@debugbundle/mcp 0.1.8 → 0.1.10

package/dist/main.cjs

@@ -15665,7 +15665,8 @@ function createRetrievalApi(client) {
           BundleSchema,
           external_exports.object({
             status: external_exports.literal("failed"),
-            reason: external_exports.string()
+            reason: external_exports.string(),
+            related_incident_ids: external_exports.array(external_exports.string()).optional()
           }).strict()
         ])
       );
@@ -16552,6 +16553,406 @@ function getRequestAnomalyThreshold(input) {
   return null;
 }
 
+// ../../packages/shared-types/src/capture-rules.ts
+var CAPTURE_RULE_EVENT_TYPES = [
+  "backend_exception",
+  "request_event",
+  "log_event",
+  "frontend_breadcrumb",
+  "frontend_exception",
+  "deploy_metadata",
+  "error_suppressed",
+  "probe_event"
+];
+var CAPTURE_RULE_RUNTIME_VALUES = [
+  "browser",
+  "node",
+  "python",
+  "php",
+  "java",
+  "go",
+  "ruby",
+  "unknown"
+];
+var CaptureRuleActionValues = ["demote", "sample", "drop"];
+var CaptureRuleActionSchema = external_exports.enum(CaptureRuleActionValues);
+var CaptureRuleSampleEventClassValues = ["preserve", "context"];
+var CaptureRuleSampleEventClassSchema = external_exports.enum(CaptureRuleSampleEventClassValues);
+var CaptureRuleRuntimeSchema = external_exports.enum(CAPTURE_RULE_RUNTIME_VALUES);
+var CaptureRuleEventTypeSchema = external_exports.enum(CAPTURE_RULE_EVENT_TYPES);
+var BrowserEventKindSchema = external_exports.enum(["window_error", "resource_error"]);
+function normalizeOptionalTrimmedString(value) {
+  const trimmed = value?.trim();
+  return trimmed && trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeOptionalLowercaseHost(value) {
+  const trimmed = normalizeOptionalTrimmedString(value);
+  return trimmed?.toLowerCase();
+}
+function normalizeOptionalPath(value) {
+  const trimmed = normalizeOptionalTrimmedString(value);
+  if (trimmed === void 0) {
+    return void 0;
+  }
+  return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+}
+function hasValue(value) {
+  return value !== void 0 && value !== null;
+}
+var UrlMatcherSchema = external_exports.object({
+  host: external_exports.string().min(1).max(255).optional(),
+  host_suffix: external_exports.string().min(1).max(255).optional(),
+  path_prefix: external_exports.string().min(1).max(1024).optional(),
+  path_equals: external_exports.string().min(1).max(1024).optional()
+}).transform((value) => {
+  const normalized = {};
+  const host = normalizeOptionalLowercaseHost(value.host);
+  const hostSuffix = normalizeOptionalLowercaseHost(value.host_suffix);
+  const pathPrefix = normalizeOptionalPath(value.path_prefix);
+  const pathEquals = normalizeOptionalPath(value.path_equals);
+  if (host !== void 0) {
+    normalized.host = host;
+  }
+  if (hostSuffix !== void 0) {
+    normalized.host_suffix = hostSuffix;
+  }
+  if (pathPrefix !== void 0) {
+    normalized.path_prefix = pathPrefix;
+  }
+  if (pathEquals !== void 0) {
+    normalized.path_equals = pathEquals;
+  }
+  return normalized;
+}).refine((value) => hasValue(value.host) || hasValue(value.host_suffix) || hasValue(value.path_prefix) || hasValue(value.path_equals), {
+  message: "URL matchers must include at least one host or path constraint."
+});
+var StatusRangeSchema = external_exports.object({
+  start: external_exports.number().int().min(100).max(599),
+  end: external_exports.number().int().min(100).max(599)
+}).refine((value) => value.start <= value.end, {
+  message: "Status range start must be less than or equal to end."
+});
+var CaptureRuleFingerprintSchema = external_exports.object({
+  version: external_exports.string().min(1).max(32),
+  value: external_exports.string().min(1).max(256)
+});
+function normalizeStringArray(values) {
+  if (values === void 0) {
+    return void 0;
+  }
+  return Array.from(new Set(values.map((value) => value.trim()).filter((value) => value.length > 0)));
+}
+function normalizeNumberArray(values) {
+  if (values === void 0) {
+    return void 0;
+  }
+  return Array.from(new Set(values)).sort((left, right) => left - right);
+}
+var CaptureRuleMatcherSchema = external_exports.object({
+  event_types: external_exports.array(CaptureRuleEventTypeSchema).min(1).optional(),
+  services: external_exports.array(external_exports.string().min(1).max(120)).min(1).optional(),
+  environments: external_exports.array(external_exports.string().min(1).max(120)).min(1).optional(),
+  runtime: external_exports.array(CaptureRuleRuntimeSchema).min(1).optional(),
+  first_party: external_exports.boolean().optional(),
+  error_name: external_exports.string().min(1).max(120).optional(),
+  message_contains: external_exports.string().min(1).max(500).optional(),
+  message_equals: external_exports.string().min(1).max(500).optional(),
+  browser_event_kind: BrowserEventKindSchema.optional(),
+  resource_url: UrlMatcherSchema.optional(),
+  request_url: UrlMatcherSchema.optional(),
+  status_codes: external_exports.array(external_exports.number().int().min(100).max(599)).min(1).optional(),
+  status_ranges: external_exports.array(StatusRangeSchema).min(1).optional(),
+  fingerprint: CaptureRuleFingerprintSchema.optional()
+}).transform((value) => {
+  const normalized = {};
+  const eventTypes = normalizeStringArray(value.event_types);
+  const services = normalizeStringArray(value.services);
+  const environments = normalizeStringArray(value.environments);
+  const runtime = normalizeStringArray(value.runtime);
+  const errorName = normalizeOptionalTrimmedString(value.error_name);
+  const messageContains = normalizeOptionalTrimmedString(value.message_contains);
+  const messageEquals = normalizeOptionalTrimmedString(value.message_equals);
+  const statusCodes = normalizeNumberArray(value.status_codes);
+  if (eventTypes !== void 0) {
+    normalized.event_types = eventTypes;
+  }
+  if (services !== void 0) {
+    normalized.services = services;
+  }
+  if (environments !== void 0) {
+    normalized.environments = environments;
+  }
+  if (runtime !== void 0) {
+    normalized.runtime = runtime;
+  }
+  if (value.first_party !== void 0) {
+    normalized.first_party = value.first_party;
+  }
+  if (errorName !== void 0) {
+    normalized.error_name = errorName;
+  }
+  if (messageContains !== void 0) {
+    normalized.message_contains = messageContains;
+  }
+  if (messageEquals !== void 0) {
+    normalized.message_equals = messageEquals;
+  }
+  if (value.browser_event_kind !== void 0) {
+    normalized.browser_event_kind = value.browser_event_kind;
+  }
+  if (value.resource_url !== void 0) {
+    normalized.resource_url = value.resource_url;
+  }
+  if (value.request_url !== void 0) {
+    normalized.request_url = value.request_url;
+  }
+  if (statusCodes !== void 0) {
+    normalized.status_codes = statusCodes;
+  }
+  if (value.status_ranges !== void 0) {
+    normalized.status_ranges = value.status_ranges;
+  }
+  if (value.fingerprint !== void 0) {
+    normalized.fingerprint = value.fingerprint;
+  }
+  return normalized;
+}).superRefine((value, context) => {
+  const narrowingKeys = [
+    "services",
+    "environments",
+    "runtime",
+    "first_party",
+    "error_name",
+    "message_contains",
+    "message_equals",
+    "browser_event_kind",
+    "resource_url",
+    "request_url",
+    "status_codes",
+    "status_ranges",
+    "fingerprint"
+  ];
+  if (!narrowingKeys.some((key) => hasValue(value[key]))) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Capture rules must include at least one narrowing field beyond event_types."
+    });
+  }
+  if (value.browser_event_kind === "resource_error") {
+    const hasResourceConstraint = hasValue(value.resource_url) || hasValue(value.fingerprint);
+    if (!hasResourceConstraint) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Resource-error rules require a resource URL constraint or an exact fingerprint."
+      });
+    }
+  }
+});
+var CaptureRuleCoreObjectSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120),
+  description: external_exports.string().trim().max(500).nullable(),
+  enabled: external_exports.boolean(),
+  action: CaptureRuleActionSchema,
+  matcher: CaptureRuleMatcherSchema,
+  sample_rate: external_exports.number().min(0).max(1).nullable(),
+  sample_event_class: CaptureRuleSampleEventClassSchema.nullable(),
+  created_by_user_id: external_exports.string().min(1).max(120).nullable(),
+  created_from_incident_id: external_exports.string().min(1).max(120).nullable(),
+  created_from_event_id: external_exports.string().min(1).max(120).nullable(),
+  expires_at: external_exports.string().datetime().nullable()
+});
+function addCaptureRuleActionValidation(schema) {
+  return schema.superRefine((value, context) => {
+    if (value["action"] === "sample") {
+      if (value["sample_rate"] === null) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["sample_rate"],
+          message: "Sample rules require sample_rate."
+        });
+      }
+      if (value["sample_event_class"] === null) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["sample_event_class"],
+          message: "Sample rules require sample_event_class."
+        });
+      }
+      return;
+    }
+    if (value["sample_rate"] !== null) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_rate"],
+        message: "Only sample rules can set sample_rate."
+      });
+    }
+    if (value["sample_event_class"] !== null) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_event_class"],
+        message: "Only sample rules can set sample_event_class."
+      });
+    }
+  });
+}
+var CaptureRuleSchema = addCaptureRuleActionValidation(
+  CaptureRuleCoreObjectSchema.extend({
+    id: external_exports.string().uuid(),
+    project_id: external_exports.string().min(1).max(120),
+    hit_count: external_exports.number().int().nonnegative(),
+    last_matched_at: external_exports.string().datetime().nullable(),
+    created_at: external_exports.string().datetime(),
+    updated_at: external_exports.string().datetime()
+  })
+);
+var CaptureRuleCreateSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120),
+  description: external_exports.string().trim().max(500).nullable().default(null),
+  enabled: external_exports.boolean().default(true),
+  action: CaptureRuleActionSchema,
+  matcher: CaptureRuleMatcherSchema,
+  sample_rate: external_exports.number().min(0).max(1).nullable().optional(),
+  sample_event_class: CaptureRuleSampleEventClassSchema.nullable().optional(),
+  created_by_user_id: external_exports.string().min(1).max(120).nullable().default(null),
+  created_from_incident_id: external_exports.string().min(1).max(120).nullable().default(null),
+  created_from_event_id: external_exports.string().min(1).max(120).nullable().default(null),
+  expires_at: external_exports.string().datetime().nullable().default(null)
+}).superRefine((value, context) => {
+  if (value.action === "sample") {
+    if (value.sample_rate === void 0 || value.sample_rate === null) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_rate"],
+        message: "Sample rules require sample_rate."
+      });
+    }
+    return;
+  }
+  if (value.sample_rate !== void 0 && value.sample_rate !== null) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["sample_rate"],
+      message: "Only sample rules can set sample_rate."
+    });
+  }
+  if (value.sample_event_class !== void 0 && value.sample_event_class !== null) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["sample_event_class"],
+      message: "Only sample rules can set sample_event_class."
+    });
+  }
+}).transform((value) => ({
+  ...value,
+  sample_rate: value.action === "sample" ? value.sample_rate : null,
+  sample_event_class: value.action === "sample" ? value.sample_event_class ?? "preserve" : null
+}));
+var CaptureRuleUpdateSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120).optional(),
+  description: external_exports.string().trim().max(500).nullable().optional(),
+  enabled: external_exports.boolean().optional(),
+  action: CaptureRuleActionSchema.optional(),
+  matcher: CaptureRuleMatcherSchema.optional(),
+  sample_rate: external_exports.number().min(0).max(1).nullable().optional(),
+  sample_event_class: CaptureRuleSampleEventClassSchema.nullable().optional(),
+  expires_at: external_exports.string().datetime().nullable().optional()
+}).superRefine((value, context) => {
+  if (Object.keys(value).length === 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "At least one capture rule field must be provided."
+    });
+  }
+  const resolvedAction = value.action;
+  if (resolvedAction === "sample") {
+    if (!("sample_rate" in value)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_rate"],
+        message: "Sample rule updates must include sample_rate when changing action to sample."
+      });
+    }
+    if (!("sample_event_class" in value)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["sample_event_class"],
+        message: "Sample rule updates must include sample_event_class when changing action to sample."
+      });
+    }
+    return;
+  }
+  if ("sample_rate" in value) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["sample_rate"],
+      message: "Sample rule fields can only be updated while setting action to sample."
+    });
+  }
+  if ("sample_event_class" in value) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["sample_event_class"],
+      message: "Sample rule fields can only be updated while setting action to sample."
+    });
+  }
+});
+var CaptureRuleResponseSchema = external_exports.object({
+  rule: CaptureRuleSchema
+});
+var CaptureRulesResponseSchema = external_exports.object({
+  access_mode: external_exports.enum(["manage", "preview"]),
+  rules: external_exports.array(CaptureRuleSchema)
+});
+var CaptureRulesFileSchema = external_exports.object({
+  version: external_exports.literal(1),
+  rules: external_exports.array(CaptureRuleSchema)
+});
+var CaptureRuleEvaluationUrlSchema = external_exports.object({
+  host: external_exports.string().min(1).transform((value) => value.toLowerCase()).optional(),
+  path: external_exports.string().min(1).transform((value) => value.startsWith("/") ? value : `/${value}`)
+});
+var CaptureRuleEvaluationContextSchema = external_exports.object({
+  project_id: external_exports.string().min(1).max(120),
+  event_id: external_exports.string().uuid(),
+  event_type: CaptureRuleEventTypeSchema,
+  service: external_exports.string().min(1).optional(),
+  environment: external_exports.string().min(1).optional(),
+  runtime: CaptureRuleRuntimeSchema,
+  first_party: external_exports.boolean().optional(),
+  error_name: external_exports.string().min(1).optional(),
+  message: external_exports.string().min(1).optional(),
+  browser_event_kind: BrowserEventKindSchema.optional(),
+  resource_url: CaptureRuleEvaluationUrlSchema.optional(),
+  request_url: CaptureRuleEvaluationUrlSchema.optional(),
+  status_code: external_exports.number().int().min(0).max(599).optional(),
+  fingerprint: CaptureRuleFingerprintSchema.optional()
+});
+
+// ../../packages/shared-types/src/capture-rule-suggestions.ts
+var CaptureRuleSuggestionConfidenceSchema = external_exports.enum(["high", "medium", "low"]);
+var CaptureRuleSuggestionSchema = external_exports.object({
+  suggestion_id: external_exports.string().min(1).max(120),
+  label: external_exports.string().min(1).max(200),
+  recommended_action: CaptureRuleActionSchema,
+  confidence: CaptureRuleSuggestionConfidenceSchema,
+  reason: external_exports.string().min(1).max(500),
+  requires_confirmation: external_exports.boolean(),
+  rule: CaptureRuleCreateSchema
+});
+var CaptureRuleSuggestionsResponseSchema = external_exports.object({
+  suggestions: external_exports.array(CaptureRuleSuggestionSchema),
+  bundle_status: external_exports.enum(["ready", "pending", "failed"]).optional(),
+  bundle_reason: external_exports.string().nullable().optional()
+});
+var CreateCaptureRuleFromSuggestionSchema = external_exports.object({
+  suggestion_id: external_exports.string().min(1).max(120),
+  name: external_exports.string().trim().min(1).max(120).optional(),
+  description: external_exports.string().trim().max(500).nullable().optional(),
+  enabled: external_exports.boolean().optional(),
+  expires_at: external_exports.string().datetime().nullable().optional()
+});
+
 // ../../packages/shared-types/src/improvement-settings.ts
 var ImprovementBundleSensitivityValues = [
   "high_confidence",
@@ -16708,6 +17109,18 @@ var DeviceInfoSchema = external_exports.object({
   connection_type: external_exports.string().nullable(),
   color_scheme_preference: external_exports.enum(["light", "dark", "no-preference"]).nullable()
 }).strict();
+var BrowserExceptionEventSchema = external_exports.object({
+  kind: external_exports.enum(["window_error", "resource_error"]),
+  message: external_exports.string().nullable(),
+  file_name: external_exports.string().nullable(),
+  line_number: external_exports.number().int().nonnegative().nullable(),
+  column_number: external_exports.number().int().nonnegative().nullable(),
+  target: external_exports.object({
+    tag_name: external_exports.string().nullable(),
+    source_url: external_exports.string().nullable()
+  }).nullable(),
+  opaque: external_exports.boolean()
+}).strict();
 var FrontendExceptionPayloadSchema = external_exports.object({
   name: external_exports.string().min(1),
   message: external_exports.string().min(1),
@@ -16719,6 +17132,7 @@ var FrontendExceptionPayloadSchema = external_exports.object({
   }),
   breadcrumbs: external_exports.array(FrontendExceptionBreadcrumbSchema).optional(),
   device: DeviceInfoSchema.nullable().optional(),
+  browser_event: BrowserExceptionEventSchema.optional(),
   dom_context: external_exports.object({
     mode: external_exports.literal("lightweight"),
     html_excerpt: external_exports.string().min(1)
@@ -17175,6 +17589,18 @@ function buildSkill() {
     "- Run `debugbundle validate --fix` to restore missing generated setup files without overwriting the profile.",
     "- Run `debugbundle process` after local events land in `.debugbundle/local/events/`.",
     "",
+    "## Browser Capture and Relay Setup",
+    "",
+    "When the repository has a browser frontend, verify capture end to end instead of stopping at backend SDK setup.",
+    "",
+    "1. Add `@debugbundle/sdk-browser` to each browser app that should capture console, error, navigation, or request context.",
+    "2. Initialize the browser SDK from the app entrypoint with the active environment and a browser relay endpoint.",
+    "3. Add a backend relay endpoint at `/debugbundle/browser` using the server SDK relay helper when available.",
+    "4. For same-origin apps, keep the browser endpoint as `/debugbundle/browser`.",
+    "5. For split frontend/backend hosts, configure the browser endpoint to the API host relay URL and require explicit frontend origin allowlisting on the backend.",
+    "6. Ensure auth and CSRF middleware allow the relay path while the relay still enforces origin, content type, body size, schema validation, and rate limits.",
+    "7. Trigger a local browser smoke event, then run `debugbundle process --json` and confirm the incident or context event appears before marking setup complete.",
+    "",
     "## References",
     "",
     "- CLI reference: `references/cli.md`",
@@ -17311,6 +17737,8 @@ function buildProfileEnrichmentReference() {
     "- add critical paths for ingestion, processing, retrieval, SDK capture, auth, billing, and any project-specific high-risk workflows",
     "- confirm `repo.generated_paths` and `repo.do_not_edit_paths` match the local scaffold",
     "- confirm build, test, lint, and install workflows in `developer_workflows`",
+    "- for browser frontends, confirm `@debugbundle/sdk-browser` is initialized and a backend `/debugbundle/browser` relay is reachable",
+    "- for split frontend/backend hosts, confirm the browser SDK uses the API relay URL and the backend allowlists the frontend origin",
     "- update `debugbundle.last_reviewed_at` and set `debugbundle.validation_status` to `agent-validated` when complete",
     ""
   ].join("\n");
@@ -17504,10 +17932,37 @@ async function pathExists(path, stat) {
   }
 }
 function formatZodErrors(error) {
-  return error.issues.map((issue) => ({
-    path: issue.path.join("."),
-    message: issue.message
-  }));
+  return error.issues.map((issue) => {
+    const path = issue.path.join(".");
+    if (path === "services" || path.startsWith("services.")) {
+      return {
+        path,
+        message: issue.message,
+        suggestion: "Add service entries with name, kind, runtime, framework, paths, owns_routes, and depends_on.",
+        example: '[{"name":"api","kind":"backend","runtime":"Node.js","framework":"Fastify","paths":["apps/api"],"owns_routes":["POST /checkout"],"depends_on":["worker"]}]'
+      };
+    }
+    if (path === "critical_paths" || path.startsWith("critical_paths.")) {
+      return {
+        path,
+        message: issue.message,
+        suggestion: "Use object entries so each critical path records its owner_service and review notes.",
+        example: '[{"name":"checkout","owner_service":"api","notes":"Creates the order, charges the card, and enqueues fulfillment."}]'
+      };
+    }
+    if (path === "developer_workflows" || path.startsWith("developer_workflows.")) {
+      return {
+        path,
+        message: issue.message,
+        suggestion: "Provide install, build, test, and lint as command strings so agents can run the standard repo workflows.",
+        example: '{"install":"pnpm install","build":"pnpm build","test":"pnpm test","lint":"pnpm lint"}'
+      };
+    }
+    return {
+      path,
+      message: issue.message
+    };
+  });
 }
 async function validateProfile(rootDirectory, dependencies = {}) {
   const readFile = dependencies.readFile ?? ((filePath) => (0, import_promises.readFile)(filePath, "utf8"));
@@ -17854,6 +18309,118 @@ function createCliHttpClient(input, dependencies) {
   };
 }
 
+// ../cli/src/capture-rule-commands.ts
+var CaptureRuleApiError = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.name = "CaptureRuleApiError";
+    this.status = status;
+  }
+};
+function toApiError(status, body, fallback) {
+  if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
+    return new CaptureRuleApiError(status, body.error);
+  }
+  return new CaptureRuleApiError(status, fallback);
+}
+function createCaptureRuleApi(httpClient) {
+  return {
+    async listCaptureRules(input) {
+      const response = await httpClient.request({
+        method: "GET",
+        path: `/v1/projects/${encodeURIComponent(input.projectId)}/capture-rules`,
+        bearerToken: input.bearerToken
+      });
+      if (response.status !== 200) {
+        throw toApiError(response.status, response.body, "Failed to list capture rules.");
+      }
+      const parsed = CaptureRulesResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule list response.");
+      }
+      return parsed.data;
+    },
+    async createCaptureRule(input) {
+      const response = await httpClient.request({
+        method: "POST",
+        path: `/v1/projects/${encodeURIComponent(input.projectId)}/capture-rules`,
+        bearerToken: input.bearerToken,
+        body: input.create
+      });
+      if (response.status !== 201) {
+        throw toApiError(response.status, response.body, "Failed to create capture rule.");
+      }
+      const parsed = CaptureRuleResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule create response.");
+      }
+      return parsed.data;
+    },
+    async suggestCaptureRulesFromIncident(input) {
+      const response = await httpClient.request({
+        method: "POST",
+        path: `/v1/incidents/${encodeURIComponent(input.incidentId)}/capture-rule-suggestion`,
+        bearerToken: input.bearerToken
+      });
+      if (response.status !== 200) {
+        throw toApiError(response.status, response.body, "Failed to suggest capture rules.");
+      }
+      const parsed = CaptureRuleSuggestionsResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule suggestion response.");
+      }
+      return parsed.data;
+    },
+    async createCaptureRuleFromIncidentSuggestion(input) {
+      const response = await httpClient.request({
+        method: "POST",
+        path: `/v1/incidents/${encodeURIComponent(input.incidentId)}/capture-rules`,
+        bearerToken: input.bearerToken,
+        body: input.create
+      });
+      if (response.status !== 201) {
+        throw toApiError(response.status, response.body, "Failed to create capture rule from suggestion.");
+      }
+      const parsed = CaptureRuleResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule create-from-suggestion response.");
+      }
+      return parsed.data;
+    },
+    async updateCaptureRule(input) {
+      const response = await httpClient.request({
+        method: "PATCH",
+        path: `/v1/projects/${encodeURIComponent(input.projectId)}/capture-rules/${encodeURIComponent(input.ruleId)}`,
+        bearerToken: input.bearerToken,
+        body: input.update
+      });
+      if (response.status !== 200) {
+        throw toApiError(response.status, response.body, "Failed to update capture rule.");
+      }
+      const parsed = CaptureRuleResponseSchema.safeParse(response.body);
+      if (!parsed.success) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule update response.");
+      }
+      return parsed.data;
+    },
+    async deleteCaptureRule(input) {
+      const response = await httpClient.request({
+        method: "DELETE",
+        path: `/v1/projects/${encodeURIComponent(input.projectId)}/capture-rules/${encodeURIComponent(input.ruleId)}`,
+        bearerToken: input.bearerToken
+      });
+      if (response.status !== 200) {
+        throw toApiError(response.status, response.body, "Failed to delete capture rule.");
+      }
+      if (typeof response.body !== "object" || response.body === null || !("success" in response.body) || response.body.success !== true) {
+        throw new CaptureRuleApiError(500, "Invalid capture rule delete response.");
+      }
+      return { success: true };
+    }
+  };
+}
+
 // ../cli/src/capture-policy-commands.ts
 var CapturePolicyApiError = class extends Error {
   status;
@@ -17863,7 +18430,7 @@ var CapturePolicyApiError = class extends Error {
     this.status = status;
   }
 };
-function toApiError(status, body, fallback) {
+function toApiError2(status, body, fallback) {
   if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
     return new CapturePolicyApiError(status, body.error);
   }
@@ -17878,7 +18445,7 @@ function createCapturePolicyApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError(response.status, response.body, "Failed to get capture policy.");
+        throw toApiError2(response.status, response.body, "Failed to get capture policy.");
       }
       const parsed = CapturePolicyResponseSchema.safeParse(response.body);
       if (!parsed.success) {
@@ -17894,7 +18461,7 @@ function createCapturePolicyApi(httpClient) {
         body: input.update
       });
       if (response.status !== 200) {
-        throw toApiError(response.status, response.body, "Failed to update capture policy.");
+        throw toApiError2(response.status, response.body, "Failed to update capture policy.");
       }
       const parsed = CapturePolicyResponseSchema.safeParse(response.body);
       if (!parsed.success) {
@@ -17914,7 +18481,7 @@ var ImprovementSettingsApiError = class extends Error {
     this.status = status;
   }
 };
-function toApiError2(status, body, fallback) {
+function toApiError3(status, body, fallback) {
   if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
     return new ImprovementSettingsApiError(status, body.error);
   }
@@ -17929,7 +18496,7 @@ function createImprovementSettingsApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError2(response.status, response.body, "Failed to get improvement settings.");
+        throw toApiError3(response.status, response.body, "Failed to get improvement settings.");
       }
       const parsed = ImprovementSettingsResponseSchema.safeParse(response.body);
       if (!parsed.success) {
@@ -17945,7 +18512,7 @@ function createImprovementSettingsApi(httpClient) {
         body: input.update
       });
       if (response.status !== 200) {
-        throw toApiError2(response.status, response.body, "Failed to update improvement settings.");
+        throw toApiError3(response.status, response.body, "Failed to update improvement settings.");
       }
       const parsed = ImprovementSettingsResponseSchema.safeParse(response.body);
       if (!parsed.success) {
@@ -17967,7 +18534,7 @@ var MemberApiError = class extends Error {
     this.code = code;
   }
 };
-function toApiError3(status, body) {
+function toApiError4(status, body) {
   if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
     return new MemberApiError(status, body.error);
   }
@@ -17982,7 +18549,7 @@ function createMemberApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -17993,7 +18560,7 @@ function createMemberApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -18005,7 +18572,7 @@ function createMemberApi(httpClient) {
         body: { email: input.email, role: input.role }
       });
       if (response.status !== 201) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -18016,7 +18583,7 @@ function createMemberApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -18028,7 +18595,7 @@ function createMemberApi(httpClient) {
         body: { role: input.role }
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     },
@@ -18039,7 +18606,7 @@ function createMemberApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError3(response.status, response.body);
+        throw toApiError4(response.status, response.body);
       }
       return response.body;
     }
@@ -18057,7 +18624,7 @@ var ProbeApiError = class extends Error {
     this.code = code;
   }
 };
-function toApiError4(status, body) {
+function toApiError5(status, body) {
   if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string") {
     return new ProbeApiError(status, body.error);
   }
@@ -18088,7 +18655,7 @@ function createProbeApi(httpClient) {
         body
       });
       if (response.status !== 201) {
-        throw toApiError4(response.status, response.body);
+        throw toApiError5(response.status, response.body);
       }
       return response.body;
     },
@@ -18099,7 +18666,7 @@ function createProbeApi(httpClient) {
         bearerToken: input.bearerToken
       });
       if (response.status !== 200) {
-        throw toApiError4(response.status, response.body);
+        throw toApiError5(response.status, response.body);
       }
       return response.body;
     },
@@ -18111,7 +18678,7 @@ function createProbeApi(httpClient) {
         body: { activation_id: input.activationId }
       });
       if (response.status !== 200) {
-        throw toApiError4(response.status, response.body);
+        throw toApiError5(response.status, response.body);
       }
       return response.body;
     }
@@ -18234,6 +18801,15 @@ function inferMatchedFields(event) {
   if (event.top_frames.length > 0) {
     matchedFields.push("top_frames");
   }
+  if (event.browser_event_kind != null) {
+    matchedFields.push("browser_event_kind");
+  }
+  if (event.resource_host != null) {
+    matchedFields.push("resource_host");
+  }
+  if (event.resource_path != null) {
+    matchedFields.push("resource_path");
+  }
   if (event.http_method !== null) {
     matchedFields.push("http_method");
   }
@@ -18294,6 +18870,39 @@ function selectTopFrames(stack, limit = 5) {
   const frames = normalizedStack.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("at ")).filter((line) => FRAME_NOISE_PATTERNS.every((pattern) => !line.includes(pattern))).slice(0, limit);
   return frames;
 }
+function normalizeResourceIdentity(value) {
+  if (value === null) {
+    return { host: null, path: null };
+  }
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    return { host: null, path: null };
+  }
+  if (trimmed.startsWith("/")) {
+    return {
+      host: null,
+      path: normalizeRoute(trimmed)
+    };
+  }
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+      return {
+        host: parsed.hostname.length > 0 ? parsed.hostname.toLowerCase() : null,
+        path: normalizeRoute(parsed.pathname)
+      };
+    }
+    return {
+      host: null,
+      path: parsed.protocol.replace(/:$/, "")
+    };
+  } catch {
+    return {
+      host: null,
+      path: normalizeRoute(trimmed) ?? trimmed
+    };
+  }
+}
 function stableJson(value) {
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value);
@@ -18321,6 +18930,9 @@ function normalizeEvent(event) {
       http_method: event.payload.request.method,
       http_status: event.payload.response.status_code,
       top_frames: selectTopFrames(event.payload.stack),
+      browser_event_kind: null,
+      resource_host: null,
+      resource_path: null,
       payload: redactedPayload
     };
   }
@@ -18334,6 +18946,9 @@ function normalizeEvent(event) {
       http_method: event.payload.method,
       http_status: event.payload.response_status,
       top_frames: [],
+      browser_event_kind: null,
+      resource_host: null,
+      resource_path: null,
       payload: redactedPayload
     };
   }
@@ -18347,6 +18962,28 @@ function normalizeEvent(event) {
       http_method: null,
       http_status: null,
       top_frames: [],
+      browser_event_kind: null,
+      resource_host: null,
+      resource_path: null,
+      payload: redactedPayload
+    };
+  }
+  if (event.event_type === "frontend_exception") {
+    const browserEvent = event.payload.browser_event;
+    const resourceIdentity = browserEvent?.kind === "resource_error" ? normalizeResourceIdentity(browserEvent.target?.source_url ?? browserEvent.file_name) : { host: null, path: null };
+    const topFrames = browserEvent?.opaque === true ? [] : selectTopFrames(event.payload.stack);
+    return {
+      event_type: event.event_type,
+      environment: event.service.environment,
+      error_type: event.payload.name,
+      normalized_message: normalizeMessage(event.payload.message),
+      route_template: normalizeRoute(event.payload.route ?? null),
+      http_method: null,
+      http_status: null,
+      top_frames: topFrames,
+      browser_event_kind: browserEvent?.kind ?? null,
+      resource_host: resourceIdentity.host,
+      resource_path: resourceIdentity.path,
       payload: redactedPayload
     };
   }
@@ -18359,6 +18996,9 @@ function normalizeEvent(event) {
     http_method: null,
     http_status: null,
     top_frames: [],
+    browser_event_kind: null,
+    resource_host: null,
+    resource_path: null,
     payload: redactedPayload
   };
 }
@@ -18368,6 +19008,9 @@ function fingerprint(event) {
     normalized_message: event.normalized_message,
     top_frames: event.top_frames,
     route_template: event.route_template,
+    browser_event_kind: event.browser_event_kind,
+    resource_host: event.resource_host,
+    resource_path: event.resource_path,
     http_method: event.http_method,
     http_status: event.http_status,
     environment: event.environment
@@ -18422,18 +19065,18 @@ var ConnectionConfigSchema = external_exports.object({
 }).strict();
 
 // ../cli/src/doctor-command.ts
-var ProfileSchema2 = external_exports.object({
-  debugbundle: external_exports.object({
-    last_reviewed_at: external_exports.string(),
-    validation_status: external_exports.enum(["static-analysis-only", "agent-validated"])
-  })
-});
 var HealthResponseSchema = external_exports.object({
   status: external_exports.literal("ok")
 });
 var IncidentsProbeResponseSchema = external_exports.object({
   incidents: external_exports.array(external_exports.unknown())
 });
+var DoctorProfileSchema = external_exports.object({
+  debugbundle: external_exports.object({
+    last_reviewed_at: external_exports.string(),
+    validation_status: external_exports.enum(["static-analysis-only", "agent-validated"])
+  })
+});
 var PROFILE_STALENESS_THRESHOLD_DAYS = 30;
 var LOCAL_RELAY_SPOOL_DIRECTORY_PATH = ".debugbundle/local/browser-relay-spool";
 var RELAY_SPOOL_DELIVERED_MARKER_SUFFIX = ".delivered";
@@ -18576,6 +19219,12 @@ async function buildFileCheck(rootDirectory, name, filePath, stat) {
     message: exists ? `Found ${filePath}` : `Missing ${filePath}`
   };
 }
+function formatZodErrors2(error) {
+  return error.issues.map((issue) => ({
+    path: issue.path.join("."),
+    message: issue.message
+  }));
+}
 async function loadProfile(rootDirectory, dependencies) {
   const profilePath = (0, import_node_path4.join)(rootDirectory, PROFILE_FILE_PATH);
   if (!await pathExists3(profilePath, dependencies.stat)) {
@@ -18585,29 +19234,46 @@ async function loadProfile(rootDirectory, dependencies) {
         status: "missing",
         message: `Missing ${PROFILE_FILE_PATH}`
       },
-      profile: null
+      profile: null,
+      validationErrors: []
     };
   }
+  let parsedJson;
   try {
-    const parsedProfile = ProfileSchema2.parse(JSON.parse(await dependencies.readFile(profilePath)));
+    parsedJson = JSON.parse(await dependencies.readFile(profilePath));
+  } catch {
     return {
       check: {
         name: "profile",
-        status: "ok",
-        message: `Found ${PROFILE_FILE_PATH}`
+        status: "error",
+        message: `Invalid ${PROFILE_FILE_PATH}`
       },
-      profile: parsedProfile
+      profile: null,
+      validationErrors: []
     };
-  } catch {
+  }
+  const parsedDoctorProfile = DoctorProfileSchema.safeParse(parsedJson);
+  if (!parsedDoctorProfile.success) {
     return {
       check: {
         name: "profile",
         status: "error",
         message: `Invalid ${PROFILE_FILE_PATH}`
       },
-      profile: null
+      profile: null,
+      validationErrors: formatZodErrors2(parsedDoctorProfile.error)
     };
   }
+  const parsedFullProfile = ProfileSchema.safeParse(parsedJson);
+  return {
+    check: {
+      name: "profile",
+      status: "ok",
+      message: `Found ${PROFILE_FILE_PATH}`
+    },
+    profile: parsedDoctorProfile.data,
+    validationErrors: parsedFullProfile.success ? [] : formatZodErrors2(parsedFullProfile.error)
+  };
 }
 async function loadConnection(rootDirectory, dependencies) {
   const connectionPath = (0, import_node_path4.join)(rootDirectory, CONNECTION_FILE_PATH);
@@ -18659,7 +19325,20 @@ function buildProjectModeCheck(connection) {
     message: `Project mode is ${connection.mode}.`
   };
 }
-function buildProfileValidationCheck(profile) {
+function formatProfileValidationError(errors) {
+  const firstError = errors[0];
+  const path = firstError.path.length === 0 ? PROFILE_FILE_PATH : firstError.path;
+  const totalErrors = errors.length === 1 ? "" : ` (${errors.length} total errors)`;
+  return `Profile schema validation failed at ${path}: ${firstError.message}${totalErrors}.`;
+}
+function buildProfileValidationCheck(profile, validationErrors) {
+  if (validationErrors.length > 0) {
+    return {
+      name: "profile-validation",
+      status: "error",
+      message: formatProfileValidationError(validationErrors)
+    };
+  }
   if (profile === null) {
     return {
       name: "profile-validation",
@@ -18908,7 +19587,7 @@ async function doctorCommand(input, dependencies = {}) {
   const stat = dependencies.stat ?? import_promises4.stat;
   const rootDirectory = cwd();
   const currentTime = now();
-  const { check: profileCheck, profile } = await loadProfile(rootDirectory, { readFile, stat });
+  const { check: profileCheck, profile, validationErrors } = await loadProfile(rootDirectory, { readFile, stat });
   const { check: connectionCheck, connection } = await loadConnection(rootDirectory, { readFile, stat });
   const { check: authCheck, authState } = await buildAuthCheck(input, readAuthStateImpl);
   const connectedApiCheck = await buildConnectedApiCheck({
@@ -18923,7 +19602,7 @@ async function doctorCommand(input, dependencies = {}) {
     authCheck,
     buildProjectModeCheck(connection),
     ...connectedApiCheck === null ? [] : [connectedApiCheck],
-    buildProfileValidationCheck(profile),
+    buildProfileValidationCheck(profile, validationErrors),
     buildProfileFreshnessCheck(profile, currentTime),
     ...input.checkRelay === true ? [await buildRelaySpoolCheck(rootDirectory, currentTime, { readdir, stat })] : []
   ];
@@ -18935,6 +19614,7 @@ async function doctorCommand(input, dependencies = {}) {
 }
 
 // ../cli/src/verify-command.ts
+var import_node_crypto6 = require("node:crypto");
 var import_promises7 = require("node:fs/promises");
 var import_node_path9 = require("node:path");
 
@@ -19232,9 +19912,872 @@ var import_ioredis3 = __toESM(require_built3(), 1);
 
 // ../../packages/storage/src/redis-queue.ts
 var import_ioredis4 = __toESM(require_built3(), 1);
+var DEFAULT_PROCESSING_TIMEOUT_MS = 5 * 60 * 1e3;
 
 // ../../packages/storage/src/schema-migrations.ts
 var import_node_crypto3 = require("node:crypto");
+
+// ../../packages/storage/src/migrations.ts
+var STORAGE_BOOTSTRAP_STATEMENTS = [
+  `
+    CREATE TABLE users (
+      id uuid PRIMARY KEY,
+      email text NOT NULL UNIQUE,
+      accepted_terms_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      email_verified_at timestamptz,
+      avatar_source text,
+      avatar_object_key text,
+      avatar_content_type text,
+      avatar_updated_at timestamptz
+    )
+  `,
+  `
+    CREATE TABLE organizations (
+      id uuid PRIMARY KEY,
+      name text NOT NULL,
+      slug text NOT NULL UNIQUE,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      suspended_at timestamptz,
+      plan text NOT NULL DEFAULT 'free',
+      stripe_customer_id text,
+      additional_capacity_units integer NOT NULL DEFAULT 0,
+      stripe_subscription_id text,
+      billing_state text,
+      billing_period_ends_at timestamptz,
+      last_billing_sync_at timestamptz,
+      last_billing_event_id text,
+      billing_period_starts_at timestamptz
+    )
+  `,
+  `
+    CREATE UNIQUE INDEX organizations_stripe_customer_id_key
+    ON organizations (stripe_customer_id)
+    WHERE stripe_customer_id IS NOT NULL
+  `,
+  `
+    CREATE TABLE projects (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      owner_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      name text NOT NULL,
+      slug text NOT NULL,
+      environment_default text NOT NULL DEFAULT 'production',
+      automated_improvement_bundles_enabled boolean NOT NULL DEFAULT true,
+      improvement_bundle_sensitivity text NOT NULL DEFAULT 'high_confidence'
+        CHECK (improvement_bundle_sensitivity IN ('high_confidence', 'balanced', 'verbose')),
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      plan text NOT NULL DEFAULT 'free'
+    )
+  `,
+  `
+    CREATE UNIQUE INDEX projects_organization_id_slug_key
+    ON projects (organization_id, slug)
+  `,
+  `
+    CREATE TABLE services (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      name text NOT NULL,
+      runtime text,
+      framework text,
+      environment text NOT NULL DEFAULT 'production',
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (project_id, name, environment)
+    )
+  `,
+  `
+    CREATE TABLE project_tokens (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      token_hash text UNIQUE NOT NULL,
+      label text NOT NULL,
+      allowed_origins jsonb NOT NULL DEFAULT '[]'::jsonb,
+      last_used_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      revoked_at timestamptz,
+      expires_at timestamptz
+    )
+  `,
+  `
+    CREATE TABLE member_tokens (
+      id uuid PRIMARY KEY,
+      user_id uuid NOT NULL,
+      organization_id uuid NOT NULL,
+      token_hash text UNIQUE NOT NULL,
+      label text NOT NULL,
+      last_used_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      revoked_at timestamptz,
+      expires_at timestamptz
+    )
+  `,
+  `
+    CREATE INDEX member_tokens_org_idx
+    ON member_tokens (organization_id)
+  `,
+  `
+    CREATE TABLE audit_logs (
+      id uuid PRIMARY KEY,
+      organization_id uuid,
+      actor_user_id uuid,
+      actor_type text NOT NULL,
+      action text NOT NULL,
+      target_type text NOT NULL,
+      target_id text,
+      status text NOT NULL,
+      ip_address text,
+      metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+      occurred_at timestamptz NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX audit_logs_organization_occurred_at_idx
+    ON audit_logs (organization_id, occurred_at DESC, created_at DESC)
+  `,
+  `
+    CREATE INDEX audit_logs_action_occurred_at_idx
+    ON audit_logs (action, occurred_at DESC, created_at DESC)
+  `,
+  `
+    CREATE TABLE organization_members (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      role text NOT NULL DEFAULT 'member',
+      suspended_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (organization_id, user_id)
+    )
+  `,
+  `
+    CREATE INDEX organization_members_org_idx
+    ON organization_members (organization_id)
+  `,
+  `
+    CREATE INDEX organization_members_user_idx
+    ON organization_members (user_id)
+  `,
+  `
+    CREATE TABLE sessions (
+      id uuid PRIMARY KEY,
+      user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      session_token_hash text UNIQUE NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      expires_at timestamptz NOT NULL,
+      revoked_at timestamptz
+    )
+  `,
+  `
+    CREATE INDEX sessions_token_hash_idx
+    ON sessions (session_token_hash)
+  `,
+  `
+    CREATE INDEX sessions_user_org_idx
+    ON sessions (user_id, organization_id)
+  `,
+  `
+    CREATE TABLE email_auth_challenges (
+      id uuid PRIMARY KEY,
+      email text NOT NULL,
+      code_hash text NOT NULL,
+      accepted_terms_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      expires_at timestamptz NOT NULL,
+      used_at timestamptz
+    )
+  `,
+  `
+    CREATE INDEX email_auth_challenges_email_idx
+    ON email_auth_challenges (lower(email), created_at DESC)
+  `,
+  `
+    CREATE INDEX email_auth_challenges_code_hash_idx
+    ON email_auth_challenges (code_hash)
+  `,
+  `
+    CREATE TABLE github_device_authorizations (
+      id uuid PRIMARY KEY,
+      device_code text NOT NULL UNIQUE,
+      user_code text NOT NULL,
+      verification_uri text NOT NULL,
+      interval_seconds integer NOT NULL,
+      expires_at timestamptz NOT NULL,
+      accepted_terms_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      completed_at timestamptz,
+      claimed_at timestamptz,
+      terminal_error text,
+      user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      organization_id uuid REFERENCES organizations(id) ON DELETE SET NULL
+    )
+  `,
+  `
+    CREATE INDEX github_device_authorizations_user_code_idx
+    ON github_device_authorizations (user_code, created_at DESC)
+  `,
+  `
+    CREATE INDEX github_device_authorizations_expires_at_idx
+    ON github_device_authorizations (expires_at)
+  `,
+  `
+    CREATE TABLE project_members (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      role text NOT NULL,
+      invited_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (project_id, user_id)
+    )
+  `,
+  `
+    CREATE INDEX project_members_project_id_idx
+    ON project_members (project_id, created_at DESC)
+  `,
+  `
+    CREATE INDEX project_members_user_id_idx
+    ON project_members (user_id, created_at DESC)
+  `,
+  `
+    CREATE TABLE project_invites (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      email text NOT NULL,
+      role text NOT NULL,
+      invited_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      invite_token_hash text NOT NULL,
+      accepted_at timestamptz,
+      canceled_at timestamptz,
+      expires_at timestamptz NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX project_invites_project_id_idx
+    ON project_invites (project_id, created_at DESC)
+  `,
+  `
+    CREATE UNIQUE INDEX project_invites_pending_project_email_key
+    ON project_invites (project_id, lower(email))
+    WHERE accepted_at IS NULL AND canceled_at IS NULL
+  `,
+  `
+    CREATE UNIQUE INDEX project_invites_invite_token_hash_key
+    ON project_invites (invite_token_hash)
+  `,
+  `
+    CREATE TABLE oauth_identities (
+      id uuid PRIMARY KEY,
+      provider text NOT NULL,
+      provider_user_id text NOT NULL,
+      user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (provider, provider_user_id)
+    )
+  `,
+  `
+    CREATE INDEX oauth_identities_user_id_idx
+    ON oauth_identities (user_id, provider)
+  `,
+  `
+    CREATE TABLE probe_activations (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      created_by_member_id uuid NOT NULL,
+      label_pattern text NOT NULL,
+      service text NOT NULL DEFAULT '*',
+      environment text NOT NULL DEFAULT '*',
+      trigger_expires_at timestamptz NOT NULL,
+      expires_at timestamptz NOT NULL,
+      deactivated_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX probe_activations_project_active_idx
+    ON probe_activations (project_id, expires_at DESC)
+    WHERE deactivated_at IS NULL
+  `,
+  `
+    CREATE TABLE capture_policies (
+      project_id uuid PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+      preset text NOT NULL DEFAULT 'minimal',
+      capture_logs text,
+      capture_request_events text,
+      capture_breadcrumbs text,
+      capture_probe_events text,
+      immediate_client_error_statuses jsonb,
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE TABLE capture_rules (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      name text NOT NULL,
+      description text,
+      enabled boolean NOT NULL DEFAULT true,
+      action text NOT NULL,
+      matcher jsonb NOT NULL,
+      sample_rate double precision,
+      sample_event_class text,
+      created_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      created_from_incident_id text,
+      created_from_event_id text,
+      expires_at timestamptz,
+      hit_count bigint NOT NULL DEFAULT 0,
+      last_matched_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX capture_rules_project_enabled_idx
+    ON capture_rules (project_id, enabled)
+  `,
+  `
+    CREATE INDEX capture_rules_project_updated_idx
+    ON capture_rules (project_id, updated_at DESC)
+  `,
+  `
+    CREATE TABLE deployments (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      service_id uuid REFERENCES services(id) ON DELETE SET NULL,
+      environment text NOT NULL,
+      source_event_id uuid UNIQUE NOT NULL,
+      commit_sha text,
+      version text,
+      branch text,
+      deployed_at timestamptz NOT NULL,
+      metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX deployments_project_service_env_deployed_idx
+    ON deployments (project_id, service_id, environment, deployed_at DESC)
+  `,
+  `
+    CREATE TABLE incidents (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      service_id uuid REFERENCES services(id) ON DELETE SET NULL,
+      environment text NOT NULL DEFAULT 'production',
+      fingerprint text NOT NULL,
+      fingerprint_version text NOT NULL DEFAULT 'v1',
+      title text NOT NULL,
+      severity text NOT NULL,
+      status text NOT NULL DEFAULT 'open',
+      first_seen_at timestamptz NOT NULL,
+      last_seen_at timestamptz NOT NULL,
+      occurrence_count integer NOT NULL DEFAULT 1,
+      matched_fields text[],
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      regressed_at timestamptz,
+      spike_detected_at timestamptz,
+      frequency_occurrences_1m integer,
+      frequency_occurrences_5m integer,
+      frequency_occurrences_1h integer,
+      frequency_occurrences_24h integer,
+      frequency_baseline_1h_per_5m double precision,
+      frequency_spike_ratio_5m_to_1h double precision,
+      frequency_has_sufficient_baseline boolean,
+      frequency_is_spiking boolean,
+      frequency_snapshot_at timestamptz,
+      latest_deployment_id uuid REFERENCES deployments(id) ON DELETE SET NULL,
+      bundle_generation_number integer NOT NULL DEFAULT 0,
+      bundle_created_at timestamptz,
+      bundle_updated_at timestamptz,
+      bundle_source_event_id uuid,
+      bundle_source_occurred_at timestamptz,
+      bundle_trigger text,
+      bundle_failure_reason text,
+      resolved_at timestamptz,
+      resolved_by_member_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      UNIQUE (project_id, environment, service_id, fingerprint)
+    )
+  `,
+  `
+    CREATE TABLE processed_events (
+      event_id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      event_type text NOT NULL,
+      fingerprint text NOT NULL,
+      normalized_message text NOT NULL,
+      processed_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE TABLE improvement_opportunities (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      service_id uuid REFERENCES services(id) ON DELETE SET NULL,
+      service_name text NOT NULL,
+      environment text NOT NULL DEFAULT 'production',
+      kind text NOT NULL,
+      status text NOT NULL DEFAULT 'open',
+      severity text NOT NULL,
+      confidence numeric NOT NULL,
+      fingerprint text NOT NULL,
+      title text NOT NULL,
+      summary text NOT NULL,
+      occurrence_count integer NOT NULL DEFAULT 1,
+      evidence jsonb NOT NULL,
+      first_detected_at timestamptz NOT NULL,
+      last_detected_at timestamptz NOT NULL,
+      last_source_event_id uuid,
+      related_incident_ids uuid[] NOT NULL DEFAULT '{}',
+      bundle_generation_number integer NOT NULL DEFAULT 0,
+      bundle_created_at timestamptz,
+      bundle_updated_at timestamptz,
+      bundle_source_event_id uuid,
+      bundle_failure_reason text,
+      resolved_at timestamptz,
+      resolved_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      snoozed_until timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (project_id, fingerprint)
+    )
+  `,
+  `
+    CREATE INDEX improvement_opportunities_project_status_detected_idx
+    ON improvement_opportunities (project_id, status, last_detected_at DESC)
+  `,
+  `
+    CREATE INDEX improvement_opportunities_project_kind_detected_idx
+    ON improvement_opportunities (project_id, kind, last_detected_at DESC)
+  `,
+  `
+    CREATE INDEX improvement_opportunities_project_service_env_idx
+    ON improvement_opportunities (project_id, service_id, environment)
+  `,
+  `
+    CREATE TABLE improvement_opportunity_events (
+      improvement_opportunity_id uuid NOT NULL REFERENCES improvement_opportunities(id) ON DELETE CASCADE,
+      event_id uuid NOT NULL,
+      event_type text NOT NULL,
+      occurred_at timestamptz NOT NULL,
+      PRIMARY KEY (improvement_opportunity_id, event_id)
+    )
+  `,
+  `
+    CREATE INDEX improvement_opportunity_events_detected_idx
+    ON improvement_opportunity_events (improvement_opportunity_id, occurred_at DESC, event_id DESC)
+  `,
+  `
+    CREATE TABLE bundle_generations (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid REFERENCES incidents(id) ON DELETE CASCADE,
+      improvement_opportunity_id uuid REFERENCES improvement_opportunities(id) ON DELETE CASCADE,
+      bundle_type text NOT NULL,
+      generation_number integer NOT NULL,
+      source_event_id uuid NOT NULL,
+      source_occurred_at timestamptz NOT NULL,
+      trigger text NOT NULL,
+      created_at timestamptz NOT NULL,
+      updated_at timestamptz NOT NULL,
+      CHECK (
+        (incident_id IS NOT NULL AND improvement_opportunity_id IS NULL AND bundle_type = 'failure')
+        OR (incident_id IS NULL AND improvement_opportunity_id IS NOT NULL AND bundle_type = 'improvement')
+      )
+    )
+  `,
+  `
+    CREATE UNIQUE INDEX bundle_generations_incident_source_idx
+    ON bundle_generations (incident_id, source_event_id)
+    WHERE incident_id IS NOT NULL
+  `,
+  `
+    CREATE UNIQUE INDEX bundle_generations_improvement_source_idx
+    ON bundle_generations (improvement_opportunity_id, source_event_id)
+    WHERE improvement_opportunity_id IS NOT NULL
+  `,
+  `
+    CREATE INDEX bundle_generations_project_created_idx
+    ON bundle_generations (project_id, created_at DESC, bundle_type)
+  `,
+  `
+    CREATE INDEX bundle_generations_incident_generation_idx
+    ON bundle_generations (incident_id, generation_number DESC)
+  `,
+  `
+    CREATE INDEX bundle_generations_improvement_generation_idx
+    ON bundle_generations (improvement_opportunity_id, generation_number DESC)
+    WHERE improvement_opportunity_id IS NOT NULL
+  `,
+  `
+    CREATE TABLE incident_events (
+      incident_id uuid NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+      event_id uuid NOT NULL,
+      event_type text NOT NULL,
+      event_class text NOT NULL DEFAULT 'context_signal',
+      occurred_at timestamptz NOT NULL,
+      is_sampled boolean NOT NULL DEFAULT false,
+      level text,
+      retain_first boolean NOT NULL DEFAULT false,
+      retain_latest boolean NOT NULL DEFAULT false,
+      retain_after_deploy boolean NOT NULL DEFAULT false,
+      retain_highest_severity boolean NOT NULL DEFAULT false,
+      retain_deploy_metadata boolean NOT NULL DEFAULT false,
+      severity_rank integer NOT NULL DEFAULT 0,
+      PRIMARY KEY (incident_id, event_id)
+    )
+  `,
+  `
+    CREATE INDEX incident_events_incident_occurred_event_idx
+    ON incident_events (incident_id, occurred_at DESC, event_id DESC)
+  `,
+  `
+    CREATE INDEX incident_events_incident_level_occurred_event_idx
+    ON incident_events (incident_id, level, occurred_at DESC, event_id DESC)
+  `,
+  `
+    CREATE INDEX incident_events_incident_sampled_idx
+    ON incident_events (incident_id, is_sampled, occurred_at ASC, event_id ASC)
+  `,
+  `
+    CREATE TABLE weekly_report_channels (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      channel text NOT NULL,
+      config jsonb NOT NULL DEFAULT '{}'::jsonb,
+      schedule_day_of_week text NOT NULL,
+      schedule_hour_of_day integer NOT NULL,
+      schedule_timezone text NOT NULL,
+      is_enabled boolean NOT NULL DEFAULT true,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX weekly_report_channels_project_created_idx
+    ON weekly_report_channels (project_id, created_at ASC)
+  `,
+  `
+    CREATE UNIQUE INDEX weekly_report_channels_project_email_unique_idx
+    ON weekly_report_channels (project_id)
+    WHERE channel = 'email'
+  `,
+  `
+    CREATE TABLE weekly_report_deliveries (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      weekly_report_channel_id uuid REFERENCES weekly_report_channels(id) ON DELETE CASCADE,
+      window_start timestamptz NOT NULL,
+      window_end timestamptz NOT NULL,
+      channel text NOT NULL,
+      status text NOT NULL,
+      last_error text,
+      delivered_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX weekly_report_deliveries_project_window_idx
+    ON weekly_report_deliveries (project_id, window_end DESC, channel)
+  `,
+  `
+    CREATE UNIQUE INDEX weekly_report_deliveries_channel_window_idx
+    ON weekly_report_deliveries (weekly_report_channel_id, window_start, window_end)
+    WHERE weekly_report_channel_id IS NOT NULL
+  `,
+  `
+    CREATE INDEX weekly_report_deliveries_channel_idx
+    ON weekly_report_deliveries (weekly_report_channel_id, window_end DESC)
+  `,
+  `
+    CREATE TABLE alert_rules (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      created_by_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      service_id uuid REFERENCES services(id) ON DELETE CASCADE,
+      channel text NOT NULL,
+      condition_type text NOT NULL,
+      severity_min text,
+      config jsonb NOT NULL DEFAULT '{}'::jsonb,
+      is_enabled boolean NOT NULL DEFAULT true,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX alert_rules_project_enabled_idx
+    ON alert_rules (project_id, is_enabled)
+  `,
+  `
+    CREATE TABLE slack_destinations (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      slack_team_id text NOT NULL,
+      slack_team_name text,
+      slack_channel_id text NOT NULL,
+      slack_channel_name text,
+      webhook_url_ciphertext text NOT NULL,
+      installed_by_member_id uuid REFERENCES users(id) ON DELETE SET NULL,
+      is_active boolean NOT NULL DEFAULT true,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (organization_id, slack_team_id, slack_channel_id)
+    )
+  `,
+  `
+    CREATE INDEX slack_destinations_org_active_idx
+    ON slack_destinations (organization_id, is_active, created_at)
+  `,
+  `
+    CREATE TABLE alert_deliveries (
+      id uuid PRIMARY KEY,
+      alert_id uuid NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+      condition_type text NOT NULL,
+      dedupe_key text NOT NULL,
+      channel text NOT NULL,
+      status text NOT NULL,
+      payload jsonb NOT NULL,
+      last_error text,
+      delivered_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (alert_id, incident_id, dedupe_key)
+    )
+  `,
+  `
+    CREATE INDEX alert_deliveries_project_status_idx
+    ON alert_deliveries (project_id, status, created_at DESC)
+  `,
+  `
+    CREATE TABLE alert_email_digests (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      recipient text NOT NULL,
+      status text NOT NULL,
+      next_attempt_at timestamptz,
+      claimed_at timestamptz,
+      last_error text,
+      delivered_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE UNIQUE INDEX alert_email_digests_project_recipient_pending_idx
+    ON alert_email_digests (project_id, recipient)
+    WHERE status = 'pending' AND claimed_at IS NULL
+  `,
+  `
+    CREATE INDEX alert_email_digests_status_next_attempt_idx
+    ON alert_email_digests (status, next_attempt_at)
+  `,
+  `
+    CREATE TABLE alert_email_digest_items (
+      id uuid PRIMARY KEY,
+      digest_id uuid NOT NULL REFERENCES alert_email_digests(id) ON DELETE CASCADE,
+      alert_id uuid NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+      condition_type text NOT NULL,
+      dedupe_key text NOT NULL,
+      payload jsonb NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (alert_id, incident_id, dedupe_key)
+    )
+  `,
+  `
+    CREATE INDEX alert_email_digest_items_digest_created_idx
+    ON alert_email_digest_items (digest_id, created_at ASC)
+  `,
+  `
+    CREATE TABLE agent_webhooks (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      created_by_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      url text NOT NULL,
+      secret_hash text NOT NULL,
+      events text[] NOT NULL,
+      filters jsonb NOT NULL DEFAULT '{}'::jsonb,
+      is_enabled boolean NOT NULL DEFAULT true,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX agent_webhooks_project_enabled_idx
+    ON agent_webhooks (project_id, is_enabled)
+  `,
+  `
+    CREATE TABLE webhook_deliveries (
+      id uuid PRIMARY KEY,
+      webhook_id uuid REFERENCES agent_webhooks(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid REFERENCES incidents(id) ON DELETE CASCADE,
+      event_type text NOT NULL,
+      target_url text NOT NULL,
+      signing_secret text NOT NULL,
+      status text NOT NULL DEFAULT 'pending',
+      attempt_count integer NOT NULL DEFAULT 0,
+      occurred_at timestamptz NOT NULL,
+      next_attempt_at timestamptz,
+      last_response_code integer,
+      last_attempted_at timestamptz,
+      last_error text,
+      payload jsonb NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX webhook_deliveries_status_next_attempt_idx
+    ON webhook_deliveries (status, next_attempt_at)
+  `,
+  `
+    CREATE TABLE processed_billing_events (
+      event_id text PRIMARY KEY,
+      event_type text NOT NULL,
+      organization_id uuid,
+      processed_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE TABLE github_installations (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      installation_id bigint NOT NULL UNIQUE,
+      account_login text NOT NULL,
+      account_type text NOT NULL CHECK (account_type IN ('Organization', 'User')),
+      status text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'suspended', 'removed')),
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (organization_id)
+    )
+  `,
+  `
+    CREATE INDEX github_installations_status_idx
+    ON github_installations (status)
+  `,
+  `
+    CREATE TABLE project_github_repos (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL UNIQUE REFERENCES projects(id) ON DELETE CASCADE,
+      installation_id uuid NOT NULL REFERENCES github_installations(id) ON DELETE CASCADE,
+      repo_owner text NOT NULL,
+      repo_name text NOT NULL,
+      default_branch text NOT NULL DEFAULT 'main',
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE TABLE github_dispatch_rules (
+      id uuid PRIMARY KEY,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      created_by_user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      name text NOT NULL,
+      enabled boolean NOT NULL DEFAULT true,
+      event_types text[] NOT NULL,
+      environments text[],
+      services text[],
+      severity_min text CHECK (severity_min IN ('low', 'medium', 'high', 'critical')),
+      bundle_type text CHECK (bundle_type IN ('failure', 'improvement')),
+      incident_status text NOT NULL DEFAULT 'new_or_reopened'
+        CHECK (incident_status IN ('new_only', 'reopened_only', 'new_or_reopened')),
+      cooldown_seconds integer NOT NULL DEFAULT 300,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now()
+    )
+  `,
+  `
+    CREATE INDEX github_dispatch_rules_project_enabled_idx
+    ON github_dispatch_rules (project_id, enabled)
+  `,
+  `
+    CREATE TABLE github_dispatch_deliveries (
+      id uuid PRIMARY KEY,
+      rule_id uuid NOT NULL REFERENCES github_dispatch_rules(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      incident_id uuid REFERENCES incidents(id) ON DELETE CASCADE,
+      improvement_opportunity_id uuid REFERENCES improvement_opportunities(id) ON DELETE CASCADE,
+      target_fingerprint text NOT NULL,
+      installation_id bigint NOT NULL,
+      repo_owner text NOT NULL,
+      repo_name text NOT NULL,
+      status text NOT NULL DEFAULT 'pending'
+        CHECK (status IN ('pending', 'retrying', 'delivered', 'failed', 'skipped')),
+      attempt_count integer NOT NULL DEFAULT 0,
+      next_attempt_at timestamptz,
+      last_attempt_at timestamptz,
+      last_error text,
+      github_status_code integer,
+      dispatch_payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      dedupe_key text NOT NULL,
+      CHECK (
+        (incident_id IS NOT NULL AND improvement_opportunity_id IS NULL)
+        OR (incident_id IS NULL AND improvement_opportunity_id IS NOT NULL)
+      )
+    )
+  `,
+  `
+    CREATE INDEX github_dispatch_deliveries_status_next_attempt_idx
+    ON github_dispatch_deliveries (status, next_attempt_at)
+  `,
+  `
+    CREATE UNIQUE INDEX github_dispatch_deliveries_rule_dedupe_key_idx
+    ON github_dispatch_deliveries (rule_id, target_fingerprint, dedupe_key)
+  `,
+  `
+    CREATE TABLE org_usage_counters (
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      period_starts_at timestamptz NOT NULL,
+      raw_ingested_events integer NOT NULL DEFAULT 0,
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (organization_id, period_starts_at)
+    )
+  `,
+  `
+    CREATE TABLE operational_email_deliveries (
+      id uuid PRIMARY KEY,
+      organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+      project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      kind text NOT NULL
+        CHECK (kind IN ('webhook_auto_disabled', 'allowance_warning_80', 'allowance_limit_reached', 'retention_rotation_notice')),
+      dedupe_key text NOT NULL,
+      payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+      status text NOT NULL DEFAULT 'pending'
+        CHECK (status IN ('pending', 'retrying', 'delivered', 'failed')),
+      attempt_count integer NOT NULL DEFAULT 0,
+      next_attempt_at timestamptz,
+      last_error text,
+      delivered_at timestamptz,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (organization_id, kind, dedupe_key)
+    )
+  `,
+  `
+    CREATE INDEX operational_email_deliveries_status_next_attempt_idx
+    ON operational_email_deliveries (status, next_attempt_at, created_at)
+  `
+];
+var STORAGE_BOOTSTRAP_SQL = STORAGE_BOOTSTRAP_STATEMENTS.join(";\n\n");
+
+// ../../packages/storage/src/schema-migrations.ts
 function computeMigrationChecksum(input) {
   return (0, import_node_crypto3.createHash)("sha256").update(JSON.stringify(input)).digest("hex");
 }
@@ -19656,6 +21199,76 @@ var STORAGE_SCHEMA_MIGRATIONS = [
     statements: [
       "ALTER TABLE project_tokens ADD COLUMN IF NOT EXISTS allowed_origins jsonb NOT NULL DEFAULT '[]'::jsonb"
     ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605260001_fix_weekly_report_delivery_conflict_index",
+    description: "Ensure weekly report delivery dedupe rows and partial unique index exist for conflict claims.",
+    statements: [
+      `
+        DELETE FROM weekly_report_deliveries
+        WHERE id IN (
+          SELECT id
+          FROM (
+            SELECT
+              id,
+              row_number() OVER (
+                PARTITION BY weekly_report_channel_id, window_start, window_end
+                ORDER BY created_at ASC, id ASC
+              ) AS row_number
+            FROM weekly_report_deliveries
+            WHERE weekly_report_channel_id IS NOT NULL
+          ) ranked
+          WHERE ranked.row_number > 1
+        )
+      `,
+      `
+        CREATE UNIQUE INDEX IF NOT EXISTS weekly_report_deliveries_channel_window_idx
+        ON weekly_report_deliveries (weekly_report_channel_id, window_start, window_end)
+        WHERE weekly_report_channel_id IS NOT NULL
+      `
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605260001_set_high_confidence_as_project_improvement_default",
+    description: "Make high-confidence the default hosted improvement sensitivity for new projects.",
+    statements: [
+      "ALTER TABLE projects ALTER COLUMN improvement_bundle_sensitivity SET DEFAULT 'high_confidence'"
+    ]
+  }),
+  defineStorageSchemaMigration({
+    id: "202605260002_add_capture_rules",
+    description: "Add persisted project capture rules for dynamic demote/sample/drop handling.",
+    statements: [
+      `
+        CREATE TABLE IF NOT EXISTS capture_rules (
+          id uuid PRIMARY KEY,
+          project_id uuid NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+          name text NOT NULL,
+          description text,
+          enabled boolean NOT NULL DEFAULT true,
+          action text NOT NULL,
+          matcher jsonb NOT NULL,
+          sample_rate double precision,
+          sample_event_class text,
+          created_by_user_id uuid REFERENCES users(id) ON DELETE SET NULL,
+          created_from_incident_id text,
+          created_from_event_id text,
+          expires_at timestamptz,
+          hit_count bigint NOT NULL DEFAULT 0,
+          last_matched_at timestamptz,
+          created_at timestamptz NOT NULL DEFAULT now(),
+          updated_at timestamptz NOT NULL DEFAULT now()
+        )
+      `,
+      `
+        CREATE INDEX IF NOT EXISTS capture_rules_project_enabled_idx
+        ON capture_rules (project_id, enabled)
+      `,
+      `
+        CREATE INDEX IF NOT EXISTS capture_rules_project_updated_idx
+        ON capture_rules (project_id, updated_at DESC)
+      `
+    ]
   })
 ];
 
@@ -19778,11 +21391,17 @@ function normalizeRouteTemplate(path) {
   const normalizedSegments = pathWithoutQueryOrFragment.split("/").filter((segment) => segment.length > 0).map((segment) => isDynamicRouteSegment2(segment) ? "{param}" : segment);
   return normalizedSegments.length === 0 ? "/" : `/${normalizedSegments.join("/")}`;
 }
+function isBrowserSdkFallbackFrame(frame) {
+  return frame.includes("debugbundle-browser-sdk") && frame.includes("onError");
+}
 function deriveFirstApplicationFrame(errorContext) {
   const firstFrame = errorContext?.top_frames[0];
   if (firstFrame === void 0) {
     return null;
   }
+  if (isBrowserSdkFallbackFrame(firstFrame)) {
+    return null;
+  }
   const match = /at\s+(.*?)\s+\((.*?):(\d+):(\d+)\)$/.exec(firstFrame) ?? /at\s+(.*?):(\d+):(\d+)$/.exec(firstFrame);
   if (match === null) {
     return {
@@ -19804,6 +21423,20 @@ function deriveFirstApplicationFrame(errorContext) {
     line: Number(match[2])
   };
 }
+function getPrimaryBrowserExceptionEvent(envelopes, primarySignalEnvelope) {
+  if (primarySignalEnvelope !== null && isFrontendExceptionEnvelope(primarySignalEnvelope)) {
+    return primarySignalEnvelope.payload.browser_event ?? null;
+  }
+  const envelope = selectLatestEnvelopeByType(envelopes, isFrontendExceptionEnvelope);
+  return envelope?.payload.browser_event ?? null;
+}
+function isOpaqueBrowserError(errorContext, browserEvent) {
+  if (browserEvent?.opaque === true) {
+    return true;
+  }
+  const firstFrame = errorContext?.top_frames[0];
+  return errorContext?.message === "Window error" && firstFrame !== void 0 && isBrowserSdkFallbackFrame(firstFrame);
+}
 function buildErrorContext(envelopes, incident, primarySignalEnvelope) {
   if (primarySignalEnvelope !== null && isBackendExceptionEnvelope(primarySignalEnvelope)) {
     return {
@@ -19926,6 +21559,20 @@ function buildSummaryGuidance(input) {
       recommended_action: null
     };
   }
+  if (input.opaqueBrowserError) {
+    if (input.browserEvent?.kind === "resource_error") {
+      return {
+        likely_cause: "The browser reported a resource load error without a usable application stack.",
+        confidence: 0.35,
+        recommended_action: "Inspect the captured resource target, browser network failures, CSP rules, and cross-origin asset configuration."
+      };
+    }
+    return {
+      likely_cause: "The browser reported an opaque window error without a usable application stack.",
+      confidence: 0.35,
+      recommended_action: "Inspect browser console output, resource loading, cross-origin script settings, and framework-level error boundaries for the affected route."
+    };
+  }
   const route = input.requestContext?.route_template ?? input.requestContext?.path ?? null;
   const requestDescription = input.requestContext !== null ? `${input.requestContext.method} ${route ?? input.requestContext.path}` : null;
   const firstDependency = input.dependenciesContext?.items[0] ?? null;
@@ -20112,7 +21759,8 @@ function buildFrontendContext(envelopes) {
         message: envelope.payload.message,
         route: envelope.payload.route ?? null,
         browser: envelope.payload.browser,
-        ts: toIsoTimestamp(envelope.occurred_at)
+        ts: toIsoTimestamp(envelope.occurred_at),
+        ...envelope.payload.browser_event !== void 0 ? { browser_event: envelope.payload.browser_event } : {}
       });
     }
   }
@@ -20255,6 +21903,8 @@ function buildBundle(input) {
   const gitContext = buildGitContext(sourceEnvelopes, input.configuredDeploy);
   const deviceContext = buildDeviceContext(sourceEnvelopes);
   const dependenciesContext = buildDependenciesContext(input.incident, errorContext, requestContext);
+  const browserEvent = getPrimaryBrowserExceptionEvent(sourceEnvelopes, primarySignalEnvelope);
+  const opaqueBrowserError = isOpaqueBrowserError(errorContext, browserEvent);
   const primarySignalType = primarySignalEnvelope !== null ? mapSignalType(primarySignalEnvelope.event_type) : inferSignalTypeFromSourceEventTypes(sourceEventTypes);
   const primarySourceEvent = errorContext?.name ?? sourceEventTypes[0] ?? "backend_exception";
   const firstSeenAt = new Date(input.incident.first_seen_at).toISOString();
@@ -20269,7 +21919,9 @@ function buildBundle(input) {
     requestContext,
     responseContext,
     dependenciesContext,
-    firstApplicationFrame
+    firstApplicationFrame,
+    browserEvent,
+    opaqueBrowserError
   });
   const candidate = {
     bundle_version: 1,
@@ -21407,7 +23059,7 @@ async function processCommand(input, dependencies = {}) {
 
 // ../cli/src/ingest-command.ts
 var LOCAL_EVENTS_DIRECTORY_PATH2 = ".debugbundle/local/events";
-var ProfileSchema3 = external_exports.object({
+var ProfileSchema2 = external_exports.object({
   project: external_exports.object({
     name: external_exports.string().min(1),
     repo_url: external_exports.string()
@@ -21432,7 +23084,7 @@ function buildEventFileName(events, filePath) {
   return `${lastOccurredAt}-${digest}-${slugify(events[0]?.service.name ?? (0, import_node_path7.basename)(filePath))}.events.json`;
 }
 async function readProfile(rootDirectory, readFile) {
-  const parsedProfile = ProfileSchema3.safeParse(JSON.parse(await readFile((0, import_node_path7.join)(rootDirectory, PROFILE_FILE_PATH))));
+  const parsedProfile = ProfileSchema2.safeParse(JSON.parse(await readFile((0, import_node_path7.join)(rootDirectory, PROFILE_FILE_PATH))));
   if (!parsedProfile.success) {
     throw new Error(`Invalid ${PROFILE_FILE_PATH}`);
   }
@@ -21752,19 +23404,32 @@ function formatResult(input, exitCode, checks, errors, incidentId) {
     output: input.json ? buildJsonOutput(checks, errors, incidentId) : formatHumanOutput(checks, incidentId)
   };
 }
-function buildCloudSuggestedActions(status, incidentId, mode = "passive_recent_incident") {
+function buildCloudSuggestedActions(status, incidentId, verification) {
+  const mode = verification?.mode ?? "passive_recent_incident";
   if (status === "healthy" && incidentId !== void 0 && (mode === "active_5xx" || mode === "active_4xx")) {
     return [
       `Run debugbundle inspect ${incidentId} --source cloud to inspect why the incident fired.`,
       `Run debugbundle bundle ${incidentId} --source cloud to fetch the generated debug bundle.`
     ];
   }
+  if (status === "healthy" && incidentId !== void 0 && mode === "app_event") {
+    return [
+      `Run debugbundle inspect ${incidentId} --source cloud to inspect the captured app event.`,
+      "Re-run debugbundle verify cloud --expect-app-event after instrumentation or deploy changes, using the same service, environment, and correlation hints when available."
+    ];
+  }
   if (status === "healthy" && incidentId !== void 0) {
     return [
       `Review incident ${incidentId} if you want to inspect the latest production bundle.`,
       "Re-run debugbundle verify cloud after a fresh deploy or instrumentation change."
     ];
   }
+  if (mode === "app_event") {
+    return [
+      "Trigger a real SDK event from the target app, then re-run debugbundle verify cloud --expect-app-event with the same service and environment filters.",
+      "Add --trace-id or --request-id when you have a correlation hint so the verification can match the hosted bundle deterministically."
+    ];
+  }
   return [
     "Run debugbundle login to choose an auth flow, or use debugbundle login --github, debugbundle login --github-device, or debugbundle login <dbundle_mem_...> to create ~/.debugbundle/auth.json before verifying cloud traffic.",
     "Generate a live cloud request, then re-run debugbundle verify cloud with the correct project and service filters."
@@ -21777,7 +23442,7 @@ function buildCloudJsonOutput(checks, errors, incidentId, verification) {
     checks,
     warnings: collectWarnings(checks),
     errors,
-    suggested_actions: buildCloudSuggestedActions(status, incidentId, verification?.mode),
+    suggested_actions: buildCloudSuggestedActions(status, incidentId, verification),
     auto_fix_available: false
   };
   if (verification !== void 0) {
@@ -21792,7 +23457,7 @@ function formatCloudHumanOutput(checks, incidentId, verification) {
     "Checks:",
     ...checks.map((check) => `- ${check.name}: ${check.status} - ${check.message}`),
     "Suggested actions:",
-    ...buildCloudSuggestedActions(status, incidentId, verification?.mode).map((action) => `- ${action}`)
+    ...buildCloudSuggestedActions(status, incidentId, verification).map((action) => `- ${action}`)
   ].join("\n");
 }
 function formatCloudResult(input, exitCode, checks, errors, incidentId, verification) {
@@ -21823,6 +23488,19 @@ function localFailureStepName(checks) {
 function cloudVerificationRunId(now) {
   return now.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14);
 }
+function defaultCloudVerificationSuffix() {
+  return (0, import_node_crypto6.randomUUID)().replace(/-/g, "").slice(0, 12);
+}
+function normalizeCloudVerificationSuffix(suffix) {
+  const normalized = suffix.toLowerCase().replace(/[^a-z0-9]/g, "").slice(0, 12);
+  if (normalized.length > 0) {
+    return normalized;
+  }
+  return defaultCloudVerificationSuffix();
+}
+function buildCloudVerificationRunId(now, suffix) {
+  return `${cloudVerificationRunId(now)}-${normalizeCloudVerificationSuffix(suffix)}`;
+}
 function requestFailureReason(responseStatus) {
   const incidentReason = deriveIncidentReasonFromSignal({
     event_type: "request_event",
@@ -21835,7 +23513,6 @@ function requestFailureReason(responseStatus) {
   return incidentReason;
 }
 function buildCloudVerificationEvent(input) {
-  const runId = cloudVerificationRunId(input.now);
   const is5xxVerification = input.responseStatus >= 500;
   const routeTemplate = is5xxVerification ? "/debugbundle/verify/cloud" : `/debugbundle/verify/cloud/client-error/${input.responseStatus}`;
   const verificationLabel = is5xxVerification ? "true" : `client-error-${input.responseStatus}`;
@@ -21856,7 +23533,7 @@ function buildCloudVerificationEvent(input) {
       route_template: routeTemplate,
       query: {
         debugbundle_verification: true,
-        run_id: runId,
+        run_id: input.runId,
         synthetic_status: input.responseStatus
       },
       headers: {
@@ -21870,7 +23547,7 @@ function buildCloudVerificationEvent(input) {
       response_body: {
         error: is5xxVerification ? "debugbundle_cloud_verification" : "debugbundle_cloud_client_error_verification",
         synthetic: true,
-        run_id: runId,
+        run_id: input.runId,
         response_status: input.responseStatus
       }
     }
@@ -21885,6 +23562,45 @@ function validateActiveCloudVerificationInput(input) {
   }
   return null;
 }
+function validateCloudVerificationInput(input) {
+  const activeInputError = validateActiveCloudVerificationInput(input);
+  if (activeInputError !== null) {
+    return activeInputError;
+  }
+  const appEventVerificationEnabled = input.expectAppEvent === true || input.traceId !== void 0 || input.requestId !== void 0;
+  if (appEventVerificationEnabled && (input.trigger5xx === true || input.trigger4xxStatus !== void 0)) {
+    return "Choose either a synthetic trigger run or --expect-app-event, not both.";
+  }
+  if (appEventVerificationEnabled && input.service === void 0 && input.traceId === void 0 && input.requestId === void 0) {
+    return "App-event verification requires --service, --trace-id, or --request-id so the check stays scoped.";
+  }
+  return null;
+}
+function buildCorrelationHints(input) {
+  return {
+    ...input.service === void 0 ? {} : { service: input.service },
+    environment: input.environment,
+    ...input.traceId === void 0 ? {} : { trace_id: input.traceId },
+    ...input.requestId === void 0 ? {} : { request_id: input.requestId }
+  };
+}
+function collectBundleHintMatches(bundle, input) {
+  const serializedBundle = JSON.stringify(bundle);
+  const matches = [];
+  if (input.traceId !== void 0 && serializedBundle.includes(input.traceId)) {
+    matches.push("trace_id");
+  }
+  if (input.requestId !== void 0 && serializedBundle.includes(input.requestId)) {
+    matches.push("request_id");
+  }
+  return matches;
+}
+function requestedBundleHints(input) {
+  return [
+    ...input.traceId === void 0 ? [] : ["trace_id"],
+    ...input.requestId === void 0 ? [] : ["request_id"]
+  ];
+}
 async function sendEventsToApi(input, dependencies = {}) {
   const fetchImpl = dependencies.fetchImpl ?? fetch;
   const baseUrl = input.baseUrl.endsWith("/") ? input.baseUrl.slice(0, -1) : input.baseUrl;
@@ -22076,7 +23792,7 @@ async function verifyCloudCommand(input, dependencies = {}) {
   const checks = [];
   const environment = input.environment ?? "production";
   const maxAgeMinutes = input.maxAgeMinutes ?? 15;
-  const activeInputError = validateActiveCloudVerificationInput(input);
+  const activeInputError = validateCloudVerificationInput(input);
   if (activeInputError !== null) {
     checks.push({
       name: "trigger-input",
@@ -22117,9 +23833,124 @@ async function verifyCloudCommand(input, dependencies = {}) {
     requestInput,
     dependencies.fetchImpl === void 0 ? {} : { fetchImpl: dependencies.fetchImpl }
   ));
+  const appEventVerificationEnabled = input.expectAppEvent === true || input.traceId !== void 0 || input.requestId !== void 0;
+  if (appEventVerificationEnabled) {
+    const verificationStartedAt = now();
+    const pollAttempts = dependencies.pollAttempts ?? 6;
+    const pollIntervalMs = dependencies.pollIntervalMs ?? 2e3;
+    const sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    const requestedHints = requestedBundleHints(input);
+    const verification = {
+      mode: "app_event",
+      bundle_status: "unknown",
+      correlation_hints: buildCorrelationHints({
+        environment,
+        ...input.service === void 0 ? {} : { service: input.service },
+        ...input.traceId === void 0 ? {} : { traceId: input.traceId },
+        ...input.requestId === void 0 ? {} : { requestId: input.requestId }
+      })
+    };
+    const oldestAcceptedIncidentTimestamp = verificationStartedAt.getTime() - maxAgeMinutes * 6e4;
+    let incidentId;
+    let exitCode = 0;
+    let activeStep = "app-event-visibility";
+    const errors = [];
+    try {
+      for (let attempt = 1; attempt <= pollAttempts; attempt += 1) {
+        const result = await listIncidents({
+          bearerToken: authState.bearer_token,
+          projectId: input.projectId,
+          environment,
+          ...input.service === void 0 ? {} : { service: input.service },
+          limit: 5
+        });
+        const recentIncidents = result.incidents.filter((candidate) => {
+          const lastSeenAt = new Date(candidate.last_seen_at);
+          return !Number.isNaN(lastSeenAt.getTime()) && lastSeenAt.getTime() >= oldestAcceptedIncidentTimestamp;
+        });
+        for (const candidate of recentIncidents) {
+          const lastSeenAt = new Date(candidate.last_seen_at);
+          if (requestedHints.length === 0 && lastSeenAt.getTime() < verificationStartedAt.getTime()) {
+            continue;
+          }
+          if (requestedHints.length === 0) {
+            incidentId = candidate.incident_id;
+            verification.incident_id = candidate.incident_id;
+            break;
+          }
+          activeStep = "bundle-status";
+          const bundle = await getBundle({
+            bearerToken: authState.bearer_token,
+            incidentId: candidate.incident_id
+          });
+          verification.bundle_status = "status" in bundle && bundle.status === "pending" ? "pending" : "ready";
+          if (verification.bundle_status !== "ready") {
+            continue;
+          }
+          const matchedHints = collectBundleHintMatches(bundle, input);
+          verification.matched_hints = matchedHints;
+          if (requestedHints.every((hint) => matchedHints.includes(hint))) {
+            incidentId = candidate.incident_id;
+            verification.incident_id = candidate.incident_id;
+            verification.suggested_next_command = `debugbundle inspect ${candidate.incident_id} --source cloud`;
+            break;
+          }
+        }
+        if (incidentId !== void 0) {
+          break;
+        }
+        if (attempt < pollAttempts) {
+          await sleep(pollIntervalMs);
+        }
+      }
+      if (incidentId === void 0) {
+        if (requestedHints.length > 0) {
+          throw new Error(`No recent cloud incident matched the requested ${requestedHints.join(" and ")} hints within the ${maxAgeMinutes} minute verification window.`);
+        }
+        throw new Error(`No new ${environment} app event was visible within the ${maxAgeMinutes} minute verification window.`);
+      }
+      checks.push({
+        name: "app-event-visibility",
+        status: "ok",
+        message: `Observed cloud incident ${incidentId} for the requested app-driven verification window.`
+      });
+      if (requestedHints.length > 0) {
+        checks.push({
+          name: "bundle-hint-match",
+          status: "ok",
+          message: `Matched ${verification.matched_hints?.join(" and ")} in bundle ${incidentId}.`
+        });
+      } else {
+        const bundle = await getBundle({
+          bearerToken: authState.bearer_token,
+          incidentId
+        });
+        verification.bundle_status = "status" in bundle && bundle.status === "pending" ? "pending" : "ready";
+        verification.suggested_next_command = `debugbundle inspect ${incidentId} --source cloud`;
+        checks.push({
+          name: "bundle-status",
+          status: verification.bundle_status === "ready" ? "ok" : "warning",
+          message: verification.bundle_status === "ready" ? `Bundle for incident ${incidentId} is ready.` : `Bundle for incident ${incidentId} is still pending.`
+        });
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      checks.push({
+        name: activeStep,
+        status: "error",
+        message
+      });
+      errors.push(message);
+      exitCode = 1;
+    }
+    return formatCloudResult(input, exitCode, checks, errors, incidentId, verification);
+  }
   if (input.trigger5xx === true || input.trigger4xxStatus !== void 0) {
     const verificationStartedAt = now();
-    const runId = cloudVerificationRunId(verificationStartedAt);
+    const runId = buildCloudVerificationRunId(
+      verificationStartedAt,
+      (dependencies.randomId ?? defaultCloudVerificationSuffix)()
+    );
     const serviceName = input.service ?? `debugbundle-verify-cloud-${runId}`;
     const tokenLabel = `debugbundle verify cloud ${runId}`;
     const pollAttempts = dependencies.pollAttempts ?? 6;
@@ -22151,6 +23982,7 @@ async function verifyCloudCommand(input, dependencies = {}) {
       }
       const event = buildCloudVerificationEvent({
         now: verificationStartedAt,
+        runId,
         serviceName,
         environment,
         responseStatus
@@ -22870,8 +24702,85 @@ function createBillingMcpTools(api) {
   };
 }
 
-// src/capture-policy-tools.ts
+// src/capture-rule-tools.ts
 function mapMcpError4(error) {
+  if (error instanceof CaptureRuleApiError) {
+    throw new Error(`mcp_tool_error:${error.message}`);
+  }
+  throw new Error("mcp_tool_error:unknown_error");
+}
+function createCaptureRuleMcpTools(api) {
+  return {
+    async list_capture_rules(input) {
+      try {
+        return await api.listCaptureRules({
+          bearerToken: String(input["bearerToken"]),
+          projectId: String(input["projectId"])
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async create_capture_rule(input) {
+      try {
+        return await api.createCaptureRule({
+          bearerToken: String(input["bearerToken"]),
+          projectId: String(input["projectId"]),
+          create: typeof input["create"] === "object" && input["create"] !== null ? input["create"] : {}
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async update_capture_rule(input) {
+      try {
+        return await api.updateCaptureRule({
+          bearerToken: String(input["bearerToken"]),
+          projectId: String(input["projectId"]),
+          ruleId: String(input["ruleId"]),
+          update: typeof input["update"] === "object" && input["update"] !== null ? input["update"] : {}
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async delete_capture_rule(input) {
+      try {
+        return await api.deleteCaptureRule({
+          bearerToken: String(input["bearerToken"]),
+          projectId: String(input["projectId"]),
+          ruleId: String(input["ruleId"])
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async suggest_capture_rules_from_incident(input) {
+      try {
+        return await api.suggestCaptureRulesFromIncident({
+          bearerToken: String(input["bearerToken"]),
+          incidentId: String(input["incidentId"])
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    },
+    async create_capture_rule_from_incident_suggestion(input) {
+      try {
+        return await api.createCaptureRuleFromIncidentSuggestion({
+          bearerToken: String(input["bearerToken"]),
+          incidentId: String(input["incidentId"]),
+          create: typeof input["create"] === "object" && input["create"] !== null ? input["create"] : {}
+        });
+      } catch (error) {
+        mapMcpError4(error);
+      }
+    }
+  };
+}
+
+// src/capture-policy-tools.ts
+function mapMcpError5(error) {
   if (error instanceof CapturePolicyApiError) {
     throw new Error(`mcp_tool_error:${error.message}`);
   }
@@ -22886,7 +24795,7 @@ function createCapturePolicyMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError4(error);
+        mapMcpError5(error);
       }
     },
     async update_capture_policy(input) {
@@ -22898,14 +24807,14 @@ function createCapturePolicyMcpTools(api) {
           update
         });
       } catch (error) {
-        mapMcpError4(error);
+        mapMcpError5(error);
       }
     }
   };
 }
 
 // src/github-tools.ts
-function mapMcpError5(error) {
+function mapMcpError6(error) {
   if (error instanceof GitHubManagementApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -22924,7 +24833,7 @@ function createGitHubMcpTools(api) {
         const repo = projectId === void 0 || api.getProjectRepo === void 0 ? void 0 : await api.getProjectRepo({ bearerToken, projectId });
         return repo === void 0 ? { installation } : { installation, repo };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async list_github_repositories(input) {
@@ -22936,7 +24845,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async list_github_dispatch_rules(input) {
@@ -22948,7 +24857,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async create_github_dispatch_rule(input) {
@@ -22969,7 +24878,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async update_github_dispatch_rule(input) {
@@ -22991,7 +24900,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async delete_github_dispatch_rule(input) {
@@ -23007,7 +24916,7 @@ function createGitHubMcpTools(api) {
           rule_id: String(input["ruleId"])
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async list_github_deliveries(input) {
@@ -23021,7 +24930,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async retry_github_delivery(input) {
@@ -23034,7 +24943,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async set_project_github_repo(input) {
@@ -23048,7 +24957,7 @@ function createGitHubMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     },
     async remove_project_github_repo(input) {
@@ -23062,14 +24971,14 @@ function createGitHubMcpTools(api) {
           project_id: String(input["projectId"])
         };
       } catch (error) {
-        mapMcpError5(error);
+        mapMcpError6(error);
       }
     }
   };
 }
 
 // src/improvement-tools.ts
-function mapMcpError6(error) {
+function mapMcpError7(error) {
   if (error instanceof RetrievalApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23102,7 +25011,7 @@ function createImprovementMcpTools(api) {
           ...typeof input["limit"] === "number" ? { limit: input["limit"] } : {}
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async get_improvement(input) {
@@ -23112,7 +25021,7 @@ function createImprovementMcpTools(api) {
           improvementId: readString2(input, "improvementId")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async get_improvement_bundle(input) {
@@ -23123,7 +25032,7 @@ function createImprovementMcpTools(api) {
           improvementId: readString2(input, "improvementId")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async resolve_improvement(input) {
@@ -23133,7 +25042,7 @@ function createImprovementMcpTools(api) {
           improvementId: readString2(input, "improvementId")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async reopen_improvement(input) {
@@ -23143,7 +25052,7 @@ function createImprovementMcpTools(api) {
           improvementId: readString2(input, "improvementId")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     },
     async snooze_improvement(input) {
@@ -23154,14 +25063,14 @@ function createImprovementMcpTools(api) {
           snoozedUntil: readString2(input, "snoozedUntil")
         });
       } catch (error) {
-        mapMcpError6(error);
+        mapMcpError7(error);
       }
     }
   };
 }
 
 // src/improvement-settings-tools.ts
-function mapMcpError7(error) {
+function mapMcpError8(error) {
   if (error instanceof ImprovementSettingsApiError) {
     throw new Error(`mcp_tool_error:${error.message}`);
   }
@@ -23176,7 +25085,7 @@ function createImprovementSettingsMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError7(error);
+        mapMcpError8(error);
       }
     },
     async update_improvement_settings(input) {
@@ -23188,14 +25097,14 @@ function createImprovementSettingsMcpTools(api) {
           update
         });
       } catch (error) {
-        mapMcpError7(error);
+        mapMcpError8(error);
       }
     }
   };
 }
 
 // src/member-tools.ts
-function mapMcpError8(error) {
+function mapMcpError9(error) {
   if (error instanceof MemberApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23210,7 +25119,7 @@ function createMemberMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async list_project_member_invites(input) {
@@ -23220,7 +25129,7 @@ function createMemberMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async invite_project_member(input) {
@@ -23232,7 +25141,7 @@ function createMemberMcpTools(api) {
           role: String(input["role"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async cancel_project_member_invite(input) {
@@ -23243,7 +25152,7 @@ function createMemberMcpTools(api) {
           inviteId: String(input["inviteId"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async update_project_member_role(input) {
@@ -23255,7 +25164,7 @@ function createMemberMcpTools(api) {
           role: String(input["role"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     },
     async remove_project_member(input) {
@@ -23266,14 +25175,14 @@ function createMemberMcpTools(api) {
           userId: String(input["userId"])
         });
       } catch (error) {
-        mapMcpError8(error);
+        mapMcpError9(error);
       }
     }
   };
 }
 
 // src/probe-tools.ts
-function mapMcpError9(error) {
+function mapMcpError10(error) {
   if (error instanceof ProbeApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23302,7 +25211,7 @@ function createProbeMcpTools(api) {
         }
         return await api.activateProbe(requestInput);
       } catch (error) {
-        mapMcpError9(error);
+        mapMcpError10(error);
       }
     },
     async list_active_probes(input) {
@@ -23312,7 +25221,7 @@ function createProbeMcpTools(api) {
           projectId: String(input["projectId"])
         });
       } catch (error) {
-        mapMcpError9(error);
+        mapMcpError10(error);
       }
     },
     async deactivate_probe(input) {
@@ -23323,14 +25232,14 @@ function createProbeMcpTools(api) {
           activationId: String(input["activationId"])
         });
       } catch (error) {
-        mapMcpError9(error);
+        mapMcpError10(error);
       }
     }
   };
 }
 
 // src/project-tools.ts
-function mapMcpError10(error) {
+function mapMcpError11(error) {
   if (error instanceof ProjectManagementApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23348,7 +25257,7 @@ function createProjectMcpTools(api) {
         }
         return { projects: await api.listProjects(requestInput) };
       } catch (error) {
-        mapMcpError10(error);
+        mapMcpError11(error);
       }
     },
     async create_project(input) {
@@ -23363,7 +25272,7 @@ function createProjectMcpTools(api) {
         }
         return { project: await api.createProject(requestInput) };
       } catch (error) {
-        mapMcpError10(error);
+        mapMcpError11(error);
       }
     },
     async update_project(input) {
@@ -23383,7 +25292,7 @@ function createProjectMcpTools(api) {
         }
         return { project: await api.updateProject(requestInput) };
       } catch (error) {
-        mapMcpError10(error);
+        mapMcpError11(error);
       }
     },
     async delete_project(input) {
@@ -23395,7 +25304,7 @@ function createProjectMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError10(error);
+        mapMcpError11(error);
       }
     }
   };
@@ -23602,7 +25511,7 @@ async function persistCloudArtifact(directoryPath, fileName, payload, dependenci
 }
 
 // src/retrieval-tools.ts
-function mapMcpError11(error) {
+function mapMcpError12(error) {
   if (error instanceof RetrievalApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -23784,7 +25693,7 @@ function createRetrievalMcpTools(api) {
           incidents: incidents.incidents.map((incident) => attachSourceToRecord(incident, "cloud"))
         };
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_incident(input) {
@@ -23819,7 +25728,7 @@ function createRetrievalMcpTools(api) {
           )
         };
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_incident_context(input) {
@@ -23848,7 +25757,7 @@ function createRetrievalMcpTools(api) {
           "cloud"
         );
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async resolve_incident(input) {
@@ -23893,7 +25802,7 @@ function createRetrievalMcpTools(api) {
           })()
         };
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async reopen_incident(input) {
@@ -23938,7 +25847,7 @@ function createRetrievalMcpTools(api) {
           })()
         };
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_bundle(input) {
@@ -23969,7 +25878,7 @@ function createRetrievalMcpTools(api) {
           }
         );
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_logs(input) {
@@ -23989,7 +25898,7 @@ function createRetrievalMcpTools(api) {
         }
         return await api.getLogs(requestInput);
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     },
     async get_reproduction(input) {
@@ -24020,14 +25929,14 @@ function createRetrievalMcpTools(api) {
           }
         );
       } catch (error) {
-        mapMcpError11(error);
+        mapMcpError12(error);
       }
     }
   };
 }
 
 // src/services-tools.ts
-function mapMcpError12(error) {
+function mapMcpError13(error) {
   if (error instanceof RetrievalApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -24048,14 +25957,14 @@ function createServicesMcpTools(api) {
           services: await api.listServices(requestInput)
         };
       } catch (error) {
-        mapMcpError12(error);
+        mapMcpError13(error);
       }
     }
   };
 }
 
 // src/setup-tools.ts
-function mapMcpError13() {
+function mapMcpError14() {
   throw new Error("mcp_tool_error:unknown_error");
 }
 function parseJsonOutput2(output) {
@@ -24070,7 +25979,7 @@ async function runJsonCommand2(command) {
     const result = await command();
     return parseJsonOutput2(result.output);
   } catch {
-    mapMcpError13();
+    mapMcpError14();
   }
 }
 function createSetupMcpTools(commands) {
@@ -24129,7 +26038,7 @@ function createSetupMcpTools(commands) {
 }
 
 // src/slack-tools.ts
-function mapMcpError14(error) {
+function mapMcpError15(error) {
   if (error instanceof SlackApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -24146,7 +26055,7 @@ function createSlackMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError14(error);
+        mapMcpError15(error);
       }
     },
     async get_slack_connect_url(input) {
@@ -24159,7 +26068,7 @@ function createSlackMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError14(error);
+        mapMcpError15(error);
       }
     },
     async test_slack_destination(input) {
@@ -24172,7 +26081,7 @@ function createSlackMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError14(error);
+        mapMcpError15(error);
       }
     },
     async delete_slack_destination(input) {
@@ -24185,14 +26094,14 @@ function createSlackMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError14(error);
+        mapMcpError15(error);
       }
     }
   };
 }
 
 // src/token-tools.ts
-function mapMcpError15(error) {
+function mapMcpError16(error) {
   if (error instanceof TokenManagementApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -24213,7 +26122,7 @@ function createTokenMcpTools(api) {
           tokens: await api.listProjectTokens(requestInput)
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async create_project_token(input) {
@@ -24228,7 +26137,7 @@ function createTokenMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async revoke_project_token(input) {
@@ -24241,7 +26150,7 @@ function createTokenMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async list_member_tokens(input) {
@@ -24256,7 +26165,7 @@ function createTokenMcpTools(api) {
           tokens: await api.listMemberTokens(requestInput)
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async create_member_token(input) {
@@ -24268,7 +26177,7 @@ function createTokenMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     },
     async revoke_member_token(input) {
@@ -24280,14 +26189,14 @@ function createTokenMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError15(error);
+        mapMcpError16(error);
       }
     }
   };
 }
 
 // src/webhook-tools.ts
-function mapMcpError16(error) {
+function mapMcpError17(error) {
   if (error instanceof WebhookApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -24308,7 +26217,7 @@ function createWebhookMcpTools(api) {
           webhooks: await api.listWebhooks(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async create_webhook(input) {
@@ -24329,7 +26238,7 @@ function createWebhookMcpTools(api) {
           webhook: await api.createWebhook(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async update_webhook(input) {
@@ -24355,7 +26264,7 @@ function createWebhookMcpTools(api) {
           webhook: await api.updateWebhook(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async delete_webhook(input) {
@@ -24368,7 +26277,7 @@ function createWebhookMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async test_webhook(input) {
@@ -24385,7 +26294,7 @@ function createWebhookMcpTools(api) {
           delivery: await api.testWebhook(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async list_webhook_deliveries(input) {
@@ -24402,7 +26311,7 @@ function createWebhookMcpTools(api) {
           deliveries: await api.listWebhookDeliveries(requestInput)
         };
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     },
     async retry_webhook_delivery(input) {
@@ -24414,14 +26323,14 @@ function createWebhookMcpTools(api) {
           deliveryId: String(input["deliveryId"])
         });
       } catch (error) {
-        mapMcpError16(error);
+        mapMcpError17(error);
       }
     }
   };
 }
 
 // src/weekly-report-tools.ts
-function mapMcpError17(error) {
+function mapMcpError18(error) {
   if (error instanceof WeeklyReportApiError) {
     throw new Error(`mcp_tool_error:${error.code}`);
   }
@@ -24439,7 +26348,7 @@ function createWeeklyReportMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError17(error);
+        mapMcpError18(error);
       }
     },
     async create_weekly_report_channel(input) {
@@ -24455,7 +26364,7 @@ function createWeeklyReportMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError17(error);
+        mapMcpError18(error);
       }
     },
     async update_weekly_report_channel(input) {
@@ -24470,7 +26379,7 @@ function createWeeklyReportMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError17(error);
+        mapMcpError18(error);
       }
     },
     async delete_weekly_report_channel(input) {
@@ -24482,7 +26391,7 @@ function createWeeklyReportMcpTools(api) {
           })
         };
       } catch (error) {
-        mapMcpError17(error);
+        mapMcpError18(error);
       }
     }
   };
@@ -24490,6 +26399,15 @@ function createWeeklyReportMcpTools(api) {
 
 // src/default-tools.ts
 var DEFAULT_API_BASE_URL = "https://api.debugbundle.com";
+var MEMBER_TOKEN_ENV_VAR = "DEBUGBUNDLE_MEMBER_TOKEN";
+function readEnvMemberToken() {
+  const rawToken = process.env[MEMBER_TOKEN_ENV_VAR];
+  if (typeof rawToken !== "string") {
+    return null;
+  }
+  const token = rawToken.trim();
+  return token.length > 0 ? token : null;
+}
 async function readLocalAuthState() {
   try {
     return await readCliAuthState({});
@@ -24510,8 +26428,8 @@ function withDefaultBearerToken(tools, bearerToken) {
 }
 async function createDefaultMcpTools(input = {}) {
   const authState = await readLocalAuthState();
-  const baseUrl = input.apiBaseUrl ?? authState?.base_url ?? process.env["DEBUGBUNDLE_API_URL"] ?? DEFAULT_API_BASE_URL;
-  const defaultBearerToken = authState?.bearer_token ?? null;
+  const baseUrl = input.apiBaseUrl ?? process.env["DEBUGBUNDLE_API_URL"] ?? authState?.base_url ?? DEFAULT_API_BASE_URL;
+  const defaultBearerToken = readEnvMemberToken() ?? authState?.bearer_token ?? null;
   const httpClient = createCliHttpClient({ baseUrl });
   const retrievalApi = createRetrievalApi(httpClient);
   return withDefaultBearerToken(
@@ -24538,6 +26456,7 @@ async function createDefaultMcpTools(input = {}) {
       ...createWeeklyReportMcpTools(createWeeklyReportApi(httpClient)),
       ...createAlertMcpTools(createAlertApi(httpClient)),
       ...createProjectMcpTools(createProjectManagementApi(httpClient)),
+      ...createCaptureRuleMcpTools(createCaptureRuleApi(httpClient)),
       ...createCapturePolicyMcpTools(createCapturePolicyApi(httpClient)),
       ...createImprovementSettingsMcpTools(createImprovementSettingsApi(httpClient)),
       ...createProbeMcpTools(createProbeApi(httpClient)),
@@ -25836,6 +27755,46 @@ var zodToJsonSchema = (schema, options) => {
   return combined;
 };
 
+// package.json
+var package_default = {
+  name: "@debugbundle/mcp",
+  mcpName: "com.debugbundle/mcp",
+  version: "0.1.10",
+  private: false,
+  description: "Model Context Protocol server for DebugBundle",
+  license: "AGPL-3.0-only",
+  repository: {
+    type: "git",
+    url: "https://github.com/debugbundle/debugbundle",
+    directory: "apps/mcp"
+  },
+  homepage: "https://debugbundle.com/docs/mcp",
+  bugs: {
+    url: "https://github.com/debugbundle/debugbundle/issues"
+  },
+  keywords: ["debugbundle", "debugging", "ai-agent", "mcp", "model-context-protocol"],
+  engines: {
+    node: ">=22 <27"
+  },
+  type: "module",
+  scripts: {
+    start: "tsx src/entrypoint.ts",
+    build: "esbuild src/entrypoint.ts --bundle --platform=node --format=cjs --target=node22 --external:@node-rs/argon2 --outfile=dist/main.cjs",
+    prepack: "npm run build"
+  },
+  bin: {
+    "debugbundle-mcp": "bin/debugbundle-mcp.js"
+  },
+  files: ["bin", "dist", "README.md", "LICENSE", "server.json"],
+  dependencies: {
+    "@node-rs/argon2": "^2.0.2"
+  },
+  devDependencies: {
+    esbuild: "^0.27.3",
+    tsx: "^4.20.5"
+  }
+};
+
 // src/tool-catalog.ts
 var jsonObjectSchema = external_exports.record(external_exports.unknown());
 var optionalBearerTokenSchema = external_exports.string().optional();
@@ -26461,6 +28420,65 @@ var MCP_TOOL_CATALOG = [
       projectId: external_exports.string()
     })
   },
+  {
+    name: "list_capture_rules",
+    group: "capture_rules",
+    description: "List project capture rules.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string()
+    })
+  },
+  {
+    name: "create_capture_rule",
+    group: "capture_rules",
+    description: "Create a project capture rule.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string(),
+      create: jsonObjectSchema
+    })
+  },
+  {
+    name: "update_capture_rule",
+    group: "capture_rules",
+    description: "Update a project capture rule.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string(),
+      ruleId: external_exports.string(),
+      update: jsonObjectSchema
+    })
+  },
+  {
+    name: "delete_capture_rule",
+    group: "capture_rules",
+    description: "Delete a project capture rule.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      projectId: external_exports.string(),
+      ruleId: external_exports.string()
+    })
+  },
+  {
+    name: "suggest_capture_rules_from_incident",
+    group: "capture_rules",
+    description: "Generate deterministic capture rule suggestions from an incident bundle.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      incidentId: external_exports.string()
+    })
+  },
+  {
+    name: "create_capture_rule_from_incident_suggestion",
+    group: "capture_rules",
+    description: "Create a capture rule from an incident-derived suggestion.",
+    inputSchema: external_exports.object({
+      bearerToken: external_exports.string(),
+      incidentId: external_exports.string(),
+      create: jsonObjectSchema
+    })
+  },
   {
     name: "get_capture_policy",
     group: "capture_policy",
@@ -26650,6 +28668,7 @@ var MCP_TOOL_CATALOG = [
 var MCP_TOOL_NAMES = MCP_TOOL_CATALOG.map((tool) => tool.name);
 
 // src/server.ts
+var MCP_SERVER_VERSION = package_default.version;
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -26725,7 +28744,7 @@ function createMcpServer(input) {
             },
             serverInfo: {
               name: "@debugbundle/mcp",
-              version: "0.1.2"
+              version: MCP_SERVER_VERSION
             }
           }
         };