@debugbundle/mcp 0.1.7 → 0.1.9

package/dist/main.cjs

@@ -14776,8 +14776,9 @@ var GitHubDispatchDeliverySchema = external_exports.object({
   delivery_id: external_exports.string(),
   rule_id: external_exports.string(),
   rule_name: external_exports.string(),
-  incident_id: external_exports.string(),
-  incident_title: external_exports.string(),
+  incident_id: external_exports.string().nullable(),
+  improvement_id: external_exports.string().nullable(),
+  target_title: external_exports.string(),
   status: external_exports.enum(["pending", "retrying", "delivered", "failed", "skipped"]),
   attempt_count: external_exports.number().int(),
   last_attempt_at: external_exports.string().nullable(),
@@ -15259,6 +15260,7 @@ var ImprovementSchema = external_exports.object({
   summary: external_exports.string(),
   occurrence_count: external_exports.number().int(),
   evidence: external_exports.record(external_exports.unknown()),
+  related_incident_ids: external_exports.array(external_exports.string()),
   first_detected_at: external_exports.string(),
   last_detected_at: external_exports.string(),
   resolved_at: external_exports.string().nullable(),
@@ -15791,6 +15793,7 @@ var ProjectTokenSchema = external_exports.object({
   token_id: external_exports.string(),
   project_id: external_exports.string(),
   label: external_exports.string(),
+  allowed_origins: external_exports.array(external_exports.string()).default([]),
   created_at: external_exports.string(),
   last_used_at: external_exports.string().nullable(),
   revoked_at: external_exports.string().nullable(),
@@ -15875,7 +15878,8 @@ function createTokenManagementApi(client) {
           path: `/v1/projects/${input.projectId}/tokens`,
           bearerToken: input.bearerToken,
           body: {
-            label: input.label
+            label: input.label,
+            ...input.allowedOrigins === void 0 ? {} : { allowed_origins: input.allowedOrigins }
           }
         })
       );
@@ -16548,6 +16552,406 @@ function getRequestAnomalyThreshold(input) {
   return null;
 }
 
+// ../../packages/shared-types/src/capture-rules.ts
+var CAPTURE_RULE_EVENT_TYPES = [
+  "backend_exception",
+  "request_event",
+  "log_event",
+  "frontend_breadcrumb",
+  "frontend_exception",
+  "deploy_metadata",
+  "error_suppressed",
+  "probe_event"
+];
+var CAPTURE_RULE_RUNTIME_VALUES = [
+  "browser",
+  "node",
+  "python",
+  "php",
+  "java",
+  "go",
+  "ruby",
+  "unknown"
+];
+var CaptureRuleActionValues = ["demote", "sample", "drop"];
+var CaptureRuleActionSchema = external_exports.enum(CaptureRuleActionValues);
+var CaptureRuleSampleEventClassValues = ["preserve", "context"];
+var CaptureRuleSampleEventClassSchema = external_exports.enum(CaptureRuleSampleEventClassValues);
+var CaptureRuleRuntimeSchema = external_exports.enum(CAPTURE_RULE_RUNTIME_VALUES);
+var CaptureRuleEventTypeSchema = external_exports.enum(CAPTURE_RULE_EVENT_TYPES);
+var BrowserEventKindSchema = external_exports.enum(["window_error", "resource_error"]);
+function normalizeOptionalTrimmedString(value) {
+  const trimmed = value?.trim();
+  return trimmed && trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeOptionalLowercaseHost(value) {
+  const trimmed = normalizeOptionalTrimmedString(value);
+  return trimmed?.toLowerCase();
+}
+function normalizeOptionalPath(value) {
+  const trimmed = normalizeOptionalTrimmedString(value);
+  if (trimmed === void 0) {
+    return void 0;
+  }
+  return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+}
+function hasValue(value) {
+  return value !== void 0 && value !== null;
+}
+var UrlMatcherSchema = external_exports.object({
+  host: external_exports.string().min(1).max(255).optional(),
+  host_suffix: external_exports.string().min(1).max(255).optional(),
+  path_prefix: external_exports.string().min(1).max(1024).optional(),
+  path_equals: external_exports.string().min(1).max(1024).optional()
+}).transform((value) => {
+  const normalized = {};
+  const host = normalizeOptionalLowercaseHost(value.host);
+  const hostSuffix = normalizeOptionalLowercaseHost(value.host_suffix);
+  const pathPrefix = normalizeOptionalPath(value.path_prefix);
+  const pathEquals = normalizeOptionalPath(value.path_equals);
+  if (host !== void 0) {
+    normalized.host = host;
+  }
+  if (hostSuffix !== void 0) {
+    normalized.host_suffix = hostSuffix;
+  }
+  if (pathPrefix !== void 0) {
+    normalized.path_prefix = pathPrefix;
+  }
+  if (pathEquals !== void 0) {
+    normalized.path_equals = pathEquals;
+  }
+  return normalized;
+}).refine((value) => hasValue(value.host) || hasValue(value.host_suffix) || hasValue(value.path_prefix) || hasValue(value.path_equals), {
+  message: "URL matchers must include at least one host or path constraint."
+});
+var StatusRangeSchema = external_exports.object({
+  start: external_exports.number().int().min(100).max(599),
+  end: external_exports.number().int().min(100).max(599)
+}).refine((value) => value.start <= value.end, {
+  message: "Status range start must be less than or equal to end."
+});
+var CaptureRuleFingerprintSchema = external_exports.object({
+  version: external_exports.string().min(1).max(32),
+  value: external_exports.string().min(1).max(256)
+});
+function normalizeStringArray(values) {
+  if (values === void 0) {
+    return void 0;
+  }
+  return Array.from(new Set(values.map((value) => value.trim()).filter((value) => value.length > 0)));
+}
+function normalizeNumberArray(values) {
+  if (values === void 0) {
+    return void 0;
+  }
+  return Array.from(new Set(values)).sort((left, right) => left - right);
+}
+var CaptureRuleMatcherSchema = external_exports.object({
+  event_types: external_exports.array(CaptureRuleEventTypeSchema).min(1).optional(),
+  services: external_exports.array(external_exports.string().min(1).max(120)).min(1).optional(),
+  environments: external_exports.array(external_exports.string().min(1).max(120)).min(1).optional(),
+  runtime: external_exports.array(CaptureRuleRuntimeSchema).min(1).optional(),
+  first_party: external_exports.boolean().optional(),
+  error_name: external_exports.string().min(1).max(120).optional(),
+  message_contains: external_exports.string().min(1).max(500).optional(),
+  message_equals: external_exports.string().min(1).max(500).optional(),
+  browser_event_kind: BrowserEventKindSchema.optional(),
+  resource_url: UrlMatcherSchema.optional(),
+  request_url: UrlMatcherSchema.optional(),
+  status_codes: external_exports.array(external_exports.number().int().min(100).max(599)).min(1).optional(),
+  status_ranges: external_exports.array(StatusRangeSchema).min(1).optional(),
+  fingerprint: CaptureRuleFingerprintSchema.optional()
+}).transform((value) => {
+  const normalized = {};
+  const eventTypes = normalizeStringArray(value.event_types);
+  const services = normalizeStringArray(value.services);
+  const environments = normalizeStringArray(value.environments);
+  const runtime = normalizeStringArray(value.runtime);
+  const errorName = normalizeOptionalTrimmedString(value.error_name);
+  const messageContains = normalizeOptionalTrimmedString(value.message_contains);
+  const messageEquals = normalizeOptionalTrimmedString(value.message_equals);
+  const statusCodes = normalizeNumberArray(value.status_codes);
+  if (eventTypes !== void 0) {
+    normalized.event_types = eventTypes;
+  }
+  if (services !== void 0) {
+    normalized.services = services;
+  }
+  if (environments !== void 0) {
+    normalized.environments = environments;
+  }
+  if (runtime !== void 0) {
+    normalized.runtime = runtime;
+  }
+  if (value.first_party !== void 0) {
+    normalized.first_party = value.first_party;
+  }
+  if (errorName !== void 0) {
+    normalized.error_name = errorName;
+  }
+  if (messageContains !== void 0) {
+    normalized.message_contains = messageContains;
+  }
+  if (messageEquals !== void 0) {
+    normalized.message_equals = messageEquals;
+  }
+  if (value.browser_event_kind !== void 0) {
+    normalized.browser_event_kind = value.browser_event_kind;
+  }
+  if (value.resource_url !== void 0) {
+    normalized.resource_url = value.resource_url;
+  }
+  if (value.request_url !== void 0) {
+    normalized.request_url = value.request_url;
+  }
+  if (statusCodes !== void 0) {
+    normalized.status_codes = statusCodes;
+  }
+  if (value.status_ranges !== void 0) {
+    normalized.status_ranges = value.status_ranges;
+  }
+  if (value.fingerprint !== void 0) {
+    normalized.fingerprint = value.fingerprint;
+  }
+  return normalized;
+}).superRefine((value, context) => {
+  const narrowingKeys = [
+    "services",
+    "environments",
+    "runtime",
+    "first_party",
+    "error_name",
+    "message_contains",
+    "message_equals",
+    "browser_event_kind",
+    "resource_url",
+    "request_url",
+    "status_codes",
+    "status_ranges",
+    "fingerprint"
+  ];
+  if (!narrowingKeys.some((key) => hasValue(value[key]))) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Capture rules must include at least one narrowing field beyond event_types."
+    });
+  }
+  if (value.browser_event_kind === "resource_error") {
+    const hasResourceConstraint = hasValue(value.resource_url) || hasValue(value.fingerprint);
+    if (!hasResourceConstraint) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Resource-error rules require a resource URL constraint or an exact fingerprint."
+      });
+    }
+  }
+});
+var CaptureRuleCoreObjectSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120),
+  description: external_exports.string().trim().max(500).nullable(),
+  enabled: external_exports.boolean(),
+  action: CaptureRuleActionSchema,
+  matcher: CaptureRuleMatcherSchema,
+  sample_rate: external_exports.number().min(0).max(1).nullable(),
+  sample_event_class: CaptureRuleSampleEventClassSchema.nullable(),
+  created_by_user_id: external_exports.string().min(1).max(120).nullable(),
+  created_from_incident_id: external_exports.string().min(1).max(120).nullable(),
+  created_from_event_id: external_exports.string().min(1).max(120).nullable(),
+  expires_at: external_exports.string().datetime().nullable()
+});
+function addCaptureRuleActionValidation(schema) {
+  return schema.superRefine((value, context) => {
+    if (value["action"] === "sample") {
+      if (value["sample_rate"] === null) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["sample_rate"],
+          message: "Sample rules require sample_rate."
+        });
+      }
+      if (value["sample_event_class"] === null) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["sample_event_class"],
+          message: "Sample rules require sample_event_class."
+        });
+      }
+      return;
+    }
+    if (value["sample_rate"] !== null) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_rate"],
+        message: "Only sample rules can set sample_rate."
+      });
+    }
+    if (value["sample_event_class"] !== null) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_event_class"],
+        message: "Only sample rules can set sample_event_class."
+      });
+    }
+  });
+}
+var CaptureRuleSchema = addCaptureRuleActionValidation(
+  CaptureRuleCoreObjectSchema.extend({
+    id: external_exports.string().uuid(),
+    project_id: external_exports.string().min(1).max(120),
+    hit_count: external_exports.number().int().nonnegative(),
+    last_matched_at: external_exports.string().datetime().nullable(),
+    created_at: external_exports.string().datetime(),
+    updated_at: external_exports.string().datetime()
+  })
+);
+var CaptureRuleCreateSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120),
+  description: external_exports.string().trim().max(500).nullable().default(null),
+  enabled: external_exports.boolean().default(true),
+  action: CaptureRuleActionSchema,
+  matcher: CaptureRuleMatcherSchema,
+  sample_rate: external_exports.number().min(0).max(1).nullable().optional(),
+  sample_event_class: CaptureRuleSampleEventClassSchema.nullable().optional(),
+  created_by_user_id: external_exports.string().min(1).max(120).nullable().default(null),
+  created_from_incident_id: external_exports.string().min(1).max(120).nullable().default(null),
+  created_from_event_id: external_exports.string().min(1).max(120).nullable().default(null),
+  expires_at: external_exports.string().datetime().nullable().default(null)
+}).superRefine((value, context) => {
+  if (value.action === "sample") {
+    if (value.sample_rate === void 0 || value.sample_rate === null) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_rate"],
+        message: "Sample rules require sample_rate."
+      });
+    }
+    return;
+  }
+  if (value.sample_rate !== void 0 && value.sample_rate !== null) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["sample_rate"],
+      message: "Only sample rules can set sample_rate."
+    });
+  }
+  if (value.sample_event_class !== void 0 && value.sample_event_class !== null) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["sample_event_class"],
+      message: "Only sample rules can set sample_event_class."
+    });
+  }
+}).transform((value) => ({
+  ...value,
+  sample_rate: value.action === "sample" ? value.sample_rate : null,
+  sample_event_class: value.action === "sample" ? value.sample_event_class ?? "preserve" : null
+}));
+var CaptureRuleUpdateSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120).optional(),
+  description: external_exports.string().trim().max(500).nullable().optional(),
+  enabled: external_exports.boolean().optional(),
+  action: CaptureRuleActionSchema.optional(),
+  matcher: CaptureRuleMatcherSchema.optional(),
+  sample_rate: external_exports.number().min(0).max(1).nullable().optional(),
+  sample_event_class: CaptureRuleSampleEventClassSchema.nullable().optional(),
+  expires_at: external_exports.string().datetime().nullable().optional()
+}).superRefine((value, context) => {
+  if (Object.keys(value).length === 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "At least one capture rule field must be provided."
+    });
+  }
+  const resolvedAction = value.action;
+  if (resolvedAction === "sample") {
+    if (!("sample_rate" in value)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_rate"],
+        message: "Sample rule updates must include sample_rate when changing action to sample."
+      });
+    }
+    if (!("sample_event_class" in value)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_event_class"],
+        message: "Sample rule updates must include sample_event_class when changing action to sample."
+      });
+    }
+    return;
+  }
+  if ("sample_rate" in value) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["sample_rate"],
+      message: "Sample rule fields can only be updated while setting action to sample."
+    });
+  }
+  if ("sample_event_class" in value) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["sample_event_class"],
+      message: "Sample rule fields can only be updated while setting action to sample."
+    });
+  }
+});
+var CaptureRuleResponseSchema = external_exports.object({
+  rule: CaptureRuleSchema
+});
+var CaptureRulesResponseSchema = external_exports.object({
+  access_mode: external_exports.enum(["manage", "preview"]),
+  rules: external_exports.array(CaptureRuleSchema)
+});
+var CaptureRulesFileSchema = external_exports.object({
+  version: external_exports.literal(1),
+  rules: external_exports.array(CaptureRuleSchema)
+});
+var CaptureRuleEvaluationUrlSchema = external_exports.object({
+  host: external_exports.string().min(1).transform((value) => value.toLowerCase()).optional(),
+  path: external_exports.string().min(1).transform((value) => value.startsWith("/") ? value : `/${value}`)
+});
+var CaptureRuleEvaluationContextSchema = external_exports.object({
+  project_id: external_exports.string().min(1).max(120),
+  event_id: external_exports.string().uuid(),
+  event_type: CaptureRuleEventTypeSchema,
+  service: external_exports.string().min(1).optional(),
+  environment: external_exports.string().min(1).optional(),
+  runtime: CaptureRuleRuntimeSchema,
+  first_party: external_exports.boolean().optional(),
+  error_name: external_exports.string().min(1).optional(),
+  message: external_exports.string().min(1).optional(),
+  browser_event_kind: BrowserEventKindSchema.optional(),
+  resource_url: CaptureRuleEvaluationUrlSchema.optional(),
+  request_url: CaptureRuleEvaluationUrlSchema.optional(),
+  status_code: external_exports.number().int().min(0).max(599).optional(),
+  fingerprint: CaptureRuleFingerprintSchema.optional()
+});
+
+// ../../packages/shared-types/src/capture-rule-suggestions.ts
+var CaptureRuleSuggestionConfidenceSchema = external_exports.enum(["high", "medium", "low"]);
+var CaptureRuleSuggestionSchema = external_exports.object({
+  suggestion_id: external_exports.string().min(1).max(120),
+  label: external_exports.string().min(1).max(200),
+  recommended_action: CaptureRuleActionSchema,
+  confidence: CaptureRuleSuggestionConfidenceSchema,
+  reason: external_exports.string().min(1).max(500),
+  requires_confirmation: external_exports.boolean(),
+  rule: CaptureRuleCreateSchema
+});
+var CaptureRuleSuggestionsResponseSchema = external_exports.object({
+  suggestions: external_exports.array(CaptureRuleSuggestionSchema),
+  bundle_status: external_exports.enum(["ready", "pending", "failed"]).optional(),
+  bundle_reason: external_exports.string().nullable().optional()
+});
+var CreateCaptureRuleFromSuggestionSchema = external_exports.object({
+  suggestion_id: external_exports.string().min(1).max(120),
+  name: external_exports.string().trim().min(1).max(120).optional(),
+  description: external_exports.string().trim().max(500).nullable().optional(),
+  enabled: external_exports.boolean().optional(),
+  expires_at: external_exports.string().datetime().nullable().optional()
+});
+
 // ../../packages/shared-types/src/improvement-settings.ts
 var ImprovementBundleSensitivityValues = [
   "high_confidence",
@@ -16704,6 +17108,18 @@ var DeviceInfoSchema = external_exports.object({
   connection_type: external_exports.string().nullable(),
   color_scheme_preference: external_exports.enum(["light", "dark", "no-preference"]).nullable()
 }).strict();
+var BrowserExceptionEventSchema = external_exports.object({
+  kind: external_exports.enum(["window_error", "resource_error"]),
+  message: external_exports.string().nullable(),
+  file_name: external_exports.string().nullable(),
+  line_number: external_exports.number().int().nonnegative().nullable(),
+  column_number: external_exports.number().int().nonnegative().nullable(),
+  target: external_exports.object({
+    tag_name: external_exports.string().nullable(),
+    source_url: external_exports.string().nullable()
+  }).nullable(),
+  opaque: external_exports.boolean()
+}).strict();
 var FrontendExceptionPayloadSchema = external_exports.object({
   name: external_exports.string().min(1),
   message: external_exports.string().min(1),
@@ -16715,6 +17131,7 @@ var FrontendExceptionPayloadSchema = external_exports.object({
   }),
   breadcrumbs: external_exports.array(FrontendExceptionBreadcrumbSchema).optional(),
   device: DeviceInfoSchema.nullable().optional(),
+  browser_event: BrowserExceptionEventSchema.optional(),
   dom_context: external_exports.object({
     mode: external_exports.literal("lightweight"),
     html_excerpt: external_exports.string().min(1)
@@ -17123,6 +17540,25 @@ function buildSkill() {
     "",
     "Use DebugBundle before starting a fresh bug investigation.",
     "",
+    "## Investigation Quickstart",
+    "",
+    "When the user reports a bug, runtime failure, production incident, regression, broken deploy, or unknown error, start here before reading arbitrary source files.",
+    "",
+    "1. Run `debugbundle doctor --json` to learn whether the project is local-only or connected and whether the local scaffold is healthy.",
+    "2. List actionable failures with `debugbundle incidents --source local --status open --json` for local data, or `debugbundle incidents --source cloud --status open --json` when the issue came from a hosted environment.",
+    "3. Inspect the chosen incident with `debugbundle inspect <incident-id> --source <local|cloud> --json` and `debugbundle explain <incident-id> --source <local|cloud> --json`.",
+    "4. Fetch evidence before editing code: `debugbundle bundle <incident-id> --source <local|cloud> --json` and `debugbundle reproduce <incident-id> --source <local|cloud> --json`.",
+    "5. If local SDK or relay events have landed but no bundle exists yet, run `debugbundle process --preset <minimal|balanced|investigative> --json` and then list incidents again.",
+    "",
+    "Key local paths:",
+    "- `.debugbundle/profile.json` \u2014 project map, service paths, and validation state",
+    "- `.debugbundle/local/connection.json` \u2014 local-only vs connected mode and environment delivery policy",
+    "- `.debugbundle/local/events/` \u2014 raw local SDK, relay, ingest, and watch event batches",
+    "- `.debugbundle/local/state.json` \u2014 local incident index, lifecycle state, and bundle paths",
+    "- `.debugbundle/bundles/local/` \u2014 locally generated bundle artifacts",
+    "- `.debugbundle/bundles/local/reproductions/` \u2014 local reproduction artifacts",
+    "- `.debugbundle/bundles/cloud/` \u2014 explicitly fetched cloud artifact cache",
+    "",
     "## Core Workflow",
     "",
     "1. Check DebugBundle incidents first to avoid re-investigating a known failure.",
@@ -17152,6 +17588,18 @@ function buildSkill() {
     "- Run `debugbundle validate --fix` to restore missing generated setup files without overwriting the profile.",
     "- Run `debugbundle process` after local events land in `.debugbundle/local/events/`.",
     "",
+    "## Browser Capture and Relay Setup",
+    "",
+    "When the repository has a browser frontend, verify capture end to end instead of stopping at backend SDK setup.",
+    "",
+    "1. Add `@debugbundle/sdk-browser` to each browser app that should capture console, error, navigation, or request context.",
+    "2. Initialize the browser SDK from the app entrypoint with the active environment and a browser relay endpoint.",
+    "3. Add a backend relay endpoint at `/debugbundle/browser` using the server SDK relay helper when available.",
+    "4. For same-origin apps, keep the browser endpoint as `/debugbundle/browser`.",
+    "5. For split frontend/backend hosts, configure the browser endpoint to the API host relay URL and require explicit frontend origin allowlisting on the backend.",
+    "6. Ensure auth and CSRF middleware allow the relay path while the relay still enforces origin, content type, body size, schema validation, and rate limits.",
+    "7. Trigger a local browser smoke event, then run `debugbundle process --json` and confirm the incident or context event appears before marking setup complete.",
+    "",
     "## References",
     "",
     "- CLI reference: `references/cli.md`",
@@ -17173,23 +17621,35 @@ function buildCliReference() {
     "## Setup",
     "",
     "- `debugbundle setup [--non-interactive] [--json]`",
-    "- `debugbundle doctor [--json]`",
+    "- `debugbundle doctor [--check-relay] [--json]`",
     "- `debugbundle validate [--fix] [--json]`",
     "- `debugbundle ingest <file> --format <format> [--json]`",
     "- `debugbundle watch --log <file> --format <format> [--json]`",
     "- `debugbundle watch --cloud --log <file> --format <format> [--json]`",
     "- `debugbundle process [--preset <minimal|balanced|investigative>] [--json]`",
+    "- `debugbundle clean [--events] [--bundles] [--all] [--older-than <Nd>] [--json]`",
     "",
     "## Investigation",
     "",
-    "- `debugbundle incidents`",
-    "- `debugbundle inspect <incident-id>`",
-    "- `debugbundle bundle <incident-id>`",
-    "- `debugbundle reproduce <incident-id>`",
-    "- `debugbundle resolve <incident-id>`",
-    "- `debugbundle reopen <incident-id>`",
+    "- `debugbundle incidents [--source <local|cloud>] [--project-id <id>] [--environment <name>] [--service <name>] [--status <status>] [--severity <severity>] [--cursor <cursor>] [--limit <n>] [--json]`",
+    "- `debugbundle inspect <incident-id> [--source <local|cloud>] [--json]`",
+    "- `debugbundle explain <incident-id> [--source <local|cloud>] [--json]`",
+    "- `debugbundle bundle <incident-id> [--source <local|cloud>] [--json]`",
+    "- `debugbundle reproduce <incident-id> [--source <local|cloud>] [--json]`",
+    "- `debugbundle resolve <incident-id> [--source <local|cloud>] [--json]`",
+    "- `debugbundle reopen <incident-id> [--source <local|cloud>] [--json]`",
     "- `debugbundle analyze --type improvement --local`",
     "",
+    "## Operational Paths",
+    "",
+    "- `.debugbundle/profile.json` \u2014 committed project map and agent validation state",
+    "- `.debugbundle/local/connection.json` \u2014 committed delivery policy and cloud connection metadata",
+    "- `.debugbundle/local/events/` \u2014 gitignored raw local event batches",
+    "- `.debugbundle/local/state.json` \u2014 gitignored local incident index and lifecycle state",
+    "- `.debugbundle/bundles/local/` \u2014 gitignored local bundle artifacts",
+    "- `.debugbundle/bundles/local/reproductions/` \u2014 gitignored local reproduction artifacts",
+    "- `.debugbundle/bundles/cloud/` \u2014 gitignored cache for explicitly fetched cloud artifacts",
+    "",
     "## Incident Hygiene",
     "",
     "Resolve incidents after a fix is verified or after an intentional smoke, dogfood, or verification incident has served its purpose.",
@@ -17221,6 +17681,17 @@ function buildMcpReference() {
     "",
     "Use the same incident-first workflow through MCP when an agent is operating in connected mode.",
     "",
+    "## Investigation Tools",
+    "",
+    "- `doctor` \u2014 validate local profile, connection config, auth state, and setup health.",
+    "- `list_incidents` \u2014 list local, cloud, or connected combined incidents; pass `source`, `status`, `environment`, `service`, `severity`, `cursor`, and `limit` when needed.",
+    "- `get_incident` \u2014 fetch incident metadata by incident id.",
+    "- `get_incident_context` \u2014 fetch deterministic explanation context for triage.",
+    "- `get_bundle` \u2014 fetch the full debug bundle before proposing a fix.",
+    "- `get_reproduction` \u2014 fetch reproduction guidance before editing code.",
+    "- `resolve_incident` / `reopen_incident` \u2014 update lifecycle state after validation.",
+    "- `analyze` \u2014 run local agent-oriented analysis from local bundles and skill schemas.",
+    "",
     "- Prefer bundle retrieval tools before reading raw repository files.",
     "- Use MCP bundle access when the current issue originated in production.",
     "- Resolve fixed or intentionally generated incidents with `resolve_incident` so open incidents stay actionable.",
@@ -17244,8 +17715,12 @@ function buildBundleSchemaReference() {
     "Focus on:",
     "- `summary` for the failure synopsis and recommended action",
     "- `service` and `environment` for routing to the right code path",
+    "- `context.error`, `context.request`, `context.response`, `context.logs`, `context.frontend`, `context.runtime`, `context.git`, `context.dependencies`, and `context.probe_data` for supporting evidence",
+    "- `reproduction` for confidence, commands, and manual steps",
     "- `links.reproduction` for the generated reproduction artifact",
     "- `metadata.source` for whether the bundle came from local or cloud data",
+    "",
+    "Treat the bundle as the source of truth for the failure report. Use repository reads to confirm and patch the implicated code paths, not to rediscover incident context from scratch.",
     ""
   ].join("\n");
 }
@@ -17256,10 +17731,14 @@ function buildProfileEnrichmentReference() {
     "The setup profile is generated from static analysis and must be reviewed before agents rely on it for architecture decisions.",
     "",
     "Checklist:",
-    "- verify service kinds, frameworks, and runtime assumptions",
-    "- add critical paths and ownership notes",
-    "- confirm build, test, and lint workflows",
-    "- update `debugbundle.validation_status` to `agent-validated` when complete",
+    "- verify `project.primary_languages`, `project.package_managers`, and `project.deployment_targets`",
+    "- verify each service `kind`, `runtime`, `framework`, `paths`, `owns_routes`, and `depends_on` value against the repository",
+    "- add critical paths for ingestion, processing, retrieval, SDK capture, auth, billing, and any project-specific high-risk workflows",
+    "- confirm `repo.generated_paths` and `repo.do_not_edit_paths` match the local scaffold",
+    "- confirm build, test, lint, and install workflows in `developer_workflows`",
+    "- for browser frontends, confirm `@debugbundle/sdk-browser` is initialized and a backend `/debugbundle/browser` relay is reachable",
+    "- for split frontend/backend hosts, confirm the browser SDK uses the API relay URL and the backend allowlists the frontend origin",
+    "- update `debugbundle.last_reviewed_at` and set `debugbundle.validation_status` to `agent-validated` when complete",
     ""
   ].join("\n");
 }
@@ -17341,6 +17820,22 @@ function buildSkillEvals() {
             "Resolve verified or intentionally generated incidents after the workflow is complete.",
             "Leave unresolved incidents open when the failure is still live or unverified."
           ]
+        },
+        {
+          name: "artifact_path_discovery",
+          prompt: "The user reports an unknown local runtime error. Confirm the skill tells the agent which DebugBundle paths and commands to inspect first.",
+          expected_behavior: [
+            "Run doctor and list local open incidents before broad source exploration.",
+            "Use .debugbundle/local/state.json, .debugbundle/bundles/local/, and reproduction artifact paths as the local evidence map."
+          ]
+        },
+        {
+          name: "connected_incident_fetch",
+          prompt: "The user says a production incident fired in the hosted DebugBundle project. Confirm the skill points the agent to the cloud retrieval path.",
+          expected_behavior: [
+            "List cloud open incidents or use MCP list_incidents with source cloud.",
+            "Fetch inspect, context, bundle, and reproduction artifacts before editing code."
+          ]
         }
       ]
     },
@@ -17436,10 +17931,37 @@ async function pathExists(path, stat) {
   }
 }
 function formatZodErrors(error) {
-  return error.issues.map((issue) => ({
-    path: issue.path.join("."),
-    message: issue.message
-  }));
+  return error.issues.map((issue) => {
+    const path = issue.path.join(".");
+    if (path === "services" || path.startsWith("services.")) {
+      return {
+        path,
+        message: issue.message,
+        suggestion: "Add service entries with name, kind, runtime, framework, paths, owns_routes, and depends_on.",
+        example: '[{"name":"api","kind":"backend","runtime":"Node.js","framework":"Fastify","paths":["apps/api"],"owns_routes":["POST /checkout"],"depends_on":["worker"]}]'
+      };
+    }
+    if (path === "critical_paths" || path.startsWith("critical_paths.")) {
+      return {
+        path,
+        message: issue.message,
+        suggestion: "Use object entries so each critical path records its owner_service and review notes.",
+        example: '[{"name":"checkout","owner_service":"api","notes":"Creates the order, charges the card, and enqueues fulfillment."}]'
+      };
+    }
+    if (path === "developer_workflows" || path.startsWith("developer_workflows.")) {
+      return {
+        path,
+        message: issue.message,
+        suggestion: "Provide install, build, test, and lint as command strings so agents can run the standard repo workflows.",
+        example: '{"install":"pnpm install","build":"pnpm build","test":"pnpm test","lint":"pnpm lint"}'
+      };
+    }
+    return {
+      path,
+      message: issue.message
+    };
+  });
 }
 async function validateProfile(rootDirectory, dependencies = {}) {
   const readFile = dependencies.readFile ?? ((filePath) => (0, import_promises.readFile)(filePath, "utf8"));
@@ -17786,6 +18308,118 @@ function createCliHttpClient(input, dependencies) {
   };
 }
 
+// ../cli/src/capture-rule-commands.ts
+var CaptureRuleApiError = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.name = "CaptureRuleApiError";
+    this.status = status;
+  }
+};
+function toApiError(status, body, fallback) {
+  if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
+    return new CaptureRuleApiError(status, body.error);
+  }
+  return new CaptureRuleApiError(status, fallback);
+}
+function createCaptureRuleApi(httpClient) {
+  return {
+    async listCaptureRules(input) {
+      const response = await httpClient.request({
+        method: "GET",
+        path: `/v1/projects/${encodeURIComponent(input.projectId)}/capture-rules`,
+        bearerToken: input.bearerToken
+      });
+      if (response.status !== 200) {
+        throw toApiError(response.status, response.body, "Failed to list capture rules.");
+      }
+      const parsed = CaptureRulesResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule list response.");
+      }
+      return parsed.data;
+    },
+    async createCaptureRule(input) {
+      const response = await httpClient.request({
+        method: "POST",
+        path: `/v1/projects/${encodeURIComponent(input.projectId)}/capture-rules`,
+        bearerToken: input.bearerToken,
+        body: input.create
+      });
+      if (response.status !== 201) {
+        throw toApiError(response.status, response.body, "Failed to create capture rule.");
+      }
+      const parsed = CaptureRuleResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule create response.");
+      }
+      return parsed.data;
+    },
+    async suggestCaptureRulesFromIncident(input) {
+      const response = await httpClient.request({
+        method: "POST",
+        path: `/v1/incidents/${encodeURIComponent(input.incidentId)}/capture-rule-suggestion`,
+        bearerToken: input.bearerToken
+      });
+      if (response.status !== 200) {
+        throw toApiError(response.status, response.body, "Failed to suggest capture rules.");
+      }
+      const parsed = CaptureRuleSuggestionsResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule suggestion response.");
+      }
+      return parsed.data;
+    },
+    async createCaptureRuleFromIncidentSuggestion(input) {
+      const response = await httpClient.request({
+        method: "POST",
+        path: `/v1/incidents/${encodeURIComponent(input.incidentId)}/capture-rules`,
+        bearerToken: input.bearerToken,
+        body: input.create
+      });
+      if (response.status !== 201) {
+        throw toApiError(response.status, response.body, "Failed to create capture rule from suggestion.");
+      }
+      const parsed = CaptureRuleResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule create-from-suggestion response.");
+      }
+      return parsed.data;
+    },
+    async updateCaptureRule(input) {
+      const response = await httpClient.request({
+        method: "PATCH",
+        path: `/v1/projects/${encodeURIComponent(input.projectId)}/capture-rules/${encodeURIComponent(input.ruleId)}`,
+        bearerToken: input.bearerToken,
+        body: input.update
+      });
+      if (response.status !== 200) {
+        throw toApiError(response.status, response.body, "Failed to update capture rule.");
+      }
+      const parsed = CaptureRuleResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule update response.");
+      }
+      return parsed.data;
+    },
+    async deleteCaptureRule(input) {
+      const response = await httpClient.request({
+        method: "DELETE",
+        path: `/v1/projects/${encodeURIComponent(input.projectId)}/capture-rules/${encodeURIComponent(input.ruleId)}`,
+        bearerToken: input.bearerToken
+      });
+      if (response.status !== 200) {
+        throw toApiError(response.status, response.body, "Failed to delete capture rule.");
+      }
+      if (typeof response.body !== "object" || response.body === null || !("success" in response.body) || response.body.success !== true) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule delete response.");
+      }
+      return { success: true };
+    }
+  };
+}
+
 // ../cli/src/capture-policy-commands.ts
 var CapturePolicyApiError = class extends Error {
   status;
@@ -17795,7 +18429,7 @@ var CapturePolicyApiError = class extends Error {
     this.status = status;
   }
 };
-function toApiError(status, body, fallback) {
+function toApiError2(status, body, fallback) {
   if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
     return new CapturePolicyApiError(status, body.error);
   }
@@ -17810,7 +18444,7 @@ function createCapturePolicyApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError(response.status, response.body, "Failed to get capture policy.");
+        throw toApiError2(response.status, response.body, "Failed to get capture policy.");
       }
       const parsed = CapturePolicyResponseSchema.safeParse(response.body);
       if (!parsed.success) {
@@ -17826,7 +18460,7 @@ function createCapturePolicyApi(httpClient) {
         body: input.update
       });
       if (response.status !== 200) {
-        throw toApiError(response.status, response.body, "Failed to update capture policy.");
+        throw toApiError2(response.status, response.body, "Failed to update capture policy.");
       }
       const parsed = CapturePolicyResponseSchema.safeParse(response.body);
       if (!parsed.success) {
@@ -17846,7 +18480,7 @@ var ImprovementSettingsApiError = class extends Error {
     this.status = status;
   }
 };
-function toApiError2(status, body, fallback) {
+function toApiError3(status, body, fallback) {
   if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
     return new ImprovementSettingsApiError(status, body.error);
   }
@@ -17861,7 +18495,7 @@ function createImprovementSettingsApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError2(response.status, response.body, "Failed to get improvement settings.");
+        throw toApiError3(response.status, response.body, "Failed to get improvement settings.");
       }
       const parsed = ImprovementSettingsResponseSchema.safeParse(response.body);
       if (!parsed.success) {
@@ -17877,7 +18511,7 @@ function createImprovementSettingsApi(httpClient) {
         body: input.update
       });
       if (response.status !== 200) {
-        throw toApiError2(response.status, response.body, "Failed to update improvement settings.");
+        throw toApiError3(response.status, response.body, "Failed to update improvement settings.");
       }
       const parsed = ImprovementSettingsResponseSchema.safeParse(response.body);
       if (!parsed.success) {
@@ -17899,7 +18533,7 @@ var MemberApiError = class extends Error {
     this.code = code;
   }
 };
-function toApiError3(status, body) {
+function toApiError4(status, body) {
   if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
     return new MemberApiError(status, body.error);
   }
@@ -17914,7 +18548,7 @@ function createMemberApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -17925,7 +18559,7 @@ function createMemberApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -17937,7 +18571,7 @@ function createMemberApi(httpClient) {
         body: { email: input.email, role: input.role }
       });
       if (response.status !== 201) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -17948,7 +18582,7 @@ function createMemberApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -17960,7 +18594,7 @@ function createMemberApi(httpClient) {
         body: { role: input.role }
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -17971,7 +18605,7 @@ function createMemberApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     }
@@ -17989,7 +18623,7 @@ var ProbeApiError = class extends Error {
     this.code = code;
   }
 };
-function toApiError4(status, body) {
+function toApiError5(status, body) {
   if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
     return new ProbeApiError(status, body.error);
   }
@@ -18020,7 +18654,7 @@ function createProbeApi(httpClient) {
         body
       });
       if (response.status !== 201) {
-        throw toApiError4(response.status, response.body);
+        throw toApiError5(response.status, response.body);
       }
       return response.body;
     },
@@ -18031,7 +18665,7 @@ function createProbeApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError4(response.status, response.body);
+        throw toApiError5(response.status, response.body);
       }
       return response.body;
     },
@@ -18043,7 +18677,7 @@ function createProbeApi(httpClient) {
         body: { activation_id: input.activationId }
       });
       if (response.status !== 200) {
-        throw toApiError4(response.status, response.body);
+        throw toApiError5(response.status, response.body);
       }
       return response.body;
     }
@@ -18166,6 +18800,15 @@ function inferMatchedFields(event) {
   if (event.top_frames.length > 0) {
     matchedFields.push("top_frames");
   }
+  if (event.browser_event_kind != null) {
+    matchedFields.push("browser_event_kind");
+  }
+  if (event.resource_host != null) {
+    matchedFields.push("resource_host");
+  }
+  if (event.resource_path != null) {
+    matchedFields.push("resource_path");
+  }
   if (event.http_method !== null) {
     matchedFields.push("http_method");
   }
@@ -18226,6 +18869,39 @@ function selectTopFrames(stack, limit = 5) {
   const frames = normalizedStack.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("at ")).filter((line) => FRAME_NOISE_PATTERNS.every((pattern) => !line.includes(pattern))).slice(0, limit);
   return frames;
 }
+function normalizeResourceIdentity(value) {
+  if (value === null) {
+    return { host: null, path: null };
+  }
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    return { host: null, path: null };
+  }
+  if (trimmed.startsWith("/")) {
+    return {
+      host: null,
+      path: normalizeRoute(trimmed)
+    };
+  }
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return {
+        host: parsed.hostname.length > 0 ? parsed.hostname.toLowerCase() : null,
+        path: normalizeRoute(parsed.pathname)
+      };
+    }
+    return {
+      host: null,
+      path: parsed.protocol.replace(/:$/, "")
+    };
+  } catch {
+    return {
+      host: null,
+      path: normalizeRoute(trimmed) ?? trimmed
+    };
+  }
+}
 function stableJson(value) {
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value);
@@ -18253,6 +18929,9 @@ function normalizeEvent(event) {
       http_method: event.payload.request.method,
       http_status: event.payload.response.status_code,
       top_frames: selectTopFrames(event.payload.stack),
+      browser_event_kind: null,
+      resource_host: null,
+      resource_path: null,
       payload: redactedPayload
     };
   }
@@ -18266,6 +18945,9 @@ function normalizeEvent(event) {
       http_method: event.payload.method,
       http_status: event.payload.response_status,
       top_frames: [],
+      browser_event_kind: null,
+      resource_host: null,
+      resource_path: null,
       payload: redactedPayload
     };
   }
@@ -18279,6 +18961,28 @@ function normalizeEvent(event) {
       http_method: null,
       http_status: null,
       top_frames: [],
+      browser_event_kind: null,
+      resource_host: null,
+      resource_path: null,
+      payload: redactedPayload
+    };
+  }
+  if (event.event_type === "frontend_exception") {
+    const browserEvent = event.payload.browser_event;
+    const resourceIdentity = browserEvent?.kind === "resource_error" ? normalizeResourceIdentity(browserEvent.target?.source_url ?? browserEvent.file_name) : { host: null, path: null };
+    const topFrames = browserEvent?.opaque === true ? [] : selectTopFrames(event.payload.stack);
+    return {
+      event_type: event.event_type,
+      environment: event.service.environment,
+      error_type: event.payload.name,
+      normalized_message: normalizeMessage(event.payload.message),
+      route_template: normalizeRoute(event.payload.route ?? null),
+      http_method: null,
+      http_status: null,
+      top_frames: topFrames,
+      browser_event_kind: browserEvent?.kind ?? null,
+      resource_host: resourceIdentity.host,
+      resource_path: resourceIdentity.path,
       payload: redactedPayload
     };
   }
@@ -18291,6 +18995,9 @@ function normalizeEvent(event) {
     http_method: null,
     http_status: null,
     top_frames: [],
+    browser_event_kind: null,
+    resource_host: null,
+    resource_path: null,
     payload: redactedPayload
   };
 }
@@ -18300,6 +19007,9 @@ function fingerprint(event) {
     normalized_message: event.normalized_message,
     top_frames: event.top_frames,
     route_template: event.route_template,
+    browser_event_kind: event.browser_event_kind,
+    resource_host: event.resource_host,
+    resource_path: event.resource_path,
     http_method: event.http_method,
     http_status: event.http_status,
     environment: event.environment
@@ -18354,18 +19064,18 @@ var ConnectionConfigSchema = external_exports.object({
 }).strict();
 
 // ../cli/src/doctor-command.ts
-var ProfileSchema2 = external_exports.object({
-  debugbundle: external_exports.object({
-    last_reviewed_at: external_exports.string(),
-    validation_status: external_exports.enum(["static-analysis-only", "agent-validated"])
-  })
-});
 var HealthResponseSchema = external_exports.object({
   status: external_exports.literal("ok")
 });
 var IncidentsProbeResponseSchema = external_exports.object({
   incidents: external_exports.array(external_exports.unknown())
 });
+var DoctorProfileSchema = external_exports.object({
+  debugbundle: external_exports.object({
+    last_reviewed_at: external_exports.string(),
+    validation_status: external_exports.enum(["static-analysis-only", "agent-validated"])
+  })
+});
 var PROFILE_STALENESS_THRESHOLD_DAYS = 30;
 var LOCAL_RELAY_SPOOL_DIRECTORY_PATH = ".debugbundle/local/browser-relay-spool";
 var RELAY_SPOOL_DELIVERED_MARKER_SUFFIX = ".delivered";
@@ -18508,6 +19218,12 @@ async function buildFileCheck(rootDirectory, name, filePath, stat) {
     message: exists ? `Found ${filePath}` : `Missing ${filePath}`
   };
 }
+function formatZodErrors2(error) {
+  return error.issues.map((issue) => ({
+    path: issue.path.join("."),
+    message: issue.message
+  }));
+}
 async function loadProfile(rootDirectory, dependencies) {
   const profilePath = (0, import_node_path4.join)(rootDirectory, PROFILE_FILE_PATH);
   if (!await pathExists3(profilePath, dependencies.stat)) {
@@ -18517,29 +19233,46 @@ async function loadProfile(rootDirectory, dependencies) {
         status: "missing",
         message: `Missing ${PROFILE_FILE_PATH}`
       },
-      profile: null
+      profile: null,
+      validationErrors: []
     };
   }
+  let parsedJson;
   try {
-    const parsedProfile = ProfileSchema2.parse(JSON.parse(await dependencies.readFile(profilePath)));
+    parsedJson = JSON.parse(await dependencies.readFile(profilePath));
+  } catch {
     return {
       check: {
         name: "profile",
-        status: "ok",
-        message: `Found ${PROFILE_FILE_PATH}`
+        status: "error",
+        message: `Invalid ${PROFILE_FILE_PATH}`
       },
-      profile: parsedProfile
+      profile: null,
+      validationErrors: []
     };
-  } catch {
+  }
+  const parsedDoctorProfile = DoctorProfileSchema.safeParse(parsedJson);
+  if (!parsedDoctorProfile.success) {
     return {
       check: {
         name: "profile",
         status: "error",
         message: `Invalid ${PROFILE_FILE_PATH}`
       },
-      profile: null
+      profile: null,
+      validationErrors: formatZodErrors2(parsedDoctorProfile.error)
     };
   }
+  const parsedFullProfile = ProfileSchema.safeParse(parsedJson);
+  return {
+    check: {
+      name: "profile",
+      status: "ok",
+      message: `Found ${PROFILE_FILE_PATH}`
+    },
+    profile: parsedDoctorProfile.data,
+    validationErrors: parsedFullProfile.success ? [] : formatZodErrors2(parsedFullProfile.error)
+  };
 }
 async function loadConnection(rootDirectory, dependencies) {
   const connectionPath = (0, import_node_path4.join)(rootDirectory, CONNECTION_FILE_PATH);
@@ -18591,7 +19324,20 @@ function buildProjectModeCheck(connection) {
     message: `Project mode is ${connection.mode}.`
   };
 }
-function buildProfileValidationCheck(profile) {
+function formatProfileValidationError(errors) {
+  const firstError = errors[0];
+  const path = firstError.path.length === 0 ? PROFILE_FILE_PATH : firstError.path;
+  const totalErrors = errors.length === 1 ? "" : ` (${errors.length} total errors)`;
+  return `Profile schema validation failed at ${path}: ${firstError.message}${totalErrors}.`;
+}
+function buildProfileValidationCheck(profile, validationErrors) {
+  if (validationErrors.length > 0) {
+    return {
+      name: "profile-validation",
+      status: "error",
+      message: formatProfileValidationError(validationErrors)
+    };
+  }
   if (profile === null) {
     return {
       name: "profile-validation",
@@ -18840,7 +19586,7 @@ async function doctorCommand(input, dependencies = {}) {
   const stat = dependencies.stat ?? import_promises4.stat;
   const rootDirectory = cwd();
   const currentTime = now();
-  const { check: profileCheck, profile } = await loadProfile(rootDirectory, { readFile, stat });
+  const { check: profileCheck, profile, validationErrors } = await loadProfile(rootDirectory, { readFile, stat });
   const { check: connectionCheck, connection } = await loadConnection(rootDirectory, { readFile, stat });
   const { check: authCheck, authState } = await buildAuthCheck(input, readAuthStateImpl);
   const connectedApiCheck = await buildConnectedApiCheck({
@@ -18855,7 +19601,7 @@ async function doctorCommand(input, dependencies = {}) {
     authCheck,
     buildProjectModeCheck(connection),
     ...connectedApiCheck === null ? [] : [connectedApiCheck],
-    buildProfileValidationCheck(profile),
+    buildProfileValidationCheck(profile, validationErrors),
     buildProfileFreshnessCheck(profile, currentTime),
     ...input.checkRelay === true ? [await buildRelaySpoolCheck(rootDirectory, currentTime, { readdir, stat })] : []
   ];
@@ -18867,6 +19613,7 @@ async function doctorCommand(input, dependencies = {}) {
 }
 
 // ../cli/src/verify-command.ts
+var import_node_crypto6 = require("node:crypto");
 var import_promises7 = require("node:fs/promises");
 var import_node_path9 = require("node:path");
 
@@ -19167,6 +19914,868 @@ var import_ioredis4 = __toESM(require_built3(), 1);
 
 // ../../packages/storage/src/schema-migrations.ts
 var import_node_crypto3 = require("node:crypto");
+
+// ../../packages/storage/src/migrations.ts
+var STORAGE_BOOTSTRAP_STATEMENTS = [
+  `
+    CREATE TABLE users (
+      id uuid PRIMARY KEY,
+      email text NOT NULL UNIQUE,
+      accepted_terms_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      email_verified_at timestamptz,
+      avatar_source text,
+      avatar_object_key text,
+      avatar_content_type text,
+      avatar_updated_at timestamptz
+    )
+  `,
+  `
+    CREATE TABLE organizations (
+      id uuid PRIMARY KEY,
+      name text NOT NULL,
+      slug text NOT NULL UNIQUE,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      suspended_at timestamptz,
+      plan text NOT NULL DEFAULT 'free',
+      stripe_customer_id text,
+      additional_capacity_units integer NOT NULL DEFAULT 0,
+      stripe_subscription_id text,
+      billing_state text,
+      billing_period_ends_at timestamptz,
+      last_billing_sync_at timestamptz,
+      last_billing_event_id text,
+      billing_period_starts_at timestamptz
+    )
+  `,
+  `
+    CREATE UNIQUE INDEX organizations_stripe_customer_id_key
+    ON organizations (stripe_customer_id)
+    WHERE stripe_customer_id IS NOT NULL
+  `,
+  `
+    CREATE TABLE projects (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      owner_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      name text NOT NULL,
+      slug text NOT NULL,
+      environment_default text NOT NULL DEFAULT 'production',
+      automated_improvement_bundles_enabled boolean NOT NULL DEFAULT true,
+      improvement_bundle_sensitivity text NOT NULL DEFAULT 'high_confidence'
+        CHECK (improvement_bundle_sensitivity IN ('high_confidence', 'balanced', 'verbose')),
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      plan text NOT NULL DEFAULT 'free'
+    )
+  `,
+  `
+    CREATE UNIQUE INDEX projects_organization_id_slug_key
+    ON projects (organization_id, slug)
+  `,
+  `
+    CREATE TABLE services (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      name text NOT NULL,
+      runtime text,
+      framework text,
+      environment text NOT NULL DEFAULT 'production',
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (project_id, name, environment)
+    )
+  `,
+  `
+    CREATE TABLE project_tokens (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      token_hash text UNIQUE NOT NULL,
+      label text NOT NULL,
+      allowed_origins jsonb NOT NULL DEFAULT '[]'::jsonb,
+      last_used_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      revoked_at timestamptz,
+      expires_at timestamptz
+    )
+  `,
+  `
+    CREATE TABLE member_tokens (
+      id uuid PRIMARY KEY,
+      user_id uuid NOT NULL,
+      organization_id uuid NOT NULL,
+      token_hash text UNIQUE NOT NULL,
+      label text NOT NULL,
+      last_used_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      revoked_at timestamptz,
+      expires_at timestamptz
+    )
+  `,
+  `
+    CREATE INDEX member_tokens_org_idx
+    ON member_tokens (organization_id)
+  `,
+  `
+    CREATE TABLE audit_logs (
+      id uuid PRIMARY KEY,
+      organization_id uuid,
+      actor_user_id uuid,
+      actor_type text NOT NULL,
+      action text NOT NULL,
+      target_type text NOT NULL,
+      target_id text,
+      status text NOT NULL,
+      ip_address text,
+      metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+      occurred_at timestamptz NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX audit_logs_organization_occurred_at_idx
+    ON audit_logs (organization_id, occurred_at DESC, created_at DESC)
+  `,
+  `
+    CREATE INDEX audit_logs_action_occurred_at_idx
+    ON audit_logs (action, occurred_at DESC, created_at DESC)
+  `,
+  `
+    CREATE TABLE organization_members (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      role text NOT NULL DEFAULT 'member',
+      suspended_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (organization_id, user_id)
+    )
+  `,
+  `
+    CREATE INDEX organization_members_org_idx
+    ON organization_members (organization_id)
+  `,
+  `
+    CREATE INDEX organization_members_user_idx
+    ON organization_members (user_id)
+  `,
+  `
+    CREATE TABLE sessions (
+      id uuid PRIMARY KEY,
+      user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      session_token_hash text UNIQUE NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      expires_at timestamptz NOT NULL,
+      revoked_at timestamptz
+    )
+  `,
+  `
+    CREATE INDEX sessions_token_hash_idx
+    ON sessions (session_token_hash)
+  `,
+  `
+    CREATE INDEX sessions_user_org_idx
+    ON sessions (user_id, organization_id)
+  `,
+  `
+    CREATE TABLE email_auth_challenges (
+      id uuid PRIMARY KEY,
+      email text NOT NULL,
+      code_hash text NOT NULL,
+      accepted_terms_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      expires_at timestamptz NOT NULL,
+      used_at timestamptz
+    )
+  `,
+  `
+    CREATE INDEX email_auth_challenges_email_idx
+    ON email_auth_challenges (lower(email), created_at DESC)
+  `,
+  `
+    CREATE INDEX email_auth_challenges_code_hash_idx
+    ON email_auth_challenges (code_hash)
+  `,
+  `
+    CREATE TABLE github_device_authorizations (
+      id uuid PRIMARY KEY,
+      device_code text NOT NULL UNIQUE,
+      user_code text NOT NULL,
+      verification_uri text NOT NULL,
+      interval_seconds integer NOT NULL,
+      expires_at timestamptz NOT NULL,
+      accepted_terms_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      completed_at timestamptz,
+      claimed_at timestamptz,
+      terminal_error text,
+      user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      organization_id uuid REFERENCES organizations(id) ON DELETE SET NULL
+    )
+  `,
+  `
+    CREATE INDEX github_device_authorizations_user_code_idx
+    ON github_device_authorizations (user_code, created_at DESC)
+  `,
+  `
+    CREATE INDEX github_device_authorizations_expires_at_idx
+    ON github_device_authorizations (expires_at)
+  `,
+  `
+    CREATE TABLE project_members (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      role text NOT NULL,
+      invited_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (project_id, user_id)
+    )
+  `,
+  `
+    CREATE INDEX project_members_project_id_idx
+    ON project_members (project_id, created_at DESC)
+  `,
+  `
+    CREATE INDEX project_members_user_id_idx
+    ON project_members (user_id, created_at DESC)
+  `,
+  `
+    CREATE TABLE project_invites (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      email text NOT NULL,
+      role text NOT NULL,
+      invited_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      invite_token_hash text NOT NULL,
+      accepted_at timestamptz,
+      canceled_at timestamptz,
+      expires_at timestamptz NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX project_invites_project_id_idx
+    ON project_invites (project_id, created_at DESC)
+  `,
+  `
+    CREATE UNIQUE INDEX project_invites_pending_project_email_key
+    ON project_invites (project_id, lower(email))
+    WHERE accepted_at IS NULL AND canceled_at IS NULL
+  `,
+  `
+    CREATE UNIQUE INDEX project_invites_invite_token_hash_key
+    ON project_invites (invite_token_hash)
+  `,
+  `
+    CREATE TABLE oauth_identities (
+      id uuid PRIMARY KEY,
+      provider text NOT NULL,
+      provider_user_id text NOT NULL,
+      user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (provider, provider_user_id)
+    )
+  `,
+  `
+    CREATE INDEX oauth_identities_user_id_idx
+    ON oauth_identities (user_id, provider)
+  `,
+  `
+    CREATE TABLE probe_activations (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      created_by_member_id uuid NOT NULL,
+      label_pattern text NOT NULL,
+      service text NOT NULL DEFAULT '*',
+      environment text NOT NULL DEFAULT '*',
+      trigger_expires_at timestamptz NOT NULL,
+      expires_at timestamptz NOT NULL,
+      deactivated_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX probe_activations_project_active_idx
+    ON probe_activations (project_id, expires_at DESC)
+    WHERE deactivated_at IS NULL
+  `,
+  `
+    CREATE TABLE capture_policies (
+      project_id uuid PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+      preset text NOT NULL DEFAULT 'minimal',
+      capture_logs text,
+      capture_request_events text,
+      capture_breadcrumbs text,
+      capture_probe_events text,
+      immediate_client_error_statuses jsonb,
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE TABLE capture_rules (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      name text NOT NULL,
+      description text,
+      enabled boolean NOT NULL DEFAULT true,
+      action text NOT NULL,
+      matcher jsonb NOT NULL,
+      sample_rate double precision,
+      sample_event_class text,
+      created_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      created_from_incident_id text,
+      created_from_event_id text,
+      expires_at timestamptz,
+      hit_count bigint NOT NULL DEFAULT 0,
+      last_matched_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX capture_rules_project_enabled_idx
+    ON capture_rules (project_id, enabled)
+  `,
+  `
+    CREATE INDEX capture_rules_project_updated_idx
+    ON capture_rules (project_id, updated_at DESC)
+  `,
+  `
+    CREATE TABLE deployments (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      service_id uuid REFERENCES services(id) ON DELETE SET NULL,
+      environment text NOT NULL,
+      source_event_id uuid UNIQUE NOT NULL,
+      commit_sha text,
+      version text,
+      branch text,
+      deployed_at timestamptz NOT NULL,
+      metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX deployments_project_service_env_deployed_idx
+    ON deployments (project_id, service_id, environment, deployed_at DESC)
+  `,
+  `
+    CREATE TABLE incidents (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      service_id uuid REFERENCES services(id) ON DELETE SET NULL,
+      environment text NOT NULL DEFAULT 'production',
+      fingerprint text NOT NULL,
+      fingerprint_version text NOT NULL DEFAULT 'v1',
+      title text NOT NULL,
+      severity text NOT NULL,
+      status text NOT NULL DEFAULT 'open',
+      first_seen_at timestamptz NOT NULL,
+      last_seen_at timestamptz NOT NULL,
+      occurrence_count integer NOT NULL DEFAULT 1,
+      matched_fields text[],
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      regressed_at timestamptz,
+      spike_detected_at timestamptz,
+      frequency_occurrences_1m integer,
+      frequency_occurrences_5m integer,
+      frequency_occurrences_1h integer,
+      frequency_occurrences_24h integer,
+      frequency_baseline_1h_per_5m double precision,
+      frequency_spike_ratio_5m_to_1h double precision,
+      frequency_has_sufficient_baseline boolean,
+      frequency_is_spiking boolean,
+      frequency_snapshot_at timestamptz,
+      latest_deployment_id uuid REFERENCES deployments(id) ON DELETE SET NULL,
+      bundle_generation_number integer NOT NULL DEFAULT 0,
+      bundle_created_at timestamptz,
+      bundle_updated_at timestamptz,
+      bundle_source_event_id uuid,
+      bundle_source_occurred_at timestamptz,
+      bundle_trigger text,
+      bundle_failure_reason text,
+      resolved_at timestamptz,
+      resolved_by_member_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      UNIQUE (project_id, environment, service_id, fingerprint)
+    )
+  `,
+  `
+    CREATE TABLE processed_events (
+      event_id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      event_type text NOT NULL,
+      fingerprint text NOT NULL,
+      normalized_message text NOT NULL,
+      processed_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE TABLE improvement_opportunities (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      service_id uuid REFERENCES services(id) ON DELETE SET NULL,
+      service_name text NOT NULL,
+      environment text NOT NULL DEFAULT 'production',
+      kind text NOT NULL,
+      status text NOT NULL DEFAULT 'open',
+      severity text NOT NULL,
+      confidence numeric NOT NULL,
+      fingerprint text NOT NULL,
+      title text NOT NULL,
+      summary text NOT NULL,
+      occurrence_count integer NOT NULL DEFAULT 1,
+      evidence jsonb NOT NULL,
+      first_detected_at timestamptz NOT NULL,
+      last_detected_at timestamptz NOT NULL,
+      last_source_event_id uuid,
+      related_incident_ids uuid[] NOT NULL DEFAULT '{}',
+      bundle_generation_number integer NOT NULL DEFAULT 0,
+      bundle_created_at timestamptz,
+      bundle_updated_at timestamptz,
+      bundle_source_event_id uuid,
+      bundle_failure_reason text,
+      resolved_at timestamptz,
+      resolved_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      snoozed_until timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (project_id, fingerprint)
+    )
+  `,
+  `
+    CREATE INDEX improvement_opportunities_project_status_detected_idx
+    ON improvement_opportunities (project_id, status, last_detected_at DESC)
+  `,
+  `
+    CREATE INDEX improvement_opportunities_project_kind_detected_idx
+    ON improvement_opportunities (project_id, kind, last_detected_at DESC)
+  `,
+  `
+    CREATE INDEX improvement_opportunities_project_service_env_idx
+    ON improvement_opportunities (project_id, service_id, environment)
+  `,
+  `
+    CREATE TABLE improvement_opportunity_events (
+      improvement_opportunity_id uuid NOT NULL REFERENCES improvement_opportunities(id) ON DELETE CASCADE,
+      event_id uuid NOT NULL,
+      event_type text NOT NULL,
+      occurred_at timestamptz NOT NULL,
+      PRIMARY KEY (improvement_opportunity_id, event_id)
+    )
+  `,
+  `
+    CREATE INDEX improvement_opportunity_events_detected_idx
+    ON improvement_opportunity_events (improvement_opportunity_id, occurred_at DESC, event_id DESC)
+  `,
+  `
+    CREATE TABLE bundle_generations (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid REFERENCES incidents(id) ON DELETE CASCADE,
+      improvement_opportunity_id uuid REFERENCES improvement_opportunities(id) ON DELETE CASCADE,
+      bundle_type text NOT NULL,
+      generation_number integer NOT NULL,
+      source_event_id uuid NOT NULL,
+      source_occurred_at timestamptz NOT NULL,
+      trigger text NOT NULL,
+      created_at timestamptz NOT NULL,
+      updated_at timestamptz NOT NULL,
+      CHECK (
+        (incident_id IS NOT NULL AND improvement_opportunity_id IS NULL AND bundle_type = 'failure')
+        OR (incident_id IS NULL AND improvement_opportunity_id IS NOT NULL AND bundle_type = 'improvement')
+      )
+    )
+  `,
+  `
+    CREATE UNIQUE INDEX bundle_generations_incident_source_idx
+    ON bundle_generations (incident_id, source_event_id)
+    WHERE incident_id IS NOT NULL
+  `,
+  `
+    CREATE UNIQUE INDEX bundle_generations_improvement_source_idx
+    ON bundle_generations (improvement_opportunity_id, source_event_id)
+    WHERE improvement_opportunity_id IS NOT NULL
+  `,
+  `
+    CREATE INDEX bundle_generations_project_created_idx
+    ON bundle_generations (project_id, created_at DESC, bundle_type)
+  `,
+  `
+    CREATE INDEX bundle_generations_incident_generation_idx
+    ON bundle_generations (incident_id, generation_number DESC)
+  `,
+  `
+    CREATE INDEX bundle_generations_improvement_generation_idx
+    ON bundle_generations (improvement_opportunity_id, generation_number DESC)
+    WHERE improvement_opportunity_id IS NOT NULL
+  `,
+  `
+    CREATE TABLE incident_events (
+      incident_id uuid NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+      event_id uuid NOT NULL,
+      event_type text NOT NULL,
+      event_class text NOT NULL DEFAULT 'context_signal',
+      occurred_at timestamptz NOT NULL,
+      is_sampled boolean NOT NULL DEFAULT false,
+      level text,
+      retain_first boolean NOT NULL DEFAULT false,
+      retain_latest boolean NOT NULL DEFAULT false,
+      retain_after_deploy boolean NOT NULL DEFAULT false,
+      retain_highest_severity boolean NOT NULL DEFAULT false,
+      retain_deploy_metadata boolean NOT NULL DEFAULT false,
+      severity_rank integer NOT NULL DEFAULT 0,
+      PRIMARY KEY (incident_id, event_id)
+    )
+  `,
+  `
+    CREATE INDEX incident_events_incident_occurred_event_idx
+    ON incident_events (incident_id, occurred_at DESC, event_id DESC)
+  `,
+  `
+    CREATE INDEX incident_events_incident_level_occurred_event_idx
+    ON incident_events (incident_id, level, occurred_at DESC, event_id DESC)
+  `,
+  `
+    CREATE INDEX incident_events_incident_sampled_idx
+    ON incident_events (incident_id, is_sampled, occurred_at ASC, event_id ASC)
+  `,
+  `
+    CREATE TABLE weekly_report_channels (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      channel text NOT NULL,
+      config jsonb NOT NULL DEFAULT '{}'::jsonb,
+      schedule_day_of_week text NOT NULL,
+      schedule_hour_of_day integer NOT NULL,
+      schedule_timezone text NOT NULL,
+      is_enabled boolean NOT NULL DEFAULT true,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX weekly_report_channels_project_created_idx
+    ON weekly_report_channels (project_id, created_at ASC)
+  `,
+  `
+    CREATE UNIQUE INDEX weekly_report_channels_project_email_unique_idx
+    ON weekly_report_channels (project_id)
+    WHERE channel = 'email'
+  `,
+  `
+    CREATE TABLE weekly_report_deliveries (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      weekly_report_channel_id uuid REFERENCES weekly_report_channels(id) ON DELETE CASCADE,
+      window_start timestamptz NOT NULL,
+      window_end timestamptz NOT NULL,
+      channel text NOT NULL,
+      status text NOT NULL,
+      last_error text,
+      delivered_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX weekly_report_deliveries_project_window_idx
+    ON weekly_report_deliveries (project_id, window_end DESC, channel)
+  `,
+  `
+    CREATE UNIQUE INDEX weekly_report_deliveries_channel_window_idx
+    ON weekly_report_deliveries (weekly_report_channel_id, window_start, window_end)
+    WHERE weekly_report_channel_id IS NOT NULL
+  `,
+  `
+    CREATE INDEX weekly_report_deliveries_channel_idx
+    ON weekly_report_deliveries (weekly_report_channel_id, window_end DESC)
+  `,
+  `
+    CREATE TABLE alert_rules (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      created_by_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      service_id uuid REFERENCES services(id) ON DELETE CASCADE,
+      channel text NOT NULL,
+      condition_type text NOT NULL,
+      severity_min text,
+      config jsonb NOT NULL DEFAULT '{}'::jsonb,
+      is_enabled boolean NOT NULL DEFAULT true,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX alert_rules_project_enabled_idx
+    ON alert_rules (project_id, is_enabled)
+  `,
+  `
+    CREATE TABLE slack_destinations (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      slack_team_id text NOT NULL,
+      slack_team_name text,
+      slack_channel_id text NOT NULL,
+      slack_channel_name text,
+      webhook_url_ciphertext text NOT NULL,
+      installed_by_member_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      is_active boolean NOT NULL DEFAULT true,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (organization_id, slack_team_id, slack_channel_id)
+    )
+  `,
+  `
+    CREATE INDEX slack_destinations_org_active_idx
+    ON slack_destinations (organization_id, is_active, created_at)
+  `,
+  `
+    CREATE TABLE alert_deliveries (
+      id uuid PRIMARY KEY,
+      alert_id uuid NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+      condition_type text NOT NULL,
+      dedupe_key text NOT NULL,
+      channel text NOT NULL,
+      status text NOT NULL,
+      payload jsonb NOT NULL,
+      last_error text,
+      delivered_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (alert_id, incident_id, dedupe_key)
+    )
+  `,
+  `
+    CREATE INDEX alert_deliveries_project_status_idx
+    ON alert_deliveries (project_id, status, created_at DESC)
+  `,
+  `
+    CREATE TABLE alert_email_digests (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      recipient text NOT NULL,
+      status text NOT NULL,
+      next_attempt_at timestamptz,
+      claimed_at timestamptz,
+      last_error text,
+      delivered_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE UNIQUE INDEX alert_email_digests_project_recipient_pending_idx
+    ON alert_email_digests (project_id, recipient)
+    WHERE status = 'pending' AND claimed_at IS NULL
+  `,
+  `
+    CREATE INDEX alert_email_digests_status_next_attempt_idx
+    ON alert_email_digests (status, next_attempt_at)
+  `,
+  `
+    CREATE TABLE alert_email_digest_items (
+      id uuid PRIMARY KEY,
+      digest_id uuid NOT NULL REFERENCES alert_email_digests(id) ON DELETE CASCADE,
+      alert_id uuid NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+      condition_type text NOT NULL,
+      dedupe_key text NOT NULL,
+      payload jsonb NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (alert_id, incident_id, dedupe_key)
+    )
+  `,
+  `
+    CREATE INDEX alert_email_digest_items_digest_created_idx
+    ON alert_email_digest_items (digest_id, created_at ASC)
+  `,
+  `
+    CREATE TABLE agent_webhooks (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      created_by_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      url text NOT NULL,
+      secret_hash text NOT NULL,
+      events text[] NOT NULL,
+      filters jsonb NOT NULL DEFAULT '{}'::jsonb,
+      is_enabled boolean NOT NULL DEFAULT true,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX agent_webhooks_project_enabled_idx
+    ON agent_webhooks (project_id, is_enabled)
+  `,
+  `
+    CREATE TABLE webhook_deliveries (
+      id uuid PRIMARY KEY,
+      webhook_id uuid REFERENCES agent_webhooks(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid REFERENCES incidents(id) ON DELETE CASCADE,
+      event_type text NOT NULL,
+      target_url text NOT NULL,
+      signing_secret text NOT NULL,
+      status text NOT NULL DEFAULT 'pending',
+      attempt_count integer NOT NULL DEFAULT 0,
+      occurred_at timestamptz NOT NULL,
+      next_attempt_at timestamptz,
+      last_response_code integer,
+      last_attempted_at timestamptz,
+      last_error text,
+      payload jsonb NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX webhook_deliveries_status_next_attempt_idx
+    ON webhook_deliveries (status, next_attempt_at)
+  `,
+  `
+    CREATE TABLE processed_billing_events (
+      event_id text PRIMARY KEY,
+      event_type text NOT NULL,
+      organization_id uuid,
+      processed_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE TABLE github_installations (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      installation_id bigint NOT NULL UNIQUE,
+      account_login text NOT NULL,
+      account_type text NOT NULL CHECK (account_type IN ('Organization', 'User')),
+      status text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'suspended', 'removed')),
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (organization_id)
+    )
+  `,
+  `
+    CREATE INDEX github_installations_status_idx
+    ON github_installations (status)
+  `,
+  `
+    CREATE TABLE project_github_repos (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL UNIQUE REFERENCES projects(id) ON DELETE CASCADE,
+      installation_id uuid NOT NULL REFERENCES github_installations(id) ON DELETE CASCADE,
+      repo_owner text NOT NULL,
+      repo_name text NOT NULL,
+      default_branch text NOT NULL DEFAULT 'main',
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE TABLE github_dispatch_rules (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      created_by_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      name text NOT NULL,
+      enabled boolean NOT NULL DEFAULT true,
+      event_types text[] NOT NULL,
+      environments text[],
+      services text[],
+      severity_min text CHECK (severity_min IN ('low', 'medium', 'high', 'critical')),
+      bundle_type text CHECK (bundle_type IN ('failure', 'improvement')),
+      incident_status text NOT NULL DEFAULT 'new_or_reopened'
+        CHECK (incident_status IN ('new_only', 'reopened_only', 'new_or_reopened')),
+      cooldown_seconds integer NOT NULL DEFAULT 300,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX github_dispatch_rules_project_enabled_idx
+    ON github_dispatch_rules (project_id, enabled)
+  `,
+  `
+    CREATE TABLE github_dispatch_deliveries (
+      id uuid PRIMARY KEY,
+      rule_id uuid NOT NULL REFERENCES github_dispatch_rules(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid REFERENCES incidents(id) ON DELETE CASCADE,
+      improvement_opportunity_id uuid REFERENCES improvement_opportunities(id) ON DELETE CASCADE,
+      target_fingerprint text NOT NULL,
+      installation_id bigint NOT NULL,
+      repo_owner text NOT NULL,
+      repo_name text NOT NULL,
+      status text NOT NULL DEFAULT 'pending'
+        CHECK (status IN ('pending', 'retrying', 'delivered', 'failed', 'skipped')),
+      attempt_count integer NOT NULL DEFAULT 0,
+      next_attempt_at timestamptz,
+      last_attempt_at timestamptz,
+      last_error text,
+      github_status_code integer,
+      dispatch_payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      dedupe_key text NOT NULL,
+      CHECK (
+        (incident_id IS NOT NULL AND improvement_opportunity_id IS NULL)
+        OR (incident_id IS NULL AND improvement_opportunity_id IS NOT NULL)
+      )
+    )
+  `,
+  `
+    CREATE INDEX github_dispatch_deliveries_status_next_attempt_idx
+    ON github_dispatch_deliveries (status, next_attempt_at)
+  `,
+  `
+    CREATE UNIQUE INDEX github_dispatch_deliveries_rule_dedupe_key_idx
+    ON github_dispatch_deliveries (rule_id, target_fingerprint, dedupe_key)
+  `,
+  `
+    CREATE TABLE org_usage_counters (
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      period_starts_at timestamptz NOT NULL,
+      raw_ingested_events integer NOT NULL DEFAULT 0,
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (organization_id, period_starts_at)
+    )
+  `,
+  `
+    CREATE TABLE operational_email_deliveries (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      kind text NOT NULL
+        CHECK (kind IN ('webhook_auto_disabled', 'allowance_warning_80', 'allowance_limit_reached', 'retention_rotation_notice')),
+      dedupe_key text NOT NULL,
+      payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+      status text NOT NULL DEFAULT 'pending'
+        CHECK (status IN ('pending', 'retrying', 'delivered', 'failed')),
+      attempt_count integer NOT NULL DEFAULT 0,
+      next_attempt_at timestamptz,
+      last_error text,
+      delivered_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (organization_id, kind, dedupe_key)
+    )
+  `,
+  `
+    CREATE INDEX operational_email_deliveries_status_next_attempt_idx
+    ON operational_email_deliveries (status, next_attempt_at, created_at)
+  `
+];
+var STORAGE_BOOTSTRAP_SQL = STORAGE_BOOTSTRAP_STATEMENTS.join(";\n\n");
+
+// ../../packages/storage/src/schema-migrations.ts
 function computeMigrationChecksum(input) {
   return (0, import_node_crypto3.createHash)("sha256").update(JSON.stringify(input)).digest("hex");
 }
@@ -19430,6 +21039,234 @@ var STORAGE_SCHEMA_MIGRATIONS = [
         )
       `
     ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605180004_add_operational_email_deliveries",
+    description: "Add durable operational email delivery queue with retries and dedupe.",
+    statements: [
+      `
+        CREATE TABLE IF NOT EXISTS operational_email_deliveries (
+          id uuid PRIMARY KEY,
+          organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+          project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+          kind text NOT NULL,
+          dedupe_key text NOT NULL,
+          payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+          status text NOT NULL DEFAULT 'pending',
+          attempt_count integer NOT NULL DEFAULT 0,
+          next_attempt_at timestamptz,
+          last_error text,
+          delivered_at timestamptz,
+          created_at timestamptz NOT NULL DEFAULT now(),
+          updated_at timestamptz NOT NULL DEFAULT now(),
+          UNIQUE (organization_id, kind, dedupe_key)
+        )
+      `,
+      `
+        ALTER TABLE operational_email_deliveries
+        DROP CONSTRAINT IF EXISTS operational_email_deliveries_kind_check
+      `,
+      `
+        ALTER TABLE operational_email_deliveries
+        ADD CONSTRAINT operational_email_deliveries_kind_check
+        CHECK (kind IN ('webhook_auto_disabled', 'allowance_warning_80', 'allowance_limit_reached', 'retention_rotation_notice'))
+      `,
+      `
+        ALTER TABLE operational_email_deliveries
+        DROP CONSTRAINT IF EXISTS operational_email_deliveries_status_check
+      `,
+      `
+        ALTER TABLE operational_email_deliveries
+        ADD CONSTRAINT operational_email_deliveries_status_check
+        CHECK (status IN ('pending', 'retrying', 'delivered', 'failed'))
+      `,
+      `
+        CREATE INDEX IF NOT EXISTS operational_email_deliveries_status_next_attempt_idx
+        ON operational_email_deliveries (status, next_attempt_at, created_at)
+      `
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605180005_add_github_improvement_dispatch_targets",
+    description: "Allow GitHub dispatch deliveries to target either incidents or hosted improvements.",
+    statements: [
+      "ALTER TABLE github_dispatch_deliveries ALTER COLUMN incident_id DROP NOT NULL",
+      "ALTER TABLE github_dispatch_deliveries RENAME COLUMN incident_fingerprint TO target_fingerprint",
+      "ALTER TABLE github_dispatch_deliveries ADD COLUMN IF NOT EXISTS improvement_opportunity_id uuid REFERENCES improvement_opportunities(id) ON DELETE CASCADE",
+      "DROP INDEX IF EXISTS github_dispatch_deliveries_rule_dedupe_key_idx",
+      `
+        CREATE UNIQUE INDEX IF NOT EXISTS github_dispatch_deliveries_rule_dedupe_key_idx
+        ON github_dispatch_deliveries (rule_id, target_fingerprint, dedupe_key)
+      `,
+      "ALTER TABLE github_dispatch_deliveries DROP CONSTRAINT IF EXISTS github_dispatch_deliveries_check",
+      `
+        ALTER TABLE github_dispatch_deliveries
+        ADD CONSTRAINT github_dispatch_deliveries_check CHECK (
+          (incident_id IS NOT NULL AND improvement_opportunity_id IS NULL)
+          OR (incident_id IS NULL AND improvement_opportunity_id IS NOT NULL)
+        )
+      `
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605180006_add_missing_bundle_and_creator_columns",
+    description: "Backfill creator ownership columns and incident bundle tracking columns that existed only in bootstrap schema.",
+    statements: [
+      "ALTER TABLE incidents ADD COLUMN IF NOT EXISTS bundle_generation_number integer NOT NULL DEFAULT 0",
+      "ALTER TABLE incidents ADD COLUMN IF NOT EXISTS bundle_created_at timestamptz",
+      "ALTER TABLE incidents ADD COLUMN IF NOT EXISTS bundle_updated_at timestamptz",
+      "ALTER TABLE incidents ADD COLUMN IF NOT EXISTS bundle_source_event_id uuid",
+      "ALTER TABLE incidents ADD COLUMN IF NOT EXISTS bundle_source_occurred_at timestamptz",
+      "ALTER TABLE incidents ADD COLUMN IF NOT EXISTS bundle_trigger text",
+      "ALTER TABLE incidents ADD COLUMN IF NOT EXISTS bundle_failure_reason text",
+      "ALTER TABLE alert_rules ADD COLUMN IF NOT EXISTS created_by_user_id uuid",
+      `
+        UPDATE alert_rules ar
+        SET created_by_user_id = p.owner_user_id
+        FROM projects p
+        WHERE ar.project_id = p.id
+          AND ar.created_by_user_id IS NULL
+      `,
+      "ALTER TABLE alert_rules DROP CONSTRAINT IF EXISTS alert_rules_created_by_user_id_fkey",
+      `
+        ALTER TABLE alert_rules
+        ADD CONSTRAINT alert_rules_created_by_user_id_fkey
+        FOREIGN KEY (created_by_user_id) REFERENCES users(id) ON DELETE CASCADE
+      `,
+      "ALTER TABLE alert_rules ALTER COLUMN created_by_user_id SET NOT NULL",
+      "ALTER TABLE agent_webhooks ADD COLUMN IF NOT EXISTS created_by_user_id uuid",
+      `
+        UPDATE agent_webhooks aw
+        SET created_by_user_id = p.owner_user_id
+        FROM projects p
+        WHERE aw.project_id = p.id
+          AND aw.created_by_user_id IS NULL
+      `,
+      "ALTER TABLE agent_webhooks DROP CONSTRAINT IF EXISTS agent_webhooks_created_by_user_id_fkey",
+      `
+        ALTER TABLE agent_webhooks
+        ADD CONSTRAINT agent_webhooks_created_by_user_id_fkey
+        FOREIGN KEY (created_by_user_id) REFERENCES users(id) ON DELETE CASCADE
+      `,
+      "ALTER TABLE agent_webhooks ALTER COLUMN created_by_user_id SET NOT NULL",
+      "ALTER TABLE github_dispatch_rules ADD COLUMN IF NOT EXISTS created_by_user_id uuid",
+      `
+        UPDATE github_dispatch_rules gdr
+        SET created_by_user_id = p.owner_user_id
+        FROM projects p
+        WHERE gdr.project_id = p.id
+          AND gdr.created_by_user_id IS NULL
+      `,
+      "ALTER TABLE github_dispatch_rules DROP CONSTRAINT IF EXISTS github_dispatch_rules_created_by_user_id_fkey",
+      `
+        ALTER TABLE github_dispatch_rules
+        ADD CONSTRAINT github_dispatch_rules_created_by_user_id_fkey
+        FOREIGN KEY (created_by_user_id) REFERENCES users(id) ON DELETE CASCADE
+      `,
+      "ALTER TABLE github_dispatch_rules ALTER COLUMN created_by_user_id SET NOT NULL"
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605200001_limit_weekly_report_email_channel_per_project",
+    description: "Keep weekly email reports singular per project.",
+    statements: [
+      `
+        DELETE FROM weekly_report_channels
+        WHERE id IN (
+          SELECT id
+          FROM (
+            SELECT
+              id,
+              row_number() OVER (PARTITION BY project_id ORDER BY created_at ASC, id ASC) AS row_number
+            FROM weekly_report_channels
+            WHERE channel = 'email'
+          ) ranked
+          WHERE ranked.row_number > 1
+        )
+      `,
+      `
+        CREATE UNIQUE INDEX IF NOT EXISTS weekly_report_channels_project_email_unique_idx
+        ON weekly_report_channels (project_id)
+        WHERE channel = 'email'
+      `
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605220001_add_project_token_allowed_origins",
+    description: "Add optional browser-origin allowlists to project ingestion tokens.",
+    statements: [
+      "ALTER TABLE project_tokens ADD COLUMN IF NOT EXISTS allowed_origins jsonb NOT NULL DEFAULT '[]'::jsonb"
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605260001_fix_weekly_report_delivery_conflict_index",
+    description: "Ensure weekly report delivery dedupe rows and partial unique index exist for conflict claims.",
+    statements: [
+      `
+        DELETE FROM weekly_report_deliveries
+        WHERE id IN (
+          SELECT id
+          FROM (
+            SELECT
+              id,
+              row_number() OVER (
+                PARTITION BY weekly_report_channel_id, window_start, window_end
+                ORDER BY created_at ASC, id ASC
+              ) AS row_number
+            FROM weekly_report_deliveries
+            WHERE weekly_report_channel_id IS NOT NULL
+          ) ranked
+          WHERE ranked.row_number > 1
+        )
+      `,
+      `
+        CREATE UNIQUE INDEX IF NOT EXISTS weekly_report_deliveries_channel_window_idx
+        ON weekly_report_deliveries (weekly_report_channel_id, window_start, window_end)
+        WHERE weekly_report_channel_id IS NOT NULL
+      `
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605260001_set_high_confidence_as_project_improvement_default",
+    description: "Make high-confidence the default hosted improvement sensitivity for new projects.",
+    statements: [
+      "ALTER TABLE projects ALTER COLUMN improvement_bundle_sensitivity SET DEFAULT 'high_confidence'"
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605260002_add_capture_rules",
+    description: "Add persisted project capture rules for dynamic demote/sample/drop handling.",
+    statements: [
+      `
+        CREATE TABLE IF NOT EXISTS capture_rules (
+          id uuid PRIMARY KEY,
+          project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+          name text NOT NULL,
+          description text,
+          enabled boolean NOT NULL DEFAULT true,
+          action text NOT NULL,
+          matcher jsonb NOT NULL,
+          sample_rate double precision,
+          sample_event_class text,
+          created_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+          created_from_incident_id text,
+          created_from_event_id text,
+          expires_at timestamptz,
+          hit_count bigint NOT NULL DEFAULT 0,
+          last_matched_at timestamptz,
+          created_at timestamptz NOT NULL DEFAULT now(),
+          updated_at timestamptz NOT NULL DEFAULT now()
+        )
+      `,
+      `
+        CREATE INDEX IF NOT EXISTS capture_rules_project_enabled_idx
+        ON capture_rules (project_id, enabled)
+      `,
+      `
+        CREATE INDEX IF NOT EXISTS capture_rules_project_updated_idx
+        ON capture_rules (project_id, updated_at DESC)
+      `
+    ]
   })
 ];
 
@@ -19552,11 +21389,17 @@ function normalizeRouteTemplate(path) {
   const normalizedSegments = pathWithoutQueryOrFragment.split("/").filter((segment) => segment.length > 0).map((segment) => isDynamicRouteSegment2(segment) ? "{param}" : segment);
   return normalizedSegments.length === 0 ? "/" : `/${normalizedSegments.join("/")}`;
 }
+function isBrowserSdkFallbackFrame(frame) {
+  return frame.includes("debugbundle-browser-sdk") && frame.includes("onError");
+}
 function deriveFirstApplicationFrame(errorContext) {
   const firstFrame = errorContext?.top_frames[0];
   if (firstFrame === void 0) {
     return null;
   }
+  if (isBrowserSdkFallbackFrame(firstFrame)) {
+    return null;
+  }
   const match = /at\s+(.*?)\s+\((.*?):(\d+):(\d+)\)$/.exec(firstFrame) ?? /at\s+(.*?):(\d+):(\d+)$/.exec(firstFrame);
   if (match === null) {
     return {
@@ -19578,6 +21421,20 @@ function deriveFirstApplicationFrame(errorContext) {
     line: Number(match[2])
   };
 }
+function getPrimaryBrowserExceptionEvent(envelopes, primarySignalEnvelope) {
+  if (primarySignalEnvelope !== null && isFrontendExceptionEnvelope(primarySignalEnvelope)) {
+    return primarySignalEnvelope.payload.browser_event ?? null;
+  }
+  const envelope = selectLatestEnvelopeByType(envelopes, isFrontendExceptionEnvelope);
+  return envelope?.payload.browser_event ?? null;
+}
+function isOpaqueBrowserError(errorContext, browserEvent) {
+  if (browserEvent?.opaque === true) {
+    return true;
+  }
+  const firstFrame = errorContext?.top_frames[0];
+  return errorContext?.message === "Window error" && firstFrame !== void 0 && isBrowserSdkFallbackFrame(firstFrame);
+}
 function buildErrorContext(envelopes, incident, primarySignalEnvelope) {
   if (primarySignalEnvelope !== null && isBackendExceptionEnvelope(primarySignalEnvelope)) {
     return {
@@ -19700,6 +21557,20 @@ function buildSummaryGuidance(input) {
       recommended_action: null
     };
   }
+  if (input.opaqueBrowserError) {
+    if (input.browserEvent?.kind === "resource_error") {
+      return {
+        likely_cause: "The browser reported a resource load error without a usable application stack.",
+        confidence: 0.35,
+        recommended_action: "Inspect the captured resource target, browser network failures, CSP rules, and cross-origin asset configuration."
+      };
+    }
+    return {
+      likely_cause: "The browser reported an opaque window error without a usable application stack.",
+      confidence: 0.35,
+      recommended_action: "Inspect browser console output, resource loading, cross-origin script settings, and framework-level error boundaries for the affected route."
+    };
+  }
   const route = input.requestContext?.route_template ?? input.requestContext?.path ?? null;
   const requestDescription = input.requestContext !== null ? `${input.requestContext.method} ${route ?? input.requestContext.path}` : null;
   const firstDependency = input.dependenciesContext?.items[0] ?? null;
@@ -19886,7 +21757,8 @@ function buildFrontendContext(envelopes) {
         message: envelope.payload.message,
         route: envelope.payload.route ?? null,
         browser: envelope.payload.browser,
-        ts: toIsoTimestamp(envelope.occurred_at)
+        ts: toIsoTimestamp(envelope.occurred_at),
+        ...envelope.payload.browser_event !== void 0 ? { browser_event: envelope.payload.browser_event } : {}
       });
     }
   }
@@ -20029,6 +21901,8 @@ function buildBundle(input) {
   const gitContext = buildGitContext(sourceEnvelopes, input.configuredDeploy);
   const deviceContext = buildDeviceContext(sourceEnvelopes);
   const dependenciesContext = buildDependenciesContext(input.incident, errorContext, requestContext);
+  const browserEvent = getPrimaryBrowserExceptionEvent(sourceEnvelopes, primarySignalEnvelope);
+  const opaqueBrowserError = isOpaqueBrowserError(errorContext, browserEvent);
   const primarySignalType = primarySignalEnvelope !== null ? mapSignalType(primarySignalEnvelope.event_type) : inferSignalTypeFromSourceEventTypes(sourceEventTypes);
   const primarySourceEvent = errorContext?.name ?? sourceEventTypes[0] ?? "backend_exception";
   const firstSeenAt = new Date(input.incident.first_seen_at).toISOString();
@@ -20043,7 +21917,9 @@ function buildBundle(input) {
     requestContext,
     responseContext,
     dependenciesContext,
-    firstApplicationFrame
+    firstApplicationFrame,
+    browserEvent,
+    opaqueBrowserError
   });
   const candidate = {
     bundle_version: 1,
@@ -21181,7 +23057,7 @@ async function processCommand(input, dependencies = {}) {
 
 // ../cli/src/ingest-command.ts
 var LOCAL_EVENTS_DIRECTORY_PATH2 = ".debugbundle/local/events";
-var ProfileSchema3 = external_exports.object({
+var ProfileSchema2 = external_exports.object({
   project: external_exports.object({
     name: external_exports.string().min(1),
     repo_url: external_exports.string()
@@ -21206,7 +23082,7 @@ function buildEventFileName(events, filePath) {
   return `${lastOccurredAt}-${digest}-${slugify(events[0]?.service.name ?? (0, import_node_path7.basename)(filePath))}.events.json`;
 }
 async function readProfile(rootDirectory, readFile) {
-  const parsedProfile = ProfileSchema3.safeParse(JSON.parse(await readFile((0, import_node_path7.join)(rootDirectory, PROFILE_FILE_PATH))));
+  const parsedProfile = ProfileSchema2.safeParse(JSON.parse(await readFile((0, import_node_path7.join)(rootDirectory, PROFILE_FILE_PATH))));
   if (!parsedProfile.success) {
     throw new Error(`Invalid ${PROFILE_FILE_PATH}`);
   }
@@ -21526,19 +23402,32 @@ function formatResult(input, exitCode, checks, errors, incidentId) {
     output: input.json ? buildJsonOutput(checks, errors, incidentId) : formatHumanOutput(checks, incidentId)
   };
 }
-function buildCloudSuggestedActions(status, incidentId, mode = "passive_recent_incident") {
+function buildCloudSuggestedActions(status, incidentId, verification) {
+  const mode = verification?.mode ?? "passive_recent_incident";
   if (status === "healthy" && incidentId !== void 0 && (mode === "active_5xx" || mode === "active_4xx")) {
     return [
       `Run debugbundle inspect ${incidentId} --source cloud to inspect why the incident fired.`,
       `Run debugbundle bundle ${incidentId} --source cloud to fetch the generated debug bundle.`
     ];
   }
+  if (status === "healthy" && incidentId !== void 0 && mode === "app_event") {
+    return [
+      `Run debugbundle inspect ${incidentId} --source cloud to inspect the captured app event.`,
+      "Re-run debugbundle verify cloud --expect-app-event after instrumentation or deploy changes, using the same service, environment, and correlation hints when available."
+    ];
+  }
   if (status === "healthy" && incidentId !== void 0) {
     return [
       `Review incident ${incidentId} if you want to inspect the latest production bundle.`,
       "Re-run debugbundle verify cloud after a fresh deploy or instrumentation change."
     ];
   }
+  if (mode === "app_event") {
+    return [
+      "Trigger a real SDK event from the target app, then re-run debugbundle verify cloud --expect-app-event with the same service and environment filters.",
+      "Add --trace-id or --request-id when you have a correlation hint so the verification can match the hosted bundle deterministically."
+    ];
+  }
   return [
     "Run debugbundle login to choose an auth flow, or use debugbundle login --github, debugbundle login --github-device, or debugbundle login <dbundle_mem_...> to create ~/.debugbundle/auth.json before verifying cloud traffic.",
     "Generate a live cloud request, then re-run debugbundle verify cloud with the correct project and service filters."
@@ -21551,7 +23440,7 @@ function buildCloudJsonOutput(checks, errors, incidentId, verification) {
     checks,
     warnings: collectWarnings(checks),
     errors,
-    suggested_actions: buildCloudSuggestedActions(status, incidentId, verification?.mode),
+    suggested_actions: buildCloudSuggestedActions(status, incidentId, verification),
     auto_fix_available: false
   };
   if (verification !== void 0) {
@@ -21566,7 +23455,7 @@ function formatCloudHumanOutput(checks, incidentId, verification) {
     "Checks:",
     ...checks.map((check) => `- ${check.name}: ${check.status} - ${check.message}`),
     "Suggested actions:",
-    ...buildCloudSuggestedActions(status, incidentId, verification?.mode).map((action) => `- ${action}`)
+    ...buildCloudSuggestedActions(status, incidentId, verification).map((action) => `- ${action}`)
   ].join("\n");
 }
 function formatCloudResult(input, exitCode, checks, errors, incidentId, verification) {
@@ -21597,6 +23486,19 @@ function localFailureStepName(checks) {
 function cloudVerificationRunId(now) {
   return now.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14);
 }
+function defaultCloudVerificationSuffix() {
+  return (0, import_node_crypto6.randomUUID)().replace(/-/g, "").slice(0, 12);
+}
+function normalizeCloudVerificationSuffix(suffix) {
+  const normalized = suffix.toLowerCase().replace(/[^a-z0-9]/g, "").slice(0, 12);
+  if (normalized.length > 0) {
+    return normalized;
+  }
+  return defaultCloudVerificationSuffix();
+}
+function buildCloudVerificationRunId(now, suffix) {
+  return `${cloudVerificationRunId(now)}-${normalizeCloudVerificationSuffix(suffix)}`;
+}
 function requestFailureReason(responseStatus) {
   const incidentReason = deriveIncidentReasonFromSignal({
     event_type: "request_event",
@@ -21609,7 +23511,6 @@ function requestFailureReason(responseStatus) {
   return incidentReason;
 }
 function buildCloudVerificationEvent(input) {
-  const runId = cloudVerificationRunId(input.now);
   const is5xxVerification = input.responseStatus >= 500;
   const routeTemplate = is5xxVerification ? "/debugbundle/verify/cloud" : `/debugbundle/verify/cloud/client-error/${input.responseStatus}`;
   const verificationLabel = is5xxVerification ? "true" : `client-error-${input.responseStatus}`;
@@ -21630,7 +23531,7 @@ function buildCloudVerificationEvent(input) {
       route_template: routeTemplate,
       query: {
         debugbundle_verification: true,
-        run_id: runId,
+        run_id: input.runId,
         synthetic_status: input.responseStatus
       },
       headers: {
@@ -21644,7 +23545,7 @@ function buildCloudVerificationEvent(input) {
       response_body: {
         error: is5xxVerification ? "debugbundle_cloud_verification" : "debugbundle_cloud_client_error_verification",
         synthetic: true,
-        run_id: runId,
+        run_id: input.runId,
         response_status: input.responseStatus
       }
     }
@@ -21659,6 +23560,45 @@ function validateActiveCloudVerificationInput(input) {
   }
   return null;
 }
+function validateCloudVerificationInput(input) {
+  const activeInputError = validateActiveCloudVerificationInput(input);
+  if (activeInputError !== null) {
+    return activeInputError;
+  }
+  const appEventVerificationEnabled = input.expectAppEvent === true || input.traceId !== void 0 || input.requestId !== void 0;
+  if (appEventVerificationEnabled && (input.trigger5xx === true || input.trigger4xxStatus !== void 0)) {
+    return "Choose either a synthetic trigger run or --expect-app-event, not both.";
+  }
+  if (appEventVerificationEnabled && input.service === void 0 && input.traceId === void 0 && input.requestId === void 0) {
+    return "App-event verification requires --service, --trace-id, or --request-id so the check stays scoped.";
+  }
+  return null;
+}
+function buildCorrelationHints(input) {
+  return {
+    ...input.service === void 0 ? {} : { service: input.service },
+    environment: input.environment,
+    ...input.traceId === void 0 ? {} : { trace_id: input.traceId },
+    ...input.requestId === void 0 ? {} : { request_id: input.requestId }
+  };
+}
+function collectBundleHintMatches(bundle, input) {
+  const serializedBundle = JSON.stringify(bundle);
+  const matches = [];
+  if (input.traceId !== void 0 && serializedBundle.includes(input.traceId)) {
+    matches.push("trace_id");
+  }
+  if (input.requestId !== void 0 && serializedBundle.includes(input.requestId)) {
+    matches.push("request_id");
+  }
+  return matches;
+}
+function requestedBundleHints(input) {
+  return [
+    ...input.traceId === void 0 ? [] : ["trace_id"],
+    ...input.requestId === void 0 ? [] : ["request_id"]
+  ];
+}
 async function sendEventsToApi(input, dependencies = {}) {
   const fetchImpl = dependencies.fetchImpl ?? fetch;
   const baseUrl = input.baseUrl.endsWith("/") ? input.baseUrl.slice(0, -1) : input.baseUrl;
@@ -21850,7 +23790,7 @@ async function verifyCloudCommand(input, dependencies = {}) {
   const checks = [];
   const environment = input.environment ?? "production";
   const maxAgeMinutes = input.maxAgeMinutes ?? 15;
-  const activeInputError = validateActiveCloudVerificationInput(input);
+  const activeInputError = validateCloudVerificationInput(input);
   if (activeInputError !== null) {
     checks.push({
       name: "trigger-input",
@@ -21891,9 +23831,124 @@ async function verifyCloudCommand(input, dependencies = {}) {
     requestInput,
     dependencies.fetchImpl === void 0 ? {} : { fetchImpl: dependencies.fetchImpl }
   ));
+  const appEventVerificationEnabled = input.expectAppEvent === true || input.traceId !== void 0 || input.requestId !== void 0;
+  if (appEventVerificationEnabled) {
+    const verificationStartedAt = now();
+    const pollAttempts = dependencies.pollAttempts ?? 6;
+    const pollIntervalMs = dependencies.pollIntervalMs ?? 2e3;
+    const sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    const requestedHints = requestedBundleHints(input);
+    const verification = {
+      mode: "app_event",
+      bundle_status: "unknown",
+      correlation_hints: buildCorrelationHints({
+        environment,
+        ...input.service === void 0 ? {} : { service: input.service },
+        ...input.traceId === void 0 ? {} : { traceId: input.traceId },
+        ...input.requestId === void 0 ? {} : { requestId: input.requestId }
+      })
+    };
+    const oldestAcceptedIncidentTimestamp = verificationStartedAt.getTime() - maxAgeMinutes * 6e4;
+    let incidentId;
+    let exitCode = 0;
+    let activeStep = "app-event-visibility";
+    const errors = [];
+    try {
+      for (let attempt = 1; attempt <= pollAttempts; attempt += 1) {
+        const result = await listIncidents({
+          bearerToken: authState.bearer_token,
+          projectId: input.projectId,
+          environment,
+          ...input.service === void 0 ? {} : { service: input.service },
+          limit: 5
+        });
+        const recentIncidents = result.incidents.filter((candidate) => {
+          const lastSeenAt = new Date(candidate.last_seen_at);
+          return !Number.isNaN(lastSeenAt.getTime()) && lastSeenAt.getTime() >= oldestAcceptedIncidentTimestamp;
+        });
+        for (const candidate of recentIncidents) {
+          const lastSeenAt = new Date(candidate.last_seen_at);
+          if (requestedHints.length === 0 && lastSeenAt.getTime() < verificationStartedAt.getTime()) {
+            continue;
+          }
+          if (requestedHints.length === 0) {
+            incidentId = candidate.incident_id;
+            verification.incident_id = candidate.incident_id;
+            break;
+          }
+          activeStep = "bundle-status";
+          const bundle = await getBundle({
+            bearerToken: authState.bearer_token,
+            incidentId: candidate.incident_id
+          });
+          verification.bundle_status = "status" in bundle && bundle.status === "pending" ? "pending" : "ready";
+          if (verification.bundle_status !== "ready") {
+            continue;
+          }
+          const matchedHints = collectBundleHintMatches(bundle, input);
+          verification.matched_hints = matchedHints;
+          if (requestedHints.every((hint) => matchedHints.includes(hint))) {
+            incidentId = candidate.incident_id;
+            verification.incident_id = candidate.incident_id;
+            verification.suggested_next_command = `debugbundle inspect ${candidate.incident_id} --source cloud`;
+            break;
+          }
+        }
+        if (incidentId !== void 0) {
+          break;
+        }
+        if (attempt < pollAttempts) {
+          await sleep(pollIntervalMs);
+        }
+      }
+      if (incidentId === void 0) {
+        if (requestedHints.length > 0) {
+          throw new Error(`No recent cloud incident matched the requested ${requestedHints.join(" and ")} hints within the ${maxAgeMinutes} minute verification window.`);
+        }
+        throw new Error(`No new ${environment} app event was visible within the ${maxAgeMinutes} minute verification window.`);
+      }
+      checks.push({
+        name: "app-event-visibility",
+        status: "ok",
+        message: `Observed cloud incident ${incidentId} for the requested app-driven verification window.`
+      });
+      if (requestedHints.length > 0) {
+        checks.push({
+          name: "bundle-hint-match",
+          status: "ok",
+          message: `Matched ${verification.matched_hints?.join(" and ")} in bundle ${incidentId}.`
+        });
+      } else {
+        const bundle = await getBundle({
+          bearerToken: authState.bearer_token,
+          incidentId
+        });
+        verification.bundle_status = "status" in bundle && bundle.status === "pending" ? "pending" : "ready";
+        verification.suggested_next_command = `debugbundle inspect ${incidentId} --source cloud`;
+        checks.push({
+          name: "bundle-status",
+          status: verification.bundle_status === "ready" ? "ok" : "warning",
+          message: verification.bundle_status === "ready" ? `Bundle for incident ${incidentId} is ready.` : `Bundle for incident ${incidentId} is still pending.`
+        });
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      checks.push({
+        name: activeStep,
+        status: "error",
+        message
+      });
+      errors.push(message);
+      exitCode = 1;
+    }
+    return formatCloudResult(input, exitCode, checks, errors, incidentId, verification);
+  }
   if (input.trigger5xx === true || input.trigger4xxStatus !== void 0) {
     const verificationStartedAt = now();
-    const runId = cloudVerificationRunId(verificationStartedAt);
+    const runId = buildCloudVerificationRunId(
+      verificationStartedAt,
+      (dependencies.randomId ?? defaultCloudVerificationSuffix)()
+    );
     const serviceName = input.service ?? `debugbundle-verify-cloud-${runId}`;
     const tokenLabel = `debugbundle verify cloud ${runId}`;
     const pollAttempts = dependencies.pollAttempts ?? 6;
@@ -21925,6 +23980,7 @@ async function verifyCloudCommand(input, dependencies = {}) {
       }
       const event = buildCloudVerificationEvent({
         now: verificationStartedAt,
+        runId,
         serviceName,
         environment,
         responseStatus
@@ -22231,53 +24287,62 @@ var import_node_path10 = require("node:path");
 var SUGGESTED_ACTIONS2 = [
   "Run debugbundle setup if .debugbundle/profile.json is missing.",
   "Run debugbundle profile validate for field-level profile errors.",
-  "Run debugbundle validate --fix to recreate missing local DebugBundle stubs when safe."
+  "Run debugbundle validate --fix to recreate missing or stale local DebugBundle stubs when safe."
 ];
 var FIXABLE_FILES = [
   {
     name: "connection-config",
     filePath: CONNECTION_FILE_PATH,
-    buildContent: buildConnectionConfig
+    buildContent: buildConnectionConfig,
+    checkContent: false
   },
   {
     name: "agent-skill",
     filePath: SKILL_FILE_PATH,
-    buildContent: buildSkill
+    buildContent: buildSkill,
+    checkContent: true
   },
   {
     name: "cli-reference",
     filePath: CLI_REFERENCE_FILE_PATH,
-    buildContent: buildCliReference
+    buildContent: buildCliReference,
+    checkContent: true
   },
   {
     name: "mcp-reference",
     filePath: MCP_REFERENCE_FILE_PATH,
-    buildContent: buildMcpReference
+    buildContent: buildMcpReference,
+    checkContent: true
   },
   {
     name: "bundle-schema-reference",
     filePath: BUNDLE_SCHEMA_REFERENCE_FILE_PATH,
-    buildContent: buildBundleSchemaReference
+    buildContent: buildBundleSchemaReference,
+    checkContent: true
   },
   {
     name: "profile-enrichment-reference",
     filePath: PROFILE_ENRICHMENT_REFERENCE_FILE_PATH,
-    buildContent: buildProfileEnrichmentReference
+    buildContent: buildProfileEnrichmentReference,
+    checkContent: true
   },
   {
     name: "improvement-analysis-recipe",
     filePath: IMPROVEMENT_ANALYSIS_RECIPE_FILE_PATH,
-    buildContent: buildImprovementAnalysisRecipe
+    buildContent: buildImprovementAnalysisRecipe,
+    checkContent: true
   },
   {
     name: "performance-analysis-recipe",
     filePath: PERFORMANCE_ANALYSIS_RECIPE_FILE_PATH,
-    buildContent: buildPerformanceAnalysisRecipe
+    buildContent: buildPerformanceAnalysisRecipe,
+    checkContent: true
   },
   {
     name: "skill-evals",
     filePath: EVALS_FILE_PATH,
-    buildContent: buildSkillEvals
+    buildContent: buildSkillEvals,
+    checkContent: true
   }
 ];
 async function pathExists5(path, stat) {
@@ -22391,6 +24456,28 @@ async function validateCommand(input, dependencies = {}) {
   for (const fixableFile of FIXABLE_FILES) {
     const absoluteFilePath = (0, import_node_path10.join)(rootDirectory, fixableFile.filePath);
     if (await pathExists5(absoluteFilePath, stat)) {
+      if (fixableFile.checkContent) {
+        const currentContents = await readFile(absoluteFilePath);
+        const expectedContents = fixableFile.buildContent();
+        if (currentContents !== expectedContents) {
+          if (input.fix === true) {
+            await writeFile(absoluteFilePath, expectedContents);
+            checks.push({
+              name: fixableFile.name,
+              status: "ok",
+              message: `Updated stale ${fixableFile.filePath}`
+            });
+            continue;
+          }
+          autoFixAvailable = true;
+          checks.push({
+            name: fixableFile.name,
+            status: "warning",
+            message: `Stale ${fixableFile.filePath}; run debugbundle validate --fix to refresh it.`
+          });
+          continue;
+        }
+      }
       checks.push({
         name: fixableFile.name,
         status: "ok",
@@ -22613,8 +24700,85 @@ function createBillingMcpTools(api) {
   };
 }
 
-// src/capture-policy-tools.ts
+// src/capture-rule-tools.ts
 function mapMcpError4(error) {
+  if (error instanceof CaptureRuleApiError) {
+    throw new Error(`mcp_tool_error:${error.message}`);
+  }
+  throw new Error("mcp_tool_error:unknown_error");
+}
+function createCaptureRuleMcpTools(api) {
+  return {
+    async list_capture_rules(input) {
+      try {
+        return await api.listCaptureRules({
+          bearerToken: String(input["bearerToken"]),
+          projectId: String(input["projectId"])
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async create_capture_rule(input) {
+      try {
+        return await api.createCaptureRule({
+          bearerToken: String(input["bearerToken"]),
+          projectId: String(input["projectId"]),
+          create: typeof input["create"] === "object" && input["create"] !== null ? input["create"] : {}
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async update_capture_rule(input) {
+      try {
+        return await api.updateCaptureRule({
+          bearerToken: String(input["bearerToken"]),
+          projectId: String(input["projectId"]),
+          ruleId: String(input["ruleId"]),
+          update: typeof input["update"] === "object" && input["update"] !== null ? input["update"] : {}
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async delete_capture_rule(input) {
+      try {
+        return await api.deleteCaptureRule({
+          bearerToken: String(input["bearerToken"]),
+          projectId: String(input["projectId"]),
+          ruleId: String(input["ruleId"])
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async suggest_capture_rules_from_incident(input) {
+      try {
+        return await api.suggestCaptureRulesFromIncident({
+          bearerToken: String(input["bearerToken"]),
+          incidentId: String(input["incidentId"])
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async create_capture_rule_from_incident_suggestion(input) {
+      try {
+        return await api.createCaptureRuleFromIncidentSuggestion({
+          bearerToken: String(input["bearerToken"]),
+          incidentId: String(input["incidentId"]),
+          create: typeof input["create"] === "object" && input["create"] !== null ? input["create"] : {}
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    }
+  };
+}
+
+// src/capture-policy-tools.ts
+function mapMcpError5(error) {
   if (error instanceof CapturePolicyApiError) {
     throw new Error(`mcp_tool_error:${error.message}`);
   }
@@ -22629,7 +24793,7 @@ function createCapturePolicyMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError4(error);
+        mapMcpError5(error);
       }
     },
     async update_capture_policy(input) {
@@ -22641,14 +24805,14 @@ function createCapturePolicyMcpTools(api) {
           update
         });
       } catch (error) {
-        mapMcpError4(error);
+        mapMcpError5(error);
       }
     }
   };
 }
 
 // src/github-tools.ts
-function mapMcpError5(error) {
+function mapMcpError6(error) {
   if (error instanceof GitHubManagementApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -22667,7 +24831,7 @@ function createGitHubMcpTools(api) {
         const repo = projectId === void 0 || api.getProjectRepo === void 0 ? void 0 : await api.getProjectRepo({ bearerToken, projectId });
         return repo === void 0 ? { installation } : { installation, repo };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async list_github_repositories(input) {
@@ -22679,7 +24843,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async list_github_dispatch_rules(input) {
@@ -22691,7 +24855,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async create_github_dispatch_rule(input) {
@@ -22712,7 +24876,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async update_github_dispatch_rule(input) {
@@ -22734,7 +24898,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async delete_github_dispatch_rule(input) {
@@ -22750,7 +24914,7 @@ function createGitHubMcpTools(api) {
           rule_id: String(input["ruleId"])
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async list_github_deliveries(input) {
@@ -22764,7 +24928,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async retry_github_delivery(input) {
@@ -22777,7 +24941,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async set_project_github_repo(input) {
@@ -22791,7 +24955,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async remove_project_github_repo(input) {
@@ -22805,14 +24969,14 @@ function createGitHubMcpTools(api) {
           project_id: String(input["projectId"])
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     }
   };
 }
 
 // src/improvement-tools.ts
-function mapMcpError6(error) {
+function mapMcpError7(error) {
   if (error instanceof RetrievalApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -22845,7 +25009,7 @@ function createImprovementMcpTools(api) {
           ...typeof input["limit"] === "number" ? { limit: input["limit"] } : {}
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async get_improvement(input) {
@@ -22855,7 +25019,7 @@ function createImprovementMcpTools(api) {
           improvementId: readString2(input, "improvementId")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async get_improvement_bundle(input) {
@@ -22866,7 +25030,7 @@ function createImprovementMcpTools(api) {
           improvementId: readString2(input, "improvementId")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async resolve_improvement(input) {
@@ -22876,7 +25040,7 @@ function createImprovementMcpTools(api) {
           improvementId: readString2(input, "improvementId")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async reopen_improvement(input) {
@@ -22886,7 +25050,7 @@ function createImprovementMcpTools(api) {
           improvementId: readString2(input, "improvementId")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async snooze_improvement(input) {
@@ -22897,14 +25061,14 @@ function createImprovementMcpTools(api) {
           snoozedUntil: readString2(input, "snoozedUntil")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     }
   };
 }
 
 // src/improvement-settings-tools.ts
-function mapMcpError7(error) {
+function mapMcpError8(error) {
   if (error instanceof ImprovementSettingsApiError) {
     throw new Error(`mcp_tool_error:${error.message}`);
   }
@@ -22919,7 +25083,7 @@ function createImprovementSettingsMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError7(error);
+        mapMcpError8(error);
       }
     },
     async update_improvement_settings(input) {
@@ -22931,14 +25095,14 @@ function createImprovementSettingsMcpTools(api) {
           update
         });
       } catch (error) {
-        mapMcpError7(error);
+        mapMcpError8(error);
       }
     }
   };
 }
 
 // src/member-tools.ts
-function mapMcpError8(error) {
+function mapMcpError9(error) {
   if (error instanceof MemberApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -22953,7 +25117,7 @@ function createMemberMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async list_project_member_invites(input) {
@@ -22963,7 +25127,7 @@ function createMemberMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async invite_project_member(input) {
@@ -22975,7 +25139,7 @@ function createMemberMcpTools(api) {
           role: String(input["role"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async cancel_project_member_invite(input) {
@@ -22986,7 +25150,7 @@ function createMemberMcpTools(api) {
           inviteId: String(input["inviteId"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async update_project_member_role(input) {
@@ -22998,7 +25162,7 @@ function createMemberMcpTools(api) {
           role: String(input["role"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async remove_project_member(input) {
@@ -23009,14 +25173,14 @@ function createMemberMcpTools(api) {
           userId: String(input["userId"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     }
   };
 }
 
 // src/probe-tools.ts
-function mapMcpError9(error) {
+function mapMcpError10(error) {
   if (error instanceof ProbeApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23045,7 +25209,7 @@ function createProbeMcpTools(api) {
         }
         return await api.activateProbe(requestInput);
       } catch (error) {
-        mapMcpError9(error);
+        mapMcpError10(error);
       }
     },
     async list_active_probes(input) {
@@ -23055,7 +25219,7 @@ function createProbeMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError9(error);
+        mapMcpError10(error);
       }
     },
     async deactivate_probe(input) {
@@ -23066,14 +25230,14 @@ function createProbeMcpTools(api) {
           activationId: String(input["activationId"])
         });
       } catch (error) {
-        mapMcpError9(error);
+        mapMcpError10(error);
       }
     }
   };
 }
 
 // src/project-tools.ts
-function mapMcpError10(error) {
+function mapMcpError11(error) {
   if (error instanceof ProjectManagementApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23091,7 +25255,7 @@ function createProjectMcpTools(api) {
         }
         return { projects: await api.listProjects(requestInput) };
       } catch (error) {
-        mapMcpError10(error);
+        mapMcpError11(error);
       }
     },
     async create_project(input) {
@@ -23106,7 +25270,7 @@ function createProjectMcpTools(api) {
         }
         return { project: await api.createProject(requestInput) };
       } catch (error) {
-        mapMcpError10(error);
+        mapMcpError11(error);
       }
     },
     async update_project(input) {
@@ -23126,7 +25290,7 @@ function createProjectMcpTools(api) {
         }
         return { project: await api.updateProject(requestInput) };
       } catch (error) {
-        mapMcpError10(error);
+        mapMcpError11(error);
       }
     },
     async delete_project(input) {
@@ -23138,7 +25302,7 @@ function createProjectMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError10(error);
+        mapMcpError11(error);
       }
     }
   };
@@ -23345,7 +25509,7 @@ async function persistCloudArtifact(directoryPath, fileName, payload, dependenci
 }
 
 // src/retrieval-tools.ts
-function mapMcpError11(error) {
+function mapMcpError12(error) {
   if (error instanceof RetrievalApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23527,7 +25691,7 @@ function createRetrievalMcpTools(api) {
           incidents: incidents.incidents.map((incident) => attachSourceToRecord(incident, "cloud"))
         };
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_incident(input) {
@@ -23562,7 +25726,7 @@ function createRetrievalMcpTools(api) {
           )
         };
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_incident_context(input) {
@@ -23591,7 +25755,7 @@ function createRetrievalMcpTools(api) {
           "cloud"
         );
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async resolve_incident(input) {
@@ -23636,7 +25800,7 @@ function createRetrievalMcpTools(api) {
           })()
         };
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async reopen_incident(input) {
@@ -23681,7 +25845,7 @@ function createRetrievalMcpTools(api) {
           })()
         };
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_bundle(input) {
@@ -23712,7 +25876,7 @@ function createRetrievalMcpTools(api) {
           }
         );
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_logs(input) {
@@ -23732,7 +25896,7 @@ function createRetrievalMcpTools(api) {
         }
         return await api.getLogs(requestInput);
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_reproduction(input) {
@@ -23763,14 +25927,14 @@ function createRetrievalMcpTools(api) {
           }
         );
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     }
   };
 }
 
 // src/services-tools.ts
-function mapMcpError12(error) {
+function mapMcpError13(error) {
   if (error instanceof RetrievalApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23791,14 +25955,14 @@ function createServicesMcpTools(api) {
           services: await api.listServices(requestInput)
         };
       } catch (error) {
-        mapMcpError12(error);
+        mapMcpError13(error);
       }
     }
   };
 }
 
 // src/setup-tools.ts
-function mapMcpError13() {
+function mapMcpError14() {
   throw new Error("mcp_tool_error:unknown_error");
 }
 function parseJsonOutput2(output) {
@@ -23813,7 +25977,7 @@ async function runJsonCommand2(command) {
     const result = await command();
     return parseJsonOutput2(result.output);
   } catch {
-    mapMcpError13();
+    mapMcpError14();
   }
 }
 function createSetupMcpTools(commands) {
@@ -23872,7 +26036,7 @@ function createSetupMcpTools(commands) {
 }
 
 // src/slack-tools.ts
-function mapMcpError14(error) {
+function mapMcpError15(error) {
   if (error instanceof SlackApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23889,7 +26053,7 @@ function createSlackMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError14(error);
+        mapMcpError15(error);
       }
     },
     async get_slack_connect_url(input) {
@@ -23902,7 +26066,7 @@ function createSlackMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError14(error);
+        mapMcpError15(error);
       }
     },
     async test_slack_destination(input) {
@@ -23915,7 +26079,7 @@ function createSlackMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError14(error);
+        mapMcpError15(error);
       }
     },
     async delete_slack_destination(input) {
@@ -23928,14 +26092,14 @@ function createSlackMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError14(error);
+        mapMcpError15(error);
       }
     }
   };
 }
 
 // src/token-tools.ts
-function mapMcpError15(error) {
+function mapMcpError16(error) {
   if (error instanceof TokenManagementApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23956,20 +26120,22 @@ function createTokenMcpTools(api) {
           tokens: await api.listProjectTokens(requestInput)
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async create_project_token(input) {
       try {
+        const allowedOrigins = Array.isArray(input["allowedOrigins"]) ? input["allowedOrigins"].map((value) => String(value)) : void 0;
         return {
           token: await api.createProjectToken({
             bearerToken: String(input["bearerToken"]),
             projectId: String(input["projectId"]),
-            label: String(input["label"])
+            label: String(input["label"]),
+            ...allowedOrigins === void 0 ? {} : { allowedOrigins }
           })
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async revoke_project_token(input) {
@@ -23982,7 +26148,7 @@ function createTokenMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async list_member_tokens(input) {
@@ -23997,7 +26163,7 @@ function createTokenMcpTools(api) {
           tokens: await api.listMemberTokens(requestInput)
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async create_member_token(input) {
@@ -24009,7 +26175,7 @@ function createTokenMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async revoke_member_token(input) {
@@ -24021,14 +26187,14 @@ function createTokenMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     }
   };
 }
 
 // src/webhook-tools.ts
-function mapMcpError16(error) {
+function mapMcpError17(error) {
   if (error instanceof WebhookApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -24049,7 +26215,7 @@ function createWebhookMcpTools(api) {
           webhooks: await api.listWebhooks(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async create_webhook(input) {
@@ -24070,7 +26236,7 @@ function createWebhookMcpTools(api) {
           webhook: await api.createWebhook(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async update_webhook(input) {
@@ -24096,7 +26262,7 @@ function createWebhookMcpTools(api) {
           webhook: await api.updateWebhook(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async delete_webhook(input) {
@@ -24109,7 +26275,7 @@ function createWebhookMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async test_webhook(input) {
@@ -24126,7 +26292,7 @@ function createWebhookMcpTools(api) {
           delivery: await api.testWebhook(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async list_webhook_deliveries(input) {
@@ -24143,7 +26309,7 @@ function createWebhookMcpTools(api) {
           deliveries: await api.listWebhookDeliveries(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async retry_webhook_delivery(input) {
@@ -24155,14 +26321,14 @@ function createWebhookMcpTools(api) {
           deliveryId: String(input["deliveryId"])
         });
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     }
   };
 }
 
 // src/weekly-report-tools.ts
-function mapMcpError17(error) {
+function mapMcpError18(error) {
   if (error instanceof WeeklyReportApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -24180,7 +26346,7 @@ function createWeeklyReportMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError17(error);
+        mapMcpError18(error);
       }
     },
     async create_weekly_report_channel(input) {
@@ -24196,7 +26362,7 @@ function createWeeklyReportMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError17(error);
+        mapMcpError18(error);
       }
     },
     async update_weekly_report_channel(input) {
@@ -24211,7 +26377,7 @@ function createWeeklyReportMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError17(error);
+        mapMcpError18(error);
       }
     },
     async delete_weekly_report_channel(input) {
@@ -24223,7 +26389,7 @@ function createWeeklyReportMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError17(error);
+        mapMcpError18(error);
       }
     }
   };
@@ -24279,6 +26445,7 @@ async function createDefaultMcpTools(input = {}) {
       ...createWeeklyReportMcpTools(createWeeklyReportApi(httpClient)),
       ...createAlertMcpTools(createAlertApi(httpClient)),
       ...createProjectMcpTools(createProjectManagementApi(httpClient)),
+      ...createCaptureRuleMcpTools(createCaptureRuleApi(httpClient)),
       ...createCapturePolicyMcpTools(createCapturePolicyApi(httpClient)),
       ...createImprovementSettingsMcpTools(createImprovementSettingsApi(httpClient)),
       ...createProbeMcpTools(createProbeApi(httpClient)),
@@ -25906,7 +28073,8 @@ var MCP_TOOL_CATALOG = [
     inputSchema: external_exports.object({
       bearerToken: external_exports.string(),
       projectId: external_exports.string(),
-      label: external_exports.string()
+      label: external_exports.string(),
+      allowedOrigins: external_exports.array(external_exports.string()).optional()
     })
   },
   {
@@ -26078,7 +28246,7 @@ var MCP_TOOL_CATALOG = [
   {
     name: "create_weekly_report_channel",
     group: "weekly_reports",
-    description: "Create a weekly report delivery channel.",
+    description: "Create a weekly report delivery channel. Email channel config supports up to 3 recipients in config.to.",
     inputSchema: external_exports.object({
       bearerToken: external_exports.string(),
       projectId: external_exports.string(),
@@ -26091,7 +28259,7 @@ var MCP_TOOL_CATALOG = [
   {
     name: "update_weekly_report_channel",
     group: "weekly_reports",
-    description: "Update a weekly report delivery channel.",
+    description: "Update a weekly report delivery channel. Email channel config supports up to 3 recipients in config.to.",
     inputSchema: external_exports.object({
       bearerToken: external_exports.string(),
       channelId: external_exports.string(),
@@ -26201,6 +28369,65 @@ var MCP_TOOL_CATALOG = [
       projectId: external_exports.string()
     })
   },
+  {
+    name: "list_capture_rules",
+    group: "capture_rules",
+    description: "List project capture rules.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string()
+    })
+  },
+  {
+    name: "create_capture_rule",
+    group: "capture_rules",
+    description: "Create a project capture rule.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string(),
+      create: jsonObjectSchema
+    })
+  },
+  {
+    name: "update_capture_rule",
+    group: "capture_rules",
+    description: "Update a project capture rule.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string(),
+      ruleId: external_exports.string(),
+      update: jsonObjectSchema
+    })
+  },
+  {
+    name: "delete_capture_rule",
+    group: "capture_rules",
+    description: "Delete a project capture rule.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string(),
+      ruleId: external_exports.string()
+    })
+  },
+  {
+    name: "suggest_capture_rules_from_incident",
+    group: "capture_rules",
+    description: "Generate deterministic capture rule suggestions from an incident bundle.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      incidentId: external_exports.string()
+    })
+  },
+  {
+    name: "create_capture_rule_from_incident_suggestion",
+    group: "capture_rules",
+    description: "Create a capture rule from an incident-derived suggestion.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      incidentId: external_exports.string(),
+      create: jsonObjectSchema
+    })
+  },
   {
     name: "get_capture_policy",
     group: "capture_policy",