@debugbundle/cli 1.11.0 → 1.12.0

package/dist/main.cjs

@@ -10041,7 +10041,7 @@ var require_agent = __commonJS({
     function defaultFactory(origin, opts) {
       return opts && opts.connections === 1 ? new Client(origin, opts) : new Pool(origin, opts);
     }
-    var Agent2 = class extends DispatcherBase {
+    var Agent3 = class extends DispatcherBase {
       constructor({ factory = defaultFactory, maxOrigins = Infinity, connect, ...options } = {}) {
         if (typeof factory !== "function") {
           throw new InvalidArgumentError("factory must be a function.");
@@ -10155,7 +10155,7 @@ var require_agent = __commonJS({
         return allClientStats;
       }
     };
-    module2.exports = Agent2;
+    module2.exports = Agent3;
   }
 });
 
@@ -10946,7 +10946,7 @@ var require_proxy_agent = __commonJS({
   "../../node_modules/.pnpm/undici@8.5.0/node_modules/undici/lib/dispatcher/proxy-agent.js"(exports2, module2) {
     "use strict";
     var { kProxy, kClose, kDestroy, kDispatch } = require_symbols();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var Pool = require_pool();
     var DispatcherBase = require_dispatcher_base();
     var { InvalidArgumentError, RequestAbortedError, SecureProxyConnectionError } = require_errors();
@@ -11082,7 +11082,7 @@ var require_proxy_agent = __commonJS({
         } else {
           this[kClient] = clientFactory(url, { connect });
         }
-        this[kAgent] = new Agent2({
+        this[kAgent] = new Agent3({
           ...opts,
           factory,
           connect: async (opts2, callback) => {
@@ -11221,7 +11221,7 @@ var require_env_http_proxy_agent = __commonJS({
     var DispatcherBase = require_dispatcher_base();
     var { kClose, kDestroy, kClosed, kDestroyed, kDispatch, kNoProxyAgent, kHttpProxyAgent, kHttpsProxyAgent } = require_symbols();
     var ProxyAgent = require_proxy_agent();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var DEFAULT_PORTS = {
       "http:": 80,
       "https:": 443
@@ -11234,7 +11234,7 @@ var require_env_http_proxy_agent = __commonJS({
         super();
         this.#opts = opts;
         const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts;
-        this[kNoProxyAgent] = new Agent2(agentOpts);
+        this[kNoProxyAgent] = new Agent3(agentOpts);
         const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY;
         if (HTTP_PROXY) {
           this[kHttpProxyAgent] = new ProxyAgent({ ...agentOpts, uri: HTTP_PROXY });
@@ -13993,7 +13993,7 @@ var require_mock_agent = __commonJS({
   "../../node_modules/.pnpm/undici@8.5.0/node_modules/undici/lib/mock/mock-agent.js"(exports2, module2) {
     "use strict";
     var { kClients } = require_symbols();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var {
       kAgent,
       kMockAgentSet,
@@ -14031,7 +14031,7 @@ var require_mock_agent = __commonJS({
         if (opts?.agent && typeof opts.agent.dispatch !== "function") {
           throw new InvalidArgumentError("Argument opts.agent must implement Agent");
         }
-        const agent = opts?.agent ? opts.agent : new Agent2(opts);
+        const agent = opts?.agent ? opts.agent : new Agent3(opts);
         this[kAgent] = agent;
         this[kClients] = agent[kClients];
         this[kOptions] = mockOptions;
@@ -14653,7 +14653,7 @@ var require_snapshot_recorder = __commonJS({
 var require_snapshot_agent = __commonJS({
   "../../node_modules/.pnpm/undici@8.5.0/node_modules/undici/lib/mock/snapshot-agent.js"(exports2, module2) {
     "use strict";
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var MockAgent = require_mock_agent();
     var { SnapshotRecorder } = require_snapshot_recorder();
     var { InvalidArgumentError, UndiciError } = require_errors();
@@ -14706,7 +14706,7 @@ var require_snapshot_agent = __commonJS({
         });
         this[kSnapshotLoaded] = false;
         if (this[kSnapshotMode] === "record" || this[kSnapshotMode] === "update" || this[kSnapshotMode] === "playback" && opts.excludeUrls && opts.excludeUrls.length > 0) {
-          this[kRealAgent] = new Agent2(opts);
+          this[kRealAgent] = new Agent3(opts);
         }
         if ((this[kSnapshotMode] === "playback" || this[kSnapshotMode] === "update") && this[kSnapshotPath]) {
           this.loadSnapshots().catch(() => {
@@ -14955,10 +14955,10 @@ var require_global2 = __commonJS({
     var globalDispatcher = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.2");
     var legacyGlobalDispatcher = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.1");
     var { InvalidArgumentError } = require_errors();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var Dispatcher1Wrapper = require_dispatcher1_wrapper();
     if (getGlobalDispatcher() === void 0) {
-      setGlobalDispatcher(new Agent2());
+      setGlobalDispatcher(new Agent3());
     }
     function setGlobalDispatcher(agent) {
       if (!agent || typeof agent.dispatch !== "function") {
@@ -15431,8 +15431,8 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "../../node_modules/.pnpm/undici@8.5.0/node_modules/undici/lib/interceptor/dns.js"(exports2, module2) {
     "use strict";
-    var { isIP: isIP2 } = require("node:net");
-    var { lookup } = require("node:dns");
+    var { isIP: isIP3 } = require("node:net");
+    var { lookup: lookup2 } = require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError, InformationalError } = require_errors();
     var maxInt = Math.pow(2, 31) - 1;
@@ -15622,7 +15622,7 @@ var require_dns = __commonJS({
         }
       }
       #defaultLookup(origin, opts, cb) {
-        lookup(
+        lookup2(
           origin.hostname,
           {
             all: true,
@@ -15840,7 +15840,7 @@ var require_dns = __commonJS({
             return dispatch(origDispatchOpts, handler7);
           }
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP2(origin.hostname) !== 0) {
+          if (isIP3(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler7);
           }
           instance.runLookup(origin, origDispatchOpts, (err, newOrigin) => {
@@ -25618,7 +25618,7 @@ var require_undici = __commonJS({
     var Pool = require_pool();
     var BalancedPool = require_balanced_pool();
     var RoundRobinPool = require_round_robin_pool();
-    var Agent2 = require_agent();
+    var Agent3 = require_agent();
     var Dispatcher1Wrapper = require_dispatcher1_wrapper();
     var ProxyAgent = require_proxy_agent();
     var Socks5ProxyAgent = require_socks5_proxy_agent();
@@ -25646,7 +25646,7 @@ var require_undici = __commonJS({
     module2.exports.Pool = Pool;
     module2.exports.BalancedPool = BalancedPool;
     module2.exports.RoundRobinPool = RoundRobinPool;
-    module2.exports.Agent = Agent2;
+    module2.exports.Agent = Agent3;
     module2.exports.Dispatcher1Wrapper = Dispatcher1Wrapper;
     module2.exports.ProxyAgent = ProxyAgent;
     module2.exports.Socks5ProxyAgent = Socks5ProxyAgent;
@@ -29507,7 +29507,7 @@ var require_fast_uri = __commonJS({
         query: void 0,
         fragment: void 0
       };
-      let isIP2 = false;
+      let isIP3 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -29532,9 +29532,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP2 = ipv6result.isIPV6;
+            isIP3 = ipv6result.isIPV6;
           } else {
-            isIP2 = true;
+            isIP3 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -29551,7 +29551,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP3 === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
             } catch (e) {
@@ -42498,7 +42498,7 @@ var require_mime_types = __commonJS({
     exports2.contentType = contentType;
     exports2.extension = extension;
     exports2.extensions = /* @__PURE__ */ Object.create(null);
-    exports2.lookup = lookup;
+    exports2.lookup = lookup2;
     exports2.types = /* @__PURE__ */ Object.create(null);
     populateMaps(exports2.extensions, exports2.types);
     function charset(type) {
@@ -42540,7 +42540,7 @@ var require_mime_types = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path) {
+    function lookup2(path) {
       if (!path || typeof path !== "string") {
         return false;
       }
@@ -52293,7 +52293,7 @@ var require_mime_types2 = __commonJS({
     exports2.contentType = contentType;
     exports2.extension = extension;
     exports2.extensions = /* @__PURE__ */ Object.create(null);
-    exports2.lookup = lookup;
+    exports2.lookup = lookup2;
     exports2.types = /* @__PURE__ */ Object.create(null);
     exports2._extensionConflicts = [];
     populateMaps(exports2.extensions, exports2.types);
@@ -52336,7 +52336,7 @@ var require_mime_types2 = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path) {
+    function lookup2(path) {
       if (!path || typeof path !== "string") {
         return false;
       }
@@ -59524,7 +59524,7 @@ var require_redis_errors = __commonJS({
 // ../../node_modules/.pnpm/cluster-key-slot@1.1.2/node_modules/cluster-key-slot/lib/index.js
 var require_lib2 = __commonJS({
   "../../node_modules/.pnpm/cluster-key-slot@1.1.2/node_modules/cluster-key-slot/lib/index.js"(exports2, module2) {
-    var lookup = [
+    var lookup2 = [
       0,
       4129,
       8258,
@@ -59824,11 +59824,11 @@ var require_lib2 = __commonJS({
             start = i;
           }
         } else if (char !== 125) {
-          resultHash = lookup[(char ^ resultHash >> 8) & 255] ^ resultHash << 8;
+          resultHash = lookup2[(char ^ resultHash >> 8) & 255] ^ resultHash << 8;
         } else if (i - 1 !== start) {
           return resultHash & 16383;
         }
-        result = lookup[(char ^ result >> 8) & 255] ^ result << 8;
+        result = lookup2[(char ^ result >> 8) & 255] ^ result << 8;
       }
       return result & 16383;
     };
@@ -73853,6 +73853,7 @@ function buildCliReference() {
     "## Notifications",
     "",
     "- `debugbundle alert list --project-id <id> [--limit <n>] [--auth-file <path>] [--json]`",
+    "- `debugbundle alert groups --project-id <id> [--limit <n>] [--cursor <cursor>] [--auth-file <path>] [--json]` lists safe alert delivery and email digest groups; `debugbundle alert group <direct|email_digest> <group-id> --project-id <id> [--cursor <cursor>] --json` pages their incident IDs.",
     "- `debugbundle alert create --project-id <id> --channel <channel> --condition <condition> [--service-id <id>] [--severity-min <level>] [--cooldown <seconds>] --config-json <json> [--is-enabled <true|false>] [--auth-file <path>] [--json]`",
     "- `debugbundle alert update <alert-id> --project-id <id> [--service-id <id|null>] [--channel <channel>] [--condition <condition>] [--severity-min <level|null>] [--cooldown <seconds>] [--config-json <json|null>] [--is-enabled <true|false>] [--auth-file <path>] [--json]`",
     "- `debugbundle alert delete <alert-id> --project-id <id> [--auth-file <path>] [--json]`",
@@ -74006,7 +74007,7 @@ function buildMcpReference() {
     "",
     "## Notification Tools",
     "",
-    "- `list_alerts`, `create_alert`, `update_alert`, `delete_alert` \u2014 manage incident alert rules.",
+    "- `list_alerts`, `create_alert`, `update_alert`, `delete_alert` \u2014 manage incident alert rules. `list_alert_groups` and `get_alert_group` inspect project-scoped delivery groups without raw payloads or destination secrets.",
     "- `list_webhooks`, `create_webhook`, `update_webhook`, `delete_webhook` \u2014 manage signed webhook destinations.",
     "- `test_webhook`, `list_webhook_deliveries` \u2014 validate webhook delivery and inspect delivery history.",
     "",
@@ -82199,7 +82200,7 @@ async function agentReadCommand(input3, dependencies = {}) {
 }
 
 // src/clean-command.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 var import_node_path11 = require("node:path");
 
 // src/cli-fs-helpers.ts
@@ -82215,7 +82216,7 @@ function resolveWorkspacePath(rootDirectory, targetPath) {
 }
 
 // src/local-retrieval-store.ts
-var import_promises8 = require("node:fs/promises");
+var import_promises9 = require("node:fs/promises");
 var import_node_path9 = require("node:path");
 
 // ../../packages/retrieval-client/src/mutation-outcome.ts
@@ -93841,8 +93842,8 @@ function applySSRFProtection(dispatcher2) {
   return dispatcher2;
 }
 function createSSRFProtectedDispatcher() {
-  const Agent2 = getAgent();
-  return applySSRFProtection(new Agent2());
+  const Agent3 = getAgent();
+  return applySSRFProtection(new Agent3());
 }
 var dispatcher;
 async function fetchRequest(provider, url, options) {
@@ -99578,6 +99579,88 @@ var CLAIM_DUE_AVAILABILITY_CHECKS_QUERY = `
     c.consecutive_successes
 `;
 
+// ../../packages/storage/src/alert-outbound-guard.ts
+var import_promises8 = require("node:dns/promises");
+var import_node_net2 = require("node:net");
+var import_undici3 = __toESM(require_undici(), 1);
+var blockedAddresses2 = new import_node_net2.BlockList();
+for (const [address, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+]) blockedAddresses2.addSubnet(address, prefix);
+for (const [address, prefix] of [
+  ["::", 128],
+  ["::1", 128],
+  ["64:ff9b::", 96],
+  ["100::", 64],
+  ["2001::", 23],
+  ["2001:db8::", 32],
+  ["2002::", 16],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["ff00::", 8]
+]) blockedAddresses2.addSubnet(address, prefix, "ipv6");
+function blocked() {
+  return new Error("alert_target_blocked");
+}
+function assertPublicAddress(address, family) {
+  if (family !== 4 && family !== 6 || (0, import_node_net2.isIP)(address) !== family || blockedAddresses2.check(address, family === 4 ? "ipv4" : "ipv6")) {
+    throw blocked();
+  }
+}
+function assertPublicHostname(hostname2) {
+  const normalized = hostname2.toLowerCase().replace(/\.$/, "");
+  if (!normalized.includes(".") || [".local", ".internal", ".localhost"].some((suffix) => normalized.endsWith(suffix))) {
+    throw blocked();
+  }
+}
+async function resolveAlertOutboundAddress(hostname2, resolve4 = import_promises8.lookup) {
+  const literalFamily = (0, import_node_net2.isIP)(hostname2);
+  if (literalFamily) {
+    assertPublicAddress(hostname2, literalFamily);
+    return { address: hostname2, family: literalFamily };
+  }
+  assertPublicHostname(hostname2);
+  let answers;
+  try {
+    answers = await resolve4(hostname2, { all: true, verbatim: true });
+  } catch {
+    throw blocked();
+  }
+  if (answers.length === 0) throw blocked();
+  for (const answer of answers) assertPublicAddress(answer.address, answer.family);
+  const first = answers[0];
+  return { address: first.address, family: first.family };
+}
+var outboundAgent = new import_undici3.Agent({
+  connections: 4,
+  maxOrigins: 128,
+  connect: {
+    lookup(hostname2, options, callback) {
+      resolveAlertOutboundAddress(hostname2).then(
+        ({ address, family }) => {
+          if (options.all) callback(null, [{ address, family }]);
+          else callback(null, address, family);
+        },
+        () => callback(blocked(), "")
+      );
+    }
+  }
+});
+
 // ../../packages/storage/src/auth-rate-limiter.ts
 var import_ioredis = __toESM(require_built3(), 1);
 
@@ -100097,6 +100180,11 @@ function normalizeInstalledJavaEvent(candidate) {
   };
 }
 
+// ../../packages/event-normalizer/src/java-stderr.ts
+function isJavaRedirectedStderrLogger(candidate) {
+  return typeof candidate === "string" && candidate.length <= 256 && (candidate === "stderr" || candidate === "org.jboss.stdio" || candidate.startsWith("org.jboss.stdio."));
+}
+
 // ../../packages/event-normalizer/src/java-timer-message.ts
 var TIMER_DIAGNOSTIC = /^WFLYEJB002(?:0|2):[^\n]*\[id=[^\]\n]*\btimedObjectId=/;
 var JAVA_TIMER_DATE = /\b(previousRun|initialExpiration|nextExpiration)=((?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s+(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+[A-Za-z][A-Za-z0-9:+-]{0,15}\s+\d{4})\b/g;
@@ -100586,12 +100674,22 @@ function getRequestResponseStatus(payload2) {
   const status = payload2?.["response_status"];
   return typeof status === "number" && Number.isFinite(status) ? status : null;
 }
-function classifyEvent(eventType, logLevel, probeActivationId, payload2, capturePreset = "minimal", immediateClientErrorStatuses = [], immediateClientErrorPathRules = []) {
+function isJavaStackContinuation(payload2) {
+  const message3 = payload2?.["message"];
+  if (typeof message3 !== "string" || message3.length > 16384 || /[\r\n]/.test(message3)) return false;
+  const attributes = payload2?.["attributes"];
+  if (attributes === null || typeof attributes !== "object" || Array.isArray(attributes)) return false;
+  if (!isJavaRedirectedStderrLogger(attributes["logger"])) return false;
+  if ("throwable" in attributes && attributes.throwable !== null) return false;
+  return /^\s*(?:at\s+[\w.$/]+\([^\r\n]*\)|\.\.\.\s+\d+\s+more|(?:Caused by|Suppressed):\s+[\w.$/]+(?:Exception|Error|Throwable)(?::[^\r\n]*|\s|$))\s*$/.test(message3);
+}
+function classifyEvent(eventType, logLevel, probeActivationId, payload2, capturePreset = "minimal", immediateClientErrorStatuses = [], immediateClientErrorPathRules = [], runtime) {
   switch (eventType) {
     case "backend_exception":
     case "frontend_exception":
       return "incident_signal";
     case "log_event":
+      if (runtime === "java" && isJavaStackContinuation(payload2)) return "context_signal";
       if (logLevel !== void 0 && INCIDENT_LOG_LEVELS.has(logLevel)) {
         return "incident_signal";
       }
@@ -102225,6 +102323,8 @@ var STORAGE_BOOTSTRAP_STATEMENTS = [
       severity_lifecycle_scope text,
       cooldown_seconds integer NOT NULL DEFAULT 0,
       config jsonb NOT NULL DEFAULT '{}'::jsonb,
+      signing_secret text,
+      webhook_payload_version smallint NOT NULL DEFAULT 0 CHECK (webhook_payload_version IN (0, 1)),
       is_enabled boolean NOT NULL DEFAULT true,
       created_at timestamptz NOT NULL DEFAULT now(),
       updated_at timestamptz NOT NULL DEFAULT now(),
@@ -102271,6 +102371,7 @@ var STORAGE_BOOTSTRAP_STATEMENTS = [
       dedupe_key text NOT NULL,
       notification_key text NOT NULL DEFAULT '',
       coalescing_key text,
+      evaluation_job_id text,
       channel text NOT NULL,
       status text NOT NULL,
       payload jsonb NOT NULL,
@@ -102289,6 +102390,21 @@ var STORAGE_BOOTSTRAP_STATEMENTS = [
     CREATE INDEX alert_deliveries_alert_notification_idx
     ON alert_deliveries (alert_id, notification_key, created_at DESC)
   `,
+  `
+    CREATE TABLE alert_delivery_members (
+      id uuid PRIMARY KEY,
+      delivery_id uuid NOT NULL REFERENCES alert_deliveries(id) ON DELETE CASCADE,
+      incident_id uuid NOT NULL,
+      condition_type text NOT NULL,
+      dedupe_key text NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (delivery_id, incident_id, condition_type, dedupe_key)
+    )
+  `,
+  `
+    CREATE INDEX alert_delivery_members_delivery_created_idx
+    ON alert_delivery_members (delivery_id, created_at ASC, id ASC)
+  `,
   `
     CREATE TABLE alert_email_digests (
       id uuid PRIMARY KEY,
@@ -104783,6 +104899,45 @@ var STORAGE_SCHEMA_MIGRATIONS = [
     id: "202609160001_add_browser_resource_routes",
     description: "Retain sanitized browser resource routes independently of raw event sampling.",
     statements: ["ALTER TABLE incident_events ADD COLUMN IF NOT EXISTS resource_route text"]
+  }),
+  defineStorageSchemaMigration({
+    id: "202609240001_add_alert_delivery_members",
+    description: "Retain incident identities represented by one coherent alert delivery.",
+    statements: [
+      `
+        CREATE TABLE IF NOT EXISTS alert_delivery_members (
+          id uuid PRIMARY KEY,
+          delivery_id uuid NOT NULL REFERENCES alert_deliveries(id) ON DELETE CASCADE,
+          incident_id uuid NOT NULL,
+          condition_type text NOT NULL,
+          dedupe_key text NOT NULL,
+          created_at timestamptz NOT NULL DEFAULT now(),
+          UNIQUE (delivery_id, incident_id, condition_type, dedupe_key)
+        )
+      `,
+      `
+        CREATE INDEX IF NOT EXISTS alert_delivery_members_delivery_created_idx
+        ON alert_delivery_members (delivery_id, created_at ASC, id ASC)
+      `
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202609240002_add_alert_webhook_signing_secret",
+    description: "Store custom alert-webhook signing secrets separately from readable rule config.",
+    statements: ["ALTER TABLE alert_rules ADD COLUMN IF NOT EXISTS signing_secret text"]
+  }),
+  defineStorageSchemaMigration({
+    id: "202609250001_add_alert_evaluation_owner",
+    description: "Bind direct alert retries to the durable evaluation job that created the intent.",
+    statements: ["ALTER TABLE alert_deliveries ADD COLUMN IF NOT EXISTS evaluation_job_id text"]
+  }),
+  defineStorageSchemaMigration({
+    id: "202609250002_version_alert_webhook_payloads",
+    description: "Preserve legacy custom webhook bodies while enforcing signatures for every delivery.",
+    statements: [
+      "ALTER TABLE alert_rules ADD COLUMN IF NOT EXISTS webhook_payload_version smallint NOT NULL DEFAULT 0 CHECK (webhook_payload_version IN (0, 1))",
+      "UPDATE alert_rules SET webhook_payload_version = 1 WHERE channel = 'webhook' AND signing_secret IS NOT NULL"
+    ]
   })
 ];
 
@@ -104808,7 +104963,7 @@ function projectLocalEvidence(value) {
   return projected.value;
 }
 async function readLocalArtifact(path, dependencies) {
-  const readFile = dependencies?.readFile ?? import_promises8.readFile;
+  const readFile = dependencies?.readFile ?? import_promises9.readFile;
   const raw = await readFile(path, "utf8");
   if (Buffer.byteLength(raw, "utf8") > MAX_ARTIFACT_BYTES) {
     throw createReadError(503, "privacy_projection_unavailable");
@@ -104827,7 +104982,7 @@ function createReadError(status, code) {
   return new RetrievalApiError(status, code);
 }
 async function readJsonFile(path, dependencies) {
-  const readFile = dependencies?.readFile ?? import_promises8.readFile;
+  const readFile = dependencies?.readFile ?? import_promises9.readFile;
   try {
     return JSON.parse(await readFile(path, "utf8"));
   } catch (error2) {
@@ -104997,7 +105152,7 @@ async function readLocalState(dependencies) {
 }
 async function writeLocalState(state, dependencies) {
   const rootDirectory = getWorkspaceRoot(dependencies);
-  const writeFile = dependencies?.writeFile ?? import_promises8.writeFile;
+  const writeFile = dependencies?.writeFile ?? import_promises9.writeFile;
   await writeFile(getStateFilePath(rootDirectory), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -105086,7 +105241,7 @@ async function reopenLocalIncident(input3, dependencies) {
 }
 
 // src/cloud-artifact-cache.ts
-var import_promises9 = require("node:fs/promises");
+var import_promises10 = require("node:fs/promises");
 var import_node_path10 = require("node:path");
 
 // src/retrieval-source.ts
@@ -105219,9 +105374,9 @@ async function pruneCloudArtifactCache(input3, dependencies) {
   };
 }
 async function pruneExpiredArtifactsInDirectory(directoryPath, now, olderThanMs, dependencies) {
-  const readdir = dependencies?.readdir ?? import_promises9.readdir;
-  const rm = dependencies?.rm ?? import_promises9.rm;
-  const stat = dependencies?.stat ?? import_promises9.stat;
+  const readdir = dependencies?.readdir ?? import_promises10.readdir;
+  const rm = dependencies?.rm ?? import_promises10.rm;
+  const stat = dependencies?.stat ?? import_promises10.stat;
   let fileNames;
   try {
     fileNames = await readdir(directoryPath);
@@ -105263,8 +105418,8 @@ async function pruneExpiredArtifactsInDirectory(directoryPath, now, olderThanMs,
   );
 }
 async function updateCachedArtifactStatus(filePath, input3, dependencies) {
-  const readFile = dependencies?.readFile ?? import_promises9.readFile;
-  const writeFile = dependencies?.writeFile ?? import_promises9.writeFile;
+  const readFile = dependencies?.readFile ?? import_promises10.readFile;
+  const writeFile = dependencies?.writeFile ?? import_promises10.writeFile;
   let payload2;
   try {
     const raw = await readFile(filePath, "utf8");
@@ -105298,8 +105453,8 @@ function applyIncidentStatusToPayload(payload2, incidentId, incident) {
   return nextPayload;
 }
 async function persistCloudArtifact(directoryPath, fileName, payload2, dependencies) {
-  const mkdir5 = dependencies?.mkdir ?? import_promises9.mkdir;
-  const writeFile = dependencies?.writeFile ?? import_promises9.writeFile;
+  const mkdir5 = dependencies?.mkdir ?? import_promises10.mkdir;
+  const writeFile = dependencies?.writeFile ?? import_promises10.writeFile;
   await mkdir5(directoryPath, { recursive: true });
   await writeFile((0, import_node_path10.join)(directoryPath, fileName), `${JSON.stringify(payload2, null, 2)}
 `, "utf8");
@@ -105341,9 +105496,9 @@ function parseOlderThan(value) {
   return Number.parseInt(match[1], 10) * 24 * 60 * 60 * 1e3;
 }
 async function cleanProcessedEventFiles(input3, dependencies) {
-  const readdir = dependencies.readdir ?? import_promises10.readdir;
-  const rm = dependencies.rm ?? import_promises10.rm;
-  const stat = dependencies.stat ?? import_promises10.stat;
+  const readdir = dependencies.readdir ?? import_promises11.readdir;
+  const rm = dependencies.rm ?? import_promises11.rm;
+  const stat = dependencies.stat ?? import_promises11.stat;
   const rootDirectory = (dependencies.cwd ?? process.cwd)();
   const eventsDirectoryPath = (0, import_node_path11.join)(rootDirectory, LOCAL_EVENTS_DIRECTORY_PATH);
   const state = await readLocalState(dependencies);
@@ -105378,9 +105533,9 @@ async function cleanProcessedEventFiles(input3, dependencies) {
   return { removed, retained };
 }
 async function cleanRelaySpoolFiles(input3, dependencies) {
-  const readdir = dependencies.readdir ?? import_promises10.readdir;
-  const rm = dependencies.rm ?? import_promises10.rm;
-  const stat = dependencies.stat ?? import_promises10.stat;
+  const readdir = dependencies.readdir ?? import_promises11.readdir;
+  const rm = dependencies.rm ?? import_promises11.rm;
+  const stat = dependencies.stat ?? import_promises11.stat;
   const rootDirectory = (dependencies.cwd ?? process.cwd)();
   const spoolDirectoryPath = (0, import_node_path11.join)(rootDirectory, LOCAL_RELAY_SPOOL_DIRECTORY_PATH);
   let spoolFileNames;
@@ -105431,7 +105586,7 @@ function sortLocalIncidentRemovalPriority(left, right) {
   return left.incident_id.localeCompare(right.incident_id);
 }
 async function applyLocalIncidentRetention(dependencies) {
-  const rm = dependencies.rm ?? import_promises10.rm;
+  const rm = dependencies.rm ?? import_promises11.rm;
   const rootDirectory = (dependencies.cwd ?? process.cwd)();
   const state = await readLocalState(dependencies);
   const incidents = Object.values(state.incidents);
@@ -105464,7 +105619,7 @@ async function countLocalIncidents(dependencies) {
   return Object.keys((await readLocalState(dependencies)).incidents).length;
 }
 async function countDirectoryFiles(directoryPath, dependencies, extension) {
-  const readdir = dependencies.readdir ?? import_promises10.readdir;
+  const readdir = dependencies.readdir ?? import_promises11.readdir;
   const rootDirectory = (dependencies.cwd ?? process.cwd)();
   try {
     return (await readdir((0, import_node_path11.join)(rootDirectory, directoryPath))).filter((fileName) => fileName.endsWith(extension)).length;
@@ -105482,8 +105637,8 @@ async function countRelaySpoolEventFiles(dependencies) {
   return countDirectoryFiles(LOCAL_RELAY_SPOOL_DIRECTORY_PATH, dependencies, ".events.json");
 }
 async function resetRuntimeData(dependencies) {
-  const mkdir5 = dependencies.mkdir ?? import_promises10.mkdir;
-  const rm = dependencies.rm ?? import_promises10.rm;
+  const mkdir5 = dependencies.mkdir ?? import_promises11.mkdir;
+  const rm = dependencies.rm ?? import_promises11.rm;
   const rootDirectory = (dependencies.cwd ?? process.cwd)();
   const [processedEventFilesRemoved, relaySpoolFilesRemoved, cloudCacheFilesRemoved, localIncidentCount] = await Promise.all([
     countProcessedAndUnprocessedEventFiles(dependencies),
@@ -105575,7 +105730,7 @@ async function cleanCommand(input3, dependencies = {}) {
   };
 }
 async function countProcessedAndUnprocessedEventFiles(dependencies) {
-  const readdir = dependencies.readdir ?? import_promises10.readdir;
+  const readdir = dependencies.readdir ?? import_promises11.readdir;
   const rootDirectory = (dependencies.cwd ?? process.cwd)();
   try {
     return (await readdir((0, import_node_path11.join)(rootDirectory, LOCAL_EVENTS_DIRECTORY_PATH))).filter((fileName) => fileName.endsWith(".events.json")).length;
@@ -105591,7 +105746,7 @@ async function countCloudArtifactCache(dependencies) {
 }
 
 // src/connect-command.ts
-var import_promises13 = require("node:fs/promises");
+var import_promises14 = require("node:fs/promises");
 var import_node_path14 = require("node:path");
 
 // ../../packages/project-management-client/src/index.ts
@@ -105978,7 +106133,7 @@ function createTokenManagementApi(client) {
 }
 
 // src/auth-state.ts
-var import_promises11 = require("node:fs/promises");
+var import_promises12 = require("node:fs/promises");
 var import_node_os2 = require("node:os");
 var import_node_path12 = require("node:path");
 var CliAuthStateSchema = external_exports.object({
@@ -106003,7 +106158,7 @@ function buildTokenPreview(token) {
 }
 async function readCliAuthState(input3, dependencies) {
   const authFilePath = input3.authFilePath ?? getDefaultAuthFilePath();
-  const readFile = dependencies?.readFile ?? ((filePath) => (0, import_promises11.readFile)(filePath, "utf8"));
+  const readFile = dependencies?.readFile ?? ((filePath) => (0, import_promises12.readFile)(filePath, "utf8"));
   let rawAuthState;
   try {
     rawAuthState = await readFile(authFilePath);
@@ -106027,8 +106182,8 @@ async function readCliAuthState(input3, dependencies) {
 }
 async function persistCliAuthState(input3, dependencies) {
   const authFilePath = input3.authFilePath ?? getDefaultAuthFilePath();
-  const mkdir5 = dependencies?.mkdir ?? import_promises11.mkdir;
-  const writeFile = dependencies?.writeFile ?? import_promises11.writeFile;
+  const mkdir5 = dependencies?.mkdir ?? import_promises12.mkdir;
+  const writeFile = dependencies?.writeFile ?? import_promises12.writeFile;
   await mkdir5((0, import_node_path12.dirname)(authFilePath), { recursive: true });
   await writeFile(`${authFilePath}`, `${JSON.stringify(input3.authState, null, 2)}
 `, "utf8");
@@ -106056,16 +106211,43 @@ var AlertSchema = external_exports.object({
   severity_lifecycle_scope: AlertSeverityLifecycleScopeSchema.nullable().optional().default(null),
   cooldown_seconds: external_exports.number().int().min(0),
   config: external_exports.record(external_exports.string(), external_exports.unknown()),
+  signing_secret: external_exports.string().optional(),
   is_enabled: external_exports.boolean(),
   created_at: external_exports.string(),
   updated_at: external_exports.string()
 }).strict();
 var AlertListResponseSchema = external_exports.object({
-  alerts: external_exports.array(AlertSchema)
+  alerts: external_exports.array(AlertSchema.omit({ signing_secret: true }).strict())
 }).strict();
 var AlertResponseSchema = external_exports.object({
   alert: AlertSchema
 }).strict();
+var AlertGroupSummarySchema = external_exports.object({
+  group_id: external_exports.string().uuid(),
+  kind: external_exports.enum(["direct", "email_digest"]),
+  project_id: external_exports.string().uuid(),
+  alert_id: external_exports.string().uuid().nullable(),
+  root_incident_id: external_exports.string().uuid().nullable(),
+  channel: AlertChannelSchema,
+  status: external_exports.enum(["pending", "delivered", "failed"]),
+  member_count: external_exports.number().int().min(0),
+  created_at: external_exports.string(),
+  delivered_at: external_exports.string().nullable()
+}).strict();
+var AlertGroupMemberSchema = external_exports.object({
+  incident_id: external_exports.string().uuid(),
+  condition_type: external_exports.string(),
+  created_at: external_exports.string()
+}).strict();
+var AlertGroupListResponseSchema = external_exports.object({
+  groups: external_exports.array(AlertGroupSummarySchema),
+  next_cursor: external_exports.string().nullable()
+}).strict();
+var AlertGroupResponseSchema = external_exports.object({
+  group: AlertGroupSummarySchema,
+  members: external_exports.array(AlertGroupMemberSchema),
+  next_cursor: external_exports.string().nullable()
+}).strict();
 var ApiErrorResponseSchema4 = external_exports.object({
   error: external_exports.string()
 }).strict();
@@ -106128,6 +106310,28 @@ function createAlertApi(client) {
         })
       );
     },
+    async listAlertGroups(input3) {
+      const response = await client.request({
+        method: "GET",
+        path: `/v1/alert-groups${buildQuery({ project_id: input3.projectId, limit: input3.limit, cursor: input3.cursor })}`,
+        bearerToken: input3.bearerToken
+      });
+      if (response.status < 200 || response.status >= 300) parseApiError4(response.status, response.body);
+      const parsed = AlertGroupListResponseSchema.safeParse(response.body);
+      if (!parsed.success) throw new AlertApiError(response.status, "invalid_response_shape");
+      return parsed.data;
+    },
+    async getAlertGroup(input3) {
+      const response = await client.request({
+        method: "GET",
+        path: `/v1/alert-groups/${input3.kind}/${encodeURIComponent(input3.groupId)}${buildQuery({ project_id: input3.projectId, limit: input3.limit, cursor: input3.cursor })}`,
+        bearerToken: input3.bearerToken
+      });
+      if (response.status < 200 || response.status >= 300) parseApiError4(response.status, response.body);
+      const parsed = AlertGroupResponseSchema.safeParse(response.body);
+      if (!parsed.success) throw new AlertApiError(response.status, "invalid_response_shape");
+      return parsed.data;
+    },
     async createAlert(input3) {
       const body = {
         project_id: input3.projectId,
@@ -106135,6 +106339,9 @@ function createAlertApi(client) {
         condition_type: input3.conditionType,
         config: input3.config
       };
+      if (input3.channel === "webhook") {
+        body.signing = "hmac_sha256_v1";
+      }
       if (input3.serviceId !== void 0) {
         body.service_id = input3.serviceId;
       }
@@ -106182,6 +106389,9 @@ function createAlertApi(client) {
       if (input3.config !== void 0) {
         body.config = input3.config;
       }
+      if (input3.rotateSigningSecret === true) {
+        body.rotate_signing_secret = true;
+      }
       if (input3.isEnabled !== void 0) {
         body.is_enabled = input3.isEnabled;
       }
@@ -107561,12 +107771,12 @@ async function readConnectionConfig(rootDirectory, readFile) {
 
 // src/interactive-auth.ts
 var import_node_process = require("node:process");
-var import_promises12 = require("node:readline/promises");
+var import_promises13 = require("node:readline/promises");
 function isInteractiveTerminal() {
   return import_node_process.stdin.isTTY === true && import_node_process.stdout.isTTY === true;
 }
 async function promptForInteractiveLoginSelection() {
-  const readlineInterface = (0, import_promises12.createInterface)({
+  const readlineInterface = (0, import_promises13.createInterface)({
     input: import_node_process.stdin,
     output: import_node_process.stdout
   });
@@ -108171,9 +108381,9 @@ function buildValidationFailureResult(input3) {
 }
 async function connectCommand(input3, dependencies = {}) {
   const cwd = dependencies.cwd ?? (() => process.cwd());
-  const readFile = dependencies.readFile ?? ((path) => (0, import_promises13.readFile)(path, "utf8"));
-  const stat = dependencies.stat ?? import_promises13.stat;
-  const writeFile = dependencies.writeFile ?? import_promises13.writeFile;
+  const readFile = dependencies.readFile ?? ((path) => (0, import_promises14.readFile)(path, "utf8"));
+  const stat = dependencies.stat ?? import_promises14.stat;
+  const writeFile = dependencies.writeFile ?? import_promises14.writeFile;
   const readAuthState = dependencies.readAuthState ?? ((authInput) => readCliAuthState(authInput));
   const createHttpClient = dependencies.createHttpClient ?? ((clientInput) => {
     const httpClientDependencies = {};
@@ -108380,7 +108590,7 @@ var legacy_skill_hashes_default = {
 };
 
 // src/agent-setup.ts
-var import_promises14 = require("node:readline/promises");
+var import_promises15 = require("node:readline/promises");
 var import_node_process2 = require("node:process");
 var MANAGED_AGENTS_START = "<!-- debugbundle:start -->";
 var MANAGED_AGENTS_END = "<!-- debugbundle:end -->";
@@ -108418,7 +108628,7 @@ async function chooseAgents(root, input3, dependencies) {
   let answer;
   if (dependencies.promptUser) answer = await dependencies.promptUser(prompt);
   else {
-    const terminal = (0, import_promises14.createInterface)({ input: import_node_process2.stdin, output: import_node_process2.stdout });
+    const terminal = (0, import_promises15.createInterface)({ input: import_node_process2.stdin, output: import_node_process2.stdout });
     try {
       answer = await terminal.question(prompt);
     } finally {
@@ -108470,7 +108680,7 @@ function localScaffoldFailure(error2, json2 = false) {
 }
 
 // src/doctor-command.ts
-var import_promises15 = require("node:fs/promises");
+var import_promises16 = require("node:fs/promises");
 var import_node_path15 = require("node:path");
 var HealthResponseSchema = external_exports.object({
   status: external_exports.literal("ok")
@@ -108618,7 +108828,7 @@ function buildPrivacyPreview() {
     "body.otp",
     "context.apiKey"
   ];
-  const sampleEventClass = classifyEvent(sampleEvent.event_type, void 0, void 0, sampleEvent.payload);
+  const sampleEventClass = classifyEvent(sampleEvent.event_type, void 0, void 0, sampleEvent.payload, "minimal", [], [], sampleEvent.service.runtime);
   return {
     policy_version: TELEMETRY_PRIVACY_POLICY_VERSION,
     rule_families: ["sensitive_keys", "credential_text", "urls", "private_keys", "payment_cards"],
@@ -109014,13 +109224,13 @@ async function runDoctorCommand(input3, dependencies = {}) {
   const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
   const fetchImpl = dependencies.fetchImpl ?? nodeFetch;
   const readAuthStateImpl = dependencies.readAuthState ?? readCliAuthState;
-  const readdir = dependencies.readdir ?? import_promises15.readdir;
+  const readdir = dependencies.readdir ?? import_promises16.readdir;
   const readFile = dependencies.readFile ?? (async (filePath) => {
     const content = await readManaged(rootDirectory, (0, import_node_path15.relative)(rootDirectory, filePath));
     if (content === void 0) throw Object.assign(new Error("Missing local scaffold file."), { code: "ENOENT" });
     return content;
   });
-  const stat = dependencies.stat ?? import_promises15.stat;
+  const stat = dependencies.stat ?? import_promises16.stat;
   const rootDirectory = await projectRoot(cwd());
   const currentTime = now();
   const { check: profileCheck, profile, validationErrors } = await loadProfile(rootDirectory, { readFile, stat });
@@ -109066,7 +109276,7 @@ async function doctorCommand(input3, dependencies = {}) {
 
 // src/ingest-command.ts
 var import_node_crypto13 = require("node:crypto");
-var import_promises17 = require("node:fs/promises");
+var import_promises18 = require("node:fs/promises");
 var import_node_path17 = require("node:path");
 
 // ../../packages/log-parser/src/project-id.ts
@@ -109386,7 +109596,7 @@ function parseLogFile(content, input3) {
 
 // src/process-command.ts
 var import_node_crypto12 = require("node:crypto");
-var import_promises16 = require("node:fs/promises");
+var import_promises17 = require("node:fs/promises");
 var import_node_path16 = require("node:path");
 
 // ../../packages/shared-types/src/browser-recovery.ts
@@ -110927,7 +111137,10 @@ function classifyEnvelope(envelope, capturePreset) {
     envelope.event_type === "log_event" ? envelope.payload.level : void 0,
     envelope.event_type === "probe_event" ? envelope.payload.activation_id : void 0,
     envelope.payload,
-    capturePreset
+    capturePreset,
+    [],
+    [],
+    envelope.service.runtime
   );
 }
 function isIncidentSignalEnvelope(envelope, capturePreset) {
@@ -111245,11 +111458,11 @@ function serializeState(state) {
 }
 async function processCommand(input3, dependencies = {}) {
   const cwd = dependencies.cwd ?? (() => process.cwd());
-  const mkdir5 = dependencies.mkdir ?? import_promises16.mkdir;
-  const readFile = dependencies.readFile ?? ((filePath) => (0, import_promises16.readFile)(filePath, "utf8"));
-  const readdir = dependencies.readdir ?? import_promises16.readdir;
-  const stat = dependencies.stat ?? import_promises16.stat;
-  const writeFile = dependencies.writeFile ?? ((filePath, content) => (0, import_promises16.writeFile)(filePath, content, "utf8"));
+  const mkdir5 = dependencies.mkdir ?? import_promises17.mkdir;
+  const readFile = dependencies.readFile ?? ((filePath) => (0, import_promises17.readFile)(filePath, "utf8"));
+  const readdir = dependencies.readdir ?? import_promises17.readdir;
+  const stat = dependencies.stat ?? import_promises17.stat;
+  const writeFile = dependencies.writeFile ?? ((filePath, content) => (0, import_promises17.writeFile)(filePath, content, "utf8"));
   const rootDirectory = cwd();
   const eventsDirectoryPath = (0, import_node_path16.join)(rootDirectory, LOCAL_EVENTS_DIRECTORY_PATH2);
   const statePath = (0, import_node_path16.join)(rootDirectory, LOCAL_STATE_FILE_PATH);
@@ -111539,11 +111752,11 @@ async function ingestCommand(input3, dependencies = {}) {
     };
   }
   const cwd = dependencies.cwd ?? (() => process.cwd());
-  const mkdir5 = dependencies.mkdir ?? (async (path, options) => (0, import_promises17.mkdir)(path, options));
+  const mkdir5 = dependencies.mkdir ?? (async (path, options) => (0, import_promises18.mkdir)(path, options));
   const processLocalEvents = dependencies.processCommand ?? processCommand;
-  const readFile = dependencies.readFile ?? (async (path) => (0, import_promises17.readFile)(path, "utf8"));
-  const rename3 = dependencies.rename ?? (async (sourcePath, destinationPath) => (0, import_promises17.rename)(sourcePath, destinationPath));
-  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises17.writeFile)(path, content, "utf8"));
+  const readFile = dependencies.readFile ?? (async (path) => (0, import_promises18.readFile)(path, "utf8"));
+  const rename3 = dependencies.rename ?? (async (sourcePath, destinationPath) => (0, import_promises18.rename)(sourcePath, destinationPath));
+  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises18.writeFile)(path, content, "utf8"));
   try {
     const rootDirectory = cwd();
     const profile = await readProfile(rootDirectory, readFile);
@@ -111600,7 +111813,7 @@ async function ingestCommand(input3, dependencies = {}) {
 }
 
 // src/watch-command.ts
-var import_promises18 = require("node:fs/promises");
+var import_promises19 = require("node:fs/promises");
 var import_node_path18 = require("node:path");
 function normalizeBaseUrl5(baseUrl) {
   return baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
@@ -111644,18 +111857,18 @@ async function watchCommand(input3, dependencies = {}) {
     };
   }
   const cwd = dependencies.cwd ?? (() => process.cwd());
-  const mkdir5 = dependencies.mkdir ?? (async (path, options) => (0, import_promises18.mkdir)(path, options));
+  const mkdir5 = dependencies.mkdir ?? (async (path, options) => (0, import_promises19.mkdir)(path, options));
   const pollIntervalMs = dependencies.pollIntervalMs ?? 1e3;
   const processLocalEvents = dependencies.processCommand ?? processCommand;
-  const readFile = dependencies.readFile ?? (async (path) => (0, import_promises18.readFile)(path));
+  const readFile = dependencies.readFile ?? (async (path) => (0, import_promises19.readFile)(path));
   const readEnv = dependencies.readEnv ?? ((name) => process.env[name]);
-  const rename3 = dependencies.rename ?? (async (sourcePath, destinationPath) => (0, import_promises18.rename)(sourcePath, destinationPath));
+  const rename3 = dependencies.rename ?? (async (sourcePath, destinationPath) => (0, import_promises19.rename)(sourcePath, destinationPath));
   const fetchDependencies = dependencies.fetchImpl === void 0 ? void 0 : { fetchImpl: dependencies.fetchImpl };
   const sendEvents = dependencies.sendEvents ?? ((requestInput) => sendEventsToApi(requestInput, fetchDependencies));
   const signal = dependencies.signal;
   const sleep = dependencies.sleep ?? (async (milliseconds) => new Promise((resolve4) => setTimeout(resolve4, milliseconds)));
-  const stat = dependencies.stat ?? import_promises18.stat;
-  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises18.writeFile)(path, content, "utf8"));
+  const stat = dependencies.stat ?? import_promises19.stat;
+  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises19.writeFile)(path, content, "utf8"));
   try {
     const rootDirectory = cwd();
     const profile = await readProfile(rootDirectory, async (path) => (await readFile(path)).toString("utf8"));
@@ -111777,7 +111990,7 @@ async function watchCommand(input3, dependencies = {}) {
 }
 
 // src/setup-command.ts
-var import_promises20 = require("node:fs/promises");
+var import_promises21 = require("node:fs/promises");
 var import_node_path21 = require("node:path");
 
 // src/setup-service-discovery.ts
@@ -112453,10 +112666,10 @@ async function resolveRelaySetup(rootDirectory, services, selectedTargetNames, r
 }
 
 // src/setup-target-selection.ts
-var import_promises19 = require("node:readline/promises");
+var import_promises20 = require("node:readline/promises");
 var import_node_process3 = require("node:process");
 function defaultPromptUser(prompt) {
-  const terminal = (0, import_promises19.createInterface)({ input: import_node_process3.stdin, output: import_node_process3.stdout });
+  const terminal = (0, import_promises20.createInterface)({ input: import_node_process3.stdin, output: import_node_process3.stdout });
   return terminal.question(prompt).finally(() => {
     terminal.close();
   });
@@ -112776,12 +112989,12 @@ async function buildProfile(rootDirectory, dependencies) {
 async function setupCommand(input3, dependencies = {}) {
   const cwd = dependencies.cwd ?? (() => process.cwd());
   const mkdir5 = dependencies.mkdir ?? (async (path, options) => {
-    await (0, import_promises20.mkdir)(path, options);
+    await (0, import_promises21.mkdir)(path, options);
   });
-  const readFile = dependencies.readFile ?? (async (path) => (0, import_promises20.readFile)(path, "utf8"));
-  const readdir = dependencies.readdir ?? (async (path) => (0, import_promises20.readdir)(path));
-  const stat = dependencies.stat ?? (async (path) => (0, import_promises20.stat)(path));
-  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises20.writeFile)(path, content, "utf8"));
+  const readFile = dependencies.readFile ?? (async (path) => (0, import_promises21.readFile)(path, "utf8"));
+  const readdir = dependencies.readdir ?? (async (path) => (0, import_promises21.readdir)(path));
+  const stat = dependencies.stat ?? (async (path) => (0, import_promises21.stat)(path));
+  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises21.writeFile)(path, content, "utf8"));
   const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
   try {
     const rootDirectory = await projectRoot(cwd());
@@ -114128,7 +114341,7 @@ function formatCloudResult(input3, exitCode, checks, errors, incidentId, verific
 
 // src/verify-command.ts
 var import_node_crypto14 = require("node:crypto");
-var import_promises21 = require("node:fs/promises");
+var import_promises22 = require("node:fs/promises");
 var import_node_path22 = require("node:path");
 function localFailureStepName(checks) {
   let hasLocalProcessing = false;
@@ -114345,14 +114558,14 @@ async function writeVerificationEventBatch(input3, dependencies) {
 async function verifyLocalCommand(input3, dependencies = {}) {
   const cwd = dependencies.cwd ?? (() => process.cwd());
   const mkdir5 = dependencies.mkdir ?? (async (path, options) => {
-    await (0, import_promises21.mkdir)(path, options);
+    await (0, import_promises22.mkdir)(path, options);
   });
   const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
   const processLocal = dependencies.processCommand ?? processCommand;
   const readVerifiedLocalState = dependencies.readLocalState ?? readLocalState;
   const readVerifiedLocalBundle = dependencies.getLocalBundle ?? getLocalBundle;
-  const rename3 = dependencies.rename ?? (async (sourcePath, destinationPath) => (0, import_promises21.rename)(sourcePath, destinationPath));
-  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises21.writeFile)(path, content, "utf8"));
+  const rename3 = dependencies.rename ?? (async (sourcePath, destinationPath) => (0, import_promises22.rename)(sourcePath, destinationPath));
+  const writeFile = dependencies.writeFile ?? (async (path, content) => (0, import_promises22.writeFile)(path, content, "utf8"));
   const checks = [];
   function finalize(exitCode, errors, incidentId) {
     return formatResult(input3, exitCode, checks, errors, incidentId);
@@ -114373,7 +114586,7 @@ async function verifyLocalCommand(input3, dependencies = {}) {
   });
   try {
     const rootDirectory = cwd();
-    const profile = await readProfile(rootDirectory, async (path) => (0, import_promises21.readFile)(path, "utf8"));
+    const profile = await readProfile(rootDirectory, async (path) => (0, import_promises22.readFile)(path, "utf8"));
     const projectId = buildProjectId(profile);
     const verificationNow = now();
     const runId = verificationNow.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14);
@@ -115039,8 +115252,10 @@ var CLI_USAGE_LINES = [
   "  debugbundle token member create --label <label> [--auth-file <path>] [--json]",
   "  debugbundle token member revoke <token-id> [--auth-file <path>] [--json]",
   "  debugbundle alert list --project-id <id> [--limit <n>] [--auth-file <path>] [--json]",
+  "  debugbundle alert groups --project-id <id> [--limit <n>] [--cursor <cursor>] [--auth-file <path>] [--json]",
+  "  debugbundle alert group <direct|email_digest> <group-id> --project-id <id> [--limit <n>] [--cursor <cursor>] [--auth-file <path>] [--json]",
   "  debugbundle alert create --project-id <id> --channel <channel> --condition <condition> [--service-id <id>] [--severity-min <level>] [--severity-lifecycle-scope <new_incident|incident_regressed|both>] [--cooldown <seconds>] --config-json <json> [--is-enabled <true|false>] [--auth-file <path>] [--json]",
-  "  debugbundle alert update <alert-id> --project-id <id> [--service-id <id|null>] [--channel <channel>] [--condition <condition>] [--severity-min <level|null>] [--severity-lifecycle-scope <new_incident|incident_regressed|both|null>] [--cooldown <seconds>] [--config-json <json|null>] [--is-enabled <true|false>] [--auth-file <path>] [--json]",
+  "  debugbundle alert update <alert-id> --project-id <id> [--service-id <id|null>] [--channel <channel>] [--condition <condition>] [--severity-min <level|null>] [--severity-lifecycle-scope <new_incident|incident_regressed|both|null>] [--cooldown <seconds>] [--config-json <json|null>] [--rotate-signing-secret <true|false>] [--is-enabled <true|false>] [--auth-file <path>] [--json]",
   "    Email config supports aggregation_window_seconds (1-300, default 10); other channels support cooldown_scope (incident or project, isolated by environment/severity).",
   "  debugbundle alert delete <alert-id> --project-id <id> [--auth-file <path>] [--json]",
   "  debugbundle slack list --project-id <id> [--auth-file <path>] [--json]",
@@ -115099,7 +115314,7 @@ function formatUsage() {
 }
 
 // src/validate-command.ts
-var import_promises22 = require("node:fs/promises");
+var import_promises23 = require("node:fs/promises");
 var import_node_path23 = require("node:path");
 var SUGGESTED_ACTIONS2 = [
   "Run debugbundle setup if .debugbundle/profile.json is missing.",
@@ -115214,14 +115429,14 @@ async function fixMissingFile(rootDirectory, filePath, buildContent, dependencie
 async function runValidateCommand(input3, dependencies = {}) {
   const cwd = dependencies.cwd ?? (() => process.cwd());
   const mkdir5 = dependencies.mkdir ?? (async (path, options) => {
-    await (0, import_promises22.mkdir)(path, options);
+    await (0, import_promises23.mkdir)(path, options);
   });
   const readFile = dependencies.readFile ?? (async (filePath) => {
     const content = await readManaged(rootDirectory, (0, import_node_path23.relative)(rootDirectory, filePath));
     if (content === void 0) throw Object.assign(new Error("Missing local scaffold file."), { code: "ENOENT" });
     return content;
   });
-  const stat = dependencies.stat ?? import_promises22.stat;
+  const stat = dependencies.stat ?? import_promises23.stat;
   const rootDirectory = await projectRoot(cwd());
   for (const file of [PROFILE_FILE_PATH, CONNECTION_FILE_PATH, GITIGNORE_FILE_PATH]) await safePath(rootDirectory, file);
   const profileValidation = await validateProfile(rootDirectory, { readFile, stat });
@@ -122317,6 +122532,78 @@ async function listAlertsWithAuthCommand(input3, dependencies) {
     }
   });
 }
+async function listAlertGroupsCommand(input3, api) {
+  try {
+    const result = await api.listAlertGroups({
+      bearerToken: input3.bearerToken,
+      projectId: input3.projectId,
+      ...input3.limit === void 0 ? {} : { limit: input3.limit },
+      ...input3.cursor === void 0 ? {} : { cursor: input3.cursor }
+    });
+    const lines = result.groups.map(
+      (group) => `${group.group_id} | ${group.kind} | ${group.channel} | ${group.status} | incidents=${group.member_count} | root=${group.root_incident_id ?? "none"} | ${group.created_at}`
+    );
+    return {
+      exitCode: 0,
+      output: input3.json ? JSON.stringify(result) : [
+        ...lines.length === 0 ? ["No alert groups found."] : lines,
+        ...result.next_cursor === null ? [] : [`Next cursor: ${result.next_cursor}`]
+      ].join("\n")
+    };
+  } catch (error2) {
+    return { exitCode: mapErrorToExitCode20(error2), output: error2 instanceof Error ? error2.message : String(error2) };
+  }
+}
+async function listAlertGroupsWithAuthCommand(input3, dependencies) {
+  return runAuthenticatedCliCommand(input3, {
+    createApi: createAuthenticatedAlertApi,
+    dependencies,
+    runCommand: (authState, api) => listAlertGroupsCommand({
+      bearerToken: authState.bearer_token,
+      projectId: input3.projectId,
+      ...input3.limit === void 0 ? {} : { limit: input3.limit },
+      ...input3.cursor === void 0 ? {} : { cursor: input3.cursor },
+      ...input3.json === void 0 ? {} : { json: input3.json }
+    }, api)
+  });
+}
+async function getAlertGroupCommand(input3, api) {
+  try {
+    const result = await api.getAlertGroup({
+      bearerToken: input3.bearerToken,
+      projectId: input3.projectId,
+      kind: input3.kind,
+      groupId: input3.groupId,
+      ...input3.limit === void 0 ? {} : { limit: input3.limit },
+      ...input3.cursor === void 0 ? {} : { cursor: input3.cursor }
+    });
+    return {
+      exitCode: 0,
+      output: input3.json ? JSON.stringify(result) : [
+        `${result.group.group_id} | ${result.group.kind} | ${result.group.channel} | ${result.group.status} | incidents=${result.group.member_count}`,
+        ...result.members.map((member) => `${member.incident_id} | ${member.condition_type} | ${member.created_at}`),
+        ...result.next_cursor === null ? [] : [`Next cursor: ${result.next_cursor}`]
+      ].join("\n")
+    };
+  } catch (error2) {
+    return { exitCode: mapErrorToExitCode20(error2), output: error2 instanceof Error ? error2.message : String(error2) };
+  }
+}
+async function getAlertGroupWithAuthCommand(input3, dependencies) {
+  return runAuthenticatedCliCommand(input3, {
+    createApi: createAuthenticatedAlertApi,
+    dependencies,
+    runCommand: (authState, api) => getAlertGroupCommand({
+      bearerToken: authState.bearer_token,
+      projectId: input3.projectId,
+      kind: input3.kind,
+      groupId: input3.groupId,
+      ...input3.limit === void 0 ? {} : { limit: input3.limit },
+      ...input3.cursor === void 0 ? {} : { cursor: input3.cursor },
+      ...input3.json === void 0 ? {} : { json: input3.json }
+    }, api)
+  });
+}
 async function createAlertCommand(input3, api) {
   try {
     const requestInput = {
@@ -122344,7 +122631,10 @@ async function createAlertCommand(input3, api) {
     const alert = await api.createAlert(requestInput);
     return {
       exitCode: 0,
-      output: input3.json ? JSON.stringify({ alert }) : `Alert created: ${alert.alert_id}`
+      output: input3.json ? JSON.stringify({ alert }) : [
+        `Alert created: ${alert.alert_id}`,
+        ...alert.signing_secret === void 0 ? [] : [`Signing secret (shown once): ${alert.signing_secret}`]
+      ].join("\n")
     };
   } catch (error2) {
     return { exitCode: mapErrorToExitCode20(error2), output: error2 instanceof Error ? error2.message : String(error2) };
@@ -122414,13 +122704,19 @@ async function updateAlertCommand(input3, api) {
     if (input3.config !== void 0) {
       requestInput.config = input3.config;
     }
+    if (input3.rotateSigningSecret === true) {
+      requestInput.rotateSigningSecret = true;
+    }
     if (input3.isEnabled !== void 0) {
       requestInput.isEnabled = input3.isEnabled;
     }
     const alert = await api.updateAlert(requestInput);
     return {
       exitCode: 0,
-      output: input3.json ? JSON.stringify({ alert }) : `Alert updated: ${alert.alert_id}`
+      output: input3.json ? JSON.stringify({ alert }) : [
+        `Alert updated: ${alert.alert_id}`,
+        ...alert.signing_secret === void 0 ? [] : [`Signing secret (shown once): ${alert.signing_secret}`]
+      ].join("\n")
     };
   } catch (error2) {
     return { exitCode: mapErrorToExitCode20(error2), output: error2 instanceof Error ? error2.message : String(error2) };
@@ -122457,6 +122753,9 @@ async function updateAlertWithAuthCommand(input3, dependencies) {
       if (input3.config !== void 0) {
         commandInput.config = input3.config;
       }
+      if (input3.rotateSigningSecret === true) {
+        commandInput.rotateSigningSecret = true;
+      }
       if (input3.isEnabled !== void 0) {
         commandInput.isEnabled = input3.isEnabled;
       }
@@ -123351,6 +123650,36 @@ async function handleWebhookCommand(parsedArgv, dependencies) {
 }
 async function handleAlertCommand(parsedArgv, dependencies) {
   const action = requirePositional(parsedArgv, 1, "action");
+  if (action === "groups" || action === "group") {
+    expectNoUnknownOptions(parsedArgv, ["auth-file", "json", "project-id", "limit", "cursor"]);
+    ensureNoExtraPositionals(parsedArgv, action === "groups" ? 2 : 4);
+    const projectId = readStringOption(parsedArgv, "project-id");
+    if (projectId === void 0) throw new CliInputError("Missing required option --project-id.");
+    const limit = readLimitOption(parsedArgv);
+    const cursor = readStringOption(parsedArgv, "cursor");
+    if (action === "groups") {
+      return await (dependencies.listAlertGroupsCommand ?? listAlertGroupsWithAuthCommand)(
+        appendCommonAuthOptions(parsedArgv, {
+          projectId,
+          ...limit === void 0 ? {} : { limit },
+          ...cursor === void 0 ? {} : { cursor }
+        })
+      );
+    }
+    const kind = requirePositional(parsedArgv, 2, "kind");
+    if (kind !== "direct" && kind !== "email_digest") {
+      throw new CliInputError("Alert group kind must be direct or email_digest.");
+    }
+    return await (dependencies.getAlertGroupCommand ?? getAlertGroupWithAuthCommand)(
+      appendCommonAuthOptions(parsedArgv, {
+        projectId,
+        kind,
+        groupId: requirePositional(parsedArgv, 3, "group-id"),
+        ...limit === void 0 ? {} : { limit },
+        ...cursor === void 0 ? {} : { cursor }
+      })
+    );
+  }
   if (action === "list") {
     expectNoUnknownOptions(parsedArgv, ["auth-file", "json", "project-id", "limit"]);
     ensureNoExtraPositionals(parsedArgv, 2);
@@ -123438,6 +123767,7 @@ async function handleAlertCommand(parsedArgv, dependencies) {
       "severity-lifecycle-scope",
       "cooldown",
       "config-json",
+      "rotate-signing-secret",
       "is-enabled"
     ]);
     ensureNoExtraPositionals(parsedArgv, 3);
@@ -123477,11 +123807,14 @@ async function handleAlertCommand(parsedArgv, dependencies) {
     if (config2 !== void 0) {
       input3.config = config2;
     }
+    if (readBooleanStringOption(parsedArgv, "rotate-signing-secret") === true) {
+      input3.rotateSigningSecret = true;
+    }
     const isEnabled = readBooleanStringOption(parsedArgv, "is-enabled");
     if (isEnabled !== void 0) {
       input3.isEnabled = isEnabled;
     }
-    if (input3.serviceId === void 0 && input3.channel === void 0 && input3.conditionType === void 0 && input3.severityMin === void 0 && input3.severityLifecycleScope === void 0 && input3.cooldownSeconds === void 0 && input3.config === void 0 && input3.isEnabled === void 0) {
+    if (input3.serviceId === void 0 && input3.channel === void 0 && input3.conditionType === void 0 && input3.severityMin === void 0 && input3.severityLifecycleScope === void 0 && input3.cooldownSeconds === void 0 && input3.config === void 0 && input3.rotateSigningSecret === void 0 && input3.isEnabled === void 0) {
       throw new CliInputError("At least one alert field must be provided.");
     }
     return await (dependencies.updateAlertCommand ?? updateAlertWithAuthCommand)(input3);
@@ -123739,7 +124072,7 @@ async function handleCaptureRuleCommand2(parsedArgv, dependencies) {
 // package.json
 var package_default = {
   name: "@debugbundle/cli",
-  version: "1.11.0",
+  version: "1.12.0",
   private: false,
   description: "Command-line interface for DebugBundle",
   license: "Apache-2.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@debugbundle/cli",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "private": false,
   "description": "Command-line interface for DebugBundle",
   "license": "Apache-2.0",