@fruggr/zendesk-mcp-server 3.4.0 → 3.5.0

package/dist/index.js

@@ -1,11 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import { parseArgs } from "node:util";
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import minpath, { dirname, join } from "node:path";
 import { fileURLToPath, fileURLToPath as urlToPath, pathToFileURL } from "node:url";
 import minproc, { default as process$2 } from "node:process";
-import { readFileSync } from "node:fs";
+import { chmod, mkdir, open, readFile, readdir, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 //#region \0rolldown/runtime.js
 var __create$1 = Object.create;
 var __defProp$1 = Object.defineProperty;
@@ -39,7 +41,7 @@ var __toESM$1 = (mod, isNodeMode, target) => (target = mod != null ? __create$1(
 }) : target, mod));
 var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/util.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
 	return Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
@@ -591,7 +593,7 @@ function constantCatch(value) {
 	return fn;
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/core.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/core.js
 var _a$4;
 /** A special constant with type `never` */
 const NEVER = /*@__PURE__*/ Object.freeze({ status: "aborted" });
@@ -699,7 +701,7 @@ function config(newConfig) {
 	return globalConfig;
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/doc.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/doc.js
 var Doc = class {
 	constructor(args = [], closed = {}) {
 		this.content = [];
@@ -733,7 +735,7 @@ var Doc = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/memoizer.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/memoizer.js
 var $ZodCyclicError = class extends Error {
 	constructor() {
 		super(`Cannot parse a reference cycle that closes through a transform`);
@@ -892,7 +894,7 @@ function bucketFor(state, inst) {
 	return bucket;
 }
 let handoff;
-const open = [];
+const open$1 = [];
 const memo$2 = {
 	alloc(_inst, payload, empty) {
 		const bucket = handoff;
@@ -903,7 +905,7 @@ const memo$2 = {
 			issues: null
 		};
 		bucket.set(payload.value, entry);
-		open.push(entry);
+		open$1.push(entry);
 		return empty;
 	},
 	guard(inst) {
@@ -969,10 +971,10 @@ const memo$2 = {
 					return payload;
 				}
 				handoff = bucket;
-				const depth = open.length;
+				const depth = open$1.length;
 				const result = base(payload, ctx);
 				handoff = void 0;
-				const entry = open.length > depth ? open.pop() : void 0;
+				const entry = open$1.length > depth ? open$1.pop() : void 0;
 				if (result instanceof Promise) return result.then((r) => {
 					if (entry) entry.issues = r.issues.length ? cloneIssues(r.issues) : NO_ISSUES;
 					return r;
@@ -995,7 +997,7 @@ function isBackEdge(ctx, value) {
 	return backEdges !== void 0 && isRef(value) && backEdges.has(value);
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/regexes.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/regexes.js
 /**
 * @deprecated CUID v1 is deprecated by its authors due to information leakage
 * (timestamps embedded in the id). Use {@link cuid2} instead.
@@ -1070,7 +1072,7 @@ const _null$2 = /^null$/i;
 const lowercase = /^[^A-Z]*$/;
 const uppercase = /^[^a-z]*$/;
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/checks.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/checks.js
 const $ZodCheck = /*@__PURE__*/ $constructor("$ZodCheck", (inst, def) => {
 	var _a;
 	inst._zod ?? (inst._zod = {});
@@ -1366,7 +1368,7 @@ const $ZodCheckOverwrite = /*@__PURE__*/ $constructor("$ZodCheckOverwrite", (ins
 	};
 });
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/errors.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/errors.js
 function _getMessage() {
 	const internals = this._zod;
 	internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));
@@ -1482,7 +1484,7 @@ function formatError(error, mapper = (issue) => issue.message) {
 	return fieldErrors;
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/parse.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/parse.js
 function finalizeParams(callee, params) {
 	return {
 		callee: params?.callee ?? callee,
@@ -1685,14 +1687,14 @@ const _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
 	return _safeParseAsync(_Err)(schema, value, _ctx);
 };
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/versions.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/versions.js
 const version = {
 	major: 4,
 	minor: 6,
-	patch: 6
+	patch: 7
 };
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/schemas.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/schemas.js
 const $ZodType = /*@__PURE__*/ $constructor("$ZodType", (inst, def) => {
 	var _a;
 	inst ?? (inst = {});
@@ -3230,7 +3232,7 @@ function handleRefineResult(result, payload, input, inst) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/compile.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/compile.js
 /** @internal Sentinel the compiled fast path returns when validation fails. */
 const INVALID = Symbol.for("zod.compile.invalid");
 const FALLBACK_FLAG = Symbol.for("zod.compile.fallback");
@@ -4715,7 +4717,7 @@ function generateTransformCheck(doc, ctx, schema, accessor) {
 	return accessor;
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/en.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/en.js
 const error = () => {
 	const Sizable = {
 		string: {
@@ -4823,7 +4825,7 @@ function en_default() {
 	return { localeError: error() };
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/registries.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/registries.js
 var _a$3;
 var $ZodRegistry = class {
 	constructor() {
@@ -4870,7 +4872,7 @@ function registry() {
 (_a$3 = globalThis).__zod_globalRegistry ?? (_a$3.__zod_globalRegistry = registry());
 const globalRegistry = globalThis.__zod_globalRegistry;
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/api.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
 	if (def.checks) def.checks = [...def.checks];
 	return def;
@@ -5399,7 +5401,7 @@ function _check(fn, params) {
 	return ch;
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/to-json-schema.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/to-json-schema.js
 function assignProps(target, ...sources) {
 	for (const source of sources) for (const key of Reflect.ownKeys(source)) if (Object.prototype.propertyIsEnumerable.call(source, key)) assignProp(target, key, source[key]);
 	return target;
@@ -5843,7 +5845,7 @@ const createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params)
 	return finalize(ctx, schema);
 };
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/json-schema-processors.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/json-schema-processors.js
 const narrowMin = (agg, key, value) => {
 	if (agg[key] === void 0 || value > agg[key]) agg[key] = value;
 };
@@ -6489,7 +6491,7 @@ function toJSONSchema(input, params) {
 	return finalize(ctx, input);
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/compile.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/compile.js
 let compiling = false;
 globalConfig.postProcessor = (inst) => {
 	if (compiling) return;
@@ -6518,7 +6520,7 @@ globalConfig.postProcessor = (inst) => {
 	inst._zod.run = shim;
 };
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/errors.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/errors.js
 const _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
 	Object.defineProperty(proto, key, {
@@ -6568,7 +6570,7 @@ const initializer = (inst, issues) => {
 };
 const ZodRealError = /*@__PURE__*/ $constructor("ZodError", initializer, void 0, { Parent: Error });
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/parse.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/parse.js
 const parse$10 = /* @__PURE__ */ _parse(ZodRealError);
 const parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 const safeParse = /* @__PURE__ */ _safeParse(ZodRealError);
@@ -6582,7 +6584,7 @@ const safeDecode = /* @__PURE__ */ _safeDecode(ZodRealError);
 const safeEncodeAsync = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
 const safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/schemas.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
 	if (!globalConfig.localeError) config(en_default());
 }
@@ -7517,7 +7519,7 @@ function preprocess$1(fn, schema) {
 	});
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/compat.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/compat.js
 /** @deprecated Use the raw string literal codes instead, e.g. "invalid_type". */
 const ZodIssueCode = {
 	invalid_type: "invalid_type",
@@ -7536,7 +7538,7 @@ const ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/iso.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/iso.js
 function datetime(params) {
 	return /* @__PURE__ */ _isoDateTime(ZodISODateTime, params);
 }
@@ -7544,7 +7546,7 @@ function date(params) {
 	return /* @__PURE__ */ _isoDate(ZodISODate, params);
 }
 //#endregion
-//#region node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/coerce.js
+//#region node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/coerce.js
 function number$1(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
@@ -7561,6 +7563,83 @@ const readEnv = (name) => ({
 	value: process.env[name]
 });
 //#endregion
+//#region src/utils/durations.ts
+const MINUTES_PER_UNIT = {
+	w: 10080,
+	d: 1440,
+	h: 60,
+	m: 1
+};
+const DURATION = /^(?:(\d+)w)?(?:(\d+)d)?(?:(\d+)h)?(?:(\d+)m)?$/;
+/**
+* Reads a readable duration (`30m`, `4h`, `2d`, `1w`, `1d4h`) as whole minutes,
+* case-insensitive. `undefined` for anything else, including a bare number: a
+* unit-less `4` is ambiguous between minutes and hours.
+*/
+const parseDuration = (raw) => {
+	const text = raw.trim().toLowerCase();
+	const match = DURATION.exec(text);
+	if (!match || text === "") return void 0;
+	const [, w, d, h, m] = match;
+	return Number(w ?? 0) * MINUTES_PER_UNIT.w + Number(d ?? 0) * MINUTES_PER_UNIT.d + Number(h ?? 0) * MINUTES_PER_UNIT.h + Number(m ?? 0);
+};
+/** Why `raw` was refused, with the spelling `parseDuration` reads. */
+const notADuration = (raw) => `"${raw}" is not a duration. Use a number and a unit: 30m, 4h, 2d, 1w, or a mix like 1d4h.`;
+/**
+* Renders a span of minutes in the same spelling `parseDuration` reads, days
+* being the largest unit (`2d1h`, `45m`). The sign is dropped: callers say
+* "overdue" or "due" themselves.
+*/
+const formatMinutes = (minutes) => {
+	let rest = Math.abs(Math.round(minutes));
+	const parts = [];
+	for (const [unit, size] of [["d", MINUTES_PER_UNIT.d], ["h", MINUTES_PER_UNIT.h]]) if (rest >= size) {
+		parts.push(`${Math.floor(rest / size)}${unit}`);
+		rest %= size;
+	}
+	if (rest > 0 || parts.length === 0) parts.push(`${rest}m`);
+	return parts.join("");
+};
+//#endregion
+//#region src/utils/sla-thresholds.ts
+const REPLY_METRICS = /* @__PURE__ */ new Set(["first_reply_time", "next_reply_time"]);
+const familyOf = (metric) => REPLY_METRICS.has(metric) ? "reply" : "wait";
+const DEFAULT_SLA_THRESHOLDS = {
+	reply: {
+		warning: 240,
+		critical: 60
+	},
+	wait: {
+		warning: 2880,
+		critical: 480
+	}
+};
+/**
+* Checks a warning/critical pair given as readable durations. Returns the pair
+* in minutes, or the reason it is refused: a critical window wider than the
+* warning one would never show a WARNING.
+*/
+const toThreshold = (warning, critical) => {
+	const w = parseDuration(warning);
+	const c = parseDuration(critical);
+	if (w === void 0 || c === void 0) return { error: notADuration(w === void 0 ? warning : critical) };
+	if (c > w) return { error: `The critical threshold (${critical}) must not be longer than the warning one (${warning}).` };
+	return { threshold: {
+		warning: w,
+		critical: c
+	} };
+};
+/** Reads the `warning,critical` form of the admin variables (`4h,1h`). */
+const parseThresholdPair = (raw) => {
+	const parts = raw.split(",").map((part) => part.trim());
+	const [warning, critical] = parts;
+	if (parts.length !== 2 || !warning || !critical) return { error: "Expected two durations separated by a comma, warning first: 4h,1h." };
+	return toThreshold(warning, critical);
+};
+const formatThreshold = (t) => `warning ${formatMinutes(t.warning)}, critical ${formatMinutes(t.critical)}`;
+/** One line naming both families' thresholds, as the alerts and the tools report them. */
+const describeThresholds = (t) => `reply metrics ${formatThreshold(t.reply)}; wait and resolution metrics ${formatThreshold(t.wait)}`;
+//#endregion
 //#region src/utils/startup-error.ts
 /**
 * Misconfigurations an operator fixes before the server can start. `index.ts`
@@ -7686,7 +7765,8 @@ const Namespace = _enum([
 	"tickets",
 	"help_center",
 	"users",
-	"requests"
+	"requests",
+	"preferences"
 ]);
 /**
 * Namespaces exposed when the operator passes no `--namespace` flag.
@@ -7701,9 +7781,18 @@ const Namespace = _enum([
 const DEFAULT_NAMESPACES = [
 	"tickets",
 	"help_center",
-	"users"
+	"users",
+	"preferences"
 ];
 const Transport = _enum(["stdio", "http"]);
+const SLA_POLL_RANGE = {
+	min: 60,
+	max: 86400
+};
+const SlaThresholdSchema = object({
+	warning: number$2().int().min(0),
+	critical: number$2().int().min(0)
+});
 const ConfigSchema = object({
 	subdomain: string$2().min(1, "ZENDESK_SUBDOMAIN is required"),
 	oauthClientId: string$2().min(1),
@@ -7809,8 +7898,51 @@ const ConfigSchema = object({
 	/** HTTP only: CIMD client ids added to the consent-skip allowlist. */
 	oauthTrustedClients: array(string$2().url()).default([]),
 	/** HTTP only: whether the built-in allowlist (claude.ai, ChatGPT) applies. */
-	defaultTrustedClients: boolean$1().default(true)
+	defaultTrustedClients: boolean$1().default(true),
+	/**
+	* Admin default SLA alert thresholds, in minutes before a breach, per metric
+	* family (`SLA_REPLY_THRESHOLDS` / `SLA_WAIT_THRESHOLDS`, `4h,1h` form).
+	* Parsed in `loadConfig`, so a bad value fails at startup naming the knob.
+	*/
+	slaThresholds: object({
+		reply: SlaThresholdSchema,
+		wait: SlaThresholdSchema
+	}).default(DEFAULT_SLA_THRESHOLDS),
+	/**
+	* Whether the server pushes SLA urgency on its own (off by default;
+	* `--sla-push` / `SLA_PUSH=true` turn it on): the `**Urgency**` line in the SLA block of
+	* get_ticket / search_tickets, and the alert resource's polling and update
+	* notifications. Every tool and reading the resource stay available.
+	*/
+	slaPush: boolean$1().default(false),
+	/**
+	* How long one user's SLA scope fetch is reused, in seconds (default 60; 0
+	* turns the cache off). Zendesk charges a 304 revalidation as a full request,
+	* so this lifetime is the only quota saving (PR #387 spike 2).
+	*/
+	slaCacheTtlSeconds: number$2().int().min(0).default(60),
+	/**
+	* Where per-user SLA state (cache, preferences) lives. Unset: `memory` on
+	* HTTP, `disk` on stdio so the stdio processes of one machine share it.
+	*/
+	slaStateStore: _enum(["memory", "disk"]).optional(),
+	/**
+	* Whether each user may set personal SLA alert thresholds with
+	* `configure_sla_alerts` (`SLA_USER_PREFERENCES=off` /
+	* `--no-sla-user-preferences` turn it off: the admin defaults then apply to
+	* everyone).
+	*/
+	slaUserPreferences: boolean$1().default(true),
+	/**
+	* How often, in seconds, a subscribed SLA alert resource is re-checked while
+	* at least one subscription is open (default 300, minimum 60, which keeps a
+	* subscriber well inside Zendesk's rate limit; at most a day, past which
+	* `setInterval` would clamp the delay to 1 ms).
+	*/
+	slaPollSeconds: number$2().int().min(SLA_POLL_RANGE.min).max(SLA_POLL_RANGE.max).default(300)
 });
+/** The store a config resolves to; see `slaStateStore`. */
+const slaStateStoreOf = (config) => config.slaStateStore ?? (config.transport === "http" ? "memory" : "disk");
 const DIGITS_ONLY = /^\d+$/;
 const parsePort = (raw, label) => {
 	if (!DIGITS_ONLY.test(raw)) throw createStartupError(`Invalid ${label} value. Expected an integer 0-65535.`, label.startsWith("--") ? STARTUP_DOCS.invocation : STARTUP_DOCS.environment);
@@ -7875,7 +8007,14 @@ const CLI_OPTIONS = {
 	"no-topology": { type: "boolean" },
 	"no-promoted-articles": { type: "boolean" },
 	dev: { type: "boolean" },
-	"print-tools": { type: "boolean" }
+	"print-tools": { type: "boolean" },
+	"sla-push": { type: "boolean" },
+	"no-sla-user-preferences": { type: "boolean" },
+	"sla-reply-thresholds": { type: "string" },
+	"sla-wait-thresholds": { type: "string" },
+	"sla-cache-ttl-seconds": { type: "string" },
+	"sla-state-store": { type: "string" },
+	"sla-poll-seconds": { type: "string" }
 };
 new Set(Object.entries(CLI_OPTIONS).filter(([, spec]) => spec.type === "string").map(([name]) => `--${name}`));
 const FIELD_BY_FLAG = /* @__PURE__ */ new Map([
@@ -7890,7 +8029,12 @@ const FIELD_BY_FLAG = /* @__PURE__ */ new Map([
 	["cors-origin", "corsOrigins"],
 	["oauth-master-secret-file", "oauthMasterSecretFile"],
 	["oauth-store", "oauthStore"],
-	["oauth-trusted-client", "oauthTrustedClients"]
+	["oauth-trusted-client", "oauthTrustedClients"],
+	["sla-reply-thresholds", "slaReplyThresholds"],
+	["sla-wait-thresholds", "slaWaitThresholds"],
+	["sla-cache-ttl-seconds", "slaCacheTtlSeconds"],
+	["sla-state-store", "slaStateStore"],
+	["sla-poll-seconds", "slaPollSeconds"]
 ]);
 const STANDALONE_EFFECTS = /* @__PURE__ */ new Map([
 	["read-only", { readOnly: true }],
@@ -7898,7 +8042,9 @@ const STANDALONE_EFFECTS = /* @__PURE__ */ new Map([
 	["no-promoted-articles", { promotedArticles: false }],
 	["dev", { dev: true }],
 	["print-tools", { printTools: true }],
-	["no-default-trusted-clients", { defaultTrustedClients: false }]
+	["no-default-trusted-clients", { defaultTrustedClients: false }],
+	["sla-push", { slaPush: true }],
+	["no-sla-user-preferences", { slaUserPreferences: false }]
 ]);
 const parseStrict = (args) => {
 	try {
@@ -7953,6 +8099,59 @@ const resolveOAuthServerSettings = (cli) => ({
 	oauthTrustedClients: [...cli.oauthTrustedClients ?? [], ...splitList(readEnv("OAUTH_TRUSTED_CLIENTS").value)],
 	defaultTrustedClients: cli.defaultTrustedClients
 });
+const BOOLEAN_WORDS = /* @__PURE__ */ new Map([
+	["true", true],
+	["on", true],
+	["1", true],
+	["false", false],
+	["off", false],
+	["0", false]
+]);
+const booleanEnv = (name) => {
+	const env = readNonEmptyEnv(name);
+	if (env.value === void 0) return void 0;
+	const value = BOOLEAN_WORDS.get(env.value.trim().toLowerCase());
+	if (value === void 0) throw createStartupError(`Invalid ${env.name} value. Expected true or false (on/off and 1/0 are accepted too).`, STARTUP_DOCS.environment);
+	return value;
+};
+const thresholdSetting = (cliValue, envName, flag, fallback) => {
+	const env = readNonEmptyEnv(envName);
+	const raw = cliValue ?? env.value;
+	if (raw === void 0) return fallback;
+	const parsed = parseThresholdPair(raw);
+	if ("error" in parsed) throw createStartupError(`Invalid ${cliValue === void 0 ? env.name : flag} value. ${parsed.error}`, cliValue === void 0 ? STARTUP_DOCS.environment : STARTUP_DOCS.invocation);
+	return parsed.threshold;
+};
+const secondsSetting = (cliValue, envName, flag, range) => {
+	const env = readNonEmptyEnv(envName);
+	const raw = cliValue ?? env.value;
+	if (raw === void 0) return void 0;
+	const fail = (expected) => {
+		throw createStartupError(`Invalid ${cliValue === void 0 ? env.name : flag} value. ${expected}`, cliValue === void 0 ? STARTUP_DOCS.environment : STARTUP_DOCS.invocation);
+	};
+	if (!DIGITS_ONLY.test(raw)) fail("Expected a whole number of seconds.");
+	const seconds = Number(raw);
+	if (range && (seconds < range.min || seconds > range.max)) fail(`Expected ${range.min} to ${range.max} seconds.`);
+	return seconds;
+};
+const SLA_STATE_STORES = /* @__PURE__ */ new Set(["memory", "disk"]);
+const stateStoreSetting = (cliValue) => {
+	const env = readNonEmptyEnv("SLA_STATE_STORE");
+	const raw = cliValue ?? env.value;
+	if (raw === void 0 || SLA_STATE_STORES.has(raw)) return raw;
+	throw createStartupError(`Invalid ${cliValue === void 0 ? env.name : "--sla-state-store"} value. Expected memory or disk.`, cliValue === void 0 ? STARTUP_DOCS.environment : STARTUP_DOCS.invocation);
+};
+const resolveSlaSettings = (cli) => ({
+	slaThresholds: {
+		reply: thresholdSetting(cli.slaReplyThresholds, "SLA_REPLY_THRESHOLDS", "--sla-reply-thresholds", DEFAULT_SLA_THRESHOLDS.reply),
+		wait: thresholdSetting(cli.slaWaitThresholds, "SLA_WAIT_THRESHOLDS", "--sla-wait-thresholds", DEFAULT_SLA_THRESHOLDS.wait)
+	},
+	slaPush: cli.slaPush ?? booleanEnv("SLA_PUSH"),
+	slaCacheTtlSeconds: secondsSetting(cli.slaCacheTtlSeconds, "SLA_CACHE_TTL_SECONDS", "--sla-cache-ttl-seconds"),
+	slaStateStore: stateStoreSetting(cli.slaStateStore),
+	slaUserPreferences: cli.slaUserPreferences ?? booleanEnv("SLA_USER_PREFERENCES"),
+	slaPollSeconds: secondsSetting(cli.slaPollSeconds, "SLA_POLL_SECONDS", "--sla-poll-seconds", SLA_POLL_RANGE)
+});
 const loadConfig = (argv = process.argv.slice(2)) => {
 	const cli = parseCliArgs(argv);
 	const subdomain = cli.subdomain ?? requireNonEmptyEnv("ZENDESK_SUBDOMAIN") ?? "";
@@ -7978,10 +8177,196 @@ const loadConfig = (argv = process.argv.slice(2)) => {
 		printTools: cli.printTools ?? false,
 		callbackPort,
 		...resolveTransportSettings(cli),
-		...resolveOAuthServerSettings(cli)
+		...resolveOAuthServerSettings(cli),
+		...resolveSlaSettings(cli)
 	});
 };
 //#endregion
+//#region src/utils/sla-resource.ts
+/**
+* The SLA alert resources. Fixed scheme: unlike the Help Center resources,
+* nothing about them depends on a deployment.
+*/
+const SLA_RESOURCE_SCHEME = "zendesk-sla";
+const SLA_ALERTS_TEMPLATES = {
+	named: `${SLA_RESOURCE_SCHEME}://alerts/{scope}`,
+	view: `${SLA_RESOURCE_SCHEME}://alerts/views/{view}`,
+	query: `${SLA_RESOURCE_SCHEME}://alerts{?query}`
+};
+const NAMED_SCOPES = [
+	"mine",
+	"my_groups",
+	"all"
+];
+const namedAlertsUri = (scope) => `${SLA_RESOURCE_SCHEME}://alerts/${scope}`;
+const DIGITS = /^\d+$/;
+const VIEW_PATH = /^\/views\/([^/]+)$/;
+/** Reads an alert resource URI, or `undefined` when it names no alert set. */
+const parseAlertsUri = (raw) => {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return;
+	}
+	if (url.protocol !== `zendesk-sla:` || url.host !== "alerts") return void 0;
+	const path = url.pathname;
+	if (path === "" || path === "/") {
+		const query = url.searchParams.get("query")?.trim();
+		return query ? {
+			kind: "query",
+			query
+		} : void 0;
+	}
+	const named = NAMED_SCOPES.find((scope) => path === `/${scope}`);
+	if (named) return {
+		kind: "scope",
+		scope: named
+	};
+	const view = VIEW_PATH.exec(path)?.[1];
+	if (!view) return void 0;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(view);
+	} catch {
+		return;
+	}
+	return {
+		kind: "view",
+		view: DIGITS.test(decoded) ? Number(decoded) : decoded
+	};
+};
+//#endregion
+//#region src/guidance/instructions.ts
+/**
+* URI of the dynamic Help Center topology resource. Single source of truth for
+* every place that cites it (resource registration, `instructions` blob): the
+* scheme comes from the config (`--hc-resource-scheme`, default `zendesk-hc`),
+* the path is fixed. Any future Help Center resource should build its URI the
+* same way so the whole surface follows the configured scheme.
+*/
+const topologyResourceUri = (config) => `${config.hcResourceScheme}://topology`;
+/**
+* URI template of the pull-only Help Center article resources, built from the
+* configured scheme exactly like `topologyResourceUri` (`--hc-resource-scheme`,
+* default `zendesk-hc`). In multi/all brand mode the URI carries a brand
+* dimension — `<scheme>://brands/{brand}/articles/{id}` — because an article id
+* alone does not say which brand's Help Center holds it; the brand is named by
+* id or subdomain, the same idiom the tools' `brand_id` accepts. Unset and
+* single-brand modes keep `<scheme>://article/{id}`: one Help Center is
+* addressed, so a brand segment would be noise. The template's `list` callback
+* enumerates the promoted ("featured") articles (so clients can surface them
+* for pinning), while any article id can be read on demand.
+*/
+const articleResourceUriTemplate = (config) => brandScopedArticles(config) ? `${config.hcResourceScheme}://brands/{brand}/articles/{id}` : `${config.hcResourceScheme}://article/{id}`;
+/**
+* Build the concrete resource URI for a single article id, under the configured
+* scheme. Shares the scheme with the template above so the listed URIs always
+* match the template the read callback is registered under. In multi/all mode
+* the brand argument (id or subdomain) is required and fills the {brand} slot.
+*/
+const articleResourceUri = (config, id, brand) => brandScopedArticles(config) ? `${config.hcResourceScheme}://brands/${brand}/articles/${id}` : `${config.hcResourceScheme}://article/${id}`;
+/**
+* Whether the article resources address one Help Center among several: the
+* server was started with several brands, or with `all`. Only then does the URI
+* carry the brand dimension; unset and single-lock modes name exactly one Help
+* Center implicitly.
+*/
+const brandScopedArticles = (config) => {
+	const brandIds = config.brandIds;
+	return brandIds !== void 0 && (brandIds.length > 1 || brandIds[0] === "all");
+};
+/**
+* Whether the `help_center` namespace is active: no `--namespace` filter, or one
+* that includes it. The shared second half of the two Help Center feature gates
+* below, so the namespace semantics live in one place.
+*/
+const helpCenterNamespaceActive = (config) => !config.namespaces?.length || config.namespaces.includes("help_center");
+/** Whether `--namespace` and `--tool` leave the tool `name` of `namespace` exposed. */
+const toolExposed = (config, namespace, name) => (!config.namespaces?.length || config.namespaces.includes(namespace)) && (!config.tools?.length || config.tools.includes(name));
+/**
+* Whether the SLA alerting (the `zendesk-sla://alerts/...` resources, their
+* polling, the instructions line) is on: wherever `list_sla_alerts`, which
+* renders the same report, is exposed.
+*/
+const slaAlertsEnabled = (config) => toolExposed(config, "tickets", "list_sla_alerts");
+/**
+* Whether a user can keep personal SLA thresholds: allowed by the operator, and
+* `configure_sla_alerts`, the only way to change them, exposed. Otherwise the
+* server defaults apply, and nothing points a user at a tool they cannot call.
+*/
+const slaPreferencesEnabled = (config) => config.slaUserPreferences && toolExposed(config, "preferences", "configure_sla_alerts");
+/**
+* Whether the Help Center structural context (init instructions + the
+* topology resource, default `zendesk-hc://topology`) should be exposed. True only when the
+* feature is enabled (`--no-topology` not set) AND the `help_center` namespace
+* is active. Shared by the instructions builder and the resource registration in
+* `server.ts` so both gates stay in sync.
+*/
+const helpCenterContextEnabled = (config) => config.topology && helpCenterNamespaceActive(config);
+/**
+* Whether the read-by-id article resource (`<scheme>://article/{id}`) should be
+* registered. Available whenever the `help_center` namespace is active — reading
+* one article is a cheap, on-demand single fetch with NO preloading, so it is
+* deliberately NOT gated by the promoted-listing flag: `--no-promoted-articles`
+* turns off the costly pre-listing (below), never the ability to address a known
+* article id. Not tied to `--no-topology` either (topology is a separate feature).
+*/
+const articleResourceEnabled = (config) => helpCenterNamespaceActive(config);
+/**
+* Whether the promoted-article PRE-LISTING is exposed: the resource `list`
+* callback's scan, which enumerates the promoted articles for `resources/list`.
+* A client may trigger it unprompted, and it fans out (a capped scan of
+* `/articles`, per brand in scope), so `--no-promoted-articles` turns it off.
+* Read-by-id and the explicit `list_promoted_articles` tool stay available.
+* `!== false` so an omitted flag on a hand-built Config stays default-on.
+*/
+const promotedArticlesEnabled = (config) => config.promotedArticles !== false && helpCenterNamespaceActive(config);
+/**
+* The one SLA line of the `instructions`: alerts exist, the thresholds in force
+* by default, and how a user changes theirs. Present whenever the `tickets`
+* namespace is, push or not: the tool and the resources stay either way.
+*/
+const buildSlaInstructions = (config) => {
+	if (!slaAlertsEnabled(config)) return void 0;
+	const subscribe = config.slaPush ? ", subscribable for change notifications" : "";
+	const change = slaPreferencesEnabled(config) ? "each user can set their own with configure_sla_alerts" : "the operator set them for everyone";
+	return `SLA alerts: list_sla_alerts lists the SLA metrics breached or about to breach (your tickets, your groups', all, a view or a search), and the ${SLA_RESOURCE_SCHEME}://alerts/... resources hold the same report${subscribe}. Thresholds in force by default: ${describeThresholds(config.slaThresholds)}; ${change}.`;
+};
+/**
+* The static `instructions` blob sent on `initialize`: the Help Center block
+* and the SLA line, each present only when its namespace is. Deliberately short
+* and I/O-free: it must not trigger the lazy OAuth/PKCE flow just to connect,
+* and it stays within a tight token budget. The rich, dynamic topology lives in
+* the pull-only topology resource (default `zendesk-hc://topology`).
+*/
+const buildInstructions = (config) => {
+	const blocks = [buildHelpCenterInstructions(config), buildSlaInstructions(config)].filter((block) => block !== void 0);
+	return blocks.length > 0 ? blocks.join("\n\n") : void 0;
+};
+const buildHelpCenterInstructions = (config) => {
+	if (!helpCenterContextEnabled(config)) return void 0;
+	let scope;
+	if (config.brandIds === void 0) scope = `the Zendesk Help Center of "${config.subdomain}"`;
+	else if (config.brandIds.length === 1 && config.brandIds[0] === "all") scope = `all brands of the Zendesk Help Center of "${config.subdomain}"`;
+	else if (config.brandIds.length === 1) scope = `brand ${config.brandIds[0]} of the Zendesk Help Center of "${config.subdomain}"`;
+	else scope = `brands ${config.brandIds.join(", ")} of the Zendesk Help Center of "${config.subdomain}"`;
+	const topologyBrandNote = config.brandIds !== void 0 && (config.brandIds.length > 1 || config.brandIds[0] === "all") ? [`The topology describes ${config.brandIds[0] === "all" ? "the account default brand" : `brand ${config.brandIds[0]}`} only; for another brand, use list_categories / list_sections with its brand_id.`] : [];
+	return [
+		`This MCP server is connected to ${scope}.`,
+		"",
+		`When creating or editing Help Center content, the resource ${topologyResourceUri(config)} is useful context:`,
+		"it lists the active locales (and the default one), the category → section tree with IDs,",
+		"the visibility user segments, the permission groups, and your current role.",
+		"Prefer its IDs (section_id, permission_group_id, user_segment_id, locale) over guessing from names.",
+		...topologyBrandNote,
+		"",
+		"It degrades gracefully: without Guide-admin / Help Center manager rights the permission-groups and",
+		"user-segments sections are marked unavailable (not empty). In that case reuse a permission_group_id",
+		"or user_segment_id from an existing article (get_article) instead."
+	].join("\n");
+};
+//#endregion
 //#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -15013,7 +15398,32 @@ function buildInputRequired(spec) {
 		...spec.requestState !== void 0 && { requestState: spec.requestState }
 	};
 }
-Object.assign(buildInputRequired, {
+/**
+* Builder for the input-required return value of multi-round-trip handlers,
+* with per-kind constructors for the embedded requests
+* (`inputRequired.elicit`, `inputRequired.elicitUrl`,
+* `inputRequired.createMessage`, `inputRequired.listRoots`).
+*
+* @example Write-once tool requesting confirmation
+* ```ts
+* server.registerTool('deploy', { inputSchema: z.object({ env: z.string() }) }, async ({ env }, ctx) => {
+*     const confirmationSchema = z.object({ confirm: z.boolean() });
+*     const confirmed = acceptedContent(ctx.mcpReq.inputResponses, 'confirm', confirmationSchema);
+*     if (confirmed?.confirm !== true) {
+*         return inputRequired({
+*             inputRequests: {
+*                 confirm: inputRequired.elicit({
+*                     message: `Deploy to ${env}?`,
+*                     requestedSchema: confirmationSchema
+*                 })
+*             }
+*         });
+*     }
+*     return { content: [{ type: 'text', text: `deployed to ${env}` }] };
+* });
+* ```
+*/
+const inputRequired = Object.assign(buildInputRequired, {
 	elicit(params) {
 		try {
 			return {
@@ -15043,6 +15453,47 @@ Object.assign(buildInputRequired, {
 		return { method: "roots/list" };
 	}
 });
+function acceptedContent(responses, key, schema) {
+	const view = inputResponse(responses, key);
+	if (view.kind !== "elicit" || view.action !== "accept" || view.content === void 0) return void 0;
+	if (schema === void 0) return view.content;
+	const outcome = schema["~standard"].validate(view.content);
+	if (outcome instanceof Promise) throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+	return outcome.issues === void 0 ? outcome.value : void 0;
+}
+/**
+* Reads one entry of a retried request's `inputResponses`
+* (`ctx.mcpReq.inputResponses`) as a discriminated view, covering
+* decline/cancel detection and the non-elicitation response kinds that
+* {@linkcode acceptedContent} does not surface.
+*
+* The values arrive from the client and are not re-validated here — treat
+* them as untrusted input (validate elicitation content with the
+* schema-aware {@linkcode acceptedContent} overload where it matters).
+*/
+function inputResponse(responses, key) {
+	if (responses === void 0 || typeof responses !== "object" || responses === null) return { kind: "missing" };
+	const entry = responses[key];
+	if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return { kind: "missing" };
+	const candidate = entry;
+	if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+		const content = candidate["content"];
+		return {
+			kind: "elicit",
+			action: candidate["action"],
+			...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+		};
+	}
+	if (Array.isArray(candidate["roots"])) return {
+		kind: "roots",
+		roots: candidate["roots"]
+	};
+	if (typeof candidate["role"] === "string" && candidate["content"] !== void 0) return {
+		kind: "sampling",
+		result: candidate
+	};
+	return { kind: "missing" };
+}
 /**
 * The message both multi-round-trip loops emit when the round cap is
 * exhausted — the client driver as a typed error, the server-side legacy
@@ -34271,7 +34722,7 @@ var manipulation_exports = /* @__PURE__ */ __exportAll$1({
 	insertBefore: () => insertBefore,
 	prepend: () => prepend,
 	prependTo: () => prependTo,
-	remove: () => remove,
+	remove: () => remove$1,
 	replaceWith: () => replaceWith,
 	text: () => text$9,
 	toString: () => toString$2,
@@ -34859,7 +35310,7 @@ function insertBefore(target) {
 * @returns The instance itself.
 * @see {@link https://api.jquery.com/remove/}
 */
-function remove(selector) {
+function remove$1(selector) {
 	domEach(selector ? this.filter(selector) : this, (el) => {
 		removeElement(el);
 		el.prev = el.next = el.parent = null;
@@ -63658,7 +64109,7 @@ var require_snapshot_utils = /* @__PURE__ */ __commonJSMin$1(((exports, module)
 //#endregion
 //#region node_modules/.pnpm/undici@7.30.0/node_modules/undici/lib/mock/snapshot-recorder.js
 var require_snapshot_recorder = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
-	const { writeFile, readFile, mkdir } = __require("node:fs/promises");
+	const { writeFile: writeFile$1, readFile: readFile$1, mkdir: mkdir$1 } = __require("node:fs/promises");
 	const { dirname: dirname$1, resolve: resolve$2 } = __require("node:path");
 	const { setTimeout: setTimeout$1, clearTimeout: clearTimeout$1 } = __require("node:timers");
 	const { InvalidArgumentError, UndiciError } = require_errors();
@@ -63925,7 +64376,7 @@ var require_snapshot_recorder = /* @__PURE__ */ __commonJSMin$1(((exports, modul
 			const path = filePath || this.#snapshotPath;
 			if (!path) throw new InvalidArgumentError("Snapshot path is required");
 			try {
-				const data = await readFile(resolve$2(path), "utf8");
+				const data = await readFile$1(resolve$2(path), "utf8");
 				const parsed = JSON.parse(data);
 				if (Array.isArray(parsed)) {
 					this.#snapshots.clear();
@@ -63946,12 +64397,12 @@ var require_snapshot_recorder = /* @__PURE__ */ __commonJSMin$1(((exports, modul
 			const path = filePath || this.#snapshotPath;
 			if (!path) throw new InvalidArgumentError("Snapshot path is required");
 			const resolvedPath = resolve$2(path);
-			await mkdir(dirname$1(resolvedPath), { recursive: true });
+			await mkdir$1(dirname$1(resolvedPath), { recursive: true });
 			const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
 				hash,
 				snapshot
 			}));
-			await writeFile(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
+			await writeFile$1(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
 		}
 		/**
 		* Clears all recorded snapshots
@@ -77092,7 +77543,7 @@ function tbody(node, index, parent) {
 *
 * @type {Record<'double' | 'name' | 'single' | 'unquoted', Array<[Array<string>, Array<string>]>>}
 */
-const constants$1 = {
+const constants$2 = {
 	name: [["	\n\f\r &/=>".split(""), "	\n\f\r \"&'/=>`".split("")], ["\0	\n\f\r \"&'/<=>".split(""), "\0	\n\f\r \"&'/<=>`".split("")]],
 	unquoted: [["	\n\f\r &>".split(""), "\0	\n\f\r \"&'<=>`".split("")], ["\0	\n\f\r \"&'<=>`".split(""), "\0	\n\f\r \"&'<=>`".split("")]],
 	single: [["&'".split(""), "\"&'`".split("")], ["\0&'".split(""), "\0\"&'`".split("")]],
@@ -77177,18 +77628,18 @@ function serializeAttribute(state, key, value) {
 	if (info.overloadedBoolean && (value === info.attribute || value === "")) value = true;
 	else if ((info.boolean || info.overloadedBoolean) && (typeof value !== "string" || value === info.attribute || value === "")) value = Boolean(value);
 	if (value === null || value === void 0 || value === false || typeof value === "number" && Number.isNaN(value)) return "";
-	const name = stringifyEntities(info.attribute, Object.assign({}, state.settings.characterReferences, { subset: constants$1.name[x][y] }));
+	const name = stringifyEntities(info.attribute, Object.assign({}, state.settings.characterReferences, { subset: constants$2.name[x][y] }));
 	if (value === true) return name;
 	value = Array.isArray(value) ? (info.commaSeparated ? stringify$1 : stringify)(value, { padLeft: !state.settings.tightCommaSeparatedLists }) : String(value);
 	if (state.settings.collapseEmptyAttributes && !value) return name;
 	if (state.settings.preferUnquoted) result = stringifyEntities(value, Object.assign({}, state.settings.characterReferences, {
 		attribute: true,
-		subset: constants$1.unquoted[x][y]
+		subset: constants$2.unquoted[x][y]
 	}));
 	if (result !== value) {
 		if (state.settings.quoteSmart && ccount(value, quote) > ccount(value, state.alternative)) quote = state.alternative;
 		result = quote + stringifyEntities(value, Object.assign({}, state.settings.characterReferences, {
-			subset: (quote === "'" ? constants$1.single : constants$1.double)[x][y],
+			subset: (quote === "'" ? constants$2.single : constants$2.double)[x][y],
 			attribute: true
 		})) + quote;
 	}
@@ -84315,7 +84766,7 @@ function wbr(state, node) {
 */
 const nodeHandlers = {
 	comment,
-	doctype: ignore$1,
+	doctype: ignore$2,
 	root: root$2,
 	text: text$5
 };
@@ -84325,43 +84776,43 @@ const nodeHandlers = {
 * Each key is an element name, each value is a `Handler`.
 */
 const handlers$1 = {
-	applet: ignore$1,
-	area: ignore$1,
-	basefont: ignore$1,
-	bgsound: ignore$1,
-	caption: ignore$1,
-	col: ignore$1,
-	colgroup: ignore$1,
-	command: ignore$1,
-	content: ignore$1,
-	datalist: ignore$1,
-	dialog: ignore$1,
-	element: ignore$1,
-	embed: ignore$1,
-	frame: ignore$1,
-	frameset: ignore$1,
-	isindex: ignore$1,
-	keygen: ignore$1,
-	link: ignore$1,
-	math: ignore$1,
-	menu: ignore$1,
-	menuitem: ignore$1,
-	meta: ignore$1,
-	nextid: ignore$1,
-	noembed: ignore$1,
-	noframes: ignore$1,
-	optgroup: ignore$1,
-	option: ignore$1,
-	param: ignore$1,
-	script: ignore$1,
-	shadow: ignore$1,
-	source: ignore$1,
-	spacer: ignore$1,
-	style: ignore$1,
-	svg: ignore$1,
-	template: ignore$1,
-	title: ignore$1,
-	track: ignore$1,
+	applet: ignore$2,
+	area: ignore$2,
+	basefont: ignore$2,
+	bgsound: ignore$2,
+	caption: ignore$2,
+	col: ignore$2,
+	colgroup: ignore$2,
+	command: ignore$2,
+	content: ignore$2,
+	datalist: ignore$2,
+	dialog: ignore$2,
+	element: ignore$2,
+	embed: ignore$2,
+	frame: ignore$2,
+	frameset: ignore$2,
+	isindex: ignore$2,
+	keygen: ignore$2,
+	link: ignore$2,
+	math: ignore$2,
+	menu: ignore$2,
+	menuitem: ignore$2,
+	meta: ignore$2,
+	nextid: ignore$2,
+	noembed: ignore$2,
+	noframes: ignore$2,
+	optgroup: ignore$2,
+	option: ignore$2,
+	param: ignore$2,
+	script: ignore$2,
+	shadow: ignore$2,
+	source: ignore$2,
+	spacer: ignore$2,
+	style: ignore$2,
+	svg: ignore$2,
+	template: ignore$2,
+	title: ignore$2,
+	track: ignore$2,
 	abbr: all$1,
 	acronym: all$1,
 	bdi: all$1,
@@ -84494,7 +84945,7 @@ function flow$2(state, node) {
 /**
 * @returns {undefined}
 */
-function ignore$1() {}
+function ignore$2() {}
 //#endregion
 //#region node_modules/.pnpm/hast-util-to-mdast@10.1.2/node_modules/hast-util-to-mdast/lib/state.js
 /**
@@ -90678,7 +91129,7 @@ function check(tokens, before, after) {
 		runs.push(run);
 		index = end;
 	}
-	pair(runs, wrong);
+	pair$1(runs, wrong);
 	index = -1;
 	while (++index < tokens.length) {
 		const involved = wrong.get(tokens[index]);
@@ -90775,7 +91226,7 @@ function improve(items, chosen, mistake, before, after) {
 * @returns {undefined}
 *   Nothing, `wrong` is changed.
 */
-function pair(runs, wrong) {
+function pair$1(runs, wrong) {
 	let index = 0;
 	while (index < runs.length) {
 		const closer = runs[index];
@@ -103417,12 +103868,12 @@ const handlers = {
 	tableRow,
 	text,
 	thematicBreak,
-	toml: ignore,
-	yaml: ignore,
-	definition: ignore,
-	footnoteDefinition: ignore
+	toml: ignore$1,
+	yaml: ignore$1,
+	definition: ignore$1,
+	footnoteDefinition: ignore$1
 };
-function ignore() {}
+function ignore$1() {}
 //#endregion
 //#region node_modules/.pnpm/mdast-util-to-hast@13.2.1/node_modules/mdast-util-to-hast/lib/footer.js
 /**
@@ -105922,18 +106373,30 @@ const formatSlaMetric = (m, now) => {
 	}
 	return parts.join("; ");
 };
-const formatSlaBlock = (entry) => {
+const formatSlaBlock = (entry, urgency = "", heading = "### SLA") => {
 	if (!entry?.policy_metrics || entry.policy_metrics.length === 0) return "";
 	const now = Date.now();
-	const lines = ["### SLA"];
+	const lines = [heading];
 	const soonest = entry.policy_metrics.filter(hasPendingDeadline).map((m) => ({
 		due: m.breach_at,
 		at: Date.parse(m.breach_at)
 	})).filter((d) => !Number.isNaN(d.at) && d.at > now).reduce((best, d) => best && best.at <= d.at ? best : d, void 0);
 	if (soonest) lines.push(`- **Next breach**: ${soonest.due}`);
+	if (urgency) lines.push(urgency);
 	for (const m of entry.policy_metrics) lines.push(formatSlaMetric(m, now));
 	return `\n\n${lines.join("\n")}`;
 };
+const formatNextBreachBlock = (metric) => metric ? formatSlaBlock({ policy_metrics: [metric] }, "", "### SLA (next breach only)") : "";
+/** The next-breaching metric each `/views/{id}/execute` row carries, by ticket id. */
+const nextBreachByTicket = (rows) => {
+	const byId = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const id = row.ticket?.id;
+		const metric = row.ticket?.sla_policy_metric;
+		if (typeof id === "number" && metric) byId.set(id, metric);
+	}
+	return byId;
+};
 const withName = (id, names) => {
 	const n = Number(id);
 	if (n === -1) return "System (-1)";
@@ -106305,106 +106768,6 @@ const createArticleResourcesProvider = (getToken, subdomain, onUnauthorized, res
 	};
 };
 //#endregion
-//#region src/guidance/instructions.ts
-/**
-* URI of the dynamic Help Center topology resource. Single source of truth for
-* every place that cites it (resource registration, `instructions` blob): the
-* scheme comes from the config (`--hc-resource-scheme`, default `zendesk-hc`),
-* the path is fixed. Any future Help Center resource should build its URI the
-* same way so the whole surface follows the configured scheme.
-*/
-const topologyResourceUri = (config) => `${config.hcResourceScheme}://topology`;
-/**
-* URI template of the pull-only Help Center article resources, built from the
-* configured scheme exactly like `topologyResourceUri` (`--hc-resource-scheme`,
-* default `zendesk-hc`). In multi/all brand mode the URI carries a brand
-* dimension — `<scheme>://brands/{brand}/articles/{id}` — because an article id
-* alone does not say which brand's Help Center holds it; the brand is named by
-* id or subdomain, the same idiom the tools' `brand_id` accepts. Unset and
-* single-brand modes keep `<scheme>://article/{id}`: one Help Center is
-* addressed, so a brand segment would be noise. The template's `list` callback
-* enumerates the promoted ("featured") articles (so clients can surface them
-* for pinning), while any article id can be read on demand.
-*/
-const articleResourceUriTemplate = (config) => brandScopedArticles(config) ? `${config.hcResourceScheme}://brands/{brand}/articles/{id}` : `${config.hcResourceScheme}://article/{id}`;
-/**
-* Build the concrete resource URI for a single article id, under the configured
-* scheme. Shares the scheme with the template above so the listed URIs always
-* match the template the read callback is registered under. In multi/all mode
-* the brand argument (id or subdomain) is required and fills the {brand} slot.
-*/
-const articleResourceUri = (config, id, brand) => brandScopedArticles(config) ? `${config.hcResourceScheme}://brands/${brand}/articles/${id}` : `${config.hcResourceScheme}://article/${id}`;
-/**
-* Whether the article resources address one Help Center among several: the
-* server was started with several brands, or with `all`. Only then does the URI
-* carry the brand dimension; unset and single-lock modes name exactly one Help
-* Center implicitly.
-*/
-const brandScopedArticles = (config) => {
-	const brandIds = config.brandIds;
-	return brandIds !== void 0 && (brandIds.length > 1 || brandIds[0] === "all");
-};
-/**
-* Whether the `help_center` namespace is active: no `--namespace` filter, or one
-* that includes it. The shared second half of the two Help Center feature gates
-* below, so the namespace semantics live in one place.
-*/
-const helpCenterNamespaceActive = (config) => !config.namespaces?.length || config.namespaces.includes("help_center");
-/**
-* Whether the Help Center structural context (init instructions + the
-* topology resource, default `zendesk-hc://topology`) should be exposed. True only when the
-* feature is enabled (`--no-topology` not set) AND the `help_center` namespace
-* is active. Shared by the instructions builder and the resource registration in
-* `server.ts` so both gates stay in sync.
-*/
-const helpCenterContextEnabled = (config) => config.topology && helpCenterNamespaceActive(config);
-/**
-* Whether the read-by-id article resource (`<scheme>://article/{id}`) should be
-* registered. Available whenever the `help_center` namespace is active — reading
-* one article is a cheap, on-demand single fetch with NO preloading, so it is
-* deliberately NOT gated by the promoted-listing flag: `--no-promoted-articles`
-* turns off the costly pre-listing (below), never the ability to address a known
-* article id. Not tied to `--no-topology` either (topology is a separate feature).
-*/
-const articleResourceEnabled = (config) => helpCenterNamespaceActive(config);
-/**
-* Whether the promoted-article PRE-LISTING is exposed: the resource `list`
-* callback's scan, which enumerates the promoted articles for `resources/list`.
-* A client may trigger it unprompted, and it fans out (a capped scan of
-* `/articles`, per brand in scope), so `--no-promoted-articles` turns it off.
-* Read-by-id and the explicit `list_promoted_articles` tool stay available.
-* `!== false` so an omitted flag on a hand-built Config stays default-on.
-*/
-const promotedArticlesEnabled = (config) => config.promotedArticles !== false && helpCenterNamespaceActive(config);
-/**
-* The static `instructions` blob sent on `initialize`. Deliberately short and
-* I/O-free: it must not trigger the lazy OAuth/PKCE flow just to connect, and
-* it stays within a tight token budget. The rich, dynamic topology lives in the
-* pull-only topology resource (default `zendesk-hc://topology`) referenced here.
-*/
-const buildInstructions = (config) => {
-	if (!helpCenterContextEnabled(config)) return void 0;
-	let scope;
-	if (config.brandIds === void 0) scope = `the Zendesk Help Center of "${config.subdomain}"`;
-	else if (config.brandIds.length === 1 && config.brandIds[0] === "all") scope = `all brands of the Zendesk Help Center of "${config.subdomain}"`;
-	else if (config.brandIds.length === 1) scope = `brand ${config.brandIds[0]} of the Zendesk Help Center of "${config.subdomain}"`;
-	else scope = `brands ${config.brandIds.join(", ")} of the Zendesk Help Center of "${config.subdomain}"`;
-	const topologyBrandNote = config.brandIds !== void 0 && (config.brandIds.length > 1 || config.brandIds[0] === "all") ? [`The topology describes ${config.brandIds[0] === "all" ? "the account default brand" : `brand ${config.brandIds[0]}`} only; for another brand, use list_categories / list_sections with its brand_id.`] : [];
-	return [
-		`This MCP server is connected to ${scope}.`,
-		"",
-		`When creating or editing Help Center content, the resource ${topologyResourceUri(config)} is useful context:`,
-		"it lists the active locales (and the default one), the category → section tree with IDs,",
-		"the visibility user segments, the permission groups, and your current role.",
-		"Prefer its IDs (section_id, permission_group_id, user_segment_id, locale) over guessing from names.",
-		...topologyBrandNote,
-		"",
-		"It degrades gracefully: without Guide-admin / Help Center manager rights the permission-groups and",
-		"user-segments sections are marked unavailable (not empty). In that case reuse a permission_group_id",
-		"or user_segment_id from an existing article (get_article) instead."
-	].join("\n");
-};
-//#endregion
 //#region src/guidance/topology.ts
 /**
 * Resolve an admin-gated fetch to a sentinel on HTTP 403 instead of rejecting.
@@ -106561,6 +106924,9 @@ const createTopologyProvider = (getToken, subdomain, onUnauthorized, brandIds, r
 		return promise;
 	} };
 };
+//#endregion
+//#region src/routing/proxy-schema.ts
+const writes = (t) => !t.readOnly || t.annotations?.readOnlyHint === false;
 const PARAMS_FIELD_DESCRIPTION = "Parameters of the chosen operation, named exactly as its line in \"operation\" lists them (* = required). An unknown name is rejected.";
 const summarizeDescription = (description) => {
 	const idx = description.indexOf(". ");
@@ -106571,7 +106937,7 @@ const operationSignature = (tool) => {
 	const params = Object.entries(tool.inputSchema.shape).map(([key, field]) => field.safeParse(void 0).success ? key : `${key}*`);
 	return `${tool.name}(${params.join(", ")})`;
 };
-const buildOperationList = (tools) => tools.map((t) => `- ${operationSignature(t)}: ${summarizeDescription(t.description)}${t.readOnly ? "" : " (write)"}`).join("\n");
+const buildOperationList = (tools) => tools.map((t) => `- ${operationSignature(t)}: ${summarizeDescription(t.description)}${writes(t) ? " (write)" : ""}`).join("\n");
 const buildOperationFieldDescription = (tools) => `One of the operations below. Each line reads name(parameters): summary, where the parameters are the exact names "params" accepts and * marks a required one; (write) marks an operation that changes data.\n${buildOperationList(tools)}`;
 const buildProxyDescription = ({ title, tools, readOnly }) => {
 	const head = `${readOnly ? "[RO] " : ""}${title}. Specify the operation and its parameters. The "operation" field lists every operation with a one-line summary and the parameter names "params" accepts (* = required); an unknown parameter is rejected with the list of valid ones.`;
@@ -106629,6 +106995,10 @@ const NAMESPACE_LABELS = {
 	requests: {
 		toolName: "zendesk_requests",
 		title: "Zendesk Requests"
+	},
+	preferences: {
+		toolName: "connector_preferences",
+		title: "Connector preferences (this MCP server, not Zendesk)"
 	}
 };
 //#endregion
@@ -108066,6 +108436,126 @@ const createHelpCenterTools = (ctx) => {
 	];
 };
 //#endregion
+//#region src/utils/sla-preferences.ts
+const SLA_FAMILIES = ["reply", "wait"];
+const FAMILY_LABEL = {
+	reply: "Reply metrics (first_reply_time, next_reply_time)",
+	wait: "Wait and resolution metrics (every other metric)"
+};
+/** Personal thresholds where set (and allowed), the server default elsewhere. */
+const effectiveThresholds = (admin, prefs) => ({
+	reply: prefs?.reply ?? admin.reply,
+	wait: prefs?.wait ?? admin.wait
+});
+const isEmptyChange = (change) => Object.values(change).every((value) => value === void 0);
+const readDuration = (raw, field) => {
+	if (raw === void 0) return void 0;
+	const minutes = parseDuration(raw);
+	return minutes === void 0 ? `${field}: ${notADuration(raw)}` : minutes;
+};
+const changeFamily = (family, current, change) => {
+	const warning = readDuration(change[`${family}_warning`], `${family}_warning`);
+	const critical = readDuration(change[`${family}_critical`], `${family}_critical`);
+	if (typeof warning === "string") return { error: warning };
+	if (typeof critical === "string") return { error: critical };
+	const given = warning !== void 0 || critical !== void 0;
+	if (change.reset === family || change.reset === "all") return given ? { error: `Either reset the ${family} thresholds or set them, not both.` } : "reset";
+	if (!given) return "keep";
+	const threshold = {
+		warning: warning ?? current.warning,
+		critical: critical ?? current.critical
+	};
+	if (threshold.critical > threshold.warning) return { error: `The ${family} critical threshold (${formatMinutes(threshold.critical)}) must not be longer than its warning one (${formatMinutes(threshold.warning)}).` };
+	return threshold;
+};
+/**
+* Applies a change to the stored preferences. A half given alone keeps the
+* other half in force (personal, else server default); a family reset goes
+* back to the server default, and `all` also forgets the user was introduced. Returns the new preferences, or why the change
+* is refused.
+*/
+const applyPreferenceChange = (admin, prefs, change) => {
+	const current = effectiveThresholds(admin, prefs);
+	const next = change.reset === "all" ? {} : { ...prefs };
+	for (const family of SLA_FAMILIES) {
+		const outcome = changeFamily(family, current[family], change);
+		if (outcome === "reset") delete next[family];
+		else if (outcome === "keep") continue;
+		else if ("error" in outcome) return outcome;
+		else next[family] = outcome;
+	}
+	return { preferences: next };
+};
+const sourceOf = (family, prefs, allowed, admin) => allowed && prefs?.[family] ? `your preference (server default: ${formatThreshold(admin[family])})` : "server default";
+/**
+* The thresholds in force for the caller, where each comes from, and how they
+* are applied. Shared by `configure_sla_alerts` and the alert tool's
+* first-call explanation.
+*/
+const describeEffectiveThresholds = (admin, prefs, allowed) => {
+	const inForce = effectiveThresholds(admin, allowed ? prefs : void 0);
+	return [
+		"SLA alert thresholds in force for you:",
+		...SLA_FAMILIES.map((family) => `- ${FAMILY_LABEL[family]}: ${formatThreshold(inForce[family])} — ${sourceOf(family, prefs, allowed, admin)}`),
+		"A running metric turns WARNING when its breach is closer than the warning threshold, CRITICAL when closer than the critical one, and BREACHED once its deadline has passed. Paused and achieved metrics never alert.",
+		allowed ? "Change them with configure_sla_alerts (reply_warning, reply_critical, wait_warning, wait_critical), or go back to the server defaults with reset." : "Personal thresholds are turned off on this server (SLA_USER_PREFERENCES=off): the server defaults apply to everyone."
+	].join("\n");
+};
+//#endregion
+//#region src/tools/preferences.ts
+/** How every SLA duration parameter is spelled, for their descriptions. */
+const DURATION_HINT = "A readable duration: 30m, 4h, 2d, 1w, or a mix like 1d4h.";
+/** The caller's SLA service, or the plain error of a server that wires none. */
+const requireSla = (sla) => {
+	if (!sla) throw new Error("SLA alerting is not available on this server.");
+	return sla;
+};
+const createPreferenceTools = (ctx) => [{
+	name: "configure_sla_alerts",
+	namespace: "preferences",
+	readOnly: true,
+	title: "Configure SLA Alert Thresholds",
+	description: "Read or change your personal SLA alert thresholds: how close to a breach a running SLA metric must be to count as WARNING or CRITICAL. Called with no parameters it changes nothing and reports the thresholds in force for you and where each comes from (your preference or the server default). With parameters it saves your own thresholds per metric family (reply: first_reply_time and next_reply_time; wait: every other metric) on this MCP server — nothing is written to Zendesk — and they then drive list_sla_alerts and the Urgency line of get_ticket / search_tickets for you only; reset goes back to the server defaults. When the operator turned personal thresholds off (SLA_USER_PREFERENCES=off), only the read works and the reply says so.",
+	inputSchema: object({
+		reply_warning: string$2().optional().describe(`Time left before a reply metric (first_reply_time, next_reply_time) breaches at which it turns WARNING. ${DURATION_HINT} Omit to keep the current value.`),
+		reply_critical: string$2().optional().describe(`Time left before a reply metric breaches at which it turns CRITICAL; must not exceed the reply warning threshold. ${DURATION_HINT} Omit to keep the current value.`),
+		wait_warning: string$2().optional().describe(`Time left before a wait or resolution metric (requester_wait_time, agent_work_time and every other non-reply metric) breaches at which it turns WARNING. ${DURATION_HINT} Omit to keep the current value.`),
+		wait_critical: string$2().optional().describe(`Time left before a wait or resolution metric breaches at which it turns CRITICAL; must not exceed the wait warning threshold. ${DURATION_HINT} Omit to keep the current value.`),
+		reset: _enum([
+			"reply",
+			"wait",
+			"all"
+		]).optional().describe("Drop your personal thresholds for one family (\"reply\" or \"wait\") or both (\"all\") and follow the server defaults again; \"all\" also makes your next list_sla_alerts call explain the thresholds again. Cannot be combined with new values for the same family.")
+	}),
+	annotations: {
+		readOnlyHint: false,
+		destructiveHint: false,
+		idempotentHint: true,
+		openWorldHint: false
+	},
+	handler: async (params) => {
+		const sla = requireSla(ctx.sla);
+		const change = params;
+		const prefs = await sla.preferences();
+		const describe = (current) => describeEffectiveThresholds(sla.adminThresholds, current, sla.userPreferencesAllowed);
+		if (isEmptyChange(change)) return { content: [{
+			type: "text",
+			text: describe(prefs)
+		}] };
+		if (!sla.userPreferencesAllowed) return { content: [{
+			type: "text",
+			text: `Nothing was changed.\n\n${describe(prefs)}`
+		}] };
+		const applied = applyPreferenceChange(sla.adminThresholds, prefs, change);
+		if ("error" in applied) throw new Error(`${applied.error} Nothing was changed.`);
+		await sla.savePreferences(applied.preferences);
+		return { content: [{
+			type: "text",
+			text: `Your SLA alert thresholds were saved.\n\n${describe(applied.preferences)}`
+		}] };
+	}
+}];
+//#endregion
 //#region src/tools/attachments.ts
 /**
 * File-attachment input, shared by every tool that can carry files on a comment.
@@ -108638,6 +109128,406 @@ const createSearchTools = (ctx) => {
 	}];
 };
 //#endregion
+//#region src/utils/elicitation.ts
+/**
+* Whether a client can answer a form elicitation. A bare `elicitation: {}`
+* predates the modes and counts as form support (spec rule the SDK follows).
+*/
+const supportsFormElicitation = (capabilities) => {
+	const elicitation = capabilities?.elicitation;
+	if (!elicitation) return false;
+	return Object.keys(elicitation).length === 0 || "form" in elicitation;
+};
+const inputRequiredError = (result) => Object.assign(/* @__PURE__ */ new Error("The tool needs input from the user before it can answer."), {
+	name: "InputRequiredError",
+	inputRequired: result
+});
+const isInputRequiredError = (err) => err instanceof Error && err.name === "InputRequiredError" && "inputRequired" in err;
+//#endregion
+//#region src/utils/sla-urgency.ts
+/** Most urgent first: the order alerts are grouped and ranked in. */
+const URGENCY_LEVELS = [
+	"BREACHED",
+	"CRITICAL",
+	"WARNING"
+];
+const MINUTE_MS = 6e4;
+/**
+* The urgency of one live SLA metric, or `undefined` when it does not call for
+* attention: not running (paused, achieved, fulfilled), no readable deadline,
+* or further away than its family's warning threshold. A deadline already
+* passed is BREACHED whatever the thresholds.
+*/
+const classifyMetric = (m, thresholds, now) => {
+	if (!hasPendingDeadline(m)) return void 0;
+	const minutesLeft = Math.round((Date.parse(m.breach_at) - now) / MINUTE_MS) + 0;
+	const { warning, critical } = thresholds[familyOf(m.metric)];
+	let level;
+	if (minutesLeft < 0) level = "BREACHED";
+	else if (minutesLeft <= critical) level = "CRITICAL";
+	else if (minutesLeft <= warning) level = "WARNING";
+	else return void 0;
+	return {
+		metric: m.metric,
+		level,
+		breachAt: m.breach_at,
+		minutesLeft
+	};
+};
+/** Orders by level (BREACHED first), then by the soonest breach. */
+const compareUrgency = (a, b) => URGENCY_LEVELS.indexOf(a.level) - URGENCY_LEVELS.indexOf(b.level) || Date.parse(a.breachAt) - Date.parse(b.breachAt);
+/** The single most urgent running metric of a ticket, if any calls for attention. */
+const ticketUrgency = (entry, thresholds, now) => {
+	let worst;
+	for (const m of entry?.policy_metrics ?? []) {
+		const u = classifyMetric(m, thresholds, now);
+		if (u && (!worst || compareUrgency(u, worst) < 0)) worst = u;
+	}
+	return worst;
+};
+/** `due in 45m` or `overdue by 2h`. */
+const formatDueIn = (u) => u.level === "BREACHED" ? `overdue by ${formatMinutes(u.minutesLeft)}` : `due in ${formatMinutes(u.minutesLeft)}`;
+/**
+* The `**Urgency**` line pushed into a ticket's SLA block, or '' when nothing is
+* urgent, so the caller can pass it on unconditionally.
+*/
+const formatUrgencyLine = (u) => u ? `- **Urgency**: ${u.level} — ${u.metric} ${formatDueIn(u)}` : "";
+//#endregion
+//#region src/utils/sla-alerts.ts
+const toAlertTicket = (ticket) => ({
+	id: ticket.id,
+	subject: ticket.subject,
+	status: ticket.status,
+	priority: ticket.priority,
+	metrics: ticket.slas?.policy_metrics ?? []
+});
+/** Several fetches into one snapshot, each ticket once (a ticket can sit in two groups). */
+const mergeSnapshots = (snapshots) => {
+	const byId = /* @__PURE__ */ new Map();
+	for (const snapshot of snapshots) for (const ticket of snapshot.tickets) if (!byId.has(ticket.id)) byId.set(ticket.id, ticket);
+	return {
+		tickets: [...byId.values()],
+		truncated: snapshots.some((s) => s.truncated),
+		unread: snapshots.reduce((sum, s) => sum + s.unread, 0)
+	};
+};
+/**
+* Every running metric that is breached or inside its family's thresholds, one
+* alert per metric, most urgent level first and soonest breach first within it.
+*/
+const selectAlerts = (tickets, thresholds, now, filter) => tickets.flatMap((ticket) => ticket.metrics.flatMap((m) => {
+	const urgency = classifyMetric(m, thresholds, now);
+	return urgency ? [{
+		ticket,
+		urgency
+	}] : [];
+})).filter(({ urgency }) => urgency.level === "BREACHED" ? filter.includeBreached : filter.withinMinutes === void 0 || urgency.minutesLeft <= filter.withinMinutes).sort((a, b) => URGENCY_LEVELS.indexOf(a.urgency.level) - URGENCY_LEVELS.indexOf(b.urgency.level) || Date.parse(a.urgency.breachAt) - Date.parse(b.urgency.breachAt) || a.ticket.id - b.ticket.id);
+/**
+* What a subscriber is notified about: which ticket, which metric, which
+* level. The minutes counting down are left out on purpose, or every poll
+* would read as a change.
+*/
+const alertFingerprint = (alerts) => alerts.map(({ ticket, urgency }) => `${ticket.id}:${urgency.metric}:${urgency.level}`).sort((a, b) => a.localeCompare(b)).join("|");
+const formatAlert = ({ ticket, urgency }) => `- #${ticket.id} ${urgency.metric} ${formatDueIn(urgency)} (due ${urgency.breachAt}) — "${ticket.subject}" [${ticket.status}, ${ticket.priority ?? "no priority"}]`;
+/**
+* The compact report: a summary line, the thresholds, then one line per alert
+* grouped by level. Past `maxLines` alerts, the rest are counted, not listed.
+*/
+const renderAlerts = (alerts, report) => {
+	const counts = URGENCY_LEVELS.map((level) => `${alerts.filter((a) => a.urgency.level === level).length} ${level.toLowerCase()}`).join(", ");
+	const lines = [`SLA alerts for ${report.scopeLabel}: ${counts} (${report.checked} ticket(s) checked).`, `Thresholds: ${report.thresholds}.`];
+	if (report.truncated) {
+		const howMany = report.unread > 0 ? `${report.unread} more ticket(s)` : "More tickets";
+		lines.push(`Truncated: ${howMany} in this scope were not read. Narrow it with query or view to see them.`);
+	}
+	for (const note of report.notes) lines.push(note);
+	if (alerts.length === 0) {
+		lines.push("", "No running SLA metric is breached or within its thresholds.");
+		return lines.join("\n");
+	}
+	const shown = alerts.slice(0, report.maxLines);
+	for (const level of URGENCY_LEVELS) {
+		const group = shown.filter((a) => a.urgency.level === level);
+		if (group.length > 0) lines.push("", `## ${level}`, ...group.map(formatAlert));
+	}
+	const hidden = alerts.length - shown.length;
+	if (hidden > 0) lines.push("", `${hidden} more alert(s) not listed. Narrow the scope with query or view, or shorten within.`);
+	return lines.join("\n");
+};
+//#endregion
+//#region src/utils/sla-scope.ts
+const SCOPE_QUERIES = {
+	mine: "assignee:me status<solved",
+	all: "status<solved"
+};
+const groupQuery = (groupId) => `group:${groupId} status<solved`;
+/** The cache key of a scope: same tickets, same key, whoever asks. */
+const scopeKey = (scope) => {
+	if (scope.kind === "scope") return `scope:${scope.scope}`;
+	if (scope.kind === "view") return `view:${scope.viewId}`;
+	return `query:${scope.query.trim()}`;
+};
+const scopeLabel = (scope) => {
+	if (scope.kind === "view") return `view ${scope.viewId}`;
+	if (scope.kind === "query") return `the tickets matching "${scope.query.trim()}"`;
+	return {
+		mine: "your assigned unsolved tickets",
+		my_groups: "your groups' unsolved tickets",
+		all: "all unsolved tickets"
+	}[scope.scope];
+};
+const PAGE_SIZE = 100;
+const readPages = async (fetchPage) => {
+	const tickets = [];
+	let total;
+	let more = true;
+	for (let page = 1; more && page <= 5; page += 1) {
+		const response = await fetchPage(page);
+		tickets.push(...response.tickets);
+		total = response.count ?? total;
+		more = response.next_page != null && response.tickets.length > 0;
+	}
+	return {
+		tickets: tickets.map(toAlertTicket),
+		truncated: more,
+		unread: more ? Math.max((total ?? 0) - tickets.length, 0) : 0
+	};
+};
+const pageParams = (page) => ({
+	per_page: String(PAGE_SIZE),
+	page: String(page)
+});
+const readSearch = (get, query) => readPages(async (page) => {
+	const response = await get("/search", {
+		query: `type:ticket ${query}`,
+		include: "tickets(slas)",
+		...pageParams(page)
+	});
+	return {
+		...response,
+		tickets: response.results ?? []
+	};
+});
+const readView = (get, viewId) => readPages(async (page) => {
+	const response = await get(`/views/${viewId}/tickets`, {
+		include: "slas",
+		...pageParams(page)
+	});
+	return {
+		...response,
+		tickets: response.tickets ?? []
+	};
+});
+/** The ids of the groups `userId` belongs to, every page read. */
+const readGroupIds = async (get, userId) => {
+	const ids = [];
+	let cursor;
+	do {
+		const params = { "page[size]": String(PAGE_SIZE) };
+		if (cursor) params["page[after]"] = cursor;
+		const response = await get(`/users/${userId}/group_memberships`, params);
+		ids.push(...(response.group_memberships ?? []).map((m) => m.group_id));
+		cursor = response.meta?.has_more ? response.meta.after_cursor ?? void 0 : void 0;
+	} while (cursor);
+	return [...new Set(ids)];
+};
+/**
+* Reads the tickets of a scope with their live SLA, bounded by
+* `MAX_SCOPE_PAGES` per search or view and `MAX_SCOPE_GROUPS` group searches. Every call goes through `get`, so
+* through the client's retry policy.
+*/
+const fetchScope = async (scope, get, userId) => {
+	if (scope.kind === "view") return readView(get, scope.viewId);
+	if (scope.kind === "query") return readSearch(get, scope.query.trim());
+	if (scope.scope !== "my_groups") return readSearch(get, SCOPE_QUERIES[scope.scope]);
+	const groupIds = await readGroupIds(get, await userId());
+	const snapshots = [];
+	for (const id of groupIds.slice(0, 10)) snapshots.push(await readSearch(get, groupQuery(id)));
+	if (groupIds.length > 10) snapshots.push({
+		tickets: [],
+		truncated: true,
+		unread: 0
+	});
+	return mergeSnapshots(snapshots);
+};
+/** Where the thresholds in force come from, as the report states it. */
+const thresholdsSource = (sla, prefs, overridden) => {
+	if (overridden) return "overridden for this call";
+	if (!sla.userPreferencesAllowed) return "server default";
+	return prefs?.reply || prefs?.wait ? "yours; change them with configure_sla_alerts" : "server default; set your own with configure_sla_alerts";
+};
+/**
+* One alert check, as the tool, a resource read and the poller all run it:
+* the scope read through the caller's cache, the alerts selected and
+* rendered, and their fingerprint for change detection.
+*/
+const checkAlerts = async (input) => {
+	const { sla, get, target } = input;
+	const snapshot = await sla.cached(scopeKey(target), () => fetchScope(target, get, sla.userId));
+	const alerts = selectAlerts(snapshot.tickets, input.thresholds, Date.now(), input.filter);
+	return {
+		fingerprint: alertFingerprint(alerts),
+		text: renderAlerts(alerts, {
+			scopeLabel: scopeLabel(target),
+			checked: snapshot.tickets.length,
+			truncated: snapshot.truncated,
+			unread: snapshot.unread,
+			thresholds: `${describeThresholds(input.thresholds)} (${input.source})`,
+			notes: input.notes,
+			maxLines: 100
+		})
+	};
+};
+//#endregion
+//#region src/utils/sla-alerts-elicitation.ts
+/** The key the alert tool's one elicitation is asked and answered under. */
+const ALERTS_ELICITATION_KEY = "sla_alerts";
+const SCOPE_CHOICES = [
+	{
+		const: "mine",
+		title: "My assigned tickets"
+	},
+	{
+		const: "my_groups",
+		title: "My groups' tickets"
+	},
+	{
+		const: "all",
+		title: "All unsolved tickets"
+	}
+];
+const pair = (t) => `${formatMinutes(t.warning)},${formatMinutes(t.critical)}`;
+/**
+* The one form the alert tool may show: the scope when none was given, and on
+* a user's first call the thresholds, explained and editable. `undefined` when
+* there is nothing to ask.
+*/
+const buildAlertsElicitation = (options) => {
+	const { askScope, introduce, thresholds } = options;
+	if (!askScope && !introduce) return void 0;
+	const properties = {};
+	const message = [];
+	if (askScope) {
+		message.push("Which tickets should be checked for SLA alerts?");
+		properties["scope"] = {
+			type: "string",
+			title: "Tickets to check",
+			oneOf: [...SCOPE_CHOICES],
+			default: "mine"
+		};
+	}
+	if (introduce) {
+		message.push(`A running SLA metric is flagged WARNING when its breach is closer than the warning threshold, CRITICAL when closer than the critical one, and BREACHED once overdue. In force for you: reply metrics (first_reply_time, next_reply_time) ${pair(thresholds.reply)}, every other metric ${pair(thresholds.wait)}, as warning,critical. Edits here apply to this call only; configure_sla_alerts keeps them.`);
+		properties["reply_thresholds"] = {
+			type: "string",
+			title: "Reply metrics: warning,critical",
+			default: pair(thresholds.reply)
+		};
+		properties["wait_thresholds"] = {
+			type: "string",
+			title: "Wait and resolution metrics: warning,critical",
+			default: pair(thresholds.wait)
+		};
+	}
+	return {
+		message: message.join("\n\n"),
+		requestedSchema: {
+			type: "object",
+			properties,
+			...askScope ? { required: ["scope"] } : {}
+		}
+	};
+};
+const isNamedScope = (value) => SCOPE_CHOICES.some((choice) => choice.const === value);
+/**
+* Reads an accepted answer to that form. The content comes from the client
+* unvalidated, so every field is checked here; a bad one is ignored with a
+* note rather than failing the whole call.
+*/
+const readAlertsAnswer = (content, thresholds) => {
+	const answer = {
+		change: {},
+		notes: []
+	};
+	if (isNamedScope(content["scope"])) answer.scope = content["scope"];
+	for (const family of ["reply", "wait"]) {
+		const raw = content[`${family}_thresholds`];
+		if (typeof raw !== "string" || raw.trim() === pair(thresholds[family])) continue;
+		const parsed = parseThresholdPair(raw);
+		if ("error" in parsed) {
+			answer.notes.push(`Your ${family} thresholds "${raw}" were not applied: ${parsed.error}`);
+			continue;
+		}
+		answer.change[`${family}_warning`] = formatMinutes(parsed.threshold.warning);
+		answer.change[`${family}_critical`] = formatMinutes(parsed.threshold.critical);
+	}
+	return answer;
+};
+/**
+* Applies the per-call `warning` / `critical` overrides to both families. A
+* pair given together must hold critical <= warning. A half given alone wins:
+* a lone warning lowers each family's critical to it at most, a lone critical
+* raises each family's warning to it at least.
+*/
+const overrideThresholds = (thresholds, warning, critical) => {
+	if (warning !== void 0 && critical !== void 0) {
+		const both = toThreshold(warning, critical);
+		return "error" in both ? both : { thresholds: {
+			reply: both.threshold,
+			wait: both.threshold
+		} };
+	}
+	const w = warning === void 0 ? void 0 : parseDuration(warning);
+	if (warning !== void 0 && w === void 0) return { error: notADuration(warning) };
+	const c = critical === void 0 ? void 0 : parseDuration(critical);
+	if (critical !== void 0 && c === void 0) return { error: notADuration(critical) };
+	const apply = (t) => ({
+		warning: w ?? Math.max(t.warning, c ?? 0),
+		critical: c ?? Math.min(t.critical, w ?? t.critical)
+	});
+	return { thresholds: {
+		reply: apply(thresholds.reply),
+		wait: apply(thresholds.wait)
+	} };
+};
+//#endregion
+//#region src/utils/ticket-metrics.ts
+const NOT_RECORDED = "not recorded";
+const DURATIONS = [
+	["First reply", "reply_time_in_minutes"],
+	["First resolution", "first_resolution_time_in_minutes"],
+	["Full resolution", "full_resolution_time_in_minutes"],
+	["Agent wait", "agent_wait_time_in_minutes"],
+	["Requester wait", "requester_wait_time_in_minutes"],
+	["On hold", "on_hold_time_in_minutes"]
+];
+const half = (minutes) => minutes === null ? "not reached yet" : formatMinutes(minutes);
+const formatPair = (pair) => {
+	if (!pair) return NOT_RECORDED;
+	if (pair.calendar === null && pair.business === null) return "not reached yet";
+	return `calendar ${half(pair.calendar)}, business ${half(pair.business)}`;
+};
+const count = (value) => value === void 0 ? NOT_RECORDED : `${value}`;
+const when = (value) => value ?? "not yet";
+/**
+* One ticket's elapsed metrics (`ticket_metric`): durations in calendar and
+* business minutes, counters and key timestamps. These are facts recorded
+* whether or not an SLA policy applies, unlike the live SLA countdown.
+*/
+const formatTicketMetrics = (id, ticket, metric) => {
+	if (!ticket) return `## Ticket #${id}\n- Not found, or not visible to you.`;
+	const header = `## Ticket #${id}: ${ticket.subject}`;
+	if (!metric) return `${header}\n- No metrics recorded for this ticket.`;
+	return [
+		header,
+		...DURATIONS.map(([label, key]) => `- **${label}**: ${formatPair(metric[key])}`),
+		`- **Reopens**: ${count(metric.reopens)} | **Replies**: ${count(metric.replies)} | **Assignee stations**: ${count(metric.assignee_stations)} | **Group stations**: ${count(metric.group_stations)}`,
+		`- **Created**: ${metric.created_at ?? NOT_RECORDED} | **First assigned**: ${when(metric.initially_assigned_at)} | **Assigned**: ${when(metric.assigned_at)} | **Solved**: ${when(metric.solved_at)}`,
+		`- **Latest comment**: ${when(metric.latest_comment_added_at)} | **Status changed**: ${when(metric.status_updated_at)}`,
+		`- **Last update by requester**: ${when(metric.requester_updated_at)} | **by assignee**: ${when(metric.assignee_updated_at)}`
+	].join("\n");
+};
+//#endregion
 //#region src/tools/tickets.ts
 const MAX_ATTACHMENT_MB = Number.parseFloat((MAX_ATTACHMENT_BYTES / 1048576).toFixed(2));
 const MAX_RESPONSE_MB = Number.parseFloat((MAX_RESPONSE_BYTES / 1048576).toFixed(2));
@@ -108980,6 +109870,12 @@ const formatMacroPreviewDiff = (ticketId, macroId, before, result) => {
 };
 const createTicketTools = (ctx) => {
 	const { subdomain, getToken } = ctx;
+	const urgencyRenderer = async () => {
+		const sla = ctx.sla;
+		if (!sla?.push) return () => "";
+		const thresholds = await sla.thresholds().catch(() => sla.adminThresholds);
+		return (entry) => formatUrgencyLine(ticketUrgency(entry, thresholds, Date.now()));
+	};
 	const subscriberIdList = (description, max) => {
 		const ids = array(number$2().int().positive());
 		return (max === void 0 ? ids : ids.max(max)).optional().describe(description);
@@ -108990,7 +109886,7 @@ const createTicketTools = (ctx) => {
 			namespace: "tickets",
 			readOnly: true,
 			title: "Get Zendesk Ticket",
-			description: "Retrieve a Zendesk ticket by ID, including its live SLA state (per-metric stage and breach countdown) when an SLA policy applies, plus its comments if requested. Returns ticket details (subject, status, priority, assignee, tags, description) and optionally all comments/internal notes. It also lists the followers and email CCs on the ticket, resolved to names, which is how you tell who a ticket update actually reaches: followers are notified of updates including internal notes, email CCs take part in the public correspondence, and being the requester makes someone neither. Both lists come back empty on an account where the \"CCs and followers\" setting is not enabled in Zendesk. The per-ticket Show endpoint exposes no SLA, so the SLA block is resolved via a scoped search and may be absent for a very high-volume requester or a just-updated ticket; SLA targets and policy conditions live in list_sla_policies. This returns the ticket as it stands now; for the history of changes behind that state (who changed what, and when), use get_ticket_history. The comment thread is appended in one block — the first page of comments Zendesk returns, cut past the response character limit — so on a long ticket read it with list_ticket_comments, which pages the comments and returns the newest first.",
+			description: "Retrieve a Zendesk ticket by ID, including its live SLA state (per-metric stage and breach countdown) when an SLA policy applies, plus its comments if requested. Returns ticket details (subject, status, priority, assignee, tags, description) and optionally all comments/internal notes. It also lists the followers and email CCs on the ticket, resolved to names, which is how you tell who a ticket update actually reaches: followers are notified of updates including internal notes, email CCs take part in the public correspondence, and being the requester makes someone neither. Both lists come back empty on an account where the \"CCs and followers\" setting is not enabled in Zendesk. The per-ticket Show endpoint exposes no SLA, so the SLA block is resolved via a scoped search and may be absent for a very high-volume requester or a just-updated ticket; SLA targets and policy conditions live in list_sla_policies. When the operator turned SLA push on, the SLA block also carries an Urgency line naming the most urgent running metric as BREACHED, CRITICAL or WARNING against the caller's alert thresholds. This returns the ticket as it stands now; for the history of changes behind that state (who changed what, and when), use get_ticket_history. The comment thread is appended in one block — the first page of comments Zendesk returns, cut past the response character limit — so on a long ticket read it with list_ticket_comments, which pages the comments and returns the newest first.",
 			inputSchema: object({
 				ticket_id: number$2().int().describe("Ticket ID — the numeric id of the ticket to fetch. Obtain it from search_tickets or list_tickets."),
 				include_comments: boolean$1().default(false).describe("When true, appends the full public comment and internal note thread to the response. Defaults to false to keep the payload small; enable it when you need the conversation, not just the ticket fields. On a long thread prefer list_ticket_comments — this flag appends one unpaginated block, so comments past Zendesk's first page are absent and the rest is cut at the response character limit.")
@@ -109005,14 +109901,18 @@ const createTicketTools = (ctx) => {
 				const { ticket_id, include_comments } = params;
 				const token = await getToken();
 				const { ticket } = await zendeskGet(subdomain, token, `/tickets/${ticket_id}`);
-				const [sla, thread] = await Promise.all([fetchTicketSla(subdomain, token, ticket), include_comments ? zendeskGet(subdomain, token, `/tickets/${ticket_id}/comments`, {
-					include: "users",
-					include_inline_images: "true"
-				}) : void 0]);
+				const [sla, thread, urgency] = await Promise.all([
+					fetchTicketSla(subdomain, token, ticket),
+					include_comments ? zendeskGet(subdomain, token, `/tickets/${ticket_id}/comments`, {
+						include: "users",
+						include_inline_images: "true"
+					}) : void 0,
+					urgencyRenderer()
+				]);
 				const comments = thread?.comments ?? [];
 				const names = await resolveUserDisplayNames(subdomain, token, [...collectSubscriberIds(ticket), ...comments.map((comment) => comment.author_id)], thread?.users);
 				const commentsBlock = thread ? `\n\n---\n# Comments\n\n${comments.map((comment) => formatComment(comment, names)).join("\n\n")}` : "";
-				const text = formatTicket(ticket) + formatSlaBlock(sla) + formatSubscribersBlock(ticket, names) + commentsBlock;
+				const text = formatTicket(ticket) + formatSlaBlock(sla, urgency(sla)) + formatSubscribersBlock(ticket, names) + commentsBlock;
 				const advice = include_comments ? `get_ticket appends the thread as one unpaginated block; read it page by page with list_ticket_comments (ticket_id: ${ticket_id}, sort_order: "desc") to get the newest comments first.` : "get_ticket takes no pagination or filter parameters, so this response cannot be narrowed from the call.";
 				return { content: [{
 					type: "text",
@@ -109148,7 +110048,7 @@ const createTicketTools = (ctx) => {
 			namespace: "tickets",
 			readOnly: true,
 			title: "Search Zendesk Tickets",
-			description: "Search tickets using Zendesk query syntax, returning each result with its live SLA state (per-metric stage and breach countdown) when an SLA policy applies. Examples: \"status:open assignee:me\", \"priority:urgent ticket_type:incident\". Returns total count, so queue triage like \"breaching today\" works without a per-ticket fetch.",
+			description: "Search tickets using Zendesk query syntax, returning each result with its live SLA state (per-metric stage and breach countdown) when an SLA policy applies. Examples: \"status:open assignee:me\", \"priority:urgent ticket_type:incident\". Returns total count, so queue triage like \"breaching today\" works without a per-ticket fetch. When the operator turned SLA push on, each SLA block also carries an Urgency line (BREACHED, CRITICAL or WARNING) against the caller's alert thresholds.",
 			inputSchema: object({
 				query: string$2().min(1).describe("Zendesk ticket search query — field filters like \"status:open\", \"assignee:me\", \"priority:urgent ticket_type:incident\", combined with free text. A \"type:ticket\" scope is added automatically, so filter the ticket kind with ticket_type: (e.g. ticket_type:incident), never type: (which the API rejects here)."),
 				per_page: number$2().int().min(1).max(100).default(100).describe(PER_PAGE_DESC),
@@ -109163,12 +110063,12 @@ const createTicketTools = (ctx) => {
 			handler: async (params) => {
 				const { query, per_page, page } = params;
 				const token = await getToken();
-				const response = await zendeskGet(subdomain, token, "/search", {
+				const [response, urgency] = await Promise.all([zendeskGet(subdomain, token, "/search", {
 					query: `type:ticket ${query}`,
 					include: "tickets(slas)",
 					...buildOffsetParams(per_page, page)
-				});
-				const formatTicketWithSla = (ticket) => formatTicket(ticket) + formatSlaBlock(ticket.slas);
+				}), urgencyRenderer()]);
+				const formatTicketWithSla = (ticket) => formatTicket(ticket) + formatSlaBlock(ticket.slas, urgency(ticket.slas));
 				return { content: [{
 					type: "text",
 					text: formatList(response.results ?? [], formatTicketWithSla, extractSearchPaginationMeta(response, per_page, page))
@@ -109482,6 +110382,35 @@ const createTicketTools = (ctx) => {
 				}] };
 			}
 		},
+		{
+			name: "get_ticket_metrics",
+			namespace: "tickets",
+			readOnly: true,
+			title: "Get Ticket Metrics",
+			description: "Read the elapsed-time metrics (reply, resolution, wait and on-hold times, reopens, replies) of up to 100 tickets in one call. Each ticket gets first reply, first and full resolution, agent wait, requester wait and on-hold times in calendar and business minutes, plus reopen, reply, assignee-station and group-station counts and the key timestamps (assigned, solved, latest comment). These are facts Zendesk records on every ticket, so they are available even on tickets no SLA policy covers; they say how long things took, not how long is left — for the live breach countdown use get_ticket, search_tickets or list_sla_alerts. A duration still running reads \"not reached yet\". Read-only; tickets the caller cannot see are reported as such rather than failing the call.",
+			inputSchema: object({ ticket_ids: array(number$2().int().positive()).min(1).max(100).describe("Ticket IDs to read metrics for, 1 to 100 numeric ids (duplicates are read once), as returned by search_tickets, list_tickets or get_view_tickets. The answer keeps this order.") }),
+			annotations: {
+				readOnlyHint: true,
+				destructiveHint: false,
+				idempotentHint: true,
+				openWorldHint: true
+			},
+			handler: async (params) => {
+				const ids = [...new Set(params.ticket_ids)];
+				const token = await getToken();
+				const response = await zendeskGet(subdomain, token, "/tickets/show_many", {
+					ids: ids.join(","),
+					include: "metric_sets"
+				});
+				const tickets = new Map((response.tickets ?? []).map((t) => [t.id, t]));
+				const metrics = new Map((response.metric_sets ?? []).map((m) => [m.ticket_id, m]));
+				const text = ids.map((id) => formatTicketMetrics(id, tickets.get(id), metrics.get(id))).join("\n\n");
+				return { content: [{
+					type: "text",
+					text: truncateIfNeeded(text, "Pass fewer ticket_ids per call.")
+				}] };
+			}
+		},
 		{
 			name: "list_ticket_fields",
 			namespace: "tickets",
@@ -109545,7 +110474,7 @@ const createTicketTools = (ctx) => {
 			namespace: "tickets",
 			readOnly: true,
 			title: "Get Tickets In A View",
-			description: "Read the tickets inside a Zendesk view, in the view's own configured sort order — the same order the agent sees in the Zendesk UI — which is the natural way to work a named queue like \"Unassigned tickets\" or \"Breaching today\". Accepts the view by title or by numeric id (discover both with list_views); a title is matched case-insensitively against the agent's active views, and on no match the available titles are returned so you can retry in one step. Tickets come back with the same fields as list_tickets and are cursor-paginated; there is no live SLA block here (use search_tickets when you need per-ticket SLA state), and sort_by/sort_order override the view's order when you want a different cut.",
+			description: "Read the tickets inside a Zendesk view, in the view's own configured sort order — the same order the agent sees in the Zendesk UI — which is the natural way to work a named queue like \"Unassigned tickets\" or \"Breaching today\". Accepts the view by title or by numeric id (discover both with list_views); a title is matched case-insensitively against the agent's active views, and on no match the available titles are returned so you can retry in one step. Tickets come back with the same fields as list_tickets and are cursor-paginated. Each ticket an SLA policy covers also shows its next SLA breach: only the one metric closest to breaching, read from the view itself at no extra cost (use get_ticket or search_tickets for every metric). sort_by/sort_order override the view's order when you want a different cut.",
 			inputSchema: object({
 				view: union([string$2().min(1), number$2().int().positive()]).describe("The view to read: its exact title as shown in Zendesk (e.g. \"Unassigned tickets\") or its numeric id from list_views. A title is matched case-insensitively against your active views; on no match the tool returns the available titles instead of erroring, so you can retry with a correct one."),
 				sort_by: string$2().optional().describe("Optional column to sort by, overriding the view's own sort. Must be one of the view's columns (e.g. \"status\", \"priority\", \"updated_at\", or a custom field id); \"subject\" and \"submitter\" are not sortable. Omit to keep the view's configured order."),
@@ -109582,9 +110511,10 @@ const createTicketTools = (ctx) => {
 				}
 				const ids = rows.map(extractRowTicketId).filter((id) => typeof id === "number");
 				const tickets = await hydrateViewTickets(subdomain, token, ids);
+				const nextBreach = nextBreachByTicket(rows);
 				return { content: [{
 					type: "text",
-					text: formatList(tickets, formatTicket, {
+					text: formatList(tickets, (ticket) => formatTicket(ticket) + formatNextBreachBlock(nextBreach.get(ticket.id)), {
 						...meta,
 						count: tickets.length
 					})
@@ -109648,6 +110578,208 @@ const createTicketTools = (ctx) => {
 	];
 };
 //#endregion
+//#region src/tools/sla-alerts.ts
+const parseWithin = (within) => {
+	if (within === void 0) return void 0;
+	const minutes = parseDuration(within);
+	if (minutes === void 0) throw new Error(`within: "${within}" is not a duration. ${DURATION_HINT}`);
+	return minutes;
+};
+/**
+* The one form the tool may show — the scope when none was given, the
+* thresholds on a user's first call — and what came of it. Asking throws the
+* SDK's input-required signal; a client that cannot answer forms gets the
+* thresholds explained in the reply instead. Thresholds edited in the form
+* apply to this call only: keeping them is configure_sla_alerts' job. The one
+* write is the marker that the user was introduced, so it happens once.
+*/
+const settleForm = async (sla, call, askScope) => {
+	const prefs = sla.userPreferencesAllowed ? await sla.preferences() : void 0;
+	const introduce = sla.userPreferencesAllowed && !prefs?.introduced;
+	const notes = [];
+	let picked;
+	let edited;
+	const form = buildAlertsElicitation({
+		askScope,
+		introduce,
+		thresholds: await sla.thresholds()
+	});
+	const answered = call?.inputResponses?.[ALERTS_ELICITATION_KEY] !== void 0;
+	if (form && call?.canElicit && !answered) throw inputRequiredError(inputRequired({ inputRequests: { [ALERTS_ELICITATION_KEY]: inputRequired.elicit(form) } }));
+	const content = answered ? acceptedContent(call?.inputResponses, ALERTS_ELICITATION_KEY) : void 0;
+	if (content) {
+		const answer = readAlertsAnswer(content, await sla.thresholds());
+		picked = answer.scope;
+		notes.push(...answer.notes);
+		if (!isEmptyChange(answer.change)) {
+			const applied = applyPreferenceChange(sla.adminThresholds, prefs, answer.change);
+			if ("preferences" in applied) {
+				edited = effectiveThresholds(sla.adminThresholds, applied.preferences);
+				notes.push(keepEditedNote(answer.change));
+			} else notes.push(`Your edited thresholds were not applied: ${applied.error}`);
+		}
+	} else if (introduce && !answered) notes.push("", describeEffectiveThresholds(sla.adminThresholds, prefs, true), "");
+	if (introduce) await sla.savePreferences({
+		...prefs,
+		introduced: true
+	});
+	return {
+		picked,
+		notes,
+		prefs,
+		edited
+	};
+};
+const keepEditedNote = (change) => {
+	return `The thresholds you edited apply to this call only. To keep them, call configure_sla_alerts with ${Object.entries(change).filter(([, value]) => value !== void 0).map(([key, value]) => `${key}: "${value}"`).join(", ")}.`;
+};
+const createSlaAlertTools = (ctx) => {
+	const { subdomain, getToken } = ctx;
+	const resolveNamedScope = (params, picked, notes) => {
+		if (params.query !== void 0) return {
+			kind: "query",
+			query: params.query
+		};
+		if (params.scope) return {
+			kind: "scope",
+			scope: params.scope
+		};
+		if (picked) return {
+			kind: "scope",
+			scope: picked
+		};
+		notes.push("No scope was given, so this checks your assigned tickets (scope \"mine\"). Pass scope, view or query for another set.");
+		return {
+			kind: "scope",
+			scope: "mine"
+		};
+	};
+	const resolveView = async (token, view) => {
+		const resolved = await resolveViewId(subdomain, token, view);
+		if ("id" in resolved) return {
+			kind: "view",
+			viewId: resolved.id
+		};
+		return resolved.available.length > 0 ? `No active view matches "${view}". Available views: ${resolved.available.join(", ")}.` : `No active view matches "${view}", and no active views were found for this agent.`;
+	};
+	return [{
+		name: "list_sla_alerts",
+		namespace: "tickets",
+		readOnly: true,
+		title: "List SLA Alerts",
+		description: "List the SLA metrics that are breached or about to breach across a set of tickets, most urgent first. Pick the set with exactly one of scope (mine, my_groups or all unsolved tickets), view (a Zendesk view by title or id) or query (any Zendesk ticket search). Each running metric that is breached, or closer to its breach than its CRITICAL or WARNING threshold, is one line under BREACHED, CRITICAL or WARNING, soonest breach first, with the ticket id, metric, time left or overdue, subject, status and priority; paused and achieved metrics never appear. Thresholds are per metric family (reply metrics vs every other metric), the caller's own when set with configure_sla_alerts, else the server's; warning and critical override them for this call only. When no set is given the client may be asked which one, otherwise it defaults to the caller's own tickets and says so; on a user's first call the thresholds are shown too (in that form, or in the reply), and thresholds edited there apply to this call only. Never changes Zendesk; its one side effect is remembering, in this connector's own per-user state, that the user has been shown the thresholds. Results are cached per user for about a minute, and a set larger than a few hundred tickets is read in part, with a notice. For one ticket's full SLA state use get_ticket; for elapsed times use get_ticket_metrics.",
+		inputSchema: object({
+			scope: _enum([
+				"mine",
+				"my_groups",
+				"all"
+			]).optional().describe("A named set of unsolved tickets: \"mine\" (assigned to you), \"my_groups\" (in any group you belong to) or \"all\" (the whole account, as far as your role sees it). Use instead of view or query."),
+			view: union([string$2().min(1), number$2().int().positive()]).optional().describe("A Zendesk view to check, by its exact title (matched case-insensitively) or numeric id, as listed by list_views. Use instead of scope or query."),
+			query: string$2().min(1).optional().describe("A Zendesk ticket search query selecting the tickets to check, e.g. \"status<solved priority:urgent\" or \"organization:acme status<solved\"; \"type:ticket\" is added automatically. Use instead of scope or view."),
+			within: string$2().optional().describe(`Only list alerts breaching within this time from now (breached ones aside, see include_breached). ${DURATION_HINT} Omit to list everything inside the thresholds.`),
+			include_breached: boolean$1().default(true).describe("Whether to list metrics already past their deadline (BREACHED). Defaults to true; set false to see only what can still be saved."),
+			warning: string$2().optional().describe(`Override the WARNING threshold of every metric family for this call only: how much time left before a breach counts as a warning. Given alone, a family's critical threshold is lowered to it where longer. ${DURATION_HINT}`),
+			critical: string$2().optional().describe(`Override the CRITICAL threshold of every metric family for this call only. Given alone, a family's warning threshold is raised to it where shorter; given with warning, it must not exceed it. ${DURATION_HINT}`)
+		}),
+		annotations: {
+			readOnlyHint: true,
+			destructiveHint: false,
+			idempotentHint: true,
+			openWorldHint: true
+		},
+		handler: async (rawParams, call) => {
+			const params = rawParams;
+			const sla = requireSla(ctx.sla);
+			const given = [
+				params.scope,
+				params.view,
+				params.query
+			].filter((v) => v !== void 0);
+			if (given.length > 1) throw new Error("Pass only one of scope, view or query.");
+			const withinMinutes = parseWithin(params.within);
+			const overridden = params.warning !== void 0 || params.critical !== void 0;
+			const checked = overrideThresholds(await sla.thresholds(), params.warning, params.critical);
+			if ("error" in checked) throw new Error(checked.error);
+			const token = await getToken();
+			const view = params.view === void 0 ? void 0 : await resolveView(token, params.view);
+			if (typeof view === "string") return { content: [{
+				type: "text",
+				text: view
+			}] };
+			const { picked, notes, prefs, edited } = await settleForm(sla, call, given.length === 0);
+			const override = edited ? overrideThresholds(edited, params.warning, params.critical) : checked;
+			if ("error" in override) throw new Error(override.error);
+			const scope = view ?? resolveNamedScope(params, picked, notes);
+			const { text } = await checkAlerts({
+				sla,
+				get: (path, query) => zendeskGet(subdomain, token, path, query),
+				target: scope,
+				thresholds: override.thresholds,
+				source: thresholdsSource(sla, prefs, overridden || edited !== void 0),
+				filter: {
+					withinMinutes,
+					includeBreached: params.include_breached
+				},
+				notes
+			});
+			return { content: [{
+				type: "text",
+				text
+			}] };
+		}
+	}];
+};
+/**
+* Reads the alert resources (`zendesk-sla://alerts/...`) with the caller's
+* token and thresholds, rendered like list_sla_alerts with its defaults. The
+* poller asks it for the fingerprint only. A view title resolves once per
+* reader (that is, per connection, session or grant): resolving pages through
+* /views, which no scope cache would spare on every poll.
+*/
+const createAlertsReader = (ctx) => {
+	const viewIds = /* @__PURE__ */ new Map();
+	const viewScope = async (view, token) => {
+		const known = viewIds.get(view);
+		if (known !== void 0) return {
+			kind: "view",
+			viewId: known
+		};
+		const resolved = await resolveViewId(ctx.subdomain, token, view);
+		if ("available" in resolved) throw new Error(`No active view matches "${view}". Available views: ${resolved.available.join(", ") || "none"}.`);
+		viewIds.set(view, resolved.id);
+		return {
+			kind: "view",
+			viewId: resolved.id
+		};
+	};
+	const evaluate = async (uri) => {
+		const sla = requireSla(ctx.sla);
+		const target = parseAlertsUri(uri);
+		if (!target) throw new Error(`Not an SLA alert resource: ${uri}`);
+		const token = await ctx.getToken();
+		const scope = target.kind === "view" ? await viewScope(target.view, token) : target;
+		const prefs = sla.userPreferencesAllowed ? await sla.preferences().catch(() => void 0) : void 0;
+		try {
+			return await checkAlerts({
+				sla,
+				get: (path, query) => zendeskGet(ctx.subdomain, token, path, query),
+				target: scope,
+				thresholds: await sla.thresholds(),
+				source: thresholdsSource(sla, prefs, false),
+				filter: { includeBreached: true },
+				notes: []
+			});
+		} catch (err) {
+			if (target.kind === "view") viewIds.delete(target.view);
+			throw err;
+		}
+	};
+	return {
+		read: async (uri) => (await evaluate(uri)).text,
+		fingerprint: async (uri) => (await evaluate(uri)).fingerprint
+	};
+};
+//#endregion
 //#region src/tools/users.ts
 const createUserTools = (ctx) => {
 	const { subdomain, getToken } = ctx;
@@ -109783,10 +110915,12 @@ const createUserTools = (ctx) => {
 //#region src/tools/index.ts
 const createAllTools = (ctx) => [
 	...createTicketTools(ctx),
+	...createSlaAlertTools(ctx),
 	...createRequestTools(ctx),
 	...createSearchTools(ctx),
 	...createHelpCenterTools(ctx),
-	...createUserTools(ctx)
+	...createUserTools(ctx),
+	...createPreferenceTools(ctx)
 ];
 //#endregion
 //#region src/utils/logger.ts
@@ -109911,7 +111045,359 @@ const createRequestStateCodec = ({ key = randomBytes(32), principal = () => "" }
 	bind: (ctx) => `${ctx.mcpReq.method}\0${principal()}`
 });
 //#endregion
+//#region src/utils/sign-in-required.ts
+const SIGN_IN_REQUIRED = "SignInRequiredError";
+/**
+* What a background caller (the SLA alert poller) gets instead of a browser
+* sign-in: only a user action may open one, so the next tool call does.
+*/
+const signInRequiredError = () => Object.assign(/* @__PURE__ */ new Error("Not signed in to Zendesk: the next tool call starts the sign-in."), { name: SIGN_IN_REQUIRED });
+const isSignInRequired = (error) => error instanceof Error && error.name === SIGN_IN_REQUIRED;
+//#endregion
+//#region src/utils/sla-poller.ts
+/**
+* Polls the subscribed alert resources while there is at least one, and
+* notifies a URI only when its alert set changed: which tickets, metrics and
+* levels. The fingerprint at subscription time is the baseline, so the first
+* round never notifies on its own. The timer is unref'd and stops with the
+* last subscription.
+*/
+const createAlertPoller = (options) => {
+	const { intervalMs, check, notify, onError = () => void 0 } = options;
+	const fingerprints = /* @__PURE__ */ new Map();
+	let timer;
+	let running = false;
+	const refresh = async (uri) => {
+		try {
+			const next = await check(uri);
+			const previous = fingerprints.get(uri);
+			if (previous !== void 0 && previous !== next) await notify(uri);
+			if (fingerprints.has(uri)) fingerprints.set(uri, next);
+		} catch (error) {
+			onError(uri, error);
+		}
+	};
+	const tick = async () => {
+		if (running) return;
+		running = true;
+		try {
+			for (const uri of [...fingerprints.keys()]) await refresh(uri);
+		} finally {
+			running = false;
+		}
+	};
+	const stopTimer = () => {
+		clearInterval(timer);
+		timer = void 0;
+	};
+	return {
+		subscribe: (uri) => {
+			if (fingerprints.has(uri)) return;
+			fingerprints.set(uri, void 0);
+			refresh(uri);
+			if (!timer) {
+				timer = setInterval(() => void tick(), intervalMs);
+				timer.unref();
+			}
+		},
+		unsubscribe: (uri) => {
+			fingerprints.delete(uri);
+			if (fingerprints.size === 0) stopTimer();
+		},
+		stop: () => {
+			fingerprints.clear();
+			stopTimer();
+		},
+		subscriptions: () => [...fingerprints.keys()],
+		tick
+	};
+};
+//#endregion
+//#region src/auth/token-persistence.ts
+const isWindows = process.platform === "win32";
+/**
+* Config-dir segments derived from the *scoped* package name
+* (`@fruggr/zendesk-mcp-server` → `fruggr` + `zendesk-mcp-server`) so the path is
+* vendor-namespaced and can't collide with another `zendesk-mcp-server`.
+*/
+const SCOPED_PACKAGE_NAME = /^@([^/]+)\/(.+)/;
+const appDirSegments = () => {
+	const { name } = readPackageInfo();
+	const scoped = SCOPED_PACKAGE_NAME.exec(name);
+	return scoped?.[1] && scoped[2] ? [scoped[1], scoped[2]] : [name];
+};
+const configDir = () => {
+	const segments = appDirSegments();
+	if (isWindows) {
+		const base = process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming");
+		return join(base, ...segments);
+	}
+	const base = process.env["XDG_CONFIG_HOME"] ?? join(homedir(), ".config");
+	return join(base, ...segments);
+};
+const safeName = (part) => part.replace(/[^a-z0-9-]/gi, "_");
+const READABLE_BUDGET = 120;
+const keyDigest = (key) => createHash("sha256").update(JSON.stringify([
+	key.subdomain,
+	key.oauthClientId,
+	key.scope
+])).digest("hex").slice(0, 8);
+/**
+* Path to the token file for one credential. Keyed on the whole `TokenKey`, so
+* a read-only server, a read-write one and one on another OAuth client each get
+* their own record instead of clobbering a shared file. Why that triple, and
+* why no migration from the old subdomain-only layout:
+* `docs/decisions/token-file-keying.md`.
+* `OAUTH_TOKEN_FILE` overrides with an explicit path — the way to separate
+* two Zendesk accounts that share a subdomain, client and scope.
+*/
+const resolveTokenPath = (key) => {
+	const { name, value: override } = readEnv("OAUTH_TOKEN_FILE");
+	if (override === "") throw new Error(`Empty ${name}. Set it to a value, or unset it entirely.`);
+	if (override) return override;
+	const readable = [
+		key.subdomain,
+		key.oauthClientId,
+		key.scope
+	].map(safeName).join("--").slice(0, READABLE_BUDGET);
+	return join(configDir(), `${readable}--${keyDigest(key)}.json`);
+};
+const writeFileAtomic = (path, record) => {
+	const dir = dirname(path);
+	mkdirSync(dir, { recursive: true });
+	const tmp = `${path}.${process.pid}.tmp`;
+	writeFileSync(tmp, JSON.stringify(record, null, 2), "utf8");
+	if (!isWindows) chmodSync(tmp, 384);
+	renameSync(tmp, path);
+	if (!isWindows) try {
+		chmodSync(dir, 448);
+	} catch {}
+};
+const loadToken = (path) => {
+	try {
+		const raw = JSON.parse(readFileSync(path, "utf8"));
+		if (typeof raw?.accessToken === "string") return raw;
+	} catch {}
+};
+const saveToken = (path, record, logger = silentLogger) => {
+	try {
+		writeFileAtomic(path, record);
+		logger.debug("token_persisted");
+	} catch (err) {
+		logger.warn("token_persist_failed", { error: err instanceof Error ? err.message : String(err) });
+	}
+};
+const clearToken = (path, logger = silentLogger) => {
+	try {
+		rmSync(path, { force: true });
+		logger.debug("token_cleared");
+	} catch (err) {
+		logger.warn("token_clear_failed", { error: err instanceof Error ? err.message : String(err) });
+	}
+};
+//#endregion
+//#region src/utils/scope-cache.ts
+/**
+* Serves `load()` from `store` for `ttlMs`, and makes concurrent calls for the
+* same key share one in-flight load. Zendesk charges a conditional GET as a
+* full request (PR #387 spike 2), so this lifetime is the only quota saving.
+* A store that fails to save only costs the cache, never the answer.
+*/
+const createScopeCache = (store, ttlMs) => {
+	const inFlight = /* @__PURE__ */ new Map();
+	return (key, load) => {
+		const pending = inFlight.get(key);
+		if (pending) return pending;
+		const run = (async () => {
+			const hit = await store.get(key).catch(() => void 0);
+			if (hit !== void 0) return hit;
+			const value = await load();
+			await store.set(key, value, ttlMs).catch(() => void 0);
+			return value;
+		})().finally(() => inFlight.delete(key));
+		inFlight.set(key, run);
+		return run;
+	};
+};
+//#endregion
+//#region src/utils/state-store.ts
+const isLive = (entry, now) => entry.expiresAt === void 0 || entry.expiresAt > now;
+const toEntry = (key, value, now, ttlMs) => ttlMs === void 0 ? {
+	key,
+	value
+} : {
+	key,
+	value,
+	expiresAt: now + ttlMs
+};
+/** One process, nothing on disk: the default on HTTP, where sessions share the process. */
+const createMemoryStore = (now = Date.now) => {
+	const entries = /* @__PURE__ */ new Map();
+	return {
+		get: async (key) => {
+			const entry = entries.get(key);
+			return entry && isLive(entry, now()) ? entry.value : void 0;
+		},
+		set: async (key, value, ttlMs) => {
+			entries.set(key, toEntry(key, value, now(), ttlMs));
+		},
+		delete: async (key) => {
+			entries.delete(key);
+		},
+		sweep: async () => {
+			const at = now();
+			for (const [key, entry] of entries) if (!isLive(entry, at)) entries.delete(key);
+			return true;
+		}
+	};
+};
+const LOCK_FILE = "cleanup.lock";
+const errnoOf = (err) => err.code;
+const ignore = () => void 0;
+const remove = (path) => unlink(path).catch(ignore);
+const fileOf = (dir, key) => join(dir, `${createHash("sha256").update(key).digest("hex").slice(0, 32)}.json`);
+const readEntry = (path) => readFile(path, "utf8").then((text) => JSON.parse(text)).catch((err) => {
+	if (err instanceof SyntaxError || errnoOf(err) === "ENOENT") return void 0;
+	throw err;
+});
+/**
+* Entries as one file each under `dir` (0600, directory 0700), written to a
+* temp file then renamed so a reader never sees half an entry. Several stdio
+* processes we do not control share it; see `sweep` for how they clean up
+* without stepping on each other.
+*/
+const createDiskStore = (dir, options = {}) => {
+	const { now = Date.now, lockStaleMs = 12e4, tempStaleMs = 3e5 } = options;
+	const ensureDir = async () => {
+		await mkdir(dir, {
+			recursive: true,
+			mode: 448
+		});
+		await chmod(dir, 448);
+	};
+	const acquireLock = async (lock, mayTakeOver = true) => {
+		try {
+			const handle = await open(lock, "wx", 384);
+			await handle.writeFile(JSON.stringify({
+				pid: process.pid,
+				at: now()
+			}));
+			await handle.close();
+			return true;
+		} catch (err) {
+			const code = errnoOf(err);
+			if (code === "ENOENT") return null;
+			if (code !== "EEXIST" || !mayTakeOver) return false;
+		}
+		const held = await readEntry(lock).catch(ignore);
+		if (typeof held?.at === "number" && now() - held.at < lockStaleMs) return false;
+		await remove(lock);
+		return acquireLock(lock, false);
+	};
+	const sweepFile = async (name, at) => {
+		const path = join(dir, name);
+		if (name.endsWith(".tmp")) {
+			const info = await stat(path).catch(ignore);
+			if (info && at - info.mtimeMs > tempStaleMs) await remove(path);
+			return;
+		}
+		const entry = await readEntry(path).catch(ignore);
+		if (entry && !isLive(entry, at)) await remove(path);
+	};
+	return {
+		get: async (key) => {
+			const entry = await readEntry(fileOf(dir, key));
+			return entry?.key === key && isLive(entry, now()) ? entry.value : void 0;
+		},
+		set: async (key, value, ttlMs) => {
+			await ensureDir();
+			const path = fileOf(dir, key);
+			const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+			await writeFile(temp, JSON.stringify(toEntry(key, value, now(), ttlMs)), { mode: 384 });
+			await rename(temp, path);
+		},
+		delete: (key) => remove(fileOf(dir, key)),
+		sweep: async () => {
+			const lock = join(dir, LOCK_FILE);
+			const acquired = await acquireLock(lock);
+			if (acquired !== true) return acquired === null;
+			try {
+				const at = now();
+				for (const name of await readdir(dir)) await sweepFile(name, at);
+			} finally {
+				await remove(lock);
+			}
+			return true;
+		}
+	};
+};
+/**
+* Sweeps `store` every `intervalMs`, never at startup. The timer is unref'd so
+* it never keeps a process alive; the returned function stops it.
+*/
+const startSweeper = (store, intervalMs = 6e5) => {
+	const timer = setInterval(() => {
+		store.sweep().catch(() => void 0);
+	}, intervalMs);
+	timer.unref();
+	return () => clearInterval(timer);
+};
+//#endregion
+//#region src/utils/sla-service.ts
+const createSlaRuntime = (settings, store = createMemoryStore()) => ({
+	store,
+	cache: createScopeCache(store, settings.slaCacheTtlSeconds * 1e3)
+});
+/**
+* The runtime the entry point builds once per process: the store the config
+* selects, next to the token files when on disk, swept in the background.
+* `stop` ends the sweeper.
+*/
+const startSlaRuntime = (config) => {
+	const store = slaStateStoreOf(config) === "disk" ? createDiskStore(join(configDir(), "sla-state")) : createMemoryStore();
+	return {
+		runtime: createSlaRuntime(config, store),
+		stop: startSweeper(store)
+	};
+};
+const MAX_REMEMBERED_TOKENS = 8;
+/**
+* Resolves the caller's Zendesk user id once per token (`/users/me`), so a
+* refreshed or another user's token can never read an entry cached under the
+* previous one. A failed lookup is forgotten, to be retried on the next call.
+*/
+const createUserIdResolver = (subdomain, getToken) => {
+	const byToken = /* @__PURE__ */ new Map();
+	return async () => {
+		const token = await getToken();
+		const known = byToken.get(token);
+		if (known) return known;
+		const lookup = zendeskGet(subdomain, token, "/users/me").then(({ user }) => user.id);
+		lookup.catch(() => byToken.delete(token));
+		if (byToken.size >= MAX_REMEMBERED_TOKENS) byToken.delete(byToken.keys().next().value);
+		byToken.set(token, lookup);
+		return lookup;
+	};
+};
+const createSlaService = (settings, runtime, userId) => {
+	const userKey = async () => `${settings.subdomain}:${await userId()}`;
+	const preferences = async () => await runtime.store.get(`prefs:${await userKey()}`);
+	return {
+		push: settings.slaPush,
+		userPreferencesAllowed: settings.slaUserPreferences,
+		adminThresholds: settings.slaThresholds,
+		thresholds: async () => settings.slaUserPreferences ? preferences().then((prefs) => effectiveThresholds(settings.slaThresholds, prefs), () => settings.slaThresholds) : settings.slaThresholds,
+		preferences,
+		savePreferences: async (prefs) => runtime.store.set(`prefs:${await userKey()}`, prefs),
+		userId,
+		cached: async (scope, load) => runtime.cache(`cache:${await userKey()}:${scope}`, load)
+	};
+};
+//#endregion
 //#region src/server.ts
+const noteUnauthorized = (err, onUnauthorized) => {
+	if (onUnauthorized && err instanceof ZendeskApiError && err.status === 401) onUnauthorized();
+};
 /**
 * Invoke a tool handler, notifying `onUnauthorized` when Zendesk rejects the
 * token (401), so the OAuth store drops the dead token instead of replaying it.
@@ -109924,19 +111410,25 @@ const createRequestStateCodec = ({ key = randomBytes(32), principal = () => "" }
 * this rare — it fires only for a token revoked between the pre-call check and
 * the request.
 */
-const runHandler = async (def, params, onUnauthorized) => {
+const runHandler = async (def, params, onUnauthorized, call) => {
 	try {
-		return await def.handler(params);
+		return await def.handler(params, call);
 	} catch (err) {
-		if (onUnauthorized && err instanceof ZendeskApiError && err.status === 401) onUnauthorized();
+		if (isInputRequiredError(err)) return err.inputRequired;
+		noteUnauthorized(err, onUnauthorized);
 		throw err;
 	}
 };
+/** The parts of the SDK request context a tool handler may use. */
+const toCallContext = (server, ctx) => ({
+	canElicit: supportsFormElicitation(ctx.mcpReq.envelope?.["io.modelcontextprotocol/clientCapabilities"] ?? server.server.getClientCapabilities()),
+	inputResponses: ctx.mcpReq.inputResponses
+});
 const aggregateAnnotations = (tools) => ({
 	readOnlyHint: tools.every((t) => t.annotations.readOnlyHint),
 	destructiveHint: tools.some((t) => t.annotations.destructiveHint),
 	idempotentHint: tools.every((t) => t.annotations.idempotentHint),
-	openWorldHint: true
+	openWorldHint: tools.some((t) => t.annotations.openWorldHint)
 });
 const buildProxyDispatch = (tools, onUnauthorized) => {
 	const operationNames = tools.map((t) => t.name);
@@ -109944,7 +111436,7 @@ const buildProxyDispatch = (tools, onUnauthorized) => {
 		def: t,
 		parseParams: createStrictParamsParser(t.inputSchema)
 	}]));
-	return async (args) => {
+	return async (args, call) => {
 		const { operation, params } = args;
 		const entry = localHandlers.get(operation);
 		if (!entry) return { content: [{
@@ -109952,7 +111444,7 @@ const buildProxyDispatch = (tools, onUnauthorized) => {
 			text: `Unknown operation "${operation}". Available: ${operationNames.join(", ")}`
 		}] };
 		const validated = entry.parseParams(params);
-		return runHandler(entry.def, validated, onUnauthorized);
+		return runHandler(entry.def, validated, onUnauthorized, call);
 	};
 };
 const registerProxyTool = (server, toolName, title, tools, readOnlyMode, onUnauthorized) => {
@@ -109963,14 +111455,25 @@ const registerProxyTool = (server, toolName, title, tools, readOnlyMode, onUnaut
 		description: buildProxyDescription({
 			title,
 			tools,
-			readOnly: readOnlyMode
+			readOnly: readOnlyMode && annotations.readOnlyHint
 		}),
 		inputSchema: object({
 			operation: string$2().describe(buildOperationFieldDescription(tools)),
 			params: record(string$2(), unknown$3()).default({}).describe(PARAMS_FIELD_DESCRIPTION)
 		}),
 		annotations
-	}, async (args) => dispatch(args));
+	}, async (args, ctx) => dispatch(args, toCallContext(server, ctx)));
+};
+/**
+* `single` mode: one `zendesk` proxy for every Zendesk tool. The preferences
+* configure this server, not Zendesk: they keep their own proxy, so `zendesk`
+* stays `[RO]` and readOnlyHint under --read-only.
+*/
+const registerSingleProxies = (server, tools, readOnlyMode, onUnauthorized) => {
+	const preferences = tools.filter((tool) => tool.namespace === "preferences");
+	const zendesk = tools.filter((tool) => tool.namespace !== "preferences");
+	const label = NAMESPACE_LABELS.preferences;
+	return [...zendesk.length > 0 || preferences.length === 0 ? [registerProxyTool(server, "zendesk", "Zendesk", zendesk, readOnlyMode, onUnauthorized)] : [], ...preferences.length > 0 ? [registerProxyTool(server, label.toolName, label.title, preferences, readOnlyMode, onUnauthorized)] : []];
 };
 /**
 * Build the bare `McpServer` — identity, `instructions` — with no tools or
@@ -109993,10 +111496,158 @@ const createServerCaches = (config, getToken, onUnauthorized) => {
 	const resolveBrandSubdomain = createBrandSubdomainResolver(config.subdomain, getToken);
 	return {
 		resolveBrandSubdomain,
+		resolveUserId: createUserIdResolver(config.subdomain, getToken),
 		topology: helpCenterContextEnabled(config) ? createTopologyProvider(getToken, config.subdomain, onUnauthorized, config.brandIds, firstBrandSubdomainResolver(config, resolveBrandSubdomain)) : void 0,
 		articles: articleResourceEnabled(config) ? createArticleResourcesProvider(getToken, config.subdomain, onUnauthorized, resourceBrandResolver(config, resolveBrandSubdomain), config.brandIds) : void 0
 	};
 };
+const ALERTS_MIME = "text/markdown";
+const registerAlertResources = (server, reader, push) => {
+	const read = async (uri) => ({ contents: [{
+		uri: uri.toString(),
+		mimeType: ALERTS_MIME,
+		text: await reader.read(uri.toString())
+	}] });
+	const describe = `SLA metrics breached or about to breach, one line each, grouped BREACHED / CRITICAL / WARNING and soonest first, against your alert thresholds; the same report as list_sla_alerts.${push ? " Subscribe to be told when the set of alerts changes." : ""}`;
+	return [
+		server.registerResource("sla-alerts", new ResourceTemplate(SLA_ALERTS_TEMPLATES.named, { list: async () => ({ resources: NAMED_SCOPES.map((scope) => ({
+			uri: namedAlertsUri(scope),
+			name: `SLA alerts: ${scope}`,
+			mimeType: ALERTS_MIME
+		})) }) }), {
+			title: "Zendesk SLA alerts",
+			description: `${describe} {scope} is mine, my_groups or all (unsolved tickets).`,
+			mimeType: ALERTS_MIME
+		}, read),
+		server.registerResource("sla-alerts-view", new ResourceTemplate(SLA_ALERTS_TEMPLATES.view, { list: void 0 }), {
+			title: "Zendesk SLA alerts in a view",
+			description: `${describe} {view} is a view title or id, as list_views shows it.`,
+			mimeType: ALERTS_MIME
+		}, read),
+		server.registerResource("sla-alerts-query", new ResourceTemplate(SLA_ALERTS_TEMPLATES.query, { list: void 0 }), {
+			title: "Zendesk SLA alerts for a search",
+			description: `${describe} {query} is any Zendesk ticket search query.`,
+			mimeType: ALERTS_MIME
+		}, read)
+	];
+};
+/** Re-checks each subscribed URI every `slaPollSeconds`; notifies when its alert set changes. */
+const createAlertsPoller = (config, reader, notify, logger) => createAlertPoller({
+	intervalMs: config.slaPollSeconds * 1e3,
+	check: reader.fingerprint,
+	notify,
+	onError: (uri, error) => {
+		if (isSignInRequired(error)) {
+			logger.debug("sla_alerts_poll_skipped", { uri });
+			return;
+		}
+		logger.warn("sla_alerts_poll_failed", {
+			uri,
+			error: error instanceof Error ? error.message : String(error)
+		});
+	}
+});
+/**
+* The SLA settings a server applies: personal thresholds only where
+* `configure_sla_alerts`, the one way to change them, is exposed.
+*/
+const slaSettings = (config) => ({
+	...config,
+	slaUserPreferences: slaPreferencesEnabled(config)
+});
+/** The context the tools and the alert readers share. */
+const toolContext = (config, getToken, resolveBrandSubdomain, sla) => ({
+	subdomain: config.subdomain,
+	brandIds: config.brandIds,
+	resolveBrandSubdomain,
+	getToken,
+	sla
+});
+/** `reader`, with a Zendesk 401 reported like a tool's: the dead token is dropped, not replayed. */
+const reportingUnauthorized = (reader, onUnauthorized) => {
+	const note = (err) => {
+		noteUnauthorized(err, onUnauthorized);
+		throw err;
+	};
+	return {
+		read: (uri) => reader.read(uri).catch(note),
+		fingerprint: (uri) => reader.fingerprint(uri).catch(note)
+	};
+};
+/** The reader the SLA alert poller checks with. */
+const createAlertPollingReader = ({ config, getToken, resolveUserId, caches, slaRuntime, onUnauthorized }) => reportingUnauthorized(createAlertsReader(toolContext(config, getToken, caches.resolveBrandSubdomain, createSlaService(slaSettings(config), slaRuntime, resolveUserId))), onUnauthorized);
+/**
+* The token source and user-id lookup a poller runs with: a background one
+* when the transport has it (stdio, whose `getToken` may open a browser).
+*/
+const pollingIdentity = (config, getToken, caches, getBackgroundToken) => getBackgroundToken ? {
+	getToken: getBackgroundToken,
+	resolveUserId: createUserIdResolver(config.subdomain, getBackgroundToken)
+} : {
+	getToken,
+	resolveUserId: caches.resolveUserId
+};
+/** Polls the SLA alert resources a 2026-07-28 client listens to; other URIs are not ours. */
+const pollListenedAlerts = (poller, listens) => listens.attach({
+	add: (uri) => {
+		if (parseAlertsUri(uri)) poller.subscribe(uri);
+	},
+	remove: (uri) => poller.unsubscribe(uri)
+});
+/**
+* The server pushing alert changes on its own, through `resources/subscribe`
+* for a 2025 client and the `listens` streams for a 2026-07-28 one when the
+* server lives as long as its connection (stdio). Installed once per server,
+* before it connects, and only with push on. Stops with the server.
+*/
+const installAlertSubscriptions = (server, config, reader, logger = silentLogger, listens) => {
+	const poller = createAlertsPoller(config, reader, (uri) => server.server.sendResourceUpdated({ uri }), logger);
+	const subscribable = (uri) => {
+		if (!parseAlertsUri(uri)) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Only SLA alert resources (${SLA_RESOURCE_SCHEME}://alerts/...) can be subscribed to: ${uri}`);
+		return uri;
+	};
+	server.server.registerCapabilities({ resources: { subscribe: true } });
+	server.server.setRequestHandler("resources/subscribe", (request) => {
+		poller.subscribe(subscribable(request.params.uri));
+		return {};
+	});
+	server.server.setRequestHandler("resources/unsubscribe", (request) => {
+		poller.unsubscribe(request.params.uri);
+		return {};
+	});
+	const detach = listens ? pollListenedAlerts(poller, listens) : void 0;
+	const previous = server.server.onclose;
+	server.server.onclose = () => {
+		detach?.();
+		poller.stop();
+		previous?.();
+	};
+	return poller;
+};
+/**
+* The SLA alert polling of a 2026-07-28 HTTP grant: its servers last one
+* request each, so the poller lives with the grant, fed by the grant's listen
+* streams. Returns the stop; a no-op when the push is off.
+*/
+const watchGrantAlerts = ({ config, getToken, caches, slaRuntime, logger, listens, notify, onUnauthorized }) => {
+	if (!(config.slaPush && slaAlertsEnabled(config))) return () => void 0;
+	const reader = createAlertPollingReader({
+		config,
+		getToken,
+		resolveUserId: caches.resolveUserId,
+		caches,
+		slaRuntime,
+		onUnauthorized
+	});
+	const poller = createAlertsPoller(config, reader, async (uri) => {
+		notify(uri);
+	}, logger);
+	const detach = pollListenedAlerts(poller, listens);
+	return () => {
+		detach();
+		poller.stop();
+	};
+};
 /**
 * Lazily resolve the Help Center subdomain the topology resource pins to: the
 * FIRST allowed brand when a list is set (named in the header), else undefined
@@ -110032,8 +111683,9 @@ const resourceBrandResolver = (config, resolveBrandSubdomain) => {
 * without dropping the transport. `tools` is passed in (not built here) so the
 * reload path can hand over freshly re-imported definitions.
 */
-const registerToolset = (server, { config, getToken, caches, onUnauthorized, logger = silentLogger }, tools) => {
-	const { topology, articles } = caches ?? createServerCaches(config, getToken, onUnauthorized);
+const registerToolset = (server, { config, getToken, caches, onUnauthorized, logger = silentLogger, sla }, tools) => {
+	const shared = caches ?? createServerCaches(config, getToken, onUnauthorized);
+	const { topology, articles } = shared;
 	const registered = [];
 	const dispose = () => {
 		for (const handle of registered) handle.remove();
@@ -110051,7 +111703,7 @@ const registerToolset = (server, { config, getToken, caches, onUnauthorized, log
 					description: tool.description,
 					inputSchema: toStrictStandardSchema(tool.inputSchema),
 					annotations: tool.annotations
-				}, async (params) => runHandler(tool, params, onUnauthorized)));
+				}, async (params, ctx) => runHandler(tool, params, onUnauthorized, toCallContext(server, ctx))));
 				break;
 			case "namespace": {
 				const grouped = groupByNamespace(filteredTools);
@@ -110062,7 +111714,7 @@ const registerToolset = (server, { config, getToken, caches, onUnauthorized, log
 				break;
 			}
 			case "single":
-				registered.push(registerProxyTool(server, "zendesk", "Zendesk", filteredTools, config.readOnly, onUnauthorized));
+				registered.push(...registerSingleProxies(server, filteredTools, config.readOnly, onUnauthorized));
 				break;
 			default: {
 				const unhandled = config.mode;
@@ -110117,6 +111769,7 @@ const registerToolset = (server, { config, getToken, caches, onUnauthorized, log
 				}] };
 			}));
 		}
+		if (sla && slaAlertsEnabled(config)) registered.push(...registerAlertResources(server, reportingUnauthorized(createAlertsReader(toolContext(config, getToken, shared.resolveBrandSubdomain, sla)), onUnauthorized), config.slaPush));
 	} catch (err) {
 		dispose();
 		throw err;
@@ -110130,25 +111783,38 @@ const registerToolset = (server, { config, getToken, caches, onUnauthorized, log
 		dispose
 	};
 };
-const createMcpServer = (config, getToken, logger = silentLogger, onUnauthorized, { caches = createServerCaches(config, getToken, onUnauthorized), requestStateCodec } = {}) => {
+const createMcpServer = (config, getToken, logger = silentLogger, onUnauthorized, { caches = createServerCaches(config, getToken, onUnauthorized), requestStateCodec, slaRuntime = createSlaRuntime(config), listens, getBackgroundToken, alertPolling = "server" } = {}) => {
 	const server = createServerShell(config, requestStateCodec);
-	const tools = createAllTools({
-		subdomain: config.subdomain,
-		brandIds: config.brandIds,
-		resolveBrandSubdomain: caches.resolveBrandSubdomain,
-		getToken
-	});
+	const sla = createSlaService(slaSettings(config), slaRuntime, caches.resolveUserId);
 	registerToolset(server, {
 		config,
 		getToken,
 		caches,
 		onUnauthorized,
-		logger
-	}, tools);
+		logger,
+		sla
+	}, createAllTools(toolContext(config, getToken, caches.resolveBrandSubdomain, sla)));
+	if (config.slaPush && slaAlertsEnabled(config)) {
+		if (alertPolling === "grant") server.server.registerCapabilities({ resources: { subscribe: true } });
+		else {
+			const reader = createAlertPollingReader({
+				config,
+				...pollingIdentity(config, getToken, caches, getBackgroundToken),
+				caches,
+				slaRuntime,
+				onUnauthorized
+			});
+			installAlertSubscriptions(server, config, reader, logger, listens);
+		}
+	}
 	return server;
 };
-const defaultServerFactory = ({ config, getToken, logger, onUnauthorized, caches, requestStateCodec }) => createMcpServer(config, getToken, logger, onUnauthorized, {
+const defaultServerFactory = ({ config, getToken, logger, onUnauthorized, caches, requestStateCodec, slaRuntime, listens, getBackgroundToken, alertPolling }) => createMcpServer(config, getToken, logger, onUnauthorized, {
 	...caches ? { caches } : {},
+	...slaRuntime ? { slaRuntime } : {},
+	...listens ? { listens } : {},
+	...getBackgroundToken ? { getBackgroundToken } : {},
+	...alertPolling ? { alertPolling } : {},
 	requestStateCodec
 });
 //#endregion
@@ -110731,8 +112397,119 @@ function toError(value) {
 	return value instanceof Error ? value : new Error(String(value));
 }
 //#endregion
+//#region src/utils/listen-feed.ts
+const tell = (sink, change, uri) => {
+	try {
+		sink[change](uri);
+	} catch {}
+};
+const createListenFeed = () => {
+	const streams = /* @__PURE__ */ new Map();
+	const listeners = /* @__PURE__ */ new Map();
+	const sinks = /* @__PURE__ */ new Set();
+	const close = (key) => {
+		const uris = streams.get(key);
+		if (!uris) return;
+		streams.delete(key);
+		for (const uri of uris) {
+			const count = (listeners.get(uri) ?? 0) - 1;
+			if (count > 0) {
+				listeners.set(uri, count);
+				continue;
+			}
+			listeners.delete(uri);
+			for (const sink of sinks) tell(sink, "remove", uri);
+		}
+	};
+	return {
+		open: (key, uris) => {
+			if (streams.has(key)) return;
+			const unique = [...new Set(uris)];
+			streams.set(key, unique);
+			for (const uri of unique) {
+				const count = (listeners.get(uri) ?? 0) + 1;
+				listeners.set(uri, count);
+				if (count === 1) for (const sink of sinks) tell(sink, "add", uri);
+			}
+		},
+		close,
+		closeAll: () => {
+			for (const key of [...streams.keys()]) close(key);
+		},
+		attach: (sink) => {
+			sinks.add(sink);
+			for (const uri of listeners.keys()) tell(sink, "add", uri);
+			return () => {
+				sinks.delete(sink);
+			};
+		}
+	};
+};
+const isRecord = (value) => typeof value === "object" && value !== null;
+/**
+* The resource URIs a `subscriptions/listen` request asks for, or `undefined`
+* when `message` is not one. A malformed filter reads as no URI: the SDK
+* refuses that request anyway.
+*/
+const listenedUris = (message) => {
+	if (!isRecord(message) || message["method"] !== "subscriptions/listen") return void 0;
+	const params = isRecord(message["params"]) ? message["params"] : {};
+	const uris = (isRecord(params["notifications"]) ? params["notifications"] : {})["resourceSubscriptions"];
+	return Array.isArray(uris) ? uris.filter((uri) => typeof uri === "string") : [];
+};
+/**
+* Feeds `feed` from a JSON-RPC connection's traffic: a listen request opens a
+* stream under its id; the client cancelling it, or any response carrying that
+* id (the SDK's refusal or its closing result), ends it.
+*/
+const createListenWireObserver = (feed) => ({
+	inbound: (message) => {
+		if (!isRecord(message)) return;
+		const uris = listenedUris(message);
+		if (uris && "id" in message) {
+			feed.open(message["id"], uris);
+			return;
+		}
+		if (message["method"] === "notifications/cancelled" && isRecord(message["params"])) feed.close(message["params"]["requestId"]);
+	},
+	outbound: (message) => {
+		if (isRecord(message) && !("method" in message) && "id" in message) feed.close(message["id"]);
+	}
+});
+//#endregion
 //#region src/transports/stdio.ts
 /**
+* `wire`, with its traffic reported to `feed`: `serveStdio` answers
+* `subscriptions/listen` before any server sees it.
+*/
+const observeListens = (wire, feed) => {
+	const observer = createListenWireObserver(feed);
+	return {
+		start: () => wire.start(),
+		send: (message, options) => {
+			observer.outbound(message);
+			return wire.send(message, options);
+		},
+		close: () => wire.close(),
+		setProtocolVersion: (version) => wire.setProtocolVersion?.(version),
+		set onmessage(handler) {
+			wire.onmessage = handler && ((message, extra) => {
+				observer.inbound(message);
+				handler(message, extra);
+			});
+		},
+		set onclose(handler) {
+			wire.onclose = () => {
+				feed.closeAll();
+				handler?.();
+			};
+		},
+		set onerror(handler) {
+			wire.onerror = handler;
+		}
+	};
+};
+/**
 * Serve MCP over stdio, both protocol eras: the SDK entry picks the era from the
 * client's opening exchange and pins one server from `build` per connection (a
 * `server/discover` probe that falls back to `initialize` builds one more, then
@@ -110740,17 +112517,19 @@ function toError(value) {
 */
 const startStdioTransport = (build, logger = silentLogger, options = {}) => {
 	const requestStateCodec = createRequestStateCodec({});
+	const listens = createListenFeed();
 	const handle = serveStdio(() => {
 		let server;
 		server = build({
 			requestStateCodec,
+			listens,
 			notifyResourceUpdated: (uri) => {
 				server?.server.sendResourceUpdated({ uri }).catch(() => void 0);
 			}
 		});
 		return server;
 	}, {
-		transport: options.transport ?? new StdioServerTransport(void 0, void 0, { maxBufferSize: 10485760 }),
+		transport: observeListens(options.transport ?? new StdioServerTransport(void 0, void 0, { maxBufferSize: 10485760 }), listens),
 		onerror: (error) => logger.warn("stdio_transport_error", { error: error.message })
 	});
 	logger.info("stdio_transport_ready");
@@ -110765,6 +112544,10 @@ const TOOL_MODULES = [
 		file: "tickets.ts",
 		factory: "createTicketTools"
 	},
+	{
+		file: "sla-alerts.ts",
+		factory: "createSlaAlertTools"
+	},
 	{
 		file: "requests.ts",
 		factory: "createRequestTools"
@@ -110780,6 +112563,10 @@ const TOOL_MODULES = [
 	{
 		file: "users.ts",
 		factory: "createUserTools"
+	},
+	{
+		file: "preferences.ts",
+		factory: "createPreferenceTools"
 	}
 ];
 /**
@@ -110806,22 +112593,29 @@ const loadFreshTools = async (ctx) => {
 * only matters after an edit); `reload()` disposes the current generation and
 * registers a fresh one.
 */
-const createReloadableServer = (config, getToken, logger = silentLogger, onUnauthorized, loadTools = loadFreshTools, requestStateCodec) => {
+const createReloadableServer = (config, getToken, logger = silentLogger, onUnauthorized, loadTools = loadFreshTools, requestStateCodec, slaRuntime = createSlaRuntime(config), listens, getBackgroundToken) => {
 	const server = createServerShell(config, requestStateCodec);
 	const caches = createServerCaches(config, getToken, onUnauthorized);
-	const ctx = {
-		subdomain: config.subdomain,
-		brandIds: config.brandIds,
-		resolveBrandSubdomain: caches.resolveBrandSubdomain,
-		getToken
-	};
+	const sla = createSlaService(slaSettings(config), slaRuntime, caches.resolveUserId);
+	const ctx = toolContext(config, getToken, caches.resolveBrandSubdomain, sla);
 	const params = {
 		config,
 		getToken,
 		caches,
 		onUnauthorized,
-		logger
+		logger,
+		sla
 	};
+	if (config.slaPush && slaAlertsEnabled(config)) {
+		const reader = createAlertPollingReader({
+			config,
+			...pollingIdentity(config, getToken, caches, getBackgroundToken),
+			caches,
+			slaRuntime,
+			onUnauthorized
+		});
+		installAlertSubscriptions(server, config, reader, logger, listens);
+	}
 	let currentTools = createAllTools(ctx);
 	let current = registerToolset(server, params, currentTools);
 	const reload = async () => {
@@ -110896,9 +112690,9 @@ const registerReloadTool = (server, reload, logger = silentLogger) => {
 */
 /* v8 ignore start -- runtime bootstrap: binds the reload tool to a real stdio
 transport; the reload machinery it wires up is covered by dev-reload.test.ts */
-const startDevServer = (config, getToken, logger = silentLogger, onUnauthorized) => {
-	const handle = startStdioTransport(({ requestStateCodec }) => {
-		const { server, reload } = createReloadableServer(config, getToken, logger, onUnauthorized, loadFreshTools, requestStateCodec);
+const startDevServer = (config, getToken, logger = silentLogger, onUnauthorized, slaRuntime, getBackgroundToken) => {
+	const handle = startStdioTransport(({ requestStateCodec, listens }) => {
+		const { server, reload } = createReloadableServer(config, getToken, logger, onUnauthorized, loadFreshTools, requestStateCodec, slaRuntime, listens, getBackgroundToken);
 		registerReloadTool(server, reload, logger);
 		return server;
 	}, logger);
@@ -111055,7 +112849,7 @@ const installShutdown = (options) => {
 //#endregion
 //#region src/index.ts
 const buildStdioTokenStore = async (config, logger) => {
-	const { createTokenStore } = await import("./token-store-DyO12sbo.js");
+	const { createTokenStore } = await import("./token-store-CQx_KFe2.js");
 	return createTokenStore({
 		subdomain: config.subdomain,
 		oauthClientId: config.oauthClientId,
@@ -111063,13 +112857,15 @@ const buildStdioTokenStore = async (config, logger) => {
 		readOnly: config.readOnly
 	}, logger);
 };
-const connectStdio = (config, tokenStore, logger) => {
-	if (config.dev) return startDevServer(config, tokenStore.getToken, logger, tokenStore.invalidate);
+const connectStdio = (config, tokenStore, logger, slaRuntime) => {
+	if (config.dev) return startDevServer(config, tokenStore.getToken, logger, tokenStore.invalidate, slaRuntime, tokenStore.getTokenSilently);
 	return startStdioTransport((extras) => defaultServerFactory({
 		config,
 		getToken: tokenStore.getToken,
 		logger,
 		onUnauthorized: tokenStore.invalidate,
+		getBackgroundToken: tokenStore.getTokenSilently,
+		slaRuntime,
 		...extras
 	}), logger);
 };
@@ -111088,11 +112884,13 @@ const main = async () => {
 	const logger = createLogger(config.logLevel);
 	if (config.transport === "stdio") {
 		const tokenStore = await buildStdioTokenStore(config, logger);
-		const stdio = connectStdio(config, tokenStore, logger);
+		const sla = startSlaRuntime(config);
+		const stdio = connectStdio(config, tokenStore, logger, sla.runtime);
 		installShutdown({
 			watchStdin: true,
 			logger,
 			cleanup: async () => {
+				sla.stop();
 				await stdio.close();
 				tokenStore.dispose();
 			}
@@ -111100,7 +112898,7 @@ const main = async () => {
 		return;
 	}
 	if (config.dev) logger.warn("dev_mode_ignored_http");
-	const { startHttpTransport } = await import("./http-DU1dSrPe.js");
+	const { startHttpTransport } = await import("./http-DDdso3Av.js");
 	const http = await startHttpTransport(config, logger);
 	installShutdown({
 		watchStdin: false,
@@ -111114,4 +112912,4 @@ main().catch((error) => {
 	process.exit(1);
 });
 //#endregion
-export { __exportAll$1 as C, __commonJSMin$1 as S, __toESM$1 as T, OAuthErrorCode as _, silentLogger as a, errnoCode as b, deadlineSignal as c, DEFAULT_MAX_REQUEST_BODY_SIZE as d, WebStandardStreamableHTTPServerTransport as f, OAuthError as g, verifyBearerToken as h, readPackageInfo as i, DEFAULT_CALLBACK_PORT as l, isLegacyRequest as m, defaultServerFactory as n, zendeskGet as o, createMcpHandler as p, createRequestStateCodec as r, REQUEST_TIMEOUT_MS as s, createServerCaches as t, getOAuthUrls as u, STARTUP_DOCS as v, __require as w, readEnv as x, createStartupError as y };
+export { __commonJSMin$1 as A, isLegacyRequest as C, STARTUP_DOCS as D, OAuthErrorCode as E, __require as M, __toESM$1 as N, createStartupError as O, createMcpHandler as S, OAuthError as T, deadlineSignal as _, watchGrantAlerts as a, DEFAULT_MAX_REQUEST_BODY_SIZE as b, configDir as c, saveToken as d, signInRequiredError as f, REQUEST_TIMEOUT_MS as g, zendeskGet as h, defaultServerFactory as i, __exportAll$1 as j, errnoCode as k, loadToken as l, silentLogger as m, listenedUris as n, startSlaRuntime as o, createRequestStateCodec as p, createServerCaches as r, clearToken as s, createListenFeed as t, resolveTokenPath as u, DEFAULT_CALLBACK_PORT as v, verifyBearerToken as w, WebStandardStreamableHTTPServerTransport as x, getOAuthUrls as y };