@belvador/mcp 0.5.0 → 0.7.0

package/dist/cli.js

@@ -182,7 +182,7 @@ function cleanUntrustedText(raw, maxBytes = MCP_LIMITS.untrustedStringMaxBytes)
   const { text, cut } = cutUtf8(escaped, maxBytes);
   return { text, cut, suspicious };
 }
-var MCP_TOOLS_VERSION = 5;
+var MCP_TOOLS_VERSION = 6;
 var MCP_TOOLS = [
   { name: "get_workspace", toolset: "investigate", scope: "org:read", readOnly: true, destructive: false, idempotent: true },
   { name: "list_projects", toolset: "investigate", scope: "projects:read", readOnly: true, destructive: false, idempotent: true },
@@ -211,9 +211,7 @@ var MCP_TOOLS = [
   { name: "search_docs", toolset: "docs", scope: null, readOnly: true, destructive: false, idempotent: true },
   { name: "get_doc", toolset: "docs", scope: null, readOnly: true, destructive: false, idempotent: true }
 ];
-var MCP_TOOLS_PENDING = {
-  release_health: "P15"
-};
+var MCP_TOOLS_PENDING = {};
 
 // ../src/shared/mcp/docs.ts
 var DOCS_MAX_BYTES = 512 * 1024;
@@ -257,7 +255,7 @@ function docsFetcher(siteUrl, fetcher = fetch, now = () => Date.now()) {
 import { CLIENT_CAPABILITIES_META_KEY, inputRequired, McpServer } from "@modelcontextprotocol/server";
 
 // ../src/shared/contracts/mcp-tools.ts
-import { z as z29 } from "zod";
+import { z as z32 } from "zod";
 
 // ../src/shared/contracts/api-ops/access.ts
 import { z as z3 } from "zod";
@@ -1238,7 +1236,7 @@ var TELEMETRY_PLAN_DEFAULTS = {
 // ../src/shared/contracts/vocab/metrics.ts
 var METRIC_TYPES = ["gauge", "sum", "histogram", "exp_histogram"];
 var METRIC_KINDS = ["gauge", "counter", "histogram", "exp_histogram"];
-var METRIC_AGGREGATIONS = ["avg", "sum", "min", "max", "count", "rate", "p50", "p90", "p95", "p99"];
+var METRIC_AGGREGATIONS = ["avg", "sum", "min", "max", "count", "rate", "p50", "p75", "p90", "p95", "p99"];
 var METRIC_NAME_RE = /^[A-Za-z_][A-Za-z0-9_.:\-/]{0,254}$/;
 var METRIC_ATTR_KEY_RE = /^[A-Za-z0-9_.:\-/@]{1,256}$/;
 var METRIC_GROUP_BY_MAX = 2;
@@ -2182,6 +2180,48 @@ import { z as z16 } from "zod";
 
 // ../src/shared/contracts/signed-message.ts
 import { z as z15 } from "zod";
+
+// ../src/shared/contracts/limits.ts
+var INGEST_LIMITS = {
+  envelopeCompressedMaxBytes: 20 * 1024 * 1024,
+  decompressedMaxBytes: 200 * 1024 * 1024,
+  maxCompressionRatio: 50,
+  eventItemMaxBytes: 1024 * 1024,
+  attachmentMaxBytes: 5 * 1024 * 1024,
+  jsonMaxDepth: 20,
+  jsonMaxKeysPerObject: 1000,
+  jsonMaxKeysTotal: 1e4,
+  jsonHardMaxDepth: 128,
+  stringMaxChars: 8192,
+  framesMaxPerException: 250,
+  exceptionsMax: 10,
+  breadcrumbsMax: 100,
+  tagsMax: 20,
+  tagKeyMaxChars: 32,
+  tagValueMaxChars: 200,
+  sourceMapMaxBytes: 10 * 1024 * 1024,
+  sourceMapSegmentMaxChars: 1024,
+  envelopeItemsMax: 100
+};
+var BUFFER_LIMITS = {
+  queueInlineMaxBytes: 100 * 1024,
+  maxAgeDays: 14,
+  nodeMaxBytes: 8 * 1024 ** 3,
+  alertRatio: 0.8,
+  alertInflowPerSecond: 5000
+};
+var RELAY_LIMITS = {
+  chunkBytes: 512 * 1024,
+  maxInflightMessages: 4,
+  maxInflightBytes: 24 * 1024 * 1024,
+  clockSkewSeconds: 60,
+  nonceMemorySeconds: 600,
+  ackTimeoutMs: 2000,
+  heartbeatSeconds: 30,
+  reconnectMaxSeconds: 30
+};
+
+// ../src/shared/contracts/signed-message.ts
 var nodeIdSchema = z15.guid();
 var signedEnvelopeSchema = z15.object({
   node_id: nodeIdSchema,
@@ -3089,154 +3129,504 @@ var MONITOR_OPERATIONS = [
 ];
 
 // ../src/shared/contracts/api-ops/node-data.ts
+import { z as z23 } from "zod";
+
+// ../src/shared/contracts/release-health.ts
+import { z as z21 } from "zod";
+
+// ../src/shared/contracts/sourcemaps.ts
 import { z as z20 } from "zod";
-var issueId = z20.number().int().positive();
-var csv = z20.string().min(1).max(2000);
-var name2 = z20.string().min(1).max(256);
-var period = z20.enum(["1h", "24h", "7d", "14d", "30d"]);
-var nodeCursor = z20.string().min(1).max(600).optional();
+var UPLOAD_LIMITS = {
+  requestMaxBytes: RELAY_LIMITS.maxInflightBytes - 512 * 1024,
+  tarMaxBytes: 64 * 1024 * 1024,
+  fileMaxBytes: INGEST_LIMITS.sourceMapMaxBytes,
+  filesMax: 1000,
+  requestsPerHour: 60,
+  retentionDays: 90
+};
+var UPLOAD_SCOPES = ["sourcemaps:write", "releases:write"];
+var UPLOAD_TOKEN_PATTERN = /^blv_sm_[A-Za-z0-9_-]{43}$/;
+var tokenHashSchema = z20.string().regex(/^[a-f0-9]{64}$/);
+var uploadTokenConfigSchema = z20.object({
+  v: z20.literal(1),
+  project_id: z20.number().int().positive(),
+  project_public_id: z20.number().int().positive(),
+  node_id: nodeIdSchema,
+  workspace_id: z20.guid(),
+  scopes: z20.array(z20.enum(UPLOAD_SCOPES)).min(1).max(4),
+  expires_at: z20.string().datetime(),
+  is_active: z20.boolean()
+});
+var releaseNameSchema = z20.string().min(1).max(200).regex(/^[^\s/\\\u0000-\u001f\u007f]+$/);
+var SENTRY_COMPAT = {
+  apiRoot: "/api/0",
+  chunkSize: 2 * 1024 * 1024,
+  chunksPerRequest: 3,
+  maxRequestSize: 7 * 1024 * 1024,
+  maxFileSize: 64 * 1024 * 1024,
+  maxBundleEntries: 4000,
+  concurrency: 1,
+  maxWaitSeconds: 60,
+  chunkBytesPerHour: 1024 * 1024 * 1024,
+  pendingBytesPerProject: 128 * 1024 * 1024,
+  pendingTtlMs: 60 * 60 * 1000
+};
+var sha1HexSchema = z20.string().regex(/^[0-9a-f]{40}$/);
+var assembleRequestSchema = z20.object({
+  checksum: sha1HexSchema,
+  chunks: z20.array(sha1HexSchema).max(Math.ceil(SENTRY_COMPAT.maxFileSize / SENTRY_COMPAT.chunkSize)),
+  projects: z20.array(z20.string().max(200)).max(50).optional(),
+  version: releaseNameSchema.optional(),
+  dist: z20.string().max(64).regex(/^[A-Za-z0-9._-]*$/).optional()
+});
+var assembleResponseSchema = z20.object({
+  state: z20.enum(["ok", "created", "assembling", "not_found", "error"]),
+  missingChunks: z20.array(sha1HexSchema),
+  detail: z20.string().max(200).nullable()
+});
+var uploadHeaderSchema = z20.object({
+  id: z20.string().regex(/^[A-Za-z0-9_-]{8,64}$/),
+  project_id: z20.number().int().positive(),
+  release: releaseNameSchema.optional(),
+  dist: z20.string().max(64).regex(/^[A-Za-z0-9._-]*$/).optional(),
+  token: z20.string().regex(UPLOAD_TOKEN_PATTERN),
+  content_encoding: z20.enum(["identity", "gzip"]),
+  op: z20.enum(["tar", "chunks", "assemble", "release"]).optional(),
+  chunks: z20.array(z20.object({
+    sha1: sha1HexSchema,
+    size: z20.number().int().positive().max(SENTRY_COMPAT.chunkSize)
+  })).max(SENTRY_COMPAT.chunksPerRequest).optional()
+});
+var uploadResultSchema = z20.object({
+  accepted: z20.array(z20.object({ file: z20.string().max(200), debug_id: z20.guid(), size: z20.number().int() })).max(UPLOAD_LIMITS.filesMax),
+  skipped: z20.array(z20.object({
+    file: z20.string().max(200),
+    reason: z20.enum([
+      "not_a_map",
+      "no_debug_id",
+      "too_large",
+      "invalid_json",
+      "unsupported",
+      "bad_name"
+    ])
+  })).max(UPLOAD_LIMITS.filesMax)
+});
+
+// ../src/shared/contracts/release-health.ts
+var RELEASE_HEALTH = {
+  verifyHours: 24,
+  windowHours: 24,
+  increaseFactor: 2,
+  increaseMinEvents: 10,
+  listMax: 50,
+  candidatesMax: 500,
+  releasesMax: 50,
+  commitsMax: 1000,
+  deploysMax: 50,
+  memoryReleasesMax: 5000,
+  memoryDeploysMax: 1e4,
+  requestsPerHour: 600,
+  bodyMaxBytes: 4 * 1024 * 1024,
+  fixLookbackDays: 30
+};
+var FIX_STATUSES = ["fixed", "not_fixed", "unverified", "unknown"];
+var FIX_REASONS = [
+  "verified",
+  "event_in_release",
+  "regressed",
+  "order_unknown",
+  "not_deployed",
+  "no_deploy_marker",
+  "not_running",
+  "too_early"
+];
+var RESOLUTION_MODES = ["now", "next_release", "in_release"];
+var RELEASE_SOURCES = ["cli", "api", "sdk"];
+var environmentNameSchema = z21.string().trim().regex(ENVIRONMENT_RE).refine((v) => !/[\s/]/.test(v));
+var isoTime = z21.string().datetime({ offset: true });
+var httpUrl = z21.string().max(500).refine((v) => /^https?:\/\/[^\s]+$/i.test(v), "http(s) URL");
+var DEPLOY_ID_RE = /^[A-Za-z0-9_.:-]{1,64}$/;
+var commitShaSchema = z21.string().regex(/^[0-9A-Za-z._-]{4,64}$/);
+var repoNameSchema = z21.string().min(1).max(200).regex(/^[^\u0000-\u001f\u007f]+$/);
+var deploymentInputSchema = z21.object({
+  version: releaseNameSchema,
+  environment: environmentNameSchema,
+  name: z21.string().trim().min(1).max(200).optional(),
+  url: httpUrl.optional(),
+  started_at: isoTime.optional(),
+  finished_at: isoTime.optional(),
+  deploy_id: z21.string().regex(DEPLOY_ID_RE).optional()
+});
+var commitSchema = z21.object({ sha: commitShaSchema, repo: repoNameSchema.optional() });
+var releaseRelaySchema = z21.discriminatedUnion("action", [
+  z21.object({
+    action: z21.literal("create"),
+    version: releaseNameSchema,
+    date_released: isoTime.optional(),
+    commits: z21.array(commitSchema).max(RELEASE_HEALTH.commitsMax).optional()
+  }),
+  z21.object({
+    action: z21.literal("update"),
+    version: releaseNameSchema,
+    date_released: isoTime.optional(),
+    commits: z21.array(commitSchema).max(RELEASE_HEALTH.commitsMax).optional()
+  }),
+  z21.object({ action: z21.literal("get"), version: releaseNameSchema }),
+  z21.object({ action: z21.literal("list") }),
+  z21.object({ action: z21.literal("previous"), version: releaseNameSchema }),
+  z21.object({ action: z21.literal("deploy"), deploy: deploymentInputSchema }),
+  z21.object({ action: z21.literal("deploys"), version: releaseNameSchema })
+]);
+var cliCommit = z21.object({ id: z21.string().max(200), repository: z21.string().max(400).nullish() }).passthrough();
+var cliRef = z21.object({
+  repository: z21.string().max(400),
+  commit: z21.string().max(200),
+  previousCommit: z21.string().max(200).nullish()
+}).passthrough();
+var cliReleaseCreateSchema = z21.object({
+  version: releaseNameSchema,
+  projects: z21.array(z21.string().max(200)).max(50).optional(),
+  dateReleased: isoTime.nullish(),
+  dateStarted: isoTime.nullish(),
+  refs: z21.array(cliRef).max(100).optional(),
+  commits: z21.array(cliCommit).max(1e4).optional()
+}).passthrough();
+var cliReleaseUpdateSchema = cliReleaseCreateSchema.omit({ version: true }).extend({ version: releaseNameSchema.optional() });
+var cliDeployCreateSchema = z21.object({
+  environment: z21.string().max(64),
+  name: z21.string().max(200).nullish(),
+  url: z21.string().max(500).nullish(),
+  dateStarted: isoTime.nullish(),
+  dateFinished: isoTime.nullish()
+}).passthrough();
+var iso5 = z21.string();
+var releaseRowSchema = z21.object({
+  version: z21.string(),
+  source: z21.enum(RELEASE_SOURCES),
+  environment: z21.string().nullable(),
+  created_at: iso5.nullable(),
+  date_released: iso5.nullable(),
+  deployed_at: iso5.nullable(),
+  last_deploy_at: iso5.nullable(),
+  deploys: z21.number().int(),
+  first_seen: iso5.nullable(),
+  last_seen: iso5.nullable(),
+  commit_count: z21.number().int(),
+  events: z21.number().int(),
+  events_per_hour: z21.number(),
+  previous: z21.string().nullable(),
+  previous_events_per_hour: z21.number().nullable(),
+  new_issues: z21.number().int(),
+  regressed_issues: z21.number().int(),
+  increased_issues: z21.number().int()
+});
+var releaseListSchema = z21.object({
+  releases: z21.array(releaseRowSchema),
+  environments: z21.array(z21.string()),
+  environment: z21.string().nullable(),
+  has_deploy_markers: z21.boolean()
+});
+var healthIssueSchema = z21.object({
+  issue_id: z21.number().int(),
+  short_id: z21.string(),
+  title: z21.string(),
+  culprit: z21.string(),
+  level: z21.string(),
+  status: z21.string(),
+  events: z21.number().int(),
+  previous_events: z21.number().int(),
+  first_seen: iso5.nullable(),
+  sparkline: z21.array(z21.number().int())
+});
+var deploymentRowSchema = z21.object({
+  deploy_id: z21.string(),
+  version: z21.string(),
+  environment: z21.string(),
+  name: z21.string().nullable(),
+  url: z21.string().nullable(),
+  started_at: iso5,
+  finished_at: iso5,
+  source: z21.enum(RELEASE_SOURCES)
+});
+var releaseHealthSchema = z21.object({
+  release: releaseRowSchema,
+  compare: z21.string().nullable(),
+  window: z21.object({
+    start: iso5.nullable(),
+    end: iso5.nullable(),
+    hours: z21.number(),
+    from_deploy: z21.boolean()
+  }),
+  new: z21.array(healthIssueSchema),
+  regressed: z21.array(healthIssueSchema),
+  increased: z21.array(healthIssueSchema),
+  deploys: z21.array(deploymentRowSchema),
+  commits: z21.array(commitSchema),
+  truncated: z21.boolean()
+});
+var fixEnvSchema = z21.object({
+  environment: z21.string(),
+  status: z21.enum(FIX_STATUSES),
+  reason: z21.enum(FIX_REASONS),
+  target: z21.string().nullable(),
+  target_deployed_at: iso5.nullable(),
+  release: z21.string().nullable(),
+  first_seen: iso5.nullable(),
+  observed_hours: z21.number().nullable()
+});
+var fixStatusSchema = z21.object({
+  issue_id: z21.number().int(),
+  resolution: z21.object({
+    mode: z21.enum(RESOLUTION_MODES),
+    resolved_at: iso5,
+    release: z21.string().nullable(),
+    regressed: z21.boolean()
+  }).nullable(),
+  status: z21.enum(FIX_STATUSES).nullable(),
+  environments: z21.array(fixEnvSchema),
+  verify_hours: z21.number()
+});
+
+// ../src/shared/contracts/web-vitals.ts
+import { z as z22 } from "zod";
+
+// ../src/shared/contracts/vocab/web-vitals.ts
+var WEB_VITAL_NAMES = ["LCP", "INP", "CLS", "FCP", "TTFB"];
+var WEB_VITAL_RATINGS = ["good", "needs-improvement", "poor"];
+var WEB_VITAL_PATH_MAX_CHARS = 200;
+
+// ../src/shared/contracts/web-vitals.ts
+var WEB_VITAL_LIMITS = {
+  routesMax: 200,
+  routesShown: 20,
+  attributionShown: 10,
+  estimateBelow: 100,
+  defaultSampleRate: 0.1,
+  targetMaxChars: 100,
+  pathMaxChars: WEB_VITAL_PATH_MAX_CHARS,
+  maxWindowMs: 7 * 24 * 3600 * 1000,
+  defaultWindowMs: 24 * 3600 * 1000
+};
+var ratingCounts = z22.object({
+  good: z22.number().int().nonnegative(),
+  needs_improvement: z22.number().int().nonnegative(),
+  poor: z22.number().int().nonnegative()
+});
+var webVitalSummarySchema = z22.object({
+  name: z22.enum(WEB_VITAL_NAMES),
+  metric: z22.string(),
+  unit: z22.enum(["ms", "1"]),
+  samples: z22.number().int().nonnegative(),
+  p75: z22.number().nullable(),
+  rating: z22.enum(WEB_VITAL_RATINGS).nullable(),
+  estimate: z22.boolean(),
+  ratings: ratingCounts,
+  distribution: z22.array(z22.object({ le: z22.number().nullable(), count: z22.number().int().nonnegative() })),
+  routes: z22.array(z22.object({
+    path: z22.string(),
+    samples: z22.number().int().nonnegative(),
+    p75: z22.number().nullable(),
+    rating: z22.enum(WEB_VITAL_RATINGS).nullable()
+  })),
+  routes_total: z22.number().int().nonnegative(),
+  attribution: z22.array(z22.object({ target: z22.string(), samples: z22.number().int().nonnegative(), p75: z22.number().nullable() }))
+});
+var webVitalsSummarySchema = z22.object({
+  from: z22.string(),
+  to: z22.string(),
+  path: z22.string().nullable(),
+  vitals: z22.array(webVitalSummarySchema),
+  complete: z22.boolean()
+});
+
+// ../src/shared/contracts/api-ops/node-data.ts
+var issueId = z23.number().int().positive();
+var csv = z23.string().min(1).max(2000);
+var projectIds2 = z23.string().max(2000).regex(/^[1-9][0-9]{0,15}(?:,[1-9][0-9]{0,15}){0,99}$/, "comma-separated project ids");
+var name2 = z23.string().min(1).max(256);
+var period = z23.enum(["1h", "24h", "7d", "14d", "30d"]);
+var nodeCursor = z23.string().min(1).max(600).optional();
 var windowFields = {
-  start: z20.string().max(40).optional(),
-  end: z20.string().max(40).optional()
+  start: z23.string().max(40).optional(),
+  end: z23.string().max(40).optional()
 };
-var traceId = z20.string().regex(/^[0-9a-fA-F]{32}$/);
-var spanId = z20.string().regex(/^[0-9a-fA-F]{16}$/);
-var attrs = z20.string().max(2000).optional();
+var traceId = z23.string().regex(/^[0-9a-fA-F]{32}$/);
+var spanId = z23.string().regex(/^[0-9a-fA-F]{16}$/);
+var attrs = z23.string().max(2000).optional();
 var telemetryCommon = {
   ...windowFields,
-  project: csv.optional(),
+  project: projectIds2.optional(),
   environment: csv.optional(),
   service: csv.optional(),
   attrs
 };
-var issueChange = z20.union([
-  z20.object({ action: z20.literal("resolve"), inNextRelease: z20.boolean().optional() }),
-  z20.object({ action: z20.literal("unresolve") }),
-  z20.object({ action: z20.literal("archive"), mode: z20.enum(["until_escalating", "forever"]) }),
-  z20.object({
-    action: z20.literal("archive"),
-    mode: z20.literal("until_condition"),
-    events: z20.number().int().min(1).max(1e6).optional(),
-    users: z20.number().int().min(1).max(1e5).optional(),
-    until: z20.string().datetime().optional()
-  }),
-  z20.object({ action: z20.literal("assign"), userId: z20.guid().nullable() }),
-  z20.object({ action: z20.literal("priority"), priority: z20.enum(["low", "medium", "high"]) })
+var issueChange = z23.union([
+  z23.object({
+    action: z23.literal("resolve"),
+    inNextRelease: z23.boolean().optional(),
+    inRelease: releaseNameSchema.optional()
+  }),
+  z23.object({ action: z23.literal("unresolve") }),
+  z23.object({ action: z23.literal("archive"), mode: z23.enum(["until_escalating", "forever"]) }),
+  z23.object({
+    action: z23.literal("archive"),
+    mode: z23.literal("until_condition"),
+    events: z23.number().int().min(1).max(1e6).optional(),
+    users: z23.number().int().min(1).max(1e5).optional(),
+    until: z23.string().datetime().optional()
+  }),
+  z23.object({ action: z23.literal("assign"), userId: z23.guid().nullable() }),
+  z23.object({ action: z23.literal("priority"), priority: z23.enum(["low", "medium", "high"]) })
 ]);
 var NODE_INPUTS = {
-  issuesList: z20.object({
-    project: csv.optional(),
-    status: z20.enum(["unresolved", "resolved", "archived", "all"]).optional(),
+  issuesList: z23.object({
+    project: projectIds2.optional(),
+    status: z23.enum(["unresolved", "resolved", "archived", "all"]).optional(),
     level: csv.optional(),
     priority: csv.optional(),
     environment: csv.optional(),
     release: csv.optional(),
-    assignee: z20.string().max(64).optional(),
+    assignee: z23.string().max(64).optional(),
     period: period.optional(),
-    q: z20.string().max(200).optional(),
-    sort: z20.enum(["last_seen", "first_seen", "events", "users", "priority"]).optional(),
+    q: z23.string().max(200).optional(),
+    sort: z23.enum(["last_seen", "first_seen", "events", "users", "priority"]).optional(),
     cursor: nodeCursor,
-    limit: z20.number().int().min(1).max(100).optional()
+    limit: z23.number().int().min(1).max(100).optional()
   }),
-  issue: z20.object({ issueId }),
-  issueStats: z20.object({ issueId, range: z20.enum(["24h", "30d"]).optional() }),
-  issueEvents: z20.object({ issueId, cursor: nodeCursor }),
-  issueEvent: z20.object({
+  issue: z23.object({ issueId }),
+  issueStats: z23.object({ issueId, range: z23.enum(["24h", "30d"]).optional() }),
+  issueEvents: z23.object({ issueId, cursor: nodeCursor }),
+  issueEvent: z23.object({
     issueId,
-    eventId: z20.string().regex(/^([0-9a-f]{32}|latest|oldest)$/)
+    eventId: z23.string().regex(/^([0-9a-f]{32}|latest|oldest)$/)
   }),
-  issueUpdate: z20.object({ issueId, change: issueChange }),
-  issuesBulk: z20.object({
-    issueIds: z20.array(issueId).min(1).max(100),
+  issueUpdate: z23.object({ issueId, change: issueChange }),
+  issuesBulk: z23.object({
+    issueIds: z23.array(issueId).min(1).max(100),
     action: issueChange
   }),
-  spansList: z20.object({
+  spansList: z23.object({
     ...telemetryCommon,
-    operation: z20.string().min(1).max(1024).optional(),
-    status: z20.enum(["unset", "ok", "error"]).optional(),
-    kind: z20.enum(["internal", "server", "client", "producer", "consumer"]).optional(),
-    minDurationMs: z20.number().min(0).max(86400000).optional(),
-    maxDurationMs: z20.number().min(0).max(86400000).optional(),
-    mode: z20.enum(["spans", "traces"]).optional(),
+    operation: z23.string().min(1).max(1024).optional(),
+    status: z23.enum(["unset", "ok", "error"]).optional(),
+    kind: z23.enum(["internal", "server", "client", "producer", "consumer"]).optional(),
+    minDurationMs: z23.number().min(0).max(86400000).optional(),
+    maxDurationMs: z23.number().min(0).max(86400000).optional(),
+    mode: z23.enum(["spans", "traces"]).optional(),
     cursor: nodeCursor
   }),
-  spansHistogram: z20.object({
+  spansHistogram: z23.object({
     ...telemetryCommon,
-    operation: z20.string().min(1).max(1024).optional(),
-    status: z20.enum(["unset", "ok", "error"]).optional()
+    operation: z23.string().min(1).max(1024).optional(),
+    status: z23.enum(["unset", "ok", "error"]).optional()
   }),
-  trace: z20.object({ traceId }),
-  traceSpans: z20.object({ traceId, errorsOnly: z20.enum(["1"]).optional(), ...windowFields }),
-  span: z20.object({ traceId, spanId, ...windowFields }),
-  logsList: z20.object({
+  trace: z23.object({ traceId }),
+  traceSpans: z23.object({ traceId, errorsOnly: z23.enum(["1"]).optional(), ...windowFields }),
+  span: z23.object({ traceId, spanId, ...windowFields }),
+  logsList: z23.object({
     ...telemetryCommon,
-    severityMin: z20.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
+    severityMin: z23.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
     traceId: traceId.optional(),
     spanId: spanId.optional(),
-    q: z20.string().max(500).optional(),
-    order: z20.enum(["asc", "desc"]).optional(),
+    q: z23.string().max(500).optional(),
+    order: z23.enum(["asc", "desc"]).optional(),
     cursor: nodeCursor
   }),
-  logsFacets: z20.object({
+  logsFacets: z23.object({
     ...telemetryCommon,
-    severityMin: z20.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
-    q: z20.string().max(500).optional()
-  }),
-  logAround: z20.object({
-    logId: name2,
-    at: z20.string().max(40),
-    same: z20.enum(["service", "trace"]).optional(),
-    before: z20.number().int().min(0).max(200).optional(),
-    after: z20.number().int().min(0).max(200).optional()
-  }),
-  metricsNames: z20.object({
-    project: z20.number().int().positive(),
+    severityMin: z23.enum(["trace", "debug", "info", "warn", "error", "fatal"]).optional(),
+    q: z23.string().max(500).optional()
+  }),
+  logAround: z23.object({
+    logId: z23.guid(),
+    at: z23.string().max(40),
+    same: z23.enum(["service", "trace"]).optional(),
+    before: z23.number().int().min(0).max(200).optional(),
+    after: z23.number().int().min(0).max(200).optional()
+  }),
+  metricsNames: z23.object({
+    project: z23.number().int().positive(),
     environment: csv.optional(),
-    q: z20.string().max(255).optional()
+    q: z23.string().max(255).optional()
   }),
-  metricsSeries: z20.object({
-    project: z20.number().int().positive(),
-    name: z20.string().regex(METRIC_NAME_RE),
+  metricsSeries: z23.object({
+    project: z23.number().int().positive(),
+    name: z23.string().regex(METRIC_NAME_RE),
     environment: csv.optional(),
     attrs,
-    cursor: z20.string().regex(/^[0-9a-f]{16}$/).optional()
+    cursor: z23.string().regex(/^[0-9a-f]{16}$/).optional()
   }),
-  metricsQuery: z20.object({
-    project: z20.number().int().positive(),
-    name: z20.string().regex(METRIC_NAME_RE),
-    aggregation: z20.enum(METRIC_AGGREGATIONS),
+  metricsQuery: z23.object({
+    project: z23.number().int().positive(),
+    name: z23.string().regex(METRIC_NAME_RE),
+    aggregation: z23.enum(METRIC_AGGREGATIONS),
     ...windowFields,
-    step: z20.number().int().min(METRIC_QUERY.minStepSeconds).max(METRIC_QUERY.maxStepSeconds).multipleOf(60).optional(),
+    step: z23.number().int().min(METRIC_QUERY.minStepSeconds).max(METRIC_QUERY.maxStepSeconds).multipleOf(60).optional(),
     attrs,
-    groupBy: z20.string().min(1).max(600).optional(),
+    groupBy: z23.string().min(1).max(600).optional(),
     environment: csv.optional()
   }),
-  telemetryUsage: z20.object({ project: csv.optional(), days: z20.number().int().min(1).max(31).optional() }),
-  monitorSignal: z20.object({ monitorId: z20.guid(), hours: z20.number().int().min(1).max(24).optional() }),
-  monitorOccurrences: z20.object({
-    monitorId: z20.guid(),
-    state: z20.enum(["open", "finished", "all"]).optional(),
-    environment: z20.string().min(1).max(64).optional(),
+  telemetryUsage: z23.object({
+    project: projectIds2.optional(),
+    days: z23.number().int().min(1).max(31).optional()
+  }),
+  monitorSignal: z23.object({
+    monitorId: z23.guid(),
+    hours: z23.number().int().min(1).max(24).optional()
+  }),
+  monitorOccurrences: z23.object({
+    monitorId: z23.guid(),
+    state: z23.enum(["open", "finished", "all"]).optional(),
+    environment: z23.string().min(1).max(64).optional(),
     cursor: nodeCursor
   }),
-  monitorBacktest: z20.object({ project: z20.number().int().positive(), settings: backtestSettingsSchema }),
-  occurrenceCreate: z20.object({
-    project: z20.number().int().positive(),
+  monitorBacktest: z23.object({
+    project: z23.number().int().positive(),
+    settings: backtestSettingsSchema
+  }),
+  occurrenceCreate: z23.object({
+    project: z23.number().int().positive(),
     monitorSlug: occurrenceInputSchema.shape.monitor_slug,
     occurrenceId: occurrenceInputSchema.shape.occurrence_id,
     dueAt: occurrenceInputSchema.shape.due_at,
     environment: occurrenceInputSchema.shape.environment
   }),
-  occurrenceCancel: z20.object({
-    project: z20.number().int().positive(),
-    monitorSlug: z20.string().regex(SLUG_RE),
-    occurrenceId: z20.string().regex(OCCURRENCE_ID_RE),
-    environment: z20.string().min(1).max(64).optional()
+  occurrenceCancel: z23.object({
+    project: z23.number().int().positive(),
+    monitorSlug: z23.string().regex(SLUG_RE),
+    occurrenceId: z23.string().regex(OCCURRENCE_ID_RE),
+    environment: z23.string().min(1).max(64).optional()
   }),
-  ticket: z20.object({
-    scope: z20.enum(["read", "write"]).default("read"),
-    project: z20.number().int().positive().optional(),
-    environment: z20.string().min(1).max(64).optional()
+  webVitals: z23.object({
+    project: z23.number().int().positive(),
+    ...windowFields,
+    environment: csv.optional(),
+    path: z23.string().max(WEB_VITAL_LIMITS.pathMaxChars).regex(/^(?:\/[^\s?#]*|other)$/).optional()
+  }),
+  releasesList: z23.object({
+    project: z23.number().int().positive(),
+    environment: environmentNameSchema.optional()
+  }),
+  releaseHealth: z23.object({
+    project: z23.number().int().positive(),
+    version: releaseNameSchema,
+    environment: environmentNameSchema.optional(),
+    compare: releaseNameSchema.optional()
+  }),
+  deploymentCreate: z23.object({
+    project: z23.number().int().positive(),
+    version: deploymentInputSchema.shape.version,
+    environment: deploymentInputSchema.shape.environment,
+    name: deploymentInputSchema.shape.name,
+    url: deploymentInputSchema.shape.url,
+    startedAt: deploymentInputSchema.shape.started_at,
+    finishedAt: deploymentInputSchema.shape.finished_at,
+    deployId: deploymentInputSchema.shape.deploy_id
+  }),
+  ticket: z23.object({
+    scope: z23.enum(["read", "write"]).default("read"),
+    project: z23.number().int().positive().optional(),
+    environment: z23.string().min(1).max(64).optional()
   })
 };
 var N = NODE_INPUTS;
@@ -3424,7 +3814,54 @@ var NODE_OPERATIONS = [
     scope: "metrics:read",
     input: N.metricsQuery,
     node: { path: "q/metrics/query", window: true },
-    summary: "One metric aggregated per step (avg, sum, min, max, count, rate, p50–p99) in a window of at most 7 days, optionally grouped by up to two attributes (≤ 50 groups, ≤ 10,000 points), with exemplar trace ids."
+    summary: "One metric aggregated per step (avg, sum, min, max, count, rate, p50, p75, p90, p95, p99) in a window of at most 7 days, optionally grouped by up to two attributes (≤ 50 groups, ≤ 10,000 points), with exemplar trace ids."
+  }),
+  op({
+    ...read,
+    id: "metrics.web_vitals",
+    path: "/v1/projects/{project}/web-vitals",
+    scope: "metrics:read",
+    input: N.webVitals,
+    node: { path: "q/metrics/web-vitals", window: true },
+    summary: "Core Web Vitals of real users (LCP, INP, CLS, FCP, TTFB) in a window of at most 7 days: samples, p75 with its web.dev rating, samples per rating, the distribution, the busiest routes and the elements behind slow samples. Optionally one route. Needs browser SDK `webVitals` and node agent 0.1.40."
+  }),
+  op({
+    ...read,
+    id: "releases.list",
+    path: "/v1/projects/{project}/releases",
+    scope: "releases:read",
+    input: N.releasesList,
+    node: { path: "q/releases" },
+    summary: "Releases of one project in one environment, newest first by deploy order (else version order): first and last deploy, events, issues, and the counts of new, regressed and increased issues in each release's first 24 hours."
+  }),
+  op({
+    ...read,
+    id: "releases.health",
+    path: "/v1/projects/{project}/releases/{version}/health",
+    scope: "releases:read",
+    input: N.releaseHealth,
+    node: { path: "q/releases/health" },
+    summary: "One release in one environment against the previous one (or `compare`): new, regressed and increased issues in its first 24 hours (≤ 50 each, with hourly sparklines) and its deploy markers."
+  }),
+  op({
+    ...read,
+    id: "issues.fix_status",
+    path: "/v1/issues/{issue_id}/fix-status",
+    scope: "releases:read",
+    input: N.issue,
+    node: { path: "q/issues/{issue_id}/fix-status" },
+    summary: "Whether a resolved issue is fixed in each environment it occurred in: fixed (a deploy of the target release and 24 h of its signals without the error), unverified, not fixed (with the event that broke it) or unknown; null while unresolved."
+  }),
+  op({
+    ...read,
+    id: "deployments.create",
+    method: "POST",
+    path: "/v1/projects/{project}/deployments",
+    scope: "releases:write",
+    input: N.deploymentCreate,
+    node: { path: "w/releases/deployments", body: "*" },
+    mcp: "configure",
+    summary: "Record that a release was deployed to an environment (a deploy marker for CI without sentry-cli). Answers the marker and `created`; the same `deploy_id` again changes nothing (`created: false`)."
   }),
   op({
     ...read,
@@ -3526,10 +3963,10 @@ var NODE_OPERATIONS = [
 ];
 
 // ../src/shared/contracts/api-ops/privacy.ts
-import { z as z22 } from "zod";
+import { z as z25 } from "zod";
 
 // ../src/shared/contracts/privacy.ts
-import { z as z21 } from "zod";
+import { z as z24 } from "zod";
 
 // ../src/shared/privacy/rules.ts
 var PRIVACY_SCHEMA = 1;
@@ -3559,44 +3996,47 @@ var IPV6_RE = new RegExp(`(^|[^0-9A-Fa-f:])((?:${H}:){7}${H}|(?:${H}:){1,6}:(?:$
 var REMOVE = Symbol("remove");
 
 // ../src/shared/contracts/privacy.ts
-var ruleId = z21.string().regex(/^[A-Za-z0-9_-]{1,64}$/);
-var privacyRuleInputSchema = z21.object({
+var PRIVACY_KEY_MAX_VERSION = 1e6;
+var ruleId = z24.string().regex(/^[A-Za-z0-9_-]{1,64}$/);
+var privacyRuleInputSchema = z24.object({
   id: ruleId,
-  selector: z21.string().min(1).max(PRIVACY_LIMITS.selector),
-  type: z21.enum(PRIVACY_RULE_TYPES),
-  method: z21.enum(PRIVACY_METHODS),
-  pattern: z21.string().min(1).max(PRIVACY_LIMITS.pattern).optional(),
-  ignoreCase: z21.boolean().optional(),
-  replaceWith: z21.string().max(PRIVACY_LIMITS.replaceWith).optional(),
-  enabled: z21.boolean().optional()
+  selector: z24.string().min(1).max(PRIVACY_LIMITS.selector),
+  type: z24.enum(PRIVACY_RULE_TYPES),
+  method: z24.enum(PRIVACY_METHODS),
+  pattern: z24.string().min(1).max(PRIVACY_LIMITS.pattern).optional(),
+  ignoreCase: z24.boolean().optional(),
+  replaceWith: z24.string().max(PRIVACY_LIMITS.replaceWith).optional(),
+  enabled: z24.boolean().optional()
 });
-var privacyPolicyInputSchema = z21.object({
-  mode: z21.enum(PRIVACY_MODES),
-  rules: z21.array(privacyRuleInputSchema).max(PRIVACY_LIMITS.rules),
-  allowlist: z21.array(z21.string().min(1).max(PRIVACY_LIMITS.selector)).max(PRIVACY_LIMITS.allowlist)
+var privacyPolicyInputSchema = z24.object({
+  mode: z24.enum(PRIVACY_MODES),
+  rules: z24.array(privacyRuleInputSchema).max(PRIVACY_LIMITS.rules),
+  allowlist: z24.array(z24.string().min(1).max(PRIVACY_LIMITS.selector)).max(PRIVACY_LIMITS.allowlist)
 });
-var storedPolicySchema = z21.object({
-  schema: z21.literal(PRIVACY_SCHEMA),
-  version: z21.number().int().min(0),
-  mode: z21.enum(PRIVACY_MODES),
-  rules: z21.array(z21.record(z21.string(), z21.unknown())).max(PRIVACY_LIMITS.rules),
-  allowlist: z21.array(z21.string()).max(PRIVACY_LIMITS.allowlist)
+var storedPolicySchema = z24.object({
+  schema: z24.literal(PRIVACY_SCHEMA),
+  version: z24.number().int().min(0),
+  mode: z24.enum(PRIVACY_MODES),
+  rules: z24.array(z24.record(z24.string(), z24.unknown())).max(PRIVACY_LIMITS.rules),
+  allowlist: z24.array(z24.string()).max(PRIVACY_LIMITS.allowlist)
 });
-var nodePrivacyBlockSchema = z21.array(z21.object({ project_id: z21.number().int().positive(), policy: z21.unknown() })).max(1000);
-var privacyRollupSchema = z21.object({
-  applied_version: z21.number().int().min(0).nullable(),
-  policy_missing_24h: z21.number().int().nonnegative(),
-  budget_exceeded_24h: z21.number().int().nonnegative(),
-  sdk_versions: z21.array(z21.object({ version: z21.number().int().min(0), last_seen_at: z21.string().datetime() })).max(5)
+var nodePrivacyBlockSchema = z24.array(z24.object({ project_id: z24.number().int().positive(), policy: z24.unknown() })).max(1000);
+var privacyRollupSchema = z24.object({
+  applied_version: z24.number().int().min(0).nullable(),
+  policy_missing_24h: z24.number().int().nonnegative(),
+  budget_exceeded_24h: z24.number().int().nonnegative(),
+  sdk_versions: z24.array(z24.object({ version: z24.number().int().min(0), last_seen_at: z24.string().datetime() })).max(5),
+  key_version: z24.number().int().min(1).max(PRIVACY_KEY_MAX_VERSION).optional(),
+  key_created_at: z24.string().datetime().nullable().optional()
 });
 
 // ../src/shared/contracts/api-ops/privacy.ts
 var PRIVACY_INPUTS = {
-  get: z22.object({ workspaceId: uuid, projectId }),
-  set: z22.object({
+  get: z25.object({ workspaceId: uuid, projectId }),
+  set: z25.object({
     workspaceId: uuid,
     projectId,
-    expectedVersion: z22.number().int().min(0),
+    expectedVersion: z25.number().int().min(0),
     policy: privacyPolicyInputSchema
   })
 };
@@ -3614,7 +4054,7 @@ var PRIVACY_OPERATIONS = [
     workspace: true,
     idempotency: "none",
     mcp: "configure",
-    summary: "A project's privacy policy (mode, rules, strict allowlist, version), the built-in detectors that are off, whether user ids are pseudonymised, the last 20 versions and what the node applies and counted in the last 24 h.",
+    summary: "A project's privacy policy (mode, rules, strict allowlist, version), the built-in detectors that are off, whether user ids are pseudonymised, the pseudonymisation key version (never the key), the last 20 versions and what the node applies, hashes with and counted in the last 24 h.",
     ui: []
   }),
   op({
@@ -3636,10 +4076,10 @@ var PRIVACY_OPERATIONS = [
 ];
 
 // ../src/shared/contracts/api-ops/projects.ts
-import { z as z26 } from "zod";
+import { z as z29 } from "zod";
 
 // ../src/shared/contracts/ingest-keys.ts
-import { z as z23 } from "zod";
+import { z as z26 } from "zod";
 var INGEST_KEY_SCOPES = ["traces", "logs", "metrics", "errors", "monitors"];
 var INGEST_KEY_STATES = ["active", "revoked"];
 var INGEST_KEY_LIMITS = {
@@ -3649,92 +4089,92 @@ var INGEST_KEY_LIMITS = {
   edgeCacheSeconds: 60
 };
 var CHECKIN_AUTH_MODES = ["public_or_key", "key_only"];
-var ingestKeyConfigSchema = z23.object({
-  v: z23.literal(1),
-  key_id: z23.guid(),
-  project_public_id: z23.number().int().positive(),
-  project_id: z23.number().int().positive(),
-  workspace_id: z23.guid(),
+var ingestKeyConfigSchema = z26.object({
+  v: z26.literal(1),
+  key_id: z26.guid(),
+  project_public_id: z26.number().int().positive(),
+  project_id: z26.number().int().positive(),
+  workspace_id: z26.guid(),
   node_id: nodeIdSchema,
-  scopes: z23.array(z23.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
-  environments: z23.array(z23.string().max(INGEST_KEY_LIMITS.environmentMaxChars)).max(INGEST_KEY_LIMITS.environmentsMax),
-  expires_at: z23.string().datetime({ offset: true }).nullable(),
-  state: z23.enum(INGEST_KEY_STATES),
-  workspace_status: z23.enum(["active", "suspended", "deleting"]),
-  ingest_kill: z23.boolean(),
-  telemetry_kill: z23.boolean(),
-  telemetry_rate_bytes_per_sec: z23.number().int().positive(),
-  telemetry_burst_bytes: z23.number().int().positive(),
-  traces_monthly_bytes: z23.number().int().positive(),
-  logs_monthly_bytes: z23.number().int().positive(),
-  metrics_monthly_bytes: z23.number().int().positive().optional(),
-  telemetry_buffer_minutes: z23.number().int().min(1).max(1440),
-  revision: z23.number().int().nonnegative()
+  scopes: z26.array(z26.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
+  environments: z26.array(z26.string().max(INGEST_KEY_LIMITS.environmentMaxChars)).max(INGEST_KEY_LIMITS.environmentsMax),
+  expires_at: z26.string().datetime({ offset: true }).nullable(),
+  state: z26.enum(INGEST_KEY_STATES),
+  workspace_status: z26.enum(["active", "suspended", "deleting"]),
+  ingest_kill: z26.boolean(),
+  telemetry_kill: z26.boolean(),
+  telemetry_rate_bytes_per_sec: z26.number().int().positive(),
+  telemetry_burst_bytes: z26.number().int().positive(),
+  traces_monthly_bytes: z26.number().int().positive(),
+  logs_monthly_bytes: z26.number().int().positive(),
+  metrics_monthly_bytes: z26.number().int().positive().optional(),
+  telemetry_buffer_minutes: z26.number().int().min(1).max(1440),
+  revision: z26.number().int().nonnegative()
 });
-var createIngestKeyInputSchema = z23.object({
-  projectId: z23.number().int().positive(),
-  name: z23.string().trim().min(1).max(INGEST_KEY_LIMITS.nameMaxChars).refine((s) => !/[\u0000-\u001f\u007f]/.test(s)),
-  scopes: z23.array(z23.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
-  environments: z23.array(z23.string().trim().min(1).max(INGEST_KEY_LIMITS.environmentMaxChars).regex(/^[^\s/\u0000-\u001f]+$/)).max(INGEST_KEY_LIMITS.environmentsMax),
-  expiresAt: z23.string().datetime({ offset: true }).nullable()
+var createIngestKeyInputSchema = z26.object({
+  projectId: z26.number().int().positive(),
+  name: z26.string().trim().min(1).max(INGEST_KEY_LIMITS.nameMaxChars).refine((s) => !/[\u0000-\u001f\u007f]/.test(s)),
+  scopes: z26.array(z26.enum(INGEST_KEY_SCOPES)).min(1).max(INGEST_KEY_SCOPES.length),
+  environments: z26.array(z26.string().trim().min(1).max(INGEST_KEY_LIMITS.environmentMaxChars).regex(/^[^\s/\u0000-\u001f]+$/)).max(INGEST_KEY_LIMITS.environmentsMax),
+  expiresAt: z26.string().datetime({ offset: true }).nullable()
 });
-var ingestKeyRowSchema = z23.object({
-  id: z23.guid(),
-  project_id: z23.number().int().positive(),
-  name: z23.string(),
-  prefix: z23.string(),
-  scopes: z23.array(z23.enum(INGEST_KEY_SCOPES)),
-  environments: z23.array(z23.string()),
-  expires_at: z23.string().nullable(),
-  state: z23.enum(INGEST_KEY_STATES),
-  created_by: z23.guid().nullable(),
-  created_at: z23.string(),
-  revoked_at: z23.string().nullable(),
-  last_used_at: z23.string().nullable()
+var ingestKeyRowSchema = z26.object({
+  id: z26.guid(),
+  project_id: z26.number().int().positive(),
+  name: z26.string(),
+  prefix: z26.string(),
+  scopes: z26.array(z26.enum(INGEST_KEY_SCOPES)),
+  environments: z26.array(z26.string()),
+  expires_at: z26.string().nullable(),
+  state: z26.enum(INGEST_KEY_STATES),
+  created_by: z26.guid().nullable(),
+  created_at: z26.string(),
+  revoked_at: z26.string().nullable(),
+  last_used_at: z26.string().nullable()
 });
 
 // ../src/shared/contracts/node-config.ts
-import { z as z25 } from "zod";
+import { z as z28 } from "zod";
 
 // ../src/shared/contracts/backup.ts
-import { z as z24 } from "zod";
+import { z as z27 } from "zod";
 var BACKUP_KINDS = ["daily", "weekly", "manual", "pre_upgrade"];
-var ageRecipient = z24.string().regex(/^age1[02-9ac-hj-np-z]{58}$/);
-var backupIdSchema = z24.string().regex(/^[a-z0-9-]{8,64}$/);
-var nodeBackupConfigSchema = z24.object({
-  enabled: z24.boolean(),
-  hour_utc: z24.number().int().min(0).max(23),
-  weekly_day: z24.number().int().min(1).max(7),
+var ageRecipient = z27.string().regex(/^age1[02-9ac-hj-np-z]{58}$/);
+var backupIdSchema = z27.string().regex(/^[a-z0-9-]{8,64}$/);
+var nodeBackupConfigSchema = z27.object({
+  enabled: z27.boolean(),
+  hour_utc: z27.number().int().min(0).max(23),
+  weekly_day: z27.number().int().min(1).max(7),
   workspace_recipient: ageRecipient
 });
-var backupCredentialsRequestSchema = z24.object({
-  mode: z24.enum(["upload", "download"]),
+var backupCredentialsRequestSchema = z27.object({
+  mode: z27.enum(["upload", "download"]),
   backup_id: backupIdSchema,
-  source_node_id: z24.guid().optional()
+  source_node_id: z27.guid().optional()
 });
-var backupCredentialsSchema = z24.object({
-  endpoint: z24.string().url(),
-  bucket: z24.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/),
-  prefix: z24.string().regex(/^backups\/[0-9a-f-]{36}\/$/),
-  access_key_id: z24.string().min(8).max(200),
-  secret_access_key: z24.string().min(8).max(200),
-  session_token: z24.string().min(8).max(4000),
-  expires_at: z24.string().datetime()
+var backupCredentialsSchema = z27.object({
+  endpoint: z27.string().url(),
+  bucket: z27.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/),
+  prefix: z27.string().regex(/^backups\/[0-9a-f-]{36}\/$/),
+  access_key_id: z27.string().min(8).max(200),
+  secret_access_key: z27.string().min(8).max(200),
+  session_token: z27.string().min(8).max(4000),
+  expires_at: z27.string().datetime()
 });
-var rowCountsSchema = z24.record(z24.string().regex(/^[a-z_][a-z0-9_]{0,63}$/), z24.number().int().nonnegative());
-var backupManifestSchema = z24.object({
-  v: z24.literal(1),
+var rowCountsSchema = z27.record(z27.string().regex(/^[a-z_][a-z0-9_]{0,63}$/), z27.number().int().nonnegative());
+var backupManifestSchema = z27.object({
+  v: z27.literal(1),
   backup_id: backupIdSchema,
-  node_id: z24.guid(),
-  kind: z24.enum(BACKUP_KINDS),
-  created_at: z24.string().datetime(),
-  object_key: z24.string(),
-  size_bytes: z24.number().int().nonnegative(),
-  sha256: z24.string().regex(/^[0-9a-f]{64}$/),
-  clickhouse_version: z24.string().max(40),
-  schema_version: z24.number().int().nonnegative(),
+  node_id: z27.guid(),
+  kind: z27.enum(BACKUP_KINDS),
+  created_at: z27.string().datetime(),
+  object_key: z27.string(),
+  size_bytes: z27.number().int().nonnegative(),
+  sha256: z27.string().regex(/^[0-9a-f]{64}$/),
+  clickhouse_version: z27.string().max(40),
+  schema_version: z27.number().int().nonnegative(),
   row_counts: rowCountsSchema,
-  recipients: z24.array(z24.string().regex(/^[0-9a-f]{8}$/)).min(1).max(4)
+  recipients: z27.array(z27.string().regex(/^[0-9a-f]{8}$/)).min(1).max(4)
 });
 var BACKUP_ERROR_CODES = [
   "CLICKHOUSE_BACKUP_FAILED",
@@ -3748,48 +4188,48 @@ var BACKUP_ERROR_CODES = [
   "RESTORE_FAILED",
   "ROW_COUNT_MISMATCH"
 ];
-var backupReportSchema = z24.object({
+var backupReportSchema = z27.object({
   backup_id: backupIdSchema,
-  kind: z24.enum(BACKUP_KINDS),
-  status: z24.enum(["succeeded", "failed"]),
-  started_at: z24.string().datetime(),
-  finished_at: z24.string().datetime(),
+  kind: z27.enum(BACKUP_KINDS),
+  status: z27.enum(["succeeded", "failed"]),
+  started_at: z27.string().datetime(),
+  finished_at: z27.string().datetime(),
   manifest: backupManifestSchema.nullable(),
-  error_code: z24.enum(BACKUP_ERROR_CODES).nullable()
+  error_code: z27.enum(BACKUP_ERROR_CODES).nullable()
 });
-var drillReportSchema = z24.object({
+var drillReportSchema = z27.object({
   backup_id: backupIdSchema,
-  kind: z24.enum(["weekly_local", "monthly_new_machine"]),
-  status: z24.enum(["passed", "failed"]),
-  finished_at: z24.string().datetime(),
-  detail: z24.string().max(300),
-  error_code: z24.enum(BACKUP_ERROR_CODES).nullable()
+  kind: z27.enum(["weekly_local", "monthly_new_machine"]),
+  status: z27.enum(["passed", "failed"]),
+  finished_at: z27.string().datetime(),
+  detail: z27.string().max(300),
+  error_code: z27.enum(BACKUP_ERROR_CODES).nullable()
 });
-var nodeIdentityEscrowSchema = z24.object({
-  v: z24.literal(1),
-  node_id: z24.guid(),
-  seal: z24.object({
-    publicKey: z24.string().regex(/^[A-Za-z0-9_-]{43}$/),
-    privateKey: z24.string().regex(/^[A-Za-z0-9_-]{43}$/)
-  }),
-  created_at: z24.string().datetime()
+var nodeIdentityEscrowSchema = z27.object({
+  v: z27.literal(1),
+  node_id: z27.guid(),
+  seal: z27.object({
+    publicKey: z27.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    privateKey: z27.string().regex(/^[A-Za-z0-9_-]{43}$/)
+  }),
+  created_at: z27.string().datetime()
 });
-var restoreArgsSchema = z24.object({
-  job_id: z24.guid(),
-  workspace_id: z24.guid(),
-  source_node_id: z24.guid(),
+var restoreArgsSchema = z27.object({
+  job_id: z27.guid(),
+  workspace_id: z27.guid(),
+  source_node_id: z27.guid(),
   manifest: backupManifestSchema,
-  sealed_identity: z24.string().regex(/^[A-Za-z0-9_-]{40,2000}$/),
-  mode: z24.enum(["rebuild", "drill"])
+  sealed_identity: z27.string().regex(/^[A-Za-z0-9_-]{40,2000}$/),
+  mode: z27.enum(["rebuild", "drill"])
 });
-var restoreReportSchema = z24.object({
-  job_id: z24.guid(),
+var restoreReportSchema = z27.object({
+  job_id: z27.guid(),
   backup_id: backupIdSchema,
-  mode: z24.enum(["rebuild", "drill"]),
-  status: z24.enum(["succeeded", "failed"]),
-  finished_at: z24.string().datetime(),
-  detail: z24.string().max(300),
-  error_code: z24.enum(BACKUP_ERROR_CODES).nullable()
+  mode: z27.enum(["rebuild", "drill"]),
+  status: z27.enum(["succeeded", "failed"]),
+  finished_at: z27.string().datetime(),
+  detail: z27.string().max(300),
+  error_code: z27.enum(BACKUP_ERROR_CODES).nullable()
 });
 
 // ../src/shared/contracts/node-config.ts
@@ -3803,83 +4243,85 @@ var SCRUB_GROUPS = [
   "headers"
 ];
 var MAX_NODE_MONITORS = 5000;
-var kid = z25.string().regex(/^[A-Za-z0-9_-]{1,40}$/);
-var publicKey = z25.string().regex(/^[A-Za-z0-9_-]{43}$/);
-var nodeConfigSchema = z25.object({
-  v: z25.literal(1),
-  config_version: z25.number().int().positive(),
-  node_id: z25.guid(),
-  workspace_id: z25.guid(),
-  workspace_status: z25.enum(["active", "suspended"]),
-  issued_at: z25.string().datetime(),
-  retention_days: z25.number().int().min(1).max(3650),
-  channel: z25.enum(["stable", "canary"]).optional(),
-  projects: z25.array(z25.object({
-    project_id: z25.number().int().positive(),
-    slug: z25.string().max(64),
-    short_prefix: z25.string().regex(/^[A-Z0-9]{1,12}$/),
-    user_id_salt: z25.string().regex(/^[A-Za-z0-9_-]{22,64}$/),
-    scrub_disabled: z25.array(z25.enum(SCRUB_GROUPS)).max(SCRUB_GROUPS.length),
-    upload_tokens: z25.array(z25.object({
-      hash: z25.string().regex(/^[a-f0-9]{64}$/),
-      expires_at: z25.string().datetime()
+var kid = z28.string().regex(/^[A-Za-z0-9_-]{1,40}$/);
+var publicKey = z28.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var nodeConfigSchema = z28.object({
+  v: z28.literal(1),
+  config_version: z28.number().int().positive(),
+  node_id: z28.guid(),
+  workspace_id: z28.guid(),
+  workspace_status: z28.enum(["active", "suspended"]),
+  issued_at: z28.string().datetime(),
+  retention_days: z28.number().int().min(1).max(3650),
+  channel: z28.enum(["stable", "canary"]).optional(),
+  projects: z28.array(z28.object({
+    project_id: z28.number().int().positive(),
+    slug: z28.string().max(64),
+    short_prefix: z28.string().regex(/^[A-Z0-9]{1,12}$/),
+    user_id_salt: z28.string().regex(/^[A-Za-z0-9_-]{22,64}$/),
+    privacy_key_version: z28.number().int().min(1).max(PRIVACY_KEY_MAX_VERSION).optional(),
+    scrub_disabled: z28.array(z28.enum(SCRUB_GROUPS)).max(SCRUB_GROUPS.length),
+    upload_tokens: z28.array(z28.object({
+      hash: z28.string().regex(/^[a-f0-9]{64}$/),
+      expires_at: z28.string().datetime(),
+      scopes: z28.array(z28.enum(UPLOAD_SCOPES)).min(1).max(UPLOAD_SCOPES.length).optional()
     })).max(10).optional()
   })).max(1000),
-  ticket_keys: z25.array(z25.object({ kid, public_key: publicKey, not_after: z25.string().datetime() })).min(1).max(5),
-  control_ops_keys: z25.array(z25.object({ kid, public_key: publicKey })).min(1).max(5),
-  kill_switches: z25.object({ ingest: z25.boolean(), alerts: z25.boolean() }),
+  ticket_keys: z28.array(z28.object({ kid, public_key: publicKey, not_after: z28.string().datetime() })).min(1).max(5),
+  control_ops_keys: z28.array(z28.object({ kid, public_key: publicKey })).min(1).max(5),
+  kill_switches: z28.object({ ingest: z28.boolean(), alerts: z28.boolean() }),
   backup: nodeBackupConfigSchema.optional(),
-  purged_projects: z25.array(z25.number().int().positive()).max(1000).optional(),
-  monitors: z25.array(monitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
-  purged_monitors: z25.array(z25.guid()).max(5000).optional(),
-  telemetry: z25.object({
-    traces_retention_days: z25.number().int().min(1).max(90),
-    logs_retention_days: z25.number().int().min(1).max(90),
-    traces_disk_share: z25.number().min(0.2).max(0.8)
+  purged_projects: z28.array(z28.number().int().positive()).max(1000).optional(),
+  monitors: z28.array(monitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
+  purged_monitors: z28.array(z28.guid()).max(5000).optional(),
+  telemetry: z28.object({
+    traces_retention_days: z28.number().int().min(1).max(90),
+    logs_retention_days: z28.number().int().min(1).max(90),
+    traces_disk_share: z28.number().min(0.2).max(0.8)
   }).optional(),
   metrics: metricsConfigSchema.optional(),
-  slos: z25.array(nodeSloSchema).max(SLO_LIMITS.maxNodeSlos).optional(),
-  signal_monitors: z25.array(signalMonitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
+  slos: z28.array(nodeSloSchema).max(SLO_LIMITS.maxNodeSlos).optional(),
+  signal_monitors: z28.array(signalMonitorDefinitionSchema).max(MAX_NODE_MONITORS).optional(),
   signal_limits: signalLimitsConfigSchema.optional(),
   privacy: nodePrivacyBlockSchema.optional()
 });
-var signedNodeConfigSchema = z25.object({ config: nodeConfigSchema, kid, sig: z25.string() });
+var signedNodeConfigSchema = z28.object({ config: nodeConfigSchema, kid, sig: z28.string() });
 
 // ../src/shared/contracts/api-ops/projects.ts
-var slug = z26.string().regex(/^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$/);
-var name3 = z26.string().trim().min(1).max(60);
-var label2 = z26.string().trim().min(1).max(40);
-var platform = z26.enum(PLATFORMS);
-var origin = z26.string().trim().toLowerCase().regex(/^https?:\/\/[a-z0-9.-]+(:[0-9]{1,5})?$/).max(200);
-var keyId = z26.number().int().positive();
+var slug = z29.string().regex(/^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$/);
+var name3 = z29.string().trim().min(1).max(60);
+var label2 = z29.string().trim().min(1).max(40);
+var platform = z29.enum(PLATFORMS);
+var origin = z29.string().trim().toLowerCase().regex(/^https?:\/\/[a-z0-9.-]+(:[0-9]{1,5})?$/).max(200);
+var keyId = z29.number().int().positive();
 var PROJECT_INPUTS = {
-  create: z26.object({ workspaceId: uuid, name: name3, slug, platform }),
-  update: z26.object({ projectId, name: name3, platform, isPinned: z26.boolean() }),
-  updateIntake: z26.object({
+  create: z29.object({ workspaceId: uuid, name: name3, slug, platform }),
+  update: z29.object({ projectId, name: name3, platform, isPinned: z29.boolean() }),
+  updateIntake: z29.object({
     projectId,
-    rateLimit: z26.number().int().positive().nullable(),
-    burst: z26.number().int().positive().nullable(),
-    allowedOrigins: z26.array(origin).max(50)
+    rateLimit: z29.number().int().positive().nullable(),
+    burst: z29.number().int().positive().nullable(),
+    allowedOrigins: z29.array(origin).max(50)
   }),
-  updateObservability: z26.object({
+  updateObservability: z29.object({
     projectId,
-    primaryEnvironment: z26.string().trim().min(1).max(64).refine((v) => v !== "*" && ENVIRONMENT_RE.test(v)),
-    allowCodeMonitors: z26.boolean()
+    primaryEnvironment: z29.string().trim().min(1).max(64).refine((v) => v !== "*" && ENVIRONMENT_RE.test(v)),
+    allowCodeMonitors: z29.boolean()
   }),
-  setScrub: z26.object({ projectId, group: z26.enum(SCRUB_GROUPS), enabled: z26.boolean() }),
-  setCheckinAuth: z26.object({ projectId, mode: z26.enum(CHECKIN_AUTH_MODES) }),
-  setEnvironmentHidden: z26.object({
+  setScrub: z29.object({ projectId, group: z29.enum(SCRUB_GROUPS), enabled: z29.boolean() }),
+  setCheckinAuth: z29.object({ projectId, mode: z29.enum(CHECKIN_AUTH_MODES) }),
+  setEnvironmentHidden: z29.object({
     projectId,
-    name: z26.string().min(1).max(64),
-    hidden: z26.boolean()
-  }),
-  scheduleDeletion: z26.object({ projectId, confirmSlug: slug }),
-  projectOnly: z26.object({ projectId }),
-  labelled: z26.object({ projectId, label: label2 }),
-  keyOnly: z26.object({ keyId }),
-  tokenOnly: z26.object({ tokenId: keyId }),
+    name: z29.string().min(1).max(64),
+    hidden: z29.boolean()
+  }),
+  scheduleDeletion: z29.object({ projectId, confirmSlug: slug }),
+  projectOnly: z29.object({ projectId }),
+  labelled: z29.object({ projectId, label: label2 }),
+  keyOnly: z29.object({ keyId }),
+  tokenOnly: z29.object({ tokenId: keyId }),
   createIngestKey: createIngestKeyInputSchema,
-  ingestKeyOnly: z26.object({ keyId: uuid })
+  ingestKeyOnly: z29.object({ keyId: uuid })
 };
 var P2 = PROJECT_INPUTS;
 var PROJECT_OPERATIONS = [
@@ -4134,24 +4576,24 @@ var PROJECT_OPERATIONS = [
 ];
 
 // ../src/shared/contracts/api-ops/reads.ts
-import { z as z27 } from "zod";
-var list = z27.object({ workspaceId: uuid, limit: pageLimit, cursor });
+import { z as z30 } from "zod";
+var list = z30.object({ workspaceId: uuid, limit: pageLimit, cursor });
 var READ_INPUTS = {
-  workspace: z27.object({ workspaceId: uuid }),
+  workspace: z30.object({ workspaceId: uuid }),
   list,
-  projectsGet: z27.object({ workspaceId: uuid, projectId }),
+  projectsGet: z30.object({ workspaceId: uuid, projectId }),
   monitorsList: list.extend({ projectId: projectId.optional() }),
-  monitorsGet: z27.object({ workspaceId: uuid, monitorId: uuid }),
-  uptimeGet: z27.object({ workspaceId: uuid, checkId: uuid }),
-  slosGet: z27.object({ workspaceId: uuid, sloId: uuid }),
+  monitorsGet: z30.object({ workspaceId: uuid, monitorId: uuid }),
+  uptimeGet: z30.object({ workspaceId: uuid, checkId: uuid }),
+  slosGet: z30.object({ workspaceId: uuid, sloId: uuid }),
   alertsList: list.extend({
-    state: z27.enum(["open", "resolved", "all"]).default("all"),
+    state: z30.enum(["open", "resolved", "all"]).default("all"),
     monitorId: uuid.optional()
   }),
-  approvalsGet: z27.object({ workspaceId: uuid, approvalId: uuid }),
+  approvalsGet: z30.object({ workspaceId: uuid, approvalId: uuid }),
   monitorsListTyped: list.extend({
     projectId: projectId.optional(),
-    type: z27.enum(MONITOR_TYPES).optional()
+    type: z30.enum(MONITOR_TYPES).optional()
   })
 };
 var R = READ_INPUTS;
@@ -4435,14 +4877,14 @@ function approvalRequestSchema(operationId, input) {
 }
 
 // ../src/shared/contracts/api-ops/wire.ts
-import { z as z28 } from "zod";
+import { z as z31 } from "zod";
 var toSnake = (s) => s.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
 var toCamel = (s) => s.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
 var schemaCache = new WeakMap;
 function inputJsonSchema(op) {
   let js = schemaCache.get(op.input);
   if (!js) {
-    js = z28.toJSONSchema(op.input, { io: "input", unrepresentable: "any" });
+    js = z31.toJSONSchema(op.input, { io: "input", unrepresentable: "any" });
     schemaCache.set(op.input, js);
   }
   return js;
@@ -4656,7 +5098,7 @@ function wireInput(operationId, opts = {}) {
   for (const [k, v] of Object.entries(op.input.shape))
     if (!omit.has(k))
       shape[toSnake(k)] = v;
-  return z29.object(shape);
+  return z32.object(shape);
 }
 var BUDGETS = [
   { stringBytes: MCP_LIMITS.untrustedStringMaxBytes, listMax: MCP_LIMITS.listMax },
@@ -4716,7 +5158,10 @@ function untrustedTree(value, reserveBytes = 2048) {
 function wrapResult(parts, extra = {}) {
   const t = untrustedTree(parts.data);
   const structuredContent = {
-    untrusted: { data: t.data, provenance: { source: parts.source, operations: [...parts.operations] } }
+    untrusted: {
+      data: t.data,
+      provenance: { source: parts.source, operations: [...parts.operations] }
+    }
   };
   if (extra.next_cursor !== undefined) {
     const c = extra.next_cursor === null ? null : cleanUntrustedText(extra.next_cursor, 600).text;
@@ -4746,40 +5191,52 @@ function errorResult(o) {
     }
   };
 }
-var TOOL_OUTPUT_SCHEMA = z29.object({
-  untrusted: z29.object({
-    data: z29.unknown(),
-    provenance: z29.object({
-      source: z29.enum(["node", "control_plane", "docs"]),
-      operations: z29.array(z29.string())
+var TOOL_OUTPUT_SCHEMA = z32.object({
+  untrusted: z32.object({
+    data: z32.unknown(),
+    provenance: z32.object({
+      source: z32.enum(["node", "control_plane", "docs"]),
+      operations: z32.array(z32.string())
     })
   }).optional(),
-  doc: z29.object({ slug: z29.string(), locale: z29.enum(["en", "vi"]), url: z29.string(), markdown: z29.string(), truncated: z29.boolean() }).optional(),
-  results: z29.array(z29.object({ slug: z29.string(), title: z29.string(), description: z29.string(), section: z29.string(), url: z29.string() })).optional(),
-  next_cursor: z29.string().nullable().optional(),
-  complete: z29.boolean().optional(),
-  omitted: z29.array(z29.object({ part: z29.string(), reason: z29.string(), scope: z29.string().optional() })).optional(),
-  truncated: z29.literal(true).optional(),
-  suspicious_unicode: z29.literal(true).optional(),
-  error: z29.object({
-    code: z29.string(),
-    status: z29.number(),
-    detail: z29.string().optional(),
-    scope: z29.string().optional(),
-    retry_after: z29.number().optional()
+  doc: z32.object({
+    slug: z32.string(),
+    locale: z32.enum(["en", "vi"]),
+    url: z32.string(),
+    markdown: z32.string(),
+    truncated: z32.boolean()
+  }).optional(),
+  results: z32.array(z32.object({
+    slug: z32.string(),
+    title: z32.string(),
+    description: z32.string(),
+    section: z32.string(),
+    url: z32.string()
+  })).optional(),
+  next_cursor: z32.string().nullable().optional(),
+  complete: z32.boolean().optional(),
+  omitted: z32.array(z32.object({ part: z32.string(), reason: z32.string(), scope: z32.string().optional() })).optional(),
+  truncated: z32.literal(true).optional(),
+  suspicious_unicode: z32.literal(true).optional(),
+  error: z32.object({
+    code: z32.string(),
+    status: z32.number(),
+    detail: z32.string().optional(),
+    scope: z32.string().optional(),
+    retry_after: z32.number().optional()
   }).optional(),
-  operations: z29.array(z29.record(z29.string(), z29.unknown())).optional(),
-  operation: z29.record(z29.string(), z29.unknown()).optional(),
-  plan: z29.record(z29.string(), z29.unknown()).optional(),
-  status: z29.enum(["done", "approval_required", "approval_pending", ...APPROVAL_STATES]).optional(),
-  approval: z29.object({
-    approval_id: z29.string(),
-    approval_url: z29.string(),
-    expires_at: z29.string(),
-    state: z29.enum(APPROVAL_STATES),
-    result_code: z29.string().nullable().optional(),
-    result: z29.record(z29.string(), z29.unknown()).optional(),
-    next: z29.string().optional()
+  operations: z32.array(z32.record(z32.string(), z32.unknown())).optional(),
+  operation: z32.record(z32.string(), z32.unknown()).optional(),
+  plan: z32.record(z32.string(), z32.unknown()).optional(),
+  status: z32.enum(["done", "approval_required", "approval_pending", ...APPROVAL_STATES]).optional(),
+  approval: z32.object({
+    approval_id: z32.string(),
+    approval_url: z32.string(),
+    expires_at: z32.string(),
+    state: z32.enum(APPROVAL_STATES),
+    result_code: z32.string().nullable().optional(),
+    result: z32.record(z32.string(), z32.unknown()).optional(),
+    next: z32.string().optional()
   }).optional()
 });
 var spec = (name) => {
@@ -4825,10 +5282,10 @@ var has = (rt, operationId) => {
   return !!op && rt.scopes.includes(op.scope);
 };
 var isoWindow = {
-  start: z29.string().max(40).describe("RFC 3339 start of the window, e.g. 2026-10-26T00:00:00Z. Required with end."),
-  end: z29.string().max(40).describe("RFC 3339 end of the window. The plan limits its length.")
+  start: z32.string().max(40).describe("RFC 3339 start of the window, e.g. 2026-10-26T00:00:00Z. Required with end."),
+  end: z32.string().max(40).describe("RFC 3339 end of the window. The plan limits its length.")
 };
-var traceIdSchema = z29.string().regex(/^[0-9a-fA-F]{32}$/);
+var traceIdSchema = z32.string().regex(/^[0-9a-fA-F]{32}$/);
 var MONITOR_KINDS2 = {
   cron: { list: "monitors.list", get: "monitors.get", idField: "monitor_id" },
   uptime: { list: "uptime.list", get: "uptime.get", idField: "check_id" },
@@ -4892,8 +5349,8 @@ function describe(op, scopes) {
     destructive: isDestructiveOperation(op)
   };
 }
-var params = z29.record(z29.string(), z29.unknown()).default({}).describe("Operation fields in wire names (snake_case), as describe_operation's args_schema shows.");
-var operationIdArg = z29.string().min(3).max(80).describe("An operation id from search_operations, e.g. `monitors.update`.");
+var params = z32.record(z32.string(), z32.unknown()).default({}).describe("Operation fields in wire names (snake_case), as describe_operation's args_schema shows.");
+var operationIdArg = z32.string().min(3).max(80).describe("An operation id from search_operations, e.g. `monitors.update`.");
 function approvalBlock(t, next) {
   return {
     approval_id: t.approval_id,
@@ -4913,7 +5370,7 @@ var MCP_TOOL_DEFS = [
     title: "Workspace and node",
     description: "The workspace this token belongs to (name, plan, limits) and the state of its node, the server that stores errors, traces and logs. Start here to learn what the token can reach.",
     operations: ["workspace.get", "node.get"],
-    input: z29.object({}),
+    input: z32.object({}),
     async run(_args, rt) {
       const [ws, node] = await Promise.all([rt.call("workspace.get", {}), rt.call("node.get", {})]);
       if (!ws.ok)
@@ -4921,7 +5378,11 @@ var MCP_TOOL_DEFS = [
       const omitted = [];
       if (!node.ok)
         omitted.push({ part: "node", reason: node.code });
-      return wrapResult({ data: { workspace: ws.body, node: node.ok ? node.body : null }, operations: ["workspace.get", "node.get"], source: "control_plane" }, { omitted });
+      return wrapResult({
+        data: { workspace: ws.body, node: node.ok ? node.body : null },
+        operations: ["workspace.get", "node.get"],
+        source: "control_plane"
+      }, { omitted });
     }
   },
   single("list_projects", "projects.list", "List projects", "Projects this token can read, with their numeric ids (use them as `project` in other tools), platforms and environments."),
@@ -4929,11 +5390,11 @@ var MCP_TOOL_DEFS = [
   {
     ...spec("get_issue"),
     title: "Get an issue",
-    description: "One issue with its 24 h and 30 d counts and, when the token can read events, its latest event (stack trace, request, breadcrumbs — scrubbed on the node).",
-    operations: ["issues.get", "events.get"],
-    input: z29.object({
-      issue_id: z29.number().int().positive().describe("Issue id from search_issues."),
-      include_latest_event: z29.boolean().default(true)
+    description: "One issue with its 24 h and 30 d counts and, when the token can read events, its latest event (stack trace, request, breadcrumbs — scrubbed on the node). A resolved issue also carries `fix_status` when the token can read releases: fixed, unverified, not_fixed (with the event that broke it) or unknown, per environment.",
+    operations: ["issues.get", "events.get", "issues.fix_status"],
+    input: z32.object({
+      issue_id: z32.number().int().positive().describe("Issue id from search_issues."),
+      include_latest_event: z32.boolean().default(true)
     }),
     async run(args, rt) {
       const omitted = [];
@@ -4951,7 +5412,20 @@ var MCP_TOOL_DEFS = [
         latest = ev.body;
       else if (ev)
         omitted.push({ part: "latest_event", reason: ev.code });
-      return wrapResult({ data: { issue: issue.body, latest_event: latest }, operations: ["issues.get", "events.get"], source: "node" }, { omitted });
+      const ops = ["issues.get", "events.get"];
+      const data = { issue: issue.body, latest_event: latest };
+      const resolved = issue.body?.issue?.status === "resolved";
+      if (resolved && !has(rt, "issues.fix_status"))
+        omitted.push({ part: "fix_status", reason: "scope", scope: "releases:read" });
+      else if (resolved) {
+        const fx = await rt.call("issues.fix_status", { issue_id: args["issue_id"] });
+        ops.push("issues.fix_status");
+        if (fx.ok)
+          data["fix_status"] = fx.body;
+        else
+          omitted.push({ part: "fix_status", reason: fx.code });
+      }
+      return wrapResult({ data, operations: ops, source: "node" }, { omitted });
     }
   },
   single("list_events", "events.list", "List events of an issue", "Events of one issue, newest first, with a cursor for older ones."),
@@ -4961,9 +5435,9 @@ var MCP_TOOL_DEFS = [
     title: "Get a trace",
     description: "Summary of one distributed trace (services, duration, errors) by its 32-hex trace id, and optionally its spans (errors only, or the first page).",
     operations: ["traces.get", "traces.spans"],
-    input: z29.object({
+    input: z32.object({
       trace_id: traceIdSchema.describe("W3C trace id, 32 hex characters."),
-      spans: z29.enum(["none", "errors", "all"]).default("none")
+      spans: z32.enum(["none", "errors", "all"]).default("none")
     }),
     async run(args, rt) {
       const sum = await rt.call("traces.get", { trace_id: args["trace_id"] });
@@ -4981,7 +5455,11 @@ var MCP_TOOL_DEFS = [
         else
           omitted.push({ part: "spans", reason: r.code });
       }
-      return wrapResult({ data: { trace: sum.body, ...spans !== undefined ? { spans } : {} }, operations: ["traces.get", "traces.spans"], source: "node" }, { omitted });
+      return wrapResult({
+        data: { trace: sum.body, ...spans !== undefined ? { spans } : {} },
+        operations: ["traces.get", "traces.spans"],
+        source: "node"
+      }, { omitted });
     }
   },
   single("search_spans", "spans.list", "Search spans", "OpenTelemetry spans in a time window (start and end required): filter by project, environment, service, operation, status, kind, duration or attribute filters (`attrs`, JSON list of {k, op, v}). mode=traces returns one row per trace."),
@@ -4991,23 +5469,29 @@ var MCP_TOOL_DEFS = [
     title: "Query metrics",
     description: "OpenTelemetry metrics of one project. Without `name`: the metric catalog (name, type, unit, series count, last seen; `q` narrows by name) and the node's series caps. With `name` plus start and end: the metric aggregated per step — `aggregation` defaults to rate for counters, p95 for histograms and avg for gauges — optionally filtered by attributes (`attrs`, JSON list of {k, op, v}) and grouped by up to two attribute keys (`group_by`, comma-separated). Exemplar trace ids open with get_trace.",
     operations: ["metrics.names", "metrics.query"],
-    input: z29.object({
-      project: z29.number().int().positive().describe("Numeric project id from list_projects."),
-      name: z29.string().regex(METRIC_NAME_RE).optional().describe("Metric name from the catalog, e.g. http.server.request.duration."),
-      q: z29.string().max(255).optional().describe("Catalog only: part of a metric name."),
-      aggregation: z29.enum(METRIC_AGGREGATIONS).optional(),
+    input: z32.object({
+      project: z32.number().int().positive().describe("Numeric project id from list_projects."),
+      name: z32.string().regex(METRIC_NAME_RE).optional().describe("Metric name from the catalog, e.g. http.server.request.duration."),
+      q: z32.string().max(255).optional().describe("Catalog only: part of a metric name."),
+      aggregation: z32.enum(METRIC_AGGREGATIONS).optional(),
       start: isoWindow.start.optional(),
       end: isoWindow.end.optional(),
-      step: z29.number().int().min(60).max(86400).multipleOf(60).optional().describe("Seconds per point (whole minutes); picked from the window when absent."),
-      attrs: z29.string().max(2000).optional(),
-      group_by: z29.string().max(600).optional(),
-      environment: z29.string().max(2000).optional().describe("Comma-separated environments.")
+      step: z32.number().int().min(60).max(86400).multipleOf(60).optional().describe("Seconds per point (whole minutes); picked from the window when absent."),
+      attrs: z32.string().max(2000).optional(),
+      group_by: z32.string().max(600).optional(),
+      environment: z32.string().max(2000).optional().describe("Comma-separated environments.")
     }),
     async run(args, rt) {
-      const scope = { project: args["project"], ...args["environment"] ? { environment: args["environment"] } : {} };
+      const scope = {
+        project: args["project"],
+        ...args["environment"] ? { environment: args["environment"] } : {}
+      };
       const name = args["name"];
       if (!name) {
-        const r = await rt.call("metrics.names", { ...scope, ...args["q"] ? { q: args["q"] } : {} });
+        const r = await rt.call("metrics.names", {
+          ...scope,
+          ...args["q"] ? { q: args["q"] } : {}
+        });
         if (!r.ok)
           return errorResult(r);
         return wrapResult({ data: r.body, operations: ["metrics.names"], source: "node" }, listExtra(r.body));
@@ -5022,7 +5506,12 @@ var MCP_TOOL_DEFS = [
         const rows = cat.body?.names ?? [];
         const kind = rows.find((n) => n.name === name)?.kind;
         if (!METRIC_KINDS.includes(kind))
-          return errorResult({ ok: false, status: 404, code: "NOT_FOUND", detail: "unknown_metric" });
+          return errorResult({
+            ok: false,
+            status: 404,
+            code: "NOT_FOUND",
+            detail: "unknown_metric"
+          });
         aggregation = defaultAggregation(kind);
       }
       const r = await rt.call("metrics.query", {
@@ -5040,23 +5529,65 @@ var MCP_TOOL_DEFS = [
       return wrapResult({ data: r.body, operations: ops, source: "node" }, listExtra(r.body));
     }
   },
+  {
+    ...spec("release_health"),
+    title: "Release health",
+    description: "What changed with a release (spec 13). With `version`: that release in one environment against the previous one (or `compare`) — three lists for its first 24 hours: new issues, regressed issues and increased issues (≥ 2× events per hour and ≥ 10 events), up to 50 each with hourly sparklines, plus its deploy markers. Without `version`: the project's releases, newest deploy first, with those three counts. `environment` defaults to production (else the busiest). Whether a resolved issue is really fixed: get_issue returns its fix status.",
+    operations: ["releases.list", "releases.health"],
+    input: z32.object({
+      project: z32.number().int().positive().describe("Numeric project id from list_projects."),
+      version: releaseNameSchema.optional().describe("Release name exactly as the SDK sends it, e.g. web@1.4.2."),
+      environment: environmentNameSchema.optional().describe("One environment, e.g. production."),
+      compare: releaseNameSchema.optional().describe("With version: compare against this release instead of the previous one.")
+    }),
+    async run(args, rt) {
+      const scope = {
+        project: args["project"],
+        ...args["environment"] ? { environment: args["environment"] } : {}
+      };
+      const version = args["version"];
+      if (!version) {
+        const r = await rt.call("releases.list", scope);
+        if (!r.ok)
+          return errorResult(r);
+        return wrapResult({ data: r.body, operations: ["releases.list"], source: "node" });
+      }
+      const r = await rt.call("releases.health", {
+        ...scope,
+        version,
+        ...args["compare"] ? { compare: args["compare"] } : {}
+      });
+      if (!r.ok)
+        return errorResult(r);
+      return wrapResult({ data: r.body, operations: ["releases.health"], source: "node" });
+    }
+  },
   {
     ...spec("correlate"),
     title: "Correlate by trace or run",
     description: "Everything that shares one W3C trace id or one Belvador run id (`belvador.run.id`, set by job monitors) in a time window: the trace summary, its error spans and the logs. Give exactly one of trace_id or run_id.",
     operations: ["traces.get", "traces.spans", "spans.list", "logs.list"],
-    input: z29.object({
+    input: z32.object({
       trace_id: traceIdSchema.optional(),
-      run_id: z29.string().min(1).max(128).optional(),
+      run_id: z32.string().min(1).max(128).optional(),
       ...isoWindow,
-      project: z29.string().max(2000).optional().describe("Comma-separated project ids.")
+      project: z32.string().max(2000).optional().describe("Comma-separated project ids.")
     }),
     async run(args, rt) {
       const trace = args["trace_id"];
       const run = args["run_id"];
       if (!!trace === !!run)
-        return errorResult({ ok: false, status: 400, code: "INVALID_INPUT", detail: "one_of_trace_id_or_run_id" });
-      const window = { start: args["start"], end: args["end"], ...args["project"] ? { project: args["project"] } : {} };
+        return errorResult({
+          ok: false,
+          status: 400,
+          code: "INVALID_INPUT",
+          detail: "one_of_trace_id_or_run_id"
+        });
+      const window = {
+        start: args["start"],
+        end: args["end"],
+        ...args["project"] ? { project: args["project"] } : {}
+      };
       const attrs = run ? JSON.stringify([{ k: "belvador.run.id", op: "=", v: run }]) : undefined;
       const omitted = [];
       const data = {};
@@ -5065,7 +5596,12 @@ var MCP_TOOL_DEFS = [
       const none = Promise.resolve(null);
       const [t, s, l] = await Promise.all([
         trace && has(rt, "traces.get") ? rt.call("traces.get", { trace_id: trace }) : none,
-        has(rt, spansOp) ? trace ? rt.call("traces.spans", { trace_id: trace, errors_only: "1", start: args["start"], end: args["end"] }) : rt.call("spans.list", { ...window, status: "error", attrs }) : none,
+        has(rt, spansOp) ? trace ? rt.call("traces.spans", {
+          trace_id: trace,
+          errors_only: "1",
+          start: args["start"],
+          end: args["end"]
+        }) : rt.call("spans.list", { ...window, status: "error", attrs }) : none,
         has(rt, "logs.list") ? rt.call("logs.list", { ...window, ...trace ? { trace_id: trace } : { attrs } }) : none
       ]);
       const windowError = [s, l].find((r) => r && !r.ok && (r.code === "QUERY_WINDOW_REQUIRED" || r.code === "QUERY_WINDOW_TOO_LARGE"));
@@ -5094,10 +5630,10 @@ var MCP_TOOL_DEFS = [
     title: "List monitors",
     description: "Monitors (cron, heartbeat, count, assertion, deadline, progress), uptime checks and SLOs with their current status. `kind` narrows to one family; `project_id` to one project (cron and uptime).",
     operations: ["monitors.list", "uptime.list", "slos.list"],
-    input: z29.object({
-      kind: z29.enum(["all", "cron", "uptime", "slo"]).default("all"),
-      project_id: z29.number().int().positive().optional(),
-      limit: z29.number().int().min(1).max(200).default(50)
+    input: z32.object({
+      kind: z32.enum(["all", "cron", "uptime", "slo"]).default("all"),
+      project_id: z32.number().int().positive().optional(),
+      limit: z32.number().int().min(1).max(200).default(50)
     }),
     async run(args, rt) {
       const kinds = args["kind"] && args["kind"] !== "all" ? [args["kind"]] : ["cron", "uptime", "slo"];
@@ -5124,11 +5660,18 @@ var MCP_TOOL_DEFS = [
     ...spec("get_monitor_status"),
     title: "Get a monitor",
     description: "One monitor (any type), uptime check or SLO by id: settings, current status and recent results. For count, assertion, deadline and progress monitors it adds the last 24 h of minute counts or runs from the node, and for deadline monitors the newest occurrences. `backtest: true` (count/assertion only) also replays the current settings over the last 30 days: how often it would have alerted.",
-    operations: ["monitors.get", "uptime.get", "slos.get", "monitors.signal", "monitors.occurrences", "monitors.backtest"],
-    input: z29.object({
-      kind: z29.enum(["cron", "uptime", "slo"]),
-      id: z29.guid(),
-      backtest: z29.boolean().default(false)
+    operations: [
+      "monitors.get",
+      "uptime.get",
+      "slos.get",
+      "monitors.signal",
+      "monitors.occurrences",
+      "monitors.backtest"
+    ],
+    input: z32.object({
+      kind: z32.enum(["cron", "uptime", "slo"]),
+      id: z32.guid(),
+      backtest: z32.boolean().default(false)
     }),
     async run(args, rt) {
       const k = MONITOR_KINDS2[args["kind"]];
@@ -5172,7 +5715,11 @@ var MCP_TOOL_DEFS = [
         else
           omitted.push({ part, reason: a.code });
       }
-      return wrapResult({ data, operations: ops, source: omitted.length === parts.length ? "control_plane" : "node" }, { omitted });
+      return wrapResult({
+        data,
+        operations: ops,
+        source: omitted.length === parts.length ? "control_plane" : "node"
+      }, { omitted });
     }
   },
   single("list_alerts", "alerts.list", "List alerts", "Alerts Belvador raised (open, resolved or all), newest first, optionally for one monitor."),
@@ -5184,15 +5731,19 @@ var MCP_TOOL_DEFS = [
     title: "Send a test event",
     description: "Asks the node to send one tagged test error through the public intake of a project, proving the path real errors take. Not read-only: it creates one test event (reuse idempotency_key to retry without a second one).",
     operations: ["projects.send_test_event"],
-    input: z29.object({
-      project_id: z29.number().int().positive(),
-      idempotency_key: z29.string().min(8).max(255).optional()
+    input: z32.object({
+      project_id: z32.number().int().positive(),
+      idempotency_key: z32.string().min(8).max(255).optional()
     }),
     async run(args, rt) {
       const r = await rt.call("projects.send_test_event", { project_id: args["project_id"] }, { idempotencyKey: args["idempotency_key"] ?? rt.newKey() });
       if (!r.ok)
         return errorResult(r);
-      return wrapResult({ data: r.body, operations: ["projects.send_test_event"], source: "control_plane" });
+      return wrapResult({
+        data: r.body,
+        operations: ["projects.send_test_event"],
+        source: "control_plane"
+      });
     }
   },
   {
@@ -5200,9 +5751,9 @@ var MCP_TOOL_DEFS = [
     title: "Find a configuration change",
     description: "Searches what this token can change in its Belvador workspace: projects, keys and tokens, monitors of every type, maintenance windows, occurrences, uptime checks, SLOs, alert rules and destinations, members, service accounts and the node. Returns operation ids for describe_operation and plan_change, whether a person must approve the change, and whether this token holds the scope.",
     operations: [],
-    input: z29.object({
-      query: z29.string().min(1).max(200).describe("Words such as `rotate dsn key`, `heartbeat monitor`, `slack alert`."),
-      limit: z29.number().int().min(1).max(20).default(10)
+    input: z32.object({
+      query: z32.string().min(1).max(200).describe("Words such as `rotate dsn key`, `heartbeat monitor`, `slack alert`."),
+      limit: z32.number().int().min(1).max(20).default(10)
     }),
     async run(args, rt) {
       const q = words(String(args["query"]));
@@ -5230,7 +5781,7 @@ var MCP_TOOL_DEFS = [
     title: "Describe a configuration change",
     description: "Everything needed to call one operation: its fields (JSON Schema, wire names), the scope, whether it needs If-Match (call plan_change for the current ETag), an idempotency key, or a person's approval, and which fields the approving person types on belvador.dev instead of the agent.",
     operations: [],
-    input: z29.object({ operation_id: operationIdArg }),
+    input: z32.object({ operation_id: operationIdArg }),
     async run(args, rt) {
       const op = configureOp(args["operation_id"]);
       if (!op || op.method === "GET")
@@ -5259,7 +5810,7 @@ var MCP_TOOL_DEFS = [
     title: "Check a change before applying it",
     description: "Validates params for one operation without changing anything: field errors, missing scope, whether a person must approve, and — when the resource can be read — its current state, the fields that would change and the ETag to pass as if_match.",
     operations: [],
-    input: z29.object({ operation_id: operationIdArg, params }),
+    input: z32.object({ operation_id: operationIdArg, params }),
     async run(args, rt) {
       const op = configureOp(args["operation_id"]);
       if (!op || op.method === "GET")
@@ -5308,11 +5859,11 @@ var MCP_TOOL_DEFS = [
     title: "Apply a configuration change",
     description: "Runs one operation with params (validate first with plan_change). Always send idempotency_key: repeating a call with the same key never applies it twice. Sensitive operations answer approval_required with an approval_url a person opens on belvador.dev; nothing changes until they approve with their authenticator code.",
     operations: [],
-    input: z29.object({
+    input: z32.object({
       operation_id: operationIdArg,
       params,
-      idempotency_key: z29.string().min(8).max(255).describe("Unique per change; reuse it to retry or to fetch the result."),
-      if_match: z29.string().max(200).optional().describe("ETag from plan_change, for operations that need it.")
+      idempotency_key: z32.string().min(8).max(255).describe("Unique per change; reuse it to retry or to fetch the result."),
+      if_match: z32.string().max(200).optional().describe("ETag from plan_change, for operations that need it.")
     }),
     async run(args, rt) {
       const op = configureOp(args["operation_id"]);
@@ -5321,8 +5872,15 @@ var MCP_TOOL_DEFS = [
       const p = args["params"] ?? {};
       for (const f of humanWire(op))
         if (f in p)
-          return errorResult({ ok: false, status: 400, code: "INVALID_INPUT", detail: `${f} is typed by the approving person` });
-      const opts = { idempotencyKey: String(args["idempotency_key"]) };
+          return errorResult({
+            ok: false,
+            status: 400,
+            code: "INVALID_INPUT",
+            detail: `${f} is typed by the approving person`
+          });
+      const opts = {
+        idempotencyKey: String(args["idempotency_key"])
+      };
       if (typeof args["if_match"] === "string" && args["if_match"])
         opts.ifMatch = args["if_match"];
       const r = await rt.call(op.id, p, opts);
@@ -5342,7 +5900,10 @@ var MCP_TOOL_DEFS = [
       if (r.approval && r.approval.state === "pending") {
         const next = APPROVAL_SETUP_OPS.includes(op.id) ? `${NEXT_PENDING} ${NEXT_SETUP}` : NEXT_PENDING;
         return {
-          structuredContent: { status: "approval_required", approval: approvalBlock(r.approval, next) },
+          structuredContent: {
+            status: "approval_required",
+            approval: approvalBlock(r.approval, next)
+          },
           approval: r.approval
         };
       }
@@ -5363,7 +5924,7 @@ var MCP_TOOL_DEFS = [
     title: "Follow an approval",
     description: "State of a change waiting for a person's approval: pending, approved, executed (with the ids it produced), rejected, expired or failed (with the error code).",
     operations: ["approvals.get"],
-    input: z29.object({ approval_id: z29.guid().describe("approval_id from apply_change.") }),
+    input: z32.object({ approval_id: z32.guid().describe("approval_id from apply_change.") }),
     async run(args, rt) {
       const r = await rt.call("approvals.get", { approval_id: args["approval_id"] });
       if (!r.ok)
@@ -5383,10 +5944,10 @@ var MCP_TOOL_DEFS = [
     title: "Search Belvador docs",
     description: "Searches the public Belvador documentation (titles and summaries) and returns the best pages with their slugs for get_doc.",
     operations: [],
-    input: z29.object({
-      query: z29.string().min(1).max(200),
-      locale: z29.enum(["en", "vi"]).default("en"),
-      limit: z29.number().int().min(1).max(10).default(5)
+    input: z32.object({
+      query: z32.string().min(1).max(200),
+      locale: z32.enum(["en", "vi"]).default("en"),
+      limit: z32.number().int().min(1).max(10).default(5)
     }),
     async run(args, rt) {
       const locale = args["locale"] ?? "en";
@@ -5402,9 +5963,9 @@ var MCP_TOOL_DEFS = [
     title: "Read a docs page",
     description: "The Markdown of one public Belvador docs page by slug (e.g. `quickstart`, `sdk/react`, `reference/api`).",
     operations: [],
-    input: z29.object({
-      slug: z29.string().regex(/^[a-z0-9][a-z0-9/-]{0,120}$/),
-      locale: z29.enum(["en", "vi"]).default("en")
+    input: z32.object({
+      slug: z32.string().regex(/^[a-z0-9][a-z0-9/-]{0,120}$/),
+      locale: z32.enum(["en", "vi"]).default("en")
     }),
     async run(args, rt) {
       const locale = args["locale"] ?? "en";
@@ -5417,7 +5978,13 @@ var MCP_TOOL_DEFS = [
       const markdown = cut ? cleanUntrustedText(md, max).text : md;
       return {
         structuredContent: {
-          doc: { slug, locale, url: `https://belvador.dev/${locale}/docs/${slug}`, markdown, truncated: cut }
+          doc: {
+            slug,
+            locale,
+            url: `https://belvador.dev/${locale}/docs/${slug}`,
+            markdown,
+            truncated: cut
+          }
         }
       };
     }
@@ -5435,7 +6002,13 @@ function parseDocsIndex(index) {
     }
     const m = /^- \[([^\]]+)\]\(https:\/\/belvador\.dev\/api\/public\/docs\/(en|vi)\/([a-z0-9/-]+)\):\s*(.*)$/.exec(line);
     if (m)
-      out.push({ title: m[1], slug: m[3], description: m[4], section, url: `https://belvador.dev/${m[2]}/docs/${m[3]}` });
+      out.push({
+        title: m[1],
+        slug: m[3],
+        description: m[4],
+        section,
+        url: `https://belvador.dev/${m[2]}/docs/${m[3]}`
+      });
   }
   return out;
 }
@@ -5586,7 +6159,7 @@ function findToken(env = process.env, keychain = keychainToken) {
 }
 
 // packages/mcp/src/cli.ts
-var PACKAGE_VERSION = "0.5.0";
+var PACKAGE_VERSION = "0.7.0";
 var HELP = `belvador-mcp ${PACKAGE_VERSION} — Belvador MCP server (stdio)
 
 Usage: npx -y @belvador/mcp [--toolsets=${MCP_DEFAULT_TOOLSETS.join(",")}]