DEFS = [
   {
     ...spec("search_operations"),
     title: "Find a configuration change",
-    description: "Searches what this token can change in its Belvador workspace: projects, keys and tokens, monitors, uptime checks, SLOs, alert rules and destinations, members, service accounts and the node. Returns operation ids for describe_operation and plan_change, whether a person must approve the change, and whether this token holds the scope.",
+    description: "Searches what this token can change in its Belvador workspace: projects, keys and tokens, monitors of every type, maintenance windows, occurrences, uptime checks, SLOs, alert rules and destinations, members, service accounts and the node. Returns operation ids for describe_operation and plan_change, whether a person must approve the change, and whether this token holds the scope.",
     operations: [],
-    input: z20.object({
-      query: z20.string().min(1).max(200).describe("Words such as `rotate dsn key`, `heartbeat monitor`, `slack alert`."),
-      limit: z20.number().int().min(1).max(20).default(10)
+    input: z28.object({
+      query: z28.string().min(1).max(200).describe("Words such as `rotate dsn key`, `heartbeat monitor`, `slack alert`."),
+      limit: z28.number().int().min(1).max(20).default(10)
     }),
     async run(args, rt) {
       const q = words(String(args["query"]));
@@ -3824,7 +4936,7 @@ var MCP_TOOL_DEFS = [
     title: "Describe a configuration change",
     description: "Everything needed to call one operation: its fields (JSON Schema, wire names), the scope, whether it needs If-Match (call plan_change for the current ETag), an idempotency key, or a person's approval, and which fields the approving person types on belvador.dev instead of the agent.",
     operations: [],
-    input: z20.object({ operation_id: operationIdArg }),
+    input: z28.object({ operation_id: operationIdArg }),
     async run(args, rt) {
       const op = configureOp(args["operation_id"]);
       if (!op || op.method === "GET")
@@ -3853,7 +4965,7 @@ var MCP_TOOL_DEFS = [
     title: "Check a change before applying it",
     description: "Validates params for one operation without changing anything: field errors, missing scope, whether a person must approve, and — when the resource can be read — its current state, the fields that would change and the ETag to pass as if_match.",
     operations: [],
-    input: z20.object({ operation_id: operationIdArg, params }),
+    input: z28.object({ operation_id: operationIdArg, params }),
     async run(args, rt) {
       const op = configureOp(args["operation_id"]);
       if (!op || op.method === "GET")
@@ -3902,11 +5014,11 @@ var MCP_TOOL_DEFS = [
     title: "Apply a configuration change",
     description: "Runs one operation with params (validate first with plan_change). Always send idempotency_key: repeating a call with the same key never applies it twice. Sensitive operations answer approval_required with an approval_url a person opens on belvador.dev; nothing changes until they approve with their authenticator code.",
     operations: [],
-    input: z20.object({
+    input: z28.object({
       operation_id: operationIdArg,
       params,
-      idempotency_key: z20.string().min(8).max(255).describe("Unique per change; reuse it to retry or to fetch the result."),
-      if_match: z20.string().max(200).optional().describe("ETag from plan_change, for operations that need it.")
+      idempotency_key: z28.string().min(8).max(255).describe("Unique per change; reuse it to retry or to fetch the result."),
+      if_match: z28.string().max(200).optional().describe("ETag from plan_change, for operations that need it.")
     }),
     async run(args, rt) {
       const op = configureOp(args["operation_id"]);
@@ -3957,7 +5069,7 @@ var MCP_TOOL_DEFS = [
     title: "Follow an approval",
     description: "State of a change waiting for a person's approval: pending, approved, executed (with the ids it produced), rejected, expired or failed (with the error code).",
     operations: ["approvals.get"],
-    input: z20.object({ approval_id: z20.guid().describe("approval_id from apply_change.") }),
+    input: z28.object({ approval_id: z28.guid().describe("approval_id from apply_change.") }),
     async run(args, rt) {
       const r = await rt.call("approvals.get", { approval_id: args["approval_id"] });
       if (!r.ok)
@@ -3977,10 +5089,10 @@ var MCP_TOOL_DEFS = [
     title: "Search Belvador docs",
     description: "Searches the public Belvador documentation (titles and summaries) and returns the best pages with their slugs for get_doc.",
     operations: [],
-    input: z20.object({
-      query: z20.string().min(1).max(200),
-      locale: z20.enum(["en", "vi"]).default("en"),
-      limit: z20.number().int().min(1).max(10).default(5)
+    input: z28.object({
+      query: z28.string().min(1).max(200),
+      locale: z28.enum(["en", "vi"]).default("en"),
+      limit: z28.number().int().min(1).max(10).default(5)
     }),
     async run(args, rt) {
       const locale = args["locale"] ?? "en";
@@ -3996,9 +5108,9 @@ var MCP_TOOL_DEFS = [
     title: "Read a docs page",
     description: "The Markdown of one public Belvador docs page by slug (e.g. `quickstart`, `sdk/react`, `reference/api`).",
     operations: [],
-    input: z20.object({
-      slug: z20.string().regex(/^[a-z0-9][a-z0-9/-]{0,120}$/),
-      locale: z20.enum(["en", "vi"]).default("en")
+    input: z28.object({
+      slug: z28.string().regex(/^[a-z0-9][a-z0-9/-]{0,120}$/),
+      locale: z28.enum(["en", "vi"]).default("en")
     }),
     async run(args, rt) {
       const locale = args["locale"] ?? "en";
@@ -4180,7 +5292,7 @@ function findToken(env = process.env, keychain = keychainToken) {
 }
 
 // packages/mcp/src/cli.ts
-var PACKAGE_VERSION = "0.2.0";
+var PACKAGE_VERSION = "0.4.0";
 var HELP = `belvador-mcp ${PACKAGE_VERSION} — Belvador MCP server (stdio)
 
 Usage: npx -y @belvador/mcp [--toolsets=${MCP_DEFAULT_TOOLSETS.join(",")}]