From 9227464c44de2fd0b91e7f23bef1fd8c74b42fe3 Mon Sep 17 00:00:00 2001
From: flashduty-bot <bot@flashcat.cloud>
Date: Thu, 10 Sep 2026 10:02:55 +0800
Subject: [PATCH 1/4] feat(monit): support datasource query tools in invoke
 command and skill cards

---
 go.mod                                        |   2 +-
 go.sum                                        |  10 +-
 internal/cli/datasource_tools_test.go         |  45 +
 internal/cli/zz_generated_alert_rules.go      | 931 +++++++++---------
 internal/cli/zz_generated_applications.go     | 405 ++++++++
 internal/cli/zz_generated_data_sources.go     |  11 +-
 internal/cli/zz_generated_manifest.go         |  14 +-
 internal/cli/zz_generated_members.go          |   6 +
 internal/cli/zz_generated_response_help.go    | 409 ++++----
 internal/cli/zz_generated_schedules.go        |  64 ++
 skills/flashduty/reference/member.md          |   1 +
 .../flashduty/reference/monit-datasource.md   |  18 +-
 skills/flashduty/reference/monit-query.md     |   4 +-
 skills/flashduty/reference/monit-rule.md      | 166 ++--
 skills/flashduty/reference/rum.md             |  38 +
 skills/flashduty/reference/schedule.md        |   5 +
 16 files changed, 1331 insertions(+), 798 deletions(-)

diff --git a/go.mod b/go.mod
index 603bbe5..9861816 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/flashcatcloud/flashduty-cli
 go 1.25.1
 
 require (
-	github.com/flashcatcloud/go-flashduty v0.15.1-0.20260908113851-5bf8f2902391
+	github.com/flashcatcloud/go-flashduty v0.15.2-0.20260910014922-dce7c882be68
 	github.com/mattn/go-runewidth v0.0.28
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
diff --git a/go.sum b/go.sum
index 732a29b..c20d3d6 100644
--- a/go.sum
+++ b/go.sum
@@ -1,14 +1,8 @@
 github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY=
 github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/flashcatcloud/go-flashduty v0.15.1-0.20260908003559-2ac06de1601e h1:CW8D+jijv7S/oJqj/hVMjMxzCzlT93FJPBx902bg5Nk=
-github.com/flashcatcloud/go-flashduty v0.15.1-0.20260908003559-2ac06de1601e/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
-github.com/flashcatcloud/go-flashduty v0.15.1-0.20260908025802-4fa9a76d8b57 h1:3g7059LyEJeIsLwT3qSng8BdV44GIOV9DQa+dLbalmo=
-github.com/flashcatcloud/go-flashduty v0.15.1-0.20260908025802-4fa9a76d8b57/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
-github.com/flashcatcloud/go-flashduty v0.15.1-0.20260908030757-f478f34797be h1:F3+A0vVRICnEeBshac70P+VBtuo64P5hBmxcfbFxiXk=
-github.com/flashcatcloud/go-flashduty v0.15.1-0.20260908030757-f478f34797be/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
-github.com/flashcatcloud/go-flashduty v0.15.1-0.20260908113851-5bf8f2902391 h1:u4IM9wE2/isYCAUMszeBsp4b9Na7Qh5mHlvPLpDgvkw=
-github.com/flashcatcloud/go-flashduty v0.15.1-0.20260908113851-5bf8f2902391/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
+github.com/flashcatcloud/go-flashduty v0.15.2-0.20260910014922-dce7c882be68 h1:jPJA1NB+HcL2FcBZ+PbVZ0xejVvqELOMHEBDJYGUbQ0=
+github.com/flashcatcloud/go-flashduty v0.15.2-0.20260910014922-dce7c882be68/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU=
diff --git a/internal/cli/datasource_tools_test.go b/internal/cli/datasource_tools_test.go
index b8bafb8..003072b 100644
--- a/internal/cli/datasource_tools_test.go
+++ b/internal/cli/datasource_tools_test.go
@@ -52,6 +52,51 @@ func TestDatasourceToolInvokeStdinPreservesJSON(t *testing.T) {
 	}
 }
 
+func TestDatasourceToolInvokeQueryParamsPreserveJSON(t *testing.T) {
+	saveAndResetGlobals(t)
+	requests := make(chan string, 1)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/monit/datasource/tools/invoke" {
+			t.Errorf("unexpected endpoint: %s %s", r.Method, r.URL.Path)
+		}
+		raw, _ := io.ReadAll(r.Body)
+		requests <- string(raw)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"request_id":"query-test","data":{"datasource_id":42,"tool":"prometheus.query","data":{"format":"explore_result.v1","result":{"kind":"samples","samples":[]}}}}`)
+	}))
+	t.Cleanup(server.Close)
+	newClientFn = func() (*flashduty.Client, error) {
+		return flashduty.NewClient("test", flashduty.WithBaseURL(server.URL))
+	}
+	out, err := execCommand("monit", "datasource-tools-invoke", "42", "--tool", "prometheus.query",
+		"--data", `{"params":{"expr":"sum by (job) (rate(http_requests_total[5m]))","execution":{"kind":"instant","to_ms":9007199254740993}}}`,
+		"--output-format", "json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw := <-requests
+	var sent struct {
+		DatasourceID uint64          `json:"datasource_id"`
+		Tool         string          `json:"tool"`
+		Params       json.RawMessage `json:"params"`
+	}
+	if err := json.Unmarshal([]byte(raw), &sent); err != nil {
+		t.Fatal(err)
+	}
+	if sent.DatasourceID != 42 || sent.Tool != "prometheus.query" {
+		t.Fatalf("request lost identity: %s", raw)
+	}
+	if !strings.Contains(string(sent.Params), `"to_ms":9007199254740993`) || strings.Contains(string(sent.Params), "9007199254740992") {
+		t.Fatalf("params lost numeric precision: %s", sent.Params)
+	}
+	if !strings.Contains(string(sent.Params), `"kind":"instant"`) || !strings.Contains(string(sent.Params), "rate(http_requests_total[5m])") {
+		t.Fatalf("params mangled: %s", sent.Params)
+	}
+	if !strings.Contains(out, "explore_result.v1") {
+		t.Fatalf("response lost query evidence: %s", out)
+	}
+}
+
 func TestDatasourceToolErrorsAreNotReplayed(t *testing.T) {
 	for _, status := range []int{400, 429, 503, 504} {
 		t.Run(fmt.Sprint(status), func(t *testing.T) {
diff --git a/internal/cli/zz_generated_alert_rules.go b/internal/cli/zz_generated_alert_rules.go
index a5f494b..ddf2dc9 100644
--- a/internal/cli/zz_generated_alert_rules.go
+++ b/internal/cli/zz_generated_alert_rules.go
@@ -149,39 +149,6 @@ API: POST /monit/rule/counter/channel (monit-rule-read-counter-channel)
 	return cmd
 }
 
-func genAlertRulesReadCounterNodeCmd() *cobra.Command {
-	var dataJSON string
-	cmd := &cobra.Command{
-		Use:   "rule-counter-node",
-		Short: "Get rule counts by folder node",
-		Long: `Get rule counts by folder node.
-
-Return an object mapping top-level folder name to the total number of rules under that folder and all its descendants.
-
-API: POST /monit/rule/counter/node (monit-rule-read-counter-node)
-`,
-		Example: `  flashduty monit rule-counter-node --data '{}'`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return runCommand(cmd, args, func(ctx *RunContext) error {
-				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
-					return nil
-				})
-				if err != nil {
-					return err
-				}
-				_ = body
-				out, _, err := ctx.Client.AlertRules.ReadCounterNode(cmdContext(ctx.Cmd))
-				if err != nil {
-					return err
-				}
-				return printGenericResult(ctx, out)
-			})
-		},
-	}
-	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
-	return cmd
-}
-
 func genAlertRulesReadCounterTotalCmd() *cobra.Command {
 	var dataJSON string
 	cmd := &cobra.Command{
@@ -221,46 +188,6 @@ Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '
 	return cmd
 }
 
-func genAlertRulesReadDstypesCmd() *cobra.Command {
-	var dataJSON string
-	cmd := &cobra.Command{
-		Use:   "rule-dstypes",
-		Short: "List available datasource types",
-		Long: `List available datasource types.
-
-Return the list of datasource types ('DSType' records) that the current account can use when authoring alert rules — combines global types and account-scoped types.
-
-API: POST /monit/rule/dstypes (monit-rule-read-dstypes)
-
-Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '.[]'', NOT '.items[]'):
-  - account_id (integer) (required) — Owning account ID. '0' for global types.
-  - id (integer) (required) — ID of the datasource type record.
-  - ident (string) (required) — Identifier used as the 'ds_type' of rules, e.g. 'prometheus'.
-  - name (string) (required) — Display name, e.g. 'Prometheus'.
-  - weight (integer) (required) — Display order weight; higher appears first.
-`,
-		Example: `  flashduty monit rule-dstypes --data '{}'`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return runCommand(cmd, args, func(ctx *RunContext) error {
-				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
-					return nil
-				})
-				if err != nil {
-					return err
-				}
-				_ = body
-				out, _, err := ctx.Client.AlertRules.ReadDstypes(cmdContext(ctx.Cmd))
-				if err != nil {
-					return err
-				}
-				return printGenericResult(ctx, out)
-			})
-		},
-	}
-	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
-	return cmd
-}
-
 func genAlertRulesReadExportCmd() *cobra.Command {
 	var dataJSON string
 	var fIDs []int
@@ -369,96 +296,104 @@ Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '
 	return cmd
 }
 
-func genAlertRulesReadInfoCmd() *cobra.Command {
+func genAlertRulesReadInfoV2Cmd() *cobra.Command {
 	var dataJSON string
 	var fID int64
 	cmd := &cobra.Command{
-		Use:   "rule-info",
-		Short: "Get alert rule detail",
-		Long: `Get alert rule detail.
+		Use:   "rule-v2-info",
+		Short: "Get alert rule detail (V2)",
+		Long: `Get alert rule detail (V2).
 
-Return the full configuration of an alert rule by its ID, including rule queries, thresholds, and notification settings.
+Return the full V2 configuration of an alert rule by ID, including lifecycle v2 recovery and ending modes.
 
-API: POST /monit/rule/info (monit-rule-read-info)
+API: POST /monit/rule/v2/info (monit-rule-read-info-v2)
 
 Request fields:
   --id int (required) — Alert rule ID. Obtainable per folder via 'POST /monit/rule/list/basic'.
 
 Response fields ('data' envelope is unwrapped — these fields are at the top level):
-  - account_id (integer) (required) — Account ID. Filled by the server from the authenticated identity; do not provide.
-  - annotations (object) — Annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
-  - channel_ids (array<integer>) — Channel IDs to send alerts to.
-  - created_at (string) (required) — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
-  - creator_id (integer) (required) — Creator user ID. Filled by the server from the current user; do not provide.
-  - creator_name (string) (required) — Creator name. Filled by the server; do not provide.
-  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval descriptor. Must not start with 'CRON_TZ=' or 'TZ='; use the 'timezone' field instead.
-  - debug_log_enabled (boolean) (required) — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.
-  - delay_seconds (integer) (required) — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.
-  - description (string) — Rule description, in Markdown.
-  - description_type (string) — Format for the description. Defaults to 'text' when omitted or empty. 'text' = plain text; 'markdown' = Markdown, rendered as Markdown in alert details. [text, markdown]
-  - ds_ids (array<integer>) — Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. At least one of 'ds_list' and 'ds_ids' must be provided.
-  - ds_list (array<string>) — Data source name patterns (supports wildcards). At least one of 'ds_list' / 'ds_ids' must be non-empty; the two are merged to decide which datasources the rule monitors.
-  - ds_type (string) (required) — Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes' (e.g. 'prometheus', 'elasticsearch').
-  - enabled (boolean) (required) — Whether the rule is enabled. Updating to 'false' makes the server clean up the rule's active alerts.
-  - enabled_times (array<object>) — Time windows when the rule is active. Defaults to all days from 00:00 to 23:59 when omitted or empty.
+  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.
+  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
+  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.
+  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.
+  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.
+  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.
+  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval. Must not start with 'CRON_TZ=' or 'TZ='; set the timezone in the 'timezone' field instead.
+  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.
+  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.
+  - description (string) — Rule description, Markdown format.
+  - description_type (string) — Format of the description content. Empty or omitted defaults to 'text'. 'text' = plain text; 'markdown' = Markdown, rendered as such in alert details. [text, markdown]
+  - ds_ids (array<integer>) — Datasource ID list, merged with 'ds_list' to decide the monitored datasources; IDs survive datasource renames. At least one of 'ds_list' / 'ds_ids' must be provided.
+  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of 'ds_list' / 'ds_ids' must be non-empty; both are merged to decide which datasources the rule monitors.
+  - ds_type (string) (required) — Datasource type identifier (e.g. 'prometheus', 'elasticsearch').
+  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including 'false') while decoding. Setting it to 'false' on update clears the rule's active alerts.
+  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.
     - days (array<integer>) — Days of week (0=Sunday).
     - etime (string) — End time, e.g. '18:00'.
     - stime (string) — Start time, e.g. '09:00'.
-  - folder_id (integer) (required) — ID of the folder the rule belongs to. Obtainable via 'POST /monit/folder/list'.
-  - id (integer) (required) — Rule ID. Required for update; omit for create (assigned by the server).
+  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via 'POST /monit/folder/list'. Cannot be changed through the update API — use '/monit/rule/move' instead.
+  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).
+  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass '[]' to clear.
+    - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
+      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
+      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
+      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
+    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
   - labels (object) — Custom labels.
-  - name (string) (required) — Rule name. Must be unique within the same folder.
-  - repeat_interval (integer) — Notification repeat interval in seconds.
-  - repeat_total (integer) — Max number of repeat notifications.
-  - rule_configs (object) (required) — Check configuration: query list plus trigger/recovery conditions. Structure see 'RuleConfigs'.
-    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery condition for any-data check. If omitted or 'mode' is empty, treated as 'nodata'.
-        - args (object) — Datasource-specific options for the recovery query, same convention as 'queries[].args'; required for Elasticsearch datasources when 'mode' is 'ql'.
-        - condition (string) — Recovery expression. Required when 'mode' is 'ql'.
-        - mode (string) — 'nodata' = recover when the query returns no data; 'ql' = recover when the 'condition' expression evaluates to true. When 'mode' is 'ql', only a single query ('name=A') is permitted. [nodata, ql]
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_nodata (object) — No-data check configuration.
-      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.
-      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when 'alert_on_empty_result' is enabled. [Critical, Warning, Info]
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - resolve_timeout (integer) — Auto-resolve after N seconds.
-      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_threshold (object) — Threshold check configuration.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - critical (string) — Critical threshold expression referencing query results via '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; at least one severity must be configured.
-      - enabled (boolean) — Whether threshold checking is enabled.
-      - info (string) — Info threshold expression, same syntax as 'critical'.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery evaluation configuration for threshold checks.
-        - args (object) — Datasource-specific extra parameters for the recovery query, using the same '<datasource>.<param>' key convention as query 'args'. Omitted when empty.
-        - condition (string) — Recovery condition expression; required when 'mode' is 'threshold' or 'ql', and must be empty for 'invert'.
-        - mode (string) — Recovery mode: 'invert' = resolve when the alert expression no longer holds ('condition' stays empty); 'threshold' = resolve when the 'condition' threshold expression holds; 'ql' = resolve when the 'condition' query expression evaluates true. [invert, threshold, ql]
-        - value_fields (array<string>) — Numeric result fields the recovery 'condition' references as '$A.<field>'; same semantics as the query's 'value_fields'. Omitted when empty.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - warning (string) — Warning threshold expression, same syntax as 'critical'.
-    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicate 'expr'.
-      - args (object) — Datasource-specific query options keyed by the '<datasource>.<option>' convention (e.g. 'es.type', 'tencent_cls.limit'); most datasources need none.
+  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.
+  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
+  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.
+  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See 'AlertRuleConfigsV2'.
+    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See 'AlertRuleAnyDataV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'data_absent' = recover when the query returns no data; 'recovery' is not allowed. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true; only a single query ('name=A') is allowed. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [data_absent, recovery_query_match, manual]
+      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]
+    - check_nodata (object) — No-data check configuration. See 'AlertRuleNoDataV2'.
+      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).
+      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when 'alert_on_empty_result' is on. [Critical, Warning, Info]
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when 'end_mode' is 'data_reappears_or_timeout'; must be 0 for the other modes.
+      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.
+      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. 'data_reappears' = recover when data reappears. 'data_reappears_or_timeout' = end when data reappears or after 'auto_close_after_seconds' seconds, whichever comes first; requires the per-series no-data check and a positive 'auto_close_after_seconds'. 'manual' = never end automatically; alerts need manual handling and no recovery event is pushed. For 'data_reappears' and 'manual', 'auto_close_after_seconds' must be 0. [data_reappears, data_reappears_or_timeout, manual]
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]
+    - check_threshold (object) — Threshold check configuration. See 'AlertRuleThresholdV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy 'alerting_check_times' <= M <= 10000.
+      - critical (string) — Critical threshold expression referencing query results as '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; when enabled at least one of the three severities must be set.
+      - enabled (boolean) — Whether the threshold check is enabled.
+      - info (string) — Info threshold expression; same syntax as 'critical'.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'expression_match' or 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'condition_clear' = recover once the alert expression no longer holds; 'recovery' is not allowed. 'expression_match' = recover when the 'recovery.expr' threshold expression holds. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [condition_clear, expression_match, recovery_query_match, manual]
+      - warning (string) — Warning threshold expression; same syntax as 'critical'.
+    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicated 'expr'.
+      - args (object) — Datasource-specific query parameters; keys follow the '<datasource>.<param>' convention (e.g. 'es.type', 'tencent_cls.limit'). Most datasources need none.
       - expr (string) — Query expression.
-      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap 'value_fields'; applies to table-shaped results (SQL/ES-style datasources).
-      - name (string) — Query identifier (letter, e.g. 'A'). The name 'R' is reserved and must not be used.
-      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as '$A.<field>' in threshold expressions); required for threshold checks unless the datasource is 'prometheus'/'loki'/'victorialogs'; field names must not contain '.'.
-    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique 'name' (not duplicating any query name) and a non-empty 'expr'.
-      - args (object) — Datasource-specific options for the auxiliary query, same convention as 'queries[].args'.
+      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap 'value_fields'; applies to tabular results (SQL/ES-like datasources).
+      - name (string) — Query identifier (e.g. 'A'), must match '[A-Za-z][A-Za-z0-9_]*'; 'R' and '__all__' are reserved and cannot be used.
+      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as '$A.<field>'); required for threshold checks when the datasource is not 'prometheus'/'loki'/'victorialogs'. Field names must not contain '.'.
+    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique 'name' (not colliding with any query name) and a non-empty 'expr'.
+      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as 'queries[].args'.
       - expr (string) — Query expression.
-      - name (string) — Relate-query identifier.
-  - timezone (string) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); shortcuts and offsets such as 'Local', 'UTC+8', or 'CST' are rejected. Treated as 'Asia/Shanghai' if empty.
-  - updated_at (string) (required) — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
-  - updater_id (integer) (required) — Last updater user ID. Filled by the server; do not provide.
-  - updater_name (string) (required) — Last updater name. Filled by the server; do not provide.
+      - name (string) — Auxiliary query identifier.
+  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); abbreviations or offsets like 'Local', 'UTC+8', 'CST' are rejected. Empty falls back to 'Asia/Shanghai'.
+  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.
+  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
 `,
-		Example: `  flashduty monit rule-info --data '{"id":50001}'`,
+		Example: `  flashduty monit rule-v2-info --data '{"id":50001}'`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
 				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
@@ -474,7 +409,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 				if err := genBindBody(body, req); err != nil {
 					return err
 				}
-				out, _, err := ctx.Client.AlertRules.ReadInfo(cmdContext(ctx.Cmd), req)
+				out, _, err := ctx.Client.AlertRules.ReadInfoV2(cmdContext(ctx.Cmd), req)
 				if err != nil {
 					return err
 				}
@@ -498,7 +433,7 @@ func genAlertRulesReadListCmd() *cobra.Command {
 		Short: "List alert rules",
 		Long: `List alert rules.
 
-Return the basic information of all alert rules in a folder. For full rule details, call 'POST /monit/rule/info'.
+Return the basic information of all alert rules in a folder. For full rule details, call 'POST /monit/rule/v2/info'.
 
 API: POST /monit/rule/list/basic (monit-rule-read-list)
 
@@ -571,7 +506,7 @@ Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '
 	return cmd
 }
 
-func genAlertRulesWriteCreateCmd() *cobra.Command {
+func genAlertRulesWriteCreateV2Cmd() *cobra.Command {
 	var dataJSON string
 	var fAccountID int64
 	var fChannelIDs []int
@@ -597,164 +532,180 @@ func genAlertRulesWriteCreateCmd() *cobra.Command {
 	var fUpdaterID int64
 	var fUpdaterName string
 	cmd := &cobra.Command{
-		Use:   "rule-create <folder-id>",
-		Short: "Create alert rule",
-		Long: `Create alert rule.
+		Use:   "rule-v2-create <folder-id>",
+		Short: "Create alert rule (V2)",
+		Long: `Create alert rule (V2).
 
-Create a new alert rule. Returns the created rule with its assigned ID.
+Create a new V2 alert rule. Returns the created rule with its assigned ID.
 
-API: POST /monit/rule/create (monit-rule-write-create)
+API: POST /monit/rule/v2/create (monit-rule-write-create-v2)
 
 Request fields:
-  --account-id int — Account ID. Filled by the server from the authenticated identity; do not provide.
-  --channel-ids []int — Channel IDs to send alerts to.
-  --created-at string — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
-  --creator-id int — Creator user ID. Filled by the server from the current user; do not provide.
-  --creator-name string — Creator name. Filled by the server; do not provide.
-  --cron-pattern string (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval descriptor. Must not start with 'CRON_TZ=' or 'TZ='; use the 'timezone' field instead.
-  --debug-log-enabled bool — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.
-  --delay-seconds int — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.
-  --description string — Rule description, in Markdown.
-  --description-type string — Format for the description. Defaults to 'text' when omitted or empty. 'text' = plain text; 'markdown' = Markdown, rendered as Markdown in alert details. [text, markdown]
-  --ds-ids []int — Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. At least one of 'ds_list' and 'ds_ids' must be provided.
-  --ds-list []string — Data source name patterns (supports wildcards). At least one of 'ds_list' / 'ds_ids' must be non-empty; the two are merged to decide which datasources the rule monitors.
-  --ds-type string (required) — Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes' (e.g. 'prometheus', 'elasticsearch').
-  --enabled bool — Whether the rule is enabled. Updating to 'false' makes the server clean up the rule's active alerts.
-  --folder-id int (required) — ID of the folder the rule belongs to. Obtainable via 'POST /monit/folder/list'.
-  --id int — Rule ID. Required for update; omit for create (assigned by the server).
-  --name string (required) — Rule name. Must be unique within the same folder.
-  --repeat-interval int — Notification repeat interval in seconds.
-  --repeat-total int — Max number of repeat notifications.
-  --timezone string — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); shortcuts and offsets such as 'Local', 'UTC+8', or 'CST' are rejected. Treated as 'Asia/Shanghai' if empty.
-  --updated-at string — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
-  --updater-id int — Last updater user ID. Filled by the server; do not provide.
-  --updater-name string — Last updater name. Filled by the server; do not provide.
-  annotations (object, via --data) — Annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
-  enabled_times (array<object>, via --data) — Time windows when the rule is active. Defaults to all days from 00:00 to 23:59 when omitted or empty.
+  --account-id int — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.
+  --channel-ids []int — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.
+  --created-at string — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+  --creator-id int — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.
+  --creator-name string — Creator name, filled by the server; any client-supplied value is ignored.
+  --cron-pattern string (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval. Must not start with 'CRON_TZ=' or 'TZ='; set the timezone in the 'timezone' field instead.
+  --debug-log-enabled bool — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.
+  --delay-seconds int — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.
+  --description string — Rule description, Markdown format.
+  --description-type string — Format of the description content. Empty or omitted defaults to 'text'. 'text' = plain text; 'markdown' = Markdown, rendered as such in alert details. [text, markdown]
+  --ds-ids []int — Datasource ID list, merged with 'ds_list' to decide the monitored datasources; IDs survive datasource renames. At least one of 'ds_list' / 'ds_ids' must be provided.
+  --ds-list []string — Datasource name match patterns (wildcards supported). At least one of 'ds_list' / 'ds_ids' must be non-empty; both are merged to decide which datasources the rule monitors.
+  --ds-type string (required) — Datasource type identifier (e.g. 'prometheus', 'elasticsearch').
+  --enabled bool (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including 'false') while decoding. Setting it to 'false' on update clears the rule's active alerts.
+  --folder-id int (required) — ID of the folder the rule belongs to; list folders via 'POST /monit/folder/list'. Cannot be changed through the update API — use '/monit/rule/move' instead.
+  --id int — Rule ID. Required on update; omit on create (assigned by the server).
+  --name string (required) — Rule name. Must be unique within the folder and at most 128 characters.
+  --repeat-interval int — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
+  --repeat-total int — Maximum number of repeat notifications. Values below 1 fall back to the default 3.
+  --timezone string — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); abbreviations or offsets like 'Local', 'UTC+8', 'CST' are rejected. Empty falls back to 'Asia/Shanghai'.
+  --updated-at string — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+  --updater-id int — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+  --updater-name string — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+  annotations (object, via --data) — Extra annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
+  enabled_times (array<object>, via --data) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.
     - days (array<integer>) — Days of week (0=Sunday).
     - etime (string) — End time, e.g. '18:00'.
     - stime (string) — Start time, e.g. '09:00'.
+  investigation_targets (array<object>, via --data) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass '[]' to clear.
+    - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
+      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
+      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
+      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
+    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
   labels (object, via --data) — Custom labels.
-  rule_configs (object, via --data) (required) — Check configuration: query list plus trigger/recovery conditions. Structure see 'RuleConfigs'.
-    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery condition for any-data check. If omitted or 'mode' is empty, treated as 'nodata'.
-        - args (object) — Datasource-specific options for the recovery query, same convention as 'queries[].args'; required for Elasticsearch datasources when 'mode' is 'ql'.
-        - condition (string) — Recovery expression. Required when 'mode' is 'ql'.
-        - mode (string) — 'nodata' = recover when the query returns no data; 'ql' = recover when the 'condition' expression evaluates to true. When 'mode' is 'ql', only a single query ('name=A') is permitted. [nodata, ql]
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_nodata (object) — No-data check configuration.
-      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.
-      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when 'alert_on_empty_result' is enabled. [Critical, Warning, Info]
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - resolve_timeout (integer) — Auto-resolve after N seconds.
-      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_threshold (object) — Threshold check configuration.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - critical (string) — Critical threshold expression referencing query results via '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; at least one severity must be configured.
-      - enabled (boolean) — Whether threshold checking is enabled.
-      - info (string) — Info threshold expression, same syntax as 'critical'.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery evaluation configuration for threshold checks.
-        - args (object) — Datasource-specific extra parameters for the recovery query, using the same '<datasource>.<param>' key convention as query 'args'. Omitted when empty.
-        - condition (string) — Recovery condition expression; required when 'mode' is 'threshold' or 'ql', and must be empty for 'invert'.
-        - mode (string) — Recovery mode: 'invert' = resolve when the alert expression no longer holds ('condition' stays empty); 'threshold' = resolve when the 'condition' threshold expression holds; 'ql' = resolve when the 'condition' query expression evaluates true. [invert, threshold, ql]
-        - value_fields (array<string>) — Numeric result fields the recovery 'condition' references as '$A.<field>'; same semantics as the query's 'value_fields'. Omitted when empty.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - warning (string) — Warning threshold expression, same syntax as 'critical'.
-    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicate 'expr'.
-      - args (object) — Datasource-specific query options keyed by the '<datasource>.<option>' convention (e.g. 'es.type', 'tencent_cls.limit'); most datasources need none.
+  rule_configs (object, via --data) (required) — Detection configuration: query list plus trigger/recovery conditions. See 'AlertRuleConfigsV2'.
+    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See 'AlertRuleAnyDataV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'data_absent' = recover when the query returns no data; 'recovery' is not allowed. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true; only a single query ('name=A') is allowed. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [data_absent, recovery_query_match, manual]
+      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]
+    - check_nodata (object) — No-data check configuration. See 'AlertRuleNoDataV2'.
+      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).
+      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when 'alert_on_empty_result' is on. [Critical, Warning, Info]
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when 'end_mode' is 'data_reappears_or_timeout'; must be 0 for the other modes.
+      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.
+      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. 'data_reappears' = recover when data reappears. 'data_reappears_or_timeout' = end when data reappears or after 'auto_close_after_seconds' seconds, whichever comes first; requires the per-series no-data check and a positive 'auto_close_after_seconds'. 'manual' = never end automatically; alerts need manual handling and no recovery event is pushed. For 'data_reappears' and 'manual', 'auto_close_after_seconds' must be 0. [data_reappears, data_reappears_or_timeout, manual]
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]
+    - check_threshold (object) — Threshold check configuration. See 'AlertRuleThresholdV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy 'alerting_check_times' <= M <= 10000.
+      - critical (string) — Critical threshold expression referencing query results as '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; when enabled at least one of the three severities must be set.
+      - enabled (boolean) — Whether the threshold check is enabled.
+      - info (string) — Info threshold expression; same syntax as 'critical'.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'expression_match' or 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'condition_clear' = recover once the alert expression no longer holds; 'recovery' is not allowed. 'expression_match' = recover when the 'recovery.expr' threshold expression holds. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [condition_clear, expression_match, recovery_query_match, manual]
+      - warning (string) — Warning threshold expression; same syntax as 'critical'.
+    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicated 'expr'.
+      - args (object) — Datasource-specific query parameters; keys follow the '<datasource>.<param>' convention (e.g. 'es.type', 'tencent_cls.limit'). Most datasources need none.
       - expr (string) — Query expression.
-      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap 'value_fields'; applies to table-shaped results (SQL/ES-style datasources).
-      - name (string) — Query identifier (letter, e.g. 'A'). The name 'R' is reserved and must not be used.
-      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as '$A.<field>' in threshold expressions); required for threshold checks unless the datasource is 'prometheus'/'loki'/'victorialogs'; field names must not contain '.'.
-    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique 'name' (not duplicating any query name) and a non-empty 'expr'.
-      - args (object) — Datasource-specific options for the auxiliary query, same convention as 'queries[].args'.
+      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap 'value_fields'; applies to tabular results (SQL/ES-like datasources).
+      - name (string) — Query identifier (e.g. 'A'), must match '[A-Za-z][A-Za-z0-9_]*'; 'R' and '__all__' are reserved and cannot be used.
+      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as '$A.<field>'); required for threshold checks when the datasource is not 'prometheus'/'loki'/'victorialogs'. Field names must not contain '.'.
+    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique 'name' (not colliding with any query name) and a non-empty 'expr'.
+      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as 'queries[].args'.
       - expr (string) — Query expression.
-      - name (string) — Relate-query identifier.
+      - name (string) — Auxiliary query identifier.
 
 Response fields ('data' envelope is unwrapped — these fields are at the top level):
-  - account_id (integer) — Account ID. Filled by the server from the authenticated identity; do not provide.
-  - annotations (object) — Annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
-  - channel_ids (array<integer>) — Channel IDs to send alerts to.
-  - created_at (integer) — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide.
-  - creator_id (integer) — Creator user ID. Filled by the server from the current user; do not provide.
-  - creator_name (string) — Creator name. Filled by the server; do not provide.
-  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval descriptor. Must not start with 'CRON_TZ=' or 'TZ='; use the 'timezone' field instead.
-  - debug_log_enabled (boolean) — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.
-  - delay_seconds (integer) — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.
-  - description (string) — Rule description, in Markdown.
-  - description_type (string) — Format for the description. Defaults to 'text' when omitted or empty. 'text' = plain text; 'markdown' = Markdown, rendered as Markdown in alert details. [text, markdown]
-  - ds_ids (array<integer>) — Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. At least one of 'ds_list' and 'ds_ids' must be provided.
-  - ds_list (array<string>) — Data source name patterns (supports wildcards). At least one of 'ds_list' / 'ds_ids' must be non-empty; the two are merged to decide which datasources the rule monitors.
-  - ds_type (string) (required) — Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes' (e.g. 'prometheus', 'elasticsearch').
-  - enabled (boolean) — Whether the rule is enabled. Updating to 'false' makes the server clean up the rule's active alerts.
-  - enabled_times (array<object>) — Time windows when the rule is active. Defaults to all days from 00:00 to 23:59 when omitted or empty.
+  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.
+  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
+  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.
+  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.
+  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.
+  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.
+  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval. Must not start with 'CRON_TZ=' or 'TZ='; set the timezone in the 'timezone' field instead.
+  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.
+  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.
+  - description (string) — Rule description, Markdown format.
+  - description_type (string) — Format of the description content. Empty or omitted defaults to 'text'. 'text' = plain text; 'markdown' = Markdown, rendered as such in alert details. [text, markdown]
+  - ds_ids (array<integer>) — Datasource ID list, merged with 'ds_list' to decide the monitored datasources; IDs survive datasource renames. At least one of 'ds_list' / 'ds_ids' must be provided.
+  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of 'ds_list' / 'ds_ids' must be non-empty; both are merged to decide which datasources the rule monitors.
+  - ds_type (string) (required) — Datasource type identifier (e.g. 'prometheus', 'elasticsearch').
+  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including 'false') while decoding. Setting it to 'false' on update clears the rule's active alerts.
+  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.
     - days (array<integer>) — Days of week (0=Sunday).
     - etime (string) — End time, e.g. '18:00'.
     - stime (string) — Start time, e.g. '09:00'.
-  - folder_id (integer) (required) — ID of the folder the rule belongs to. Obtainable via 'POST /monit/folder/list'.
-  - id (integer) — Rule ID. Required for update; omit for create (assigned by the server).
+  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via 'POST /monit/folder/list'. Cannot be changed through the update API — use '/monit/rule/move' instead.
+  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).
+  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass '[]' to clear.
+    - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
+      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
+      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
+      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
+    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
   - labels (object) — Custom labels.
-  - name (string) (required) — Rule name. Must be unique within the same folder.
-  - repeat_interval (integer) — Notification repeat interval in seconds.
-  - repeat_total (integer) — Max number of repeat notifications.
-  - rule_configs (object) (required) — Check configuration: query list plus trigger/recovery conditions. Structure see 'RuleConfigs'.
-    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery condition for any-data check. If omitted or 'mode' is empty, treated as 'nodata'.
-        - args (object) — Datasource-specific options for the recovery query, same convention as 'queries[].args'; required for Elasticsearch datasources when 'mode' is 'ql'.
-        - condition (string) — Recovery expression. Required when 'mode' is 'ql'.
-        - mode (string) — 'nodata' = recover when the query returns no data; 'ql' = recover when the 'condition' expression evaluates to true. When 'mode' is 'ql', only a single query ('name=A') is permitted. [nodata, ql]
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_nodata (object) — No-data check configuration.
-      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.
-      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when 'alert_on_empty_result' is enabled. [Critical, Warning, Info]
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - resolve_timeout (integer) — Auto-resolve after N seconds.
-      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_threshold (object) — Threshold check configuration.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - critical (string) — Critical threshold expression referencing query results via '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; at least one severity must be configured.
-      - enabled (boolean) — Whether threshold checking is enabled.
-      - info (string) — Info threshold expression, same syntax as 'critical'.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery evaluation configuration for threshold checks.
-        - args (object) — Datasource-specific extra parameters for the recovery query, using the same '<datasource>.<param>' key convention as query 'args'. Omitted when empty.
-        - condition (string) — Recovery condition expression; required when 'mode' is 'threshold' or 'ql', and must be empty for 'invert'.
-        - mode (string) — Recovery mode: 'invert' = resolve when the alert expression no longer holds ('condition' stays empty); 'threshold' = resolve when the 'condition' threshold expression holds; 'ql' = resolve when the 'condition' query expression evaluates true. [invert, threshold, ql]
-        - value_fields (array<string>) — Numeric result fields the recovery 'condition' references as '$A.<field>'; same semantics as the query's 'value_fields'. Omitted when empty.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - warning (string) — Warning threshold expression, same syntax as 'critical'.
-    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicate 'expr'.
-      - args (object) — Datasource-specific query options keyed by the '<datasource>.<option>' convention (e.g. 'es.type', 'tencent_cls.limit'); most datasources need none.
+  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.
+  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
+  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.
+  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See 'AlertRuleConfigsV2'.
+    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See 'AlertRuleAnyDataV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'data_absent' = recover when the query returns no data; 'recovery' is not allowed. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true; only a single query ('name=A') is allowed. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [data_absent, recovery_query_match, manual]
+      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]
+    - check_nodata (object) — No-data check configuration. See 'AlertRuleNoDataV2'.
+      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).
+      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when 'alert_on_empty_result' is on. [Critical, Warning, Info]
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when 'end_mode' is 'data_reappears_or_timeout'; must be 0 for the other modes.
+      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.
+      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. 'data_reappears' = recover when data reappears. 'data_reappears_or_timeout' = end when data reappears or after 'auto_close_after_seconds' seconds, whichever comes first; requires the per-series no-data check and a positive 'auto_close_after_seconds'. 'manual' = never end automatically; alerts need manual handling and no recovery event is pushed. For 'data_reappears' and 'manual', 'auto_close_after_seconds' must be 0. [data_reappears, data_reappears_or_timeout, manual]
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]
+    - check_threshold (object) — Threshold check configuration. See 'AlertRuleThresholdV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy 'alerting_check_times' <= M <= 10000.
+      - critical (string) — Critical threshold expression referencing query results as '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; when enabled at least one of the three severities must be set.
+      - enabled (boolean) — Whether the threshold check is enabled.
+      - info (string) — Info threshold expression; same syntax as 'critical'.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'expression_match' or 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'condition_clear' = recover once the alert expression no longer holds; 'recovery' is not allowed. 'expression_match' = recover when the 'recovery.expr' threshold expression holds. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [condition_clear, expression_match, recovery_query_match, manual]
+      - warning (string) — Warning threshold expression; same syntax as 'critical'.
+    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicated 'expr'.
+      - args (object) — Datasource-specific query parameters; keys follow the '<datasource>.<param>' convention (e.g. 'es.type', 'tencent_cls.limit'). Most datasources need none.
       - expr (string) — Query expression.
-      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap 'value_fields'; applies to table-shaped results (SQL/ES-style datasources).
-      - name (string) — Query identifier (letter, e.g. 'A'). The name 'R' is reserved and must not be used.
-      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as '$A.<field>' in threshold expressions); required for threshold checks unless the datasource is 'prometheus'/'loki'/'victorialogs'; field names must not contain '.'.
-    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique 'name' (not duplicating any query name) and a non-empty 'expr'.
-      - args (object) — Datasource-specific options for the auxiliary query, same convention as 'queries[].args'.
+      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap 'value_fields'; applies to tabular results (SQL/ES-like datasources).
+      - name (string) — Query identifier (e.g. 'A'), must match '[A-Za-z][A-Za-z0-9_]*'; 'R' and '__all__' are reserved and cannot be used.
+      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as '$A.<field>'); required for threshold checks when the datasource is not 'prometheus'/'loki'/'victorialogs'. Field names must not contain '.'.
+    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique 'name' (not colliding with any query name) and a non-empty 'expr'.
+      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as 'queries[].args'.
       - expr (string) — Query expression.
-      - name (string) — Relate-query identifier.
-  - timezone (string) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); shortcuts and offsets such as 'Local', 'UTC+8', or 'CST' are rejected. Treated as 'Asia/Shanghai' if empty.
-  - updated_at (integer) — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide.
-  - updater_id (integer) — Last updater user ID. Filled by the server; do not provide.
-  - updater_name (string) — Last updater name. Filled by the server; do not provide.
+      - name (string) — Auxiliary query identifier.
+  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); abbreviations or offsets like 'Local', 'UTC+8', 'CST' are rejected. Empty falls back to 'Asia/Shanghai'.
+  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.
+  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
 `,
 		Args:    requireBodyFieldOrExactArg("folder_id", "folder-id"),
-		Example: `  flashduty monit rule-create --data '{"channel_ids":[20001],"cron_pattern":"0 * * * * *","ds_list":["prometheus*"],"ds_type":"prometheus","enabled":true,"folder_id":100,"name":"CPU High","rule_configs":{"check_threshold":{"alerting_check_times":1,"critical":"A","enabled":true,"push_recovery_event":true,"recovery":{"mode":"invert"},"recovery_check_times":1},"queries":[{"expr":"avg(cpu_usage_idle) \u003c 10","name":"A"}]}}'`,
+		Example: `  flashduty monit rule-v2-create --data '{"channel_ids":[20001],"cron_pattern":"0 * * * * *","ds_list":["prometheus*"],"ds_type":"prometheus","enabled":true,"folder_id":100,"name":"CPU High","rule_configs":{"check_threshold":{"alerting_check_times":3,"alerting_window_size":5,"critical":"$A \u003e 90","enabled":true,"recovery_check_times":2,"recovery_mode":"condition_clear","warning":"$A \u003e 80"},"queries":[{"expr":"100 - avg(cpu_usage_idle)","name":"A"}]}}'`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
 				vCreatedAt, okCreatedAt, err := genParseTimeFlag(cmd, "created-at", fCreatedAt)
@@ -843,11 +794,11 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 				if err != nil {
 					return err
 				}
-				req := new(flashduty.AlertRule)
+				req := new(flashduty.AlertRuleV2)
 				if err := genBindBody(body, req); err != nil {
 					return err
 				}
-				out, _, err := ctx.Client.AlertRules.WriteCreate(cmdContext(ctx.Cmd), req)
+				out, _, err := ctx.Client.AlertRules.WriteCreateV2(cmdContext(ctx.Cmd), req)
 				if err != nil {
 					return err
 				}
@@ -855,29 +806,29 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 			})
 		},
 	}
-	cmd.Flags().Int64Var(&fAccountID, "account-id", 0, "Account ID. Filled by the server from the authenticated identity; do not provide.")
-	cmd.Flags().IntSliceVar(&fChannelIDs, "channel-ids", nil, "Channel IDs to send alerts to.")
-	cmd.Flags().StringVar(&fCreatedAt, "created-at", "", "Creation time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
-	cmd.Flags().Int64Var(&fCreatorID, "creator-id", 0, "Creator user ID. Filled by the server from the current user; do not provide.")
-	cmd.Flags().StringVar(&fCreatorName, "creator-name", "", "Creator name. Filled by the server; do not provide.")
-	cmd.Flags().StringVar(&fCronPattern, "cron-pattern", "", "Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval descriptor. Must not start with 'CRON_TZ=' or 'TZ='; use the 'timezone' field instead. (required)")
-	cmd.Flags().BoolVar(&fDebugLogEnabled, "debug-log-enabled", false, "Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.")
-	cmd.Flags().Int64Var(&fDelaySeconds, "delay-seconds", 0, "Seconds to shift the evaluation query window backward, compensating for data ingestion latency.")
-	cmd.Flags().StringVar(&fDescription, "description", "", "Rule description, in Markdown.")
-	cmd.Flags().StringVar(&fDescriptionType, "description-type", "", "Format for the description. Defaults to 'text' when omitted or empty. 'text' = plain text; 'markdown' = Markdown, rendered as Markdown in alert details. [text, markdown]")
-	cmd.Flags().IntSliceVar(&fDsIDs, "ds-ids", nil, "Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. At least one of 'ds_list' and 'ds_ids' must be provided.")
-	cmd.Flags().StringSliceVar(&fDsList, "ds-list", nil, "Data source name patterns (supports wildcards). At least one of 'ds_list' / 'ds_ids' must be non-empty; the two are merged to decide which datasources the rule monitors.")
-	cmd.Flags().StringVar(&fDsType, "ds-type", "", "Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes' (e.g. 'prometheus', 'elasticsearch'). (required)")
-	cmd.Flags().BoolVar(&fEnabled, "enabled", false, "Whether the rule is enabled. Updating to 'false' makes the server clean up the rule's active alerts.")
-	cmd.Flags().Int64Var(&fFolderID, "folder-id", 0, "ID of the folder the rule belongs to. Obtainable via 'POST /monit/folder/list'. (required)")
-	cmd.Flags().Int64Var(&fID, "id", 0, "Rule ID. Required for update; omit for create (assigned by the server).")
-	cmd.Flags().StringVar(&fName, "name", "", "Rule name. Must be unique within the same folder. (required)")
-	cmd.Flags().Int64Var(&fRepeatInterval, "repeat-interval", 0, "Notification repeat interval in seconds.")
-	cmd.Flags().Int64Var(&fRepeatTotal, "repeat-total", 0, "Max number of repeat notifications.")
-	cmd.Flags().StringVar(&fTimezone, "timezone", "", "Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); shortcuts and offsets such as 'Local', 'UTC+8', or 'CST' are rejected. Treated as 'Asia/Shanghai' if empty.")
-	cmd.Flags().StringVar(&fUpdatedAt, "updated-at", "", "Last update time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
-	cmd.Flags().Int64Var(&fUpdaterID, "updater-id", 0, "Last updater user ID. Filled by the server; do not provide.")
-	cmd.Flags().StringVar(&fUpdaterName, "updater-name", "", "Last updater name. Filled by the server; do not provide.")
+	cmd.Flags().Int64Var(&fAccountID, "account-id", 0, "Account ID, filled by the server from the authentication context; any client-supplied value is ignored.")
+	cmd.Flags().IntSliceVar(&fChannelIDs, "channel-ids", nil, "Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.")
+	cmd.Flags().StringVar(&fCreatedAt, "created-at", "", "Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
+	cmd.Flags().Int64Var(&fCreatorID, "creator-id", 0, "Creator member ID, filled by the server from the current user; any client-supplied value is ignored.")
+	cmd.Flags().StringVar(&fCreatorName, "creator-name", "", "Creator name, filled by the server; any client-supplied value is ignored.")
+	cmd.Flags().StringVar(&fCronPattern, "cron-pattern", "", "Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval. Must not start with 'CRON_TZ=' or 'TZ='; set the timezone in the 'timezone' field instead. (required)")
+	cmd.Flags().BoolVar(&fDebugLogEnabled, "debug-log-enabled", false, "Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.")
+	cmd.Flags().Int64Var(&fDelaySeconds, "delay-seconds", 0, "Seconds the evaluation query window is shifted back, compensating for data ingestion latency.")
+	cmd.Flags().StringVar(&fDescription, "description", "", "Rule description, Markdown format.")
+	cmd.Flags().StringVar(&fDescriptionType, "description-type", "", "Format of the description content. Empty or omitted defaults to 'text'. 'text' = plain text; 'markdown' = Markdown, rendered as such in alert details. [text, markdown]")
+	cmd.Flags().IntSliceVar(&fDsIDs, "ds-ids", nil, "Datasource ID list, merged with 'ds_list' to decide the monitored datasources; IDs survive datasource renames. At least one of 'ds_list' / 'ds_ids' must be provided.")
+	cmd.Flags().StringSliceVar(&fDsList, "ds-list", nil, "Datasource name match patterns (wildcards supported). At least one of 'ds_list' / 'ds_ids' must be non-empty; both are merged to decide which datasources the rule monitors.")
+	cmd.Flags().StringVar(&fDsType, "ds-type", "", "Datasource type identifier (e.g. 'prometheus', 'elasticsearch'). (required)")
+	cmd.Flags().BoolVar(&fEnabled, "enabled", false, "Whether the rule is enabled. Required — the server enforces an explicit value (including 'false') while decoding. Setting it to 'false' on update clears the rule's active alerts. (required)")
+	cmd.Flags().Int64Var(&fFolderID, "folder-id", 0, "ID of the folder the rule belongs to; list folders via 'POST /monit/folder/list'. Cannot be changed through the update API — use '/monit/rule/move' instead. (required)")
+	cmd.Flags().Int64Var(&fID, "id", 0, "Rule ID. Required on update; omit on create (assigned by the server).")
+	cmd.Flags().StringVar(&fName, "name", "", "Rule name. Must be unique within the folder and at most 128 characters. (required)")
+	cmd.Flags().Int64Var(&fRepeatInterval, "repeat-interval", 0, "Notification repeat interval in seconds. Values below 1 fall back to the default 3600.")
+	cmd.Flags().Int64Var(&fRepeatTotal, "repeat-total", 0, "Maximum number of repeat notifications. Values below 1 fall back to the default 3.")
+	cmd.Flags().StringVar(&fTimezone, "timezone", "", "Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); abbreviations or offsets like 'Local', 'UTC+8', 'CST' are rejected. Empty falls back to 'Asia/Shanghai'.")
+	cmd.Flags().StringVar(&fUpdatedAt, "updated-at", "", "Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
+	cmd.Flags().Int64Var(&fUpdaterID, "updater-id", 0, "ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.")
+	cmd.Flags().StringVar(&fUpdaterName, "updater-name", "", "Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
 	return cmd
 }
@@ -1011,7 +962,7 @@ Request fields:
   --description string — Rule description (Markdown). Effective only when 'fields' includes 'description'.
   --ds-ids []int — Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. Effective only when 'fields' includes 'ds_ids'.
   --ds-list []string — Datasource name match patterns; wildcards supported. Effective only when 'fields' includes 'ds_list'.
-  --ds-type string — Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes'. Effective only when 'fields' includes 'ds_type'.
+  --ds-type string — Datasource type identifier. Effective only when 'fields' includes 'ds_type'.
   --enabled bool — Whether the rule is enabled. Setting it to 'false' makes the server clean up the rule's active alerts. Effective only when 'fields' includes 'enabled'.
   --fields []string (required) — Field names to update. Only listed fields are updated, taking new values from the same-named request fields; values for unlisted fields are silently ignored. [labels, ds_type, ds_list, ds_ids, enabled, debug_log_enabled, cron_pattern, timezone, delay_seconds, enabled_times, annotations, description, channel_ids, repeat_interval, repeat_total]
   --ids []int (required) — Rule IDs to update.
@@ -1105,7 +1056,7 @@ Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '
 	cmd.Flags().StringVar(&fDescription, "description", "", "Rule description (Markdown). Effective only when 'fields' includes 'description'.")
 	cmd.Flags().IntSliceVar(&fDsIDs, "ds-ids", nil, "Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. Effective only when 'fields' includes 'ds_ids'.")
 	cmd.Flags().StringSliceVar(&fDsList, "ds-list", nil, "Datasource name match patterns; wildcards supported. Effective only when 'fields' includes 'ds_list'.")
-	cmd.Flags().StringVar(&fDsType, "ds-type", "", "Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes'. Effective only when 'fields' includes 'ds_type'.")
+	cmd.Flags().StringVar(&fDsType, "ds-type", "", "Datasource type identifier. Effective only when 'fields' includes 'ds_type'.")
 	cmd.Flags().BoolVar(&fEnabled, "enabled", false, "Whether the rule is enabled. Setting it to 'false' makes the server clean up the rule's active alerts. Effective only when 'fields' includes 'enabled'.")
 	cmd.Flags().StringSliceVar(&fFields, "fields", nil, "Field names to update. Only listed fields are updated, taking new values from the same-named request fields; values for unlisted fields are silently ignored. (required) [labels, ds_type, ds_list, ds_ids, enabled, debug_log_enabled, cron_pattern, timezone, delay_seconds, enabled_times, annotations, description, channel_ids, repeat_interval, repeat_total]")
 	cmd.Flags().IntSliceVar(&fIDs, "ids", nil, "Rule IDs to update. (required)")
@@ -1210,7 +1161,7 @@ Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '
 	return cmd
 }
 
-func genAlertRulesWriteUpdateCmd() *cobra.Command {
+func genAlertRulesWriteUpdateV2Cmd() *cobra.Command {
 	var dataJSON string
 	var fAccountID int64
 	var fChannelIDs []int
@@ -1236,164 +1187,180 @@ func genAlertRulesWriteUpdateCmd() *cobra.Command {
 	var fUpdaterID int64
 	var fUpdaterName string
 	cmd := &cobra.Command{
-		Use:   "rule-update <folder-id>",
-		Short: "Update alert rule",
-		Long: `Update alert rule.
+		Use:   "rule-v2-update <folder-id>",
+		Short: "Update alert rule (V2)",
+		Long: `Update alert rule (V2).
 
-Replace the full configuration of an existing alert rule. All fields are overwritten.
+Replace an alert rule's V2 configuration in full by ID. Returns the updated rule.
 
-API: POST /monit/rule/update (monit-rule-write-update)
+API: POST /monit/rule/v2/update (monit-rule-write-update-v2)
 
 Request fields:
-  --account-id int — Account ID. Filled by the server from the authenticated identity; do not provide.
-  --channel-ids []int — Channel IDs to send alerts to.
-  --created-at string — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
-  --creator-id int — Creator user ID. Filled by the server from the current user; do not provide.
-  --creator-name string — Creator name. Filled by the server; do not provide.
-  --cron-pattern string (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval descriptor. Must not start with 'CRON_TZ=' or 'TZ='; use the 'timezone' field instead.
-  --debug-log-enabled bool — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.
-  --delay-seconds int — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.
-  --description string — Rule description, in Markdown.
-  --description-type string — Format for the description. Defaults to 'text' when omitted or empty. 'text' = plain text; 'markdown' = Markdown, rendered as Markdown in alert details. [text, markdown]
-  --ds-ids []int — Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. At least one of 'ds_list' and 'ds_ids' must be provided.
-  --ds-list []string — Data source name patterns (supports wildcards). At least one of 'ds_list' / 'ds_ids' must be non-empty; the two are merged to decide which datasources the rule monitors.
-  --ds-type string (required) — Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes' (e.g. 'prometheus', 'elasticsearch').
-  --enabled bool — Whether the rule is enabled. Updating to 'false' makes the server clean up the rule's active alerts.
-  --folder-id int (required) — ID of the folder the rule belongs to. Obtainable via 'POST /monit/folder/list'.
-  --id int — Rule ID. Required for update; omit for create (assigned by the server).
-  --name string (required) — Rule name. Must be unique within the same folder.
-  --repeat-interval int — Notification repeat interval in seconds.
-  --repeat-total int — Max number of repeat notifications.
-  --timezone string — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); shortcuts and offsets such as 'Local', 'UTC+8', or 'CST' are rejected. Treated as 'Asia/Shanghai' if empty.
-  --updated-at string — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
-  --updater-id int — Last updater user ID. Filled by the server; do not provide.
-  --updater-name string — Last updater name. Filled by the server; do not provide.
-  annotations (object, via --data) — Annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
-  enabled_times (array<object>, via --data) — Time windows when the rule is active. Defaults to all days from 00:00 to 23:59 when omitted or empty.
+  --account-id int — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.
+  --channel-ids []int — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.
+  --created-at string — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+  --creator-id int — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.
+  --creator-name string — Creator name, filled by the server; any client-supplied value is ignored.
+  --cron-pattern string (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval. Must not start with 'CRON_TZ=' or 'TZ='; set the timezone in the 'timezone' field instead.
+  --debug-log-enabled bool — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.
+  --delay-seconds int — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.
+  --description string — Rule description, Markdown format.
+  --description-type string — Format of the description content. Empty or omitted defaults to 'text'. 'text' = plain text; 'markdown' = Markdown, rendered as such in alert details. [text, markdown]
+  --ds-ids []int — Datasource ID list, merged with 'ds_list' to decide the monitored datasources; IDs survive datasource renames. At least one of 'ds_list' / 'ds_ids' must be provided.
+  --ds-list []string — Datasource name match patterns (wildcards supported). At least one of 'ds_list' / 'ds_ids' must be non-empty; both are merged to decide which datasources the rule monitors.
+  --ds-type string (required) — Datasource type identifier (e.g. 'prometheus', 'elasticsearch').
+  --enabled bool (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including 'false') while decoding. Setting it to 'false' on update clears the rule's active alerts.
+  --folder-id int (required) — ID of the folder the rule belongs to; list folders via 'POST /monit/folder/list'. Cannot be changed through the update API — use '/monit/rule/move' instead.
+  --id int — Rule ID. Required on update; omit on create (assigned by the server).
+  --name string (required) — Rule name. Must be unique within the folder and at most 128 characters.
+  --repeat-interval int — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
+  --repeat-total int — Maximum number of repeat notifications. Values below 1 fall back to the default 3.
+  --timezone string — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); abbreviations or offsets like 'Local', 'UTC+8', 'CST' are rejected. Empty falls back to 'Asia/Shanghai'.
+  --updated-at string — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+  --updater-id int — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+  --updater-name string — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+  annotations (object, via --data) — Extra annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
+  enabled_times (array<object>, via --data) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.
     - days (array<integer>) — Days of week (0=Sunday).
     - etime (string) — End time, e.g. '18:00'.
     - stime (string) — Start time, e.g. '09:00'.
+  investigation_targets (array<object>, via --data) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass '[]' to clear.
+    - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
+      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
+      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
+      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
+    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
   labels (object, via --data) — Custom labels.
-  rule_configs (object, via --data) (required) — Check configuration: query list plus trigger/recovery conditions. Structure see 'RuleConfigs'.
-    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery condition for any-data check. If omitted or 'mode' is empty, treated as 'nodata'.
-        - args (object) — Datasource-specific options for the recovery query, same convention as 'queries[].args'; required for Elasticsearch datasources when 'mode' is 'ql'.
-        - condition (string) — Recovery expression. Required when 'mode' is 'ql'.
-        - mode (string) — 'nodata' = recover when the query returns no data; 'ql' = recover when the 'condition' expression evaluates to true. When 'mode' is 'ql', only a single query ('name=A') is permitted. [nodata, ql]
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_nodata (object) — No-data check configuration.
-      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.
-      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when 'alert_on_empty_result' is enabled. [Critical, Warning, Info]
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - resolve_timeout (integer) — Auto-resolve after N seconds.
-      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_threshold (object) — Threshold check configuration.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - critical (string) — Critical threshold expression referencing query results via '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; at least one severity must be configured.
-      - enabled (boolean) — Whether threshold checking is enabled.
-      - info (string) — Info threshold expression, same syntax as 'critical'.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery evaluation configuration for threshold checks.
-        - args (object) — Datasource-specific extra parameters for the recovery query, using the same '<datasource>.<param>' key convention as query 'args'. Omitted when empty.
-        - condition (string) — Recovery condition expression; required when 'mode' is 'threshold' or 'ql', and must be empty for 'invert'.
-        - mode (string) — Recovery mode: 'invert' = resolve when the alert expression no longer holds ('condition' stays empty); 'threshold' = resolve when the 'condition' threshold expression holds; 'ql' = resolve when the 'condition' query expression evaluates true. [invert, threshold, ql]
-        - value_fields (array<string>) — Numeric result fields the recovery 'condition' references as '$A.<field>'; same semantics as the query's 'value_fields'. Omitted when empty.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - warning (string) — Warning threshold expression, same syntax as 'critical'.
-    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicate 'expr'.
-      - args (object) — Datasource-specific query options keyed by the '<datasource>.<option>' convention (e.g. 'es.type', 'tencent_cls.limit'); most datasources need none.
+  rule_configs (object, via --data) (required) — Detection configuration: query list plus trigger/recovery conditions. See 'AlertRuleConfigsV2'.
+    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See 'AlertRuleAnyDataV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'data_absent' = recover when the query returns no data; 'recovery' is not allowed. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true; only a single query ('name=A') is allowed. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [data_absent, recovery_query_match, manual]
+      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]
+    - check_nodata (object) — No-data check configuration. See 'AlertRuleNoDataV2'.
+      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).
+      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when 'alert_on_empty_result' is on. [Critical, Warning, Info]
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when 'end_mode' is 'data_reappears_or_timeout'; must be 0 for the other modes.
+      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.
+      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. 'data_reappears' = recover when data reappears. 'data_reappears_or_timeout' = end when data reappears or after 'auto_close_after_seconds' seconds, whichever comes first; requires the per-series no-data check and a positive 'auto_close_after_seconds'. 'manual' = never end automatically; alerts need manual handling and no recovery event is pushed. For 'data_reappears' and 'manual', 'auto_close_after_seconds' must be 0. [data_reappears, data_reappears_or_timeout, manual]
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]
+    - check_threshold (object) — Threshold check configuration. See 'AlertRuleThresholdV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy 'alerting_check_times' <= M <= 10000.
+      - critical (string) — Critical threshold expression referencing query results as '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; when enabled at least one of the three severities must be set.
+      - enabled (boolean) — Whether the threshold check is enabled.
+      - info (string) — Info threshold expression; same syntax as 'critical'.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'expression_match' or 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'condition_clear' = recover once the alert expression no longer holds; 'recovery' is not allowed. 'expression_match' = recover when the 'recovery.expr' threshold expression holds. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [condition_clear, expression_match, recovery_query_match, manual]
+      - warning (string) — Warning threshold expression; same syntax as 'critical'.
+    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicated 'expr'.
+      - args (object) — Datasource-specific query parameters; keys follow the '<datasource>.<param>' convention (e.g. 'es.type', 'tencent_cls.limit'). Most datasources need none.
       - expr (string) — Query expression.
-      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap 'value_fields'; applies to table-shaped results (SQL/ES-style datasources).
-      - name (string) — Query identifier (letter, e.g. 'A'). The name 'R' is reserved and must not be used.
-      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as '$A.<field>' in threshold expressions); required for threshold checks unless the datasource is 'prometheus'/'loki'/'victorialogs'; field names must not contain '.'.
-    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique 'name' (not duplicating any query name) and a non-empty 'expr'.
-      - args (object) — Datasource-specific options for the auxiliary query, same convention as 'queries[].args'.
+      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap 'value_fields'; applies to tabular results (SQL/ES-like datasources).
+      - name (string) — Query identifier (e.g. 'A'), must match '[A-Za-z][A-Za-z0-9_]*'; 'R' and '__all__' are reserved and cannot be used.
+      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as '$A.<field>'); required for threshold checks when the datasource is not 'prometheus'/'loki'/'victorialogs'. Field names must not contain '.'.
+    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique 'name' (not colliding with any query name) and a non-empty 'expr'.
+      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as 'queries[].args'.
       - expr (string) — Query expression.
-      - name (string) — Relate-query identifier.
+      - name (string) — Auxiliary query identifier.
 
 Response fields ('data' envelope is unwrapped — these fields are at the top level):
-  - account_id (integer) — Account ID. Filled by the server from the authenticated identity; do not provide.
-  - annotations (object) — Annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
-  - channel_ids (array<integer>) — Channel IDs to send alerts to.
-  - created_at (integer) — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide.
-  - creator_id (integer) — Creator user ID. Filled by the server from the current user; do not provide.
-  - creator_name (string) — Creator name. Filled by the server; do not provide.
-  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval descriptor. Must not start with 'CRON_TZ=' or 'TZ='; use the 'timezone' field instead.
-  - debug_log_enabled (boolean) — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.
-  - delay_seconds (integer) — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.
-  - description (string) — Rule description, in Markdown.
-  - description_type (string) — Format for the description. Defaults to 'text' when omitted or empty. 'text' = plain text; 'markdown' = Markdown, rendered as Markdown in alert details. [text, markdown]
-  - ds_ids (array<integer>) — Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. At least one of 'ds_list' and 'ds_ids' must be provided.
-  - ds_list (array<string>) — Data source name patterns (supports wildcards). At least one of 'ds_list' / 'ds_ids' must be non-empty; the two are merged to decide which datasources the rule monitors.
-  - ds_type (string) (required) — Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes' (e.g. 'prometheus', 'elasticsearch').
-  - enabled (boolean) — Whether the rule is enabled. Updating to 'false' makes the server clean up the rule's active alerts.
-  - enabled_times (array<object>) — Time windows when the rule is active. Defaults to all days from 00:00 to 23:59 when omitted or empty.
+  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.
+  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with '$' (reserved for query fields).
+  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.
+  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.
+  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.
+  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.
+  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval. Must not start with 'CRON_TZ=' or 'TZ='; set the timezone in the 'timezone' field instead.
+  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.
+  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.
+  - description (string) — Rule description, Markdown format.
+  - description_type (string) — Format of the description content. Empty or omitted defaults to 'text'. 'text' = plain text; 'markdown' = Markdown, rendered as such in alert details. [text, markdown]
+  - ds_ids (array<integer>) — Datasource ID list, merged with 'ds_list' to decide the monitored datasources; IDs survive datasource renames. At least one of 'ds_list' / 'ds_ids' must be provided.
+  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of 'ds_list' / 'ds_ids' must be non-empty; both are merged to decide which datasources the rule monitors.
+  - ds_type (string) (required) — Datasource type identifier (e.g. 'prometheus', 'elasticsearch').
+  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including 'false') while decoding. Setting it to 'false' on update clears the rule's active alerts.
+  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.
     - days (array<integer>) — Days of week (0=Sunday).
     - etime (string) — End time, e.g. '18:00'.
     - stime (string) — Start time, e.g. '09:00'.
-  - folder_id (integer) (required) — ID of the folder the rule belongs to. Obtainable via 'POST /monit/folder/list'.
-  - id (integer) — Rule ID. Required for update; omit for create (assigned by the server).
+  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via 'POST /monit/folder/list'. Cannot be changed through the update API — use '/monit/rule/move' instead.
+  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).
+  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass '[]' to clear.
+    - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
+      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
+      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
+      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
+    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
   - labels (object) — Custom labels.
-  - name (string) (required) — Rule name. Must be unique within the same folder.
-  - repeat_interval (integer) — Notification repeat interval in seconds.
-  - repeat_total (integer) — Max number of repeat notifications.
-  - rule_configs (object) (required) — Check configuration: query list plus trigger/recovery conditions. Structure see 'RuleConfigs'.
-    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery condition for any-data check. If omitted or 'mode' is empty, treated as 'nodata'.
-        - args (object) — Datasource-specific options for the recovery query, same convention as 'queries[].args'; required for Elasticsearch datasources when 'mode' is 'ql'.
-        - condition (string) — Recovery expression. Required when 'mode' is 'ql'.
-        - mode (string) — 'nodata' = recover when the query returns no data; 'ql' = recover when the 'condition' expression evaluates to true. When 'mode' is 'ql', only a single query ('name=A') is permitted. [nodata, ql]
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_nodata (object) — No-data check configuration.
-      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.
-      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when 'alert_on_empty_result' is enabled. [Critical, Warning, Info]
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - resolve_timeout (integer) — Auto-resolve after N seconds.
-      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_threshold (object) — Threshold check configuration.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - critical (string) — Critical threshold expression referencing query results via '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; at least one severity must be configured.
-      - enabled (boolean) — Whether threshold checking is enabled.
-      - info (string) — Info threshold expression, same syntax as 'critical'.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery evaluation configuration for threshold checks.
-        - args (object) — Datasource-specific extra parameters for the recovery query, using the same '<datasource>.<param>' key convention as query 'args'. Omitted when empty.
-        - condition (string) — Recovery condition expression; required when 'mode' is 'threshold' or 'ql', and must be empty for 'invert'.
-        - mode (string) — Recovery mode: 'invert' = resolve when the alert expression no longer holds ('condition' stays empty); 'threshold' = resolve when the 'condition' threshold expression holds; 'ql' = resolve when the 'condition' query expression evaluates true. [invert, threshold, ql]
-        - value_fields (array<string>) — Numeric result fields the recovery 'condition' references as '$A.<field>'; same semantics as the query's 'value_fields'. Omitted when empty.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - warning (string) — Warning threshold expression, same syntax as 'critical'.
-    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicate 'expr'.
-      - args (object) — Datasource-specific query options keyed by the '<datasource>.<option>' convention (e.g. 'es.type', 'tencent_cls.limit'); most datasources need none.
+  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.
+  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
+  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.
+  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See 'AlertRuleConfigsV2'.
+    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See 'AlertRuleAnyDataV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'data_absent' = recover when the query returns no data; 'recovery' is not allowed. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true; only a single query ('name=A') is allowed. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [data_absent, recovery_query_match, manual]
+      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]
+    - check_nodata (object) — No-data check configuration. See 'AlertRuleNoDataV2'.
+      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).
+      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when 'alert_on_empty_result' is on. [Critical, Warning, Info]
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode. Must satisfy 'alerting_check_times' <= M <= 10000.
+      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when 'end_mode' is 'data_reappears_or_timeout'; must be 0 for the other modes.
+      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.
+      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. 'data_reappears' = recover when data reappears. 'data_reappears_or_timeout' = end when data reappears or after 'auto_close_after_seconds' seconds, whichever comes first; requires the per-series no-data check and a positive 'auto_close_after_seconds'. 'manual' = never end automatically; alerts need manual handling and no recovery event is pushed. For 'data_reappears' and 'manual', 'auto_close_after_seconds' must be 0. [data_reappears, data_reappears_or_timeout, manual]
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]
+    - check_threshold (object) — Threshold check configuration. See 'AlertRuleThresholdV2'.
+      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with 'alerting_window_size' it means at least N hits within the last M evaluations.
+      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least 'alerting_check_times' times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy 'alerting_check_times' <= M <= 10000.
+      - critical (string) — Critical threshold expression referencing query results as '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; when enabled at least one of the three severities must be set.
+      - enabled (boolean) — Whether the threshold check is enabled.
+      - info (string) — Info threshold expression; same syntax as 'critical'.
+      - recovery (object) — Recovery evaluation config. Required (with non-empty 'recovery.expr') only when 'recovery_mode' is 'expression_match' or 'recovery_query_match'; must be omitted for the other modes.
+        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same '<datasource>.<param>' convention as a query's 'args'. Not returned when empty.
+        - expr (string) — Recovery condition expression: a threshold expression (e.g. '$A < 90') in 'expression_match' mode, a query expression in 'recovery_query_match' mode. Required and non-empty when the corresponding mode is enabled.
+        - value_fields (array<string>) — Numeric result fields the recovery expression references as '$A.<field>'; same semantics as a query's 'value_fields'. Not returned when empty.
+      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.
+      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. 'condition_clear' = recover once the alert expression no longer holds; 'recovery' is not allowed. 'expression_match' = recover when the 'recovery.expr' threshold expression holds. 'recovery_query_match' = recover when the 'recovery.expr' query expression evaluates true. 'manual' = never recover automatically; alerts need manual handling, no recovery event is pushed, and 'recovery' is not allowed. [condition_clear, expression_match, recovery_query_match, manual]
+      - warning (string) — Warning threshold expression; same syntax as 'critical'.
+    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicated 'expr'.
+      - args (object) — Datasource-specific query parameters; keys follow the '<datasource>.<param>' convention (e.g. 'es.type', 'tencent_cls.limit'). Most datasources need none.
       - expr (string) — Query expression.
-      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap 'value_fields'; applies to table-shaped results (SQL/ES-style datasources).
-      - name (string) — Query identifier (letter, e.g. 'A'). The name 'R' is reserved and must not be used.
-      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as '$A.<field>' in threshold expressions); required for threshold checks unless the datasource is 'prometheus'/'loki'/'victorialogs'; field names must not contain '.'.
-    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique 'name' (not duplicating any query name) and a non-empty 'expr'.
-      - args (object) — Datasource-specific options for the auxiliary query, same convention as 'queries[].args'.
+      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap 'value_fields'; applies to tabular results (SQL/ES-like datasources).
+      - name (string) — Query identifier (e.g. 'A'), must match '[A-Za-z][A-Za-z0-9_]*'; 'R' and '__all__' are reserved and cannot be used.
+      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as '$A.<field>'); required for threshold checks when the datasource is not 'prometheus'/'loki'/'victorialogs'. Field names must not contain '.'.
+    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique 'name' (not colliding with any query name) and a non-empty 'expr'.
+      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as 'queries[].args'.
       - expr (string) — Query expression.
-      - name (string) — Relate-query identifier.
-  - timezone (string) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); shortcuts and offsets such as 'Local', 'UTC+8', or 'CST' are rejected. Treated as 'Asia/Shanghai' if empty.
-  - updated_at (integer) — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide.
-  - updater_id (integer) — Last updater user ID. Filled by the server; do not provide.
-  - updater_name (string) — Last updater name. Filled by the server; do not provide.
+      - name (string) — Auxiliary query identifier.
+  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); abbreviations or offsets like 'Local', 'UTC+8', 'CST' are rejected. Empty falls back to 'Asia/Shanghai'.
+  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.
+  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
 `,
 		Args:    requireBodyFieldOrExactArg("folder_id", "folder-id"),
-		Example: `  flashduty monit rule-update --data '{"cron_pattern":"0 * * * * *","ds_list":["prometheus*"],"ds_type":"prometheus","enabled":true,"folder_id":100,"id":50001,"name":"CPU High v2","rule_configs":{"queries":[{"expr":"avg(cpu_usage_idle) \u003c 5","name":"A"}]}}'`,
+		Example: `  flashduty monit rule-v2-update --data '{"channel_ids":[20001],"cron_pattern":"0 * * * * *","ds_list":["prometheus*"],"ds_type":"prometheus","enabled":true,"folder_id":100,"id":50001,"name":"CPU High","rule_configs":{"check_threshold":{"alerting_check_times":3,"alerting_window_size":5,"critical":"$A \u003e 95","enabled":true,"recovery_check_times":2,"recovery_mode":"condition_clear","warning":"$A \u003e 80"},"queries":[{"expr":"100 - avg(cpu_usage_idle)","name":"A"}]}}'`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
 				vCreatedAt, okCreatedAt, err := genParseTimeFlag(cmd, "created-at", fCreatedAt)
@@ -1482,11 +1449,11 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 				if err != nil {
 					return err
 				}
-				req := new(flashduty.AlertRule)
+				req := new(flashduty.AlertRuleV2)
 				if err := genBindBody(body, req); err != nil {
 					return err
 				}
-				out, _, err := ctx.Client.AlertRules.WriteUpdate(cmdContext(ctx.Cmd), req)
+				out, _, err := ctx.Client.AlertRules.WriteUpdateV2(cmdContext(ctx.Cmd), req)
 				if err != nil {
 					return err
 				}
@@ -1494,29 +1461,29 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 			})
 		},
 	}
-	cmd.Flags().Int64Var(&fAccountID, "account-id", 0, "Account ID. Filled by the server from the authenticated identity; do not provide.")
-	cmd.Flags().IntSliceVar(&fChannelIDs, "channel-ids", nil, "Channel IDs to send alerts to.")
-	cmd.Flags().StringVar(&fCreatedAt, "created-at", "", "Creation time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
-	cmd.Flags().Int64Var(&fCreatorID, "creator-id", 0, "Creator user ID. Filled by the server from the current user; do not provide.")
-	cmd.Flags().StringVar(&fCreatorName, "creator-name", "", "Creator name. Filled by the server; do not provide.")
-	cmd.Flags().StringVar(&fCronPattern, "cron-pattern", "", "Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval descriptor. Must not start with 'CRON_TZ=' or 'TZ='; use the 'timezone' field instead. (required)")
-	cmd.Flags().BoolVar(&fDebugLogEnabled, "debug-log-enabled", false, "Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.")
-	cmd.Flags().Int64Var(&fDelaySeconds, "delay-seconds", 0, "Seconds to shift the evaluation query window backward, compensating for data ingestion latency.")
-	cmd.Flags().StringVar(&fDescription, "description", "", "Rule description, in Markdown.")
-	cmd.Flags().StringVar(&fDescriptionType, "description-type", "", "Format for the description. Defaults to 'text' when omitted or empty. 'text' = plain text; 'markdown' = Markdown, rendered as Markdown in alert details. [text, markdown]")
-	cmd.Flags().IntSliceVar(&fDsIDs, "ds-ids", nil, "Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. At least one of 'ds_list' and 'ds_ids' must be provided.")
-	cmd.Flags().StringSliceVar(&fDsList, "ds-list", nil, "Data source name patterns (supports wildcards). At least one of 'ds_list' / 'ds_ids' must be non-empty; the two are merged to decide which datasources the rule monitors.")
-	cmd.Flags().StringVar(&fDsType, "ds-type", "", "Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes' (e.g. 'prometheus', 'elasticsearch'). (required)")
-	cmd.Flags().BoolVar(&fEnabled, "enabled", false, "Whether the rule is enabled. Updating to 'false' makes the server clean up the rule's active alerts.")
-	cmd.Flags().Int64Var(&fFolderID, "folder-id", 0, "ID of the folder the rule belongs to. Obtainable via 'POST /monit/folder/list'. (required)")
-	cmd.Flags().Int64Var(&fID, "id", 0, "Rule ID. Required for update; omit for create (assigned by the server).")
-	cmd.Flags().StringVar(&fName, "name", "", "Rule name. Must be unique within the same folder. (required)")
-	cmd.Flags().Int64Var(&fRepeatInterval, "repeat-interval", 0, "Notification repeat interval in seconds.")
-	cmd.Flags().Int64Var(&fRepeatTotal, "repeat-total", 0, "Max number of repeat notifications.")
-	cmd.Flags().StringVar(&fTimezone, "timezone", "", "Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); shortcuts and offsets such as 'Local', 'UTC+8', or 'CST' are rejected. Treated as 'Asia/Shanghai' if empty.")
-	cmd.Flags().StringVar(&fUpdatedAt, "updated-at", "", "Last update time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
-	cmd.Flags().Int64Var(&fUpdaterID, "updater-id", 0, "Last updater user ID. Filled by the server; do not provide.")
-	cmd.Flags().StringVar(&fUpdaterName, "updater-name", "", "Last updater name. Filled by the server; do not provide.")
+	cmd.Flags().Int64Var(&fAccountID, "account-id", 0, "Account ID, filled by the server from the authentication context; any client-supplied value is ignored.")
+	cmd.Flags().IntSliceVar(&fChannelIDs, "channel-ids", nil, "Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.")
+	cmd.Flags().StringVar(&fCreatedAt, "created-at", "", "Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
+	cmd.Flags().Int64Var(&fCreatorID, "creator-id", 0, "Creator member ID, filled by the server from the current user; any client-supplied value is ignored.")
+	cmd.Flags().StringVar(&fCreatorName, "creator-name", "", "Creator name, filled by the server; any client-supplied value is ignored.")
+	cmd.Flags().StringVar(&fCronPattern, "cron-pattern", "", "Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval. Must not start with 'CRON_TZ=' or 'TZ='; set the timezone in the 'timezone' field instead. (required)")
+	cmd.Flags().BoolVar(&fDebugLogEnabled, "debug-log-enabled", false, "Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.")
+	cmd.Flags().Int64Var(&fDelaySeconds, "delay-seconds", 0, "Seconds the evaluation query window is shifted back, compensating for data ingestion latency.")
+	cmd.Flags().StringVar(&fDescription, "description", "", "Rule description, Markdown format.")
+	cmd.Flags().StringVar(&fDescriptionType, "description-type", "", "Format of the description content. Empty or omitted defaults to 'text'. 'text' = plain text; 'markdown' = Markdown, rendered as such in alert details. [text, markdown]")
+	cmd.Flags().IntSliceVar(&fDsIDs, "ds-ids", nil, "Datasource ID list, merged with 'ds_list' to decide the monitored datasources; IDs survive datasource renames. At least one of 'ds_list' / 'ds_ids' must be provided.")
+	cmd.Flags().StringSliceVar(&fDsList, "ds-list", nil, "Datasource name match patterns (wildcards supported). At least one of 'ds_list' / 'ds_ids' must be non-empty; both are merged to decide which datasources the rule monitors.")
+	cmd.Flags().StringVar(&fDsType, "ds-type", "", "Datasource type identifier (e.g. 'prometheus', 'elasticsearch'). (required)")
+	cmd.Flags().BoolVar(&fEnabled, "enabled", false, "Whether the rule is enabled. Required — the server enforces an explicit value (including 'false') while decoding. Setting it to 'false' on update clears the rule's active alerts. (required)")
+	cmd.Flags().Int64Var(&fFolderID, "folder-id", 0, "ID of the folder the rule belongs to; list folders via 'POST /monit/folder/list'. Cannot be changed through the update API — use '/monit/rule/move' instead. (required)")
+	cmd.Flags().Int64Var(&fID, "id", 0, "Rule ID. Required on update; omit on create (assigned by the server).")
+	cmd.Flags().StringVar(&fName, "name", "", "Rule name. Must be unique within the folder and at most 128 characters. (required)")
+	cmd.Flags().Int64Var(&fRepeatInterval, "repeat-interval", 0, "Notification repeat interval in seconds. Values below 1 fall back to the default 3600.")
+	cmd.Flags().Int64Var(&fRepeatTotal, "repeat-total", 0, "Maximum number of repeat notifications. Values below 1 fall back to the default 3.")
+	cmd.Flags().StringVar(&fTimezone, "timezone", "", "Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); abbreviations or offsets like 'Local', 'UTC+8', 'CST' are rejected. Empty falls back to 'Asia/Shanghai'.")
+	cmd.Flags().StringVar(&fUpdatedAt, "updated-at", "", "Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
+	cmd.Flags().Int64Var(&fUpdaterID, "updater-id", 0, "ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.")
+	cmd.Flags().StringVar(&fUpdaterName, "updater-name", "", "Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
 	return cmd
 }
@@ -1526,17 +1493,15 @@ func registerGeneratedAlertRules(root *cobra.Command) {
 	genAddLeaf(gMonit, genAlertRulesReadAuditDetailCmd())
 	genAddLeaf(gMonit, genAlertRulesReadAuditsCmd())
 	genAddLeaf(gMonit, genAlertRulesReadCounterChannelCmd())
-	genAddLeaf(gMonit, genAlertRulesReadCounterNodeCmd())
 	genAddLeaf(gMonit, genAlertRulesReadCounterTotalCmd())
-	genAddLeaf(gMonit, genAlertRulesReadDstypesCmd())
 	genAddLeaf(gMonit, genAlertRulesReadExportCmd())
-	genAddLeaf(gMonit, genAlertRulesReadInfoCmd())
+	genAddLeaf(gMonit, genAlertRulesReadInfoV2Cmd())
 	genAddLeaf(gMonit, genAlertRulesReadListCmd())
-	genAddLeaf(gMonit, genAlertRulesWriteCreateCmd())
+	genAddLeaf(gMonit, genAlertRulesWriteCreateV2Cmd())
 	genAddLeaf(gMonit, genAlertRulesWriteDeleteCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteDeleteBatchCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteFieldsUpdateCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteImportCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteMoveCmd())
-	genAddLeaf(gMonit, genAlertRulesWriteUpdateCmd())
+	genAddLeaf(gMonit, genAlertRulesWriteUpdateV2Cmd())
 }
diff --git a/internal/cli/zz_generated_applications.go b/internal/cli/zz_generated_applications.go
index 0b52741..4ed818f 100644
--- a/internal/cli/zz_generated_applications.go
+++ b/internal/cli/zz_generated_applications.go
@@ -302,6 +302,406 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
 	return cmd
 }
 
+func genApplicationsRemoteConfigReadGetCmd() *cobra.Command {
+	var dataJSON string
+	var fApplicationID string
+	cmd := &cobra.Command{
+		Use:   "application-remote-config-get <application-id>",
+		Short: "Get remote config detail",
+		Long: `Get remote config detail.
+
+Retrieve the live remote configuration of a RUM application and the version it is stored under.
+
+API: POST /rum/application/remote-config/get (rum-application-remote-config-read-get)
+
+Request fields:
+  --application-id string (required) — RUM application ID.
+
+Response fields ('data' envelope is unwrapped — these fields are at the top level):
+  - config (object) — The whole per-application remote configuration. A change reaches an SDK asynchronously and is applied when that SDK creates its next session, so a running session never flips a decision mid-flight.
+    - activation (string) — How a change lands on a client that is already running: 'next_session' (the default, and what an empty value means) leaves running sessions untouched and applies the change to new sessions; 'immediate' ends the running session as soon as the change arrives so a new session starts under the new configuration. [next_session, immediate]
+    - custom (object) — Application-defined pass-through values handed to the host app verbatim. At most 5 keys, each key up to 64 bytes, each value up to 4 KB of JSON nested at most 3 levels, 16 KB in total. Anyone holding the public client token can read it.
+    - default (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.
+      - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]
+      - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)
+      - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)
+      - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)
+    - enabled (boolean) — Kill switch. When false the engine reports no values at all and SDKs fall back to their init values.
+    - refresh_on_foreground (boolean) — Let clients re-check the configuration when they return to the foreground instead of waiting for the next poll.
+    - rules (array<object>) — Targeting rules, evaluated in order; at most 20 per application.
+      - match (object) (required) — Key/value conditions the SDK's config request must equal. Keys are limited to 'env', 'app_version' and 'sdk'; values are at most 256 bytes.
+      - set (object) (required) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.
+        - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]
+        - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)
+        - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)
+        - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)
+  - updated_at (string) — Unix timestamp in milliseconds - when the current version was published. 0 when never configured. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+  - version (integer) — Version the live configuration is stored under. 0 means the application has never been configured.
+`,
+		Args:    requireBodyFieldOrExactArg("application_id", "application-id"),
+		Example: `  flashduty rum application-remote-config-get --data '{"application_id":"WoyQQ3BohkdtPivubEvE8o"}'`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runCommand(cmd, args, func(ctx *RunContext) error {
+				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
+					if err := genFoldPositional(args, body, "application_id", "string"); err != nil {
+						return err
+					}
+					if cmd.Flags().Changed("application-id") {
+						body["application_id"] = fApplicationID
+					}
+					return nil
+				})
+				if err != nil {
+					return err
+				}
+				req := new(flashduty.GetRemoteConfigRequest)
+				if err := genBindBody(body, req); err != nil {
+					return err
+				}
+				out, _, err := ctx.Client.Applications.RemoteConfigReadGet(cmdContext(ctx.Cmd), req)
+				if err != nil {
+					return err
+				}
+				return printGenericResult(ctx, out)
+			})
+		},
+	}
+	cmd.Flags().StringVar(&fApplicationID, "application-id", "", "RUM application ID. (required)")
+	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
+	return cmd
+}
+
+func genApplicationsRemoteConfigReadHistoryListCmd() *cobra.Command {
+	var dataJSON string
+	var fP int64
+	var fLimit int64
+	var fSearchAfterCtx string
+	var fApplicationID string
+	var fAsc bool
+	var fOrderby string
+	cmd := &cobra.Command{
+		Use:   "application-remote-config-history-list <application-id>",
+		Short: "List remote config history",
+		Long: `List remote config history.
+
+List published remote configuration versions of a RUM application.
+
+API: POST /rum/application/remote-config/history/list (rum-application-remote-config-read-history-list)
+
+Request fields:
+  --page int — Zero-based page index; offset is p multiplied by limit. (0-100000)
+  --limit int — Page size. Default 20, max 100. (max 100)
+  --search-after-ctx string
+  --application-id string (required) — RUM application ID.
+  --asc bool — Ascending order. Default: false (descending).
+  --orderby string — Sort field. Default: 'updated_at'. [updated_at, version]
+
+Response fields ('data' envelope is unwrapped — rows are nested under items[]; pipe 'jq '.items[]'', NOT '.data.items[]'):
+  - has_next_page (boolean) — Whether more pages remain.
+  - items (array<object>) — Version items, newest first by default.
+    - config (object) — The whole per-application remote configuration. A change reaches an SDK asynchronously and is applied when that SDK creates its next session, so a running session never flips a decision mid-flight.
+      - activation (string) — How a change lands on a client that is already running: 'next_session' (the default, and what an empty value means) leaves running sessions untouched and applies the change to new sessions; 'immediate' ends the running session as soon as the change arrives so a new session starts under the new configuration. [next_session, immediate]
+      - custom (object) — Application-defined pass-through values handed to the host app verbatim. At most 5 keys, each key up to 64 bytes, each value up to 4 KB of JSON nested at most 3 levels, 16 KB in total. Anyone holding the public client token can read it.
+      - default (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.
+        - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]
+        - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)
+        - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)
+        - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)
+      - enabled (boolean) — Kill switch. When false the engine reports no values at all and SDKs fall back to their init values.
+      - refresh_on_foreground (boolean) — Let clients re-check the configuration when they return to the foreground instead of waiting for the next poll.
+      - rules (array<object>) — Targeting rules, evaluated in order; at most 20 per application.
+        - match (object) (required) — Key/value conditions the SDK's config request must equal. Keys are limited to 'env', 'app_version' and 'sdk'; values are at most 256 bytes.
+        - set (object) (required) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.
+    - content_hash (string) — Hash of the configuration content; lets the console identify versions with identical content.
+    - equivalent_to (integer) — Earliest version carrying the same content, when that is not this version itself.
+    - reason (string) — Operator's note left when the version was published. Empty when none was given.
+    - updated_at (string) — Unix timestamp in milliseconds - when the version was published. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+    - updated_by (integer) — ID of the member who published the version.
+    - updated_by_name (string) — Name of the member who published the version.
+    - version (integer) — Version number, unique within the application.
+  - total (integer) — Total number of versions.
+`,
+		Args:    requireBodyFieldOrExactArg("application_id", "application-id"),
+		Example: `  flashduty rum application-remote-config-history-list --data '{"application_id":"WoyQQ3BohkdtPivubEvE8o","asc":false,"limit":20,"orderby":"updated_at","p":0}'`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runCommand(cmd, args, func(ctx *RunContext) error {
+				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
+					if err := genFoldPositional(args, body, "application_id", "string"); err != nil {
+						return err
+					}
+					if cmd.Flags().Changed("page") {
+						body["p"] = fP
+					}
+					if cmd.Flags().Changed("limit") {
+						body["limit"] = fLimit
+					}
+					if cmd.Flags().Changed("search-after-ctx") {
+						body["search_after_ctx"] = fSearchAfterCtx
+					}
+					if cmd.Flags().Changed("application-id") {
+						body["application_id"] = fApplicationID
+					}
+					if cmd.Flags().Changed("asc") {
+						body["asc"] = fAsc
+					}
+					if cmd.Flags().Changed("orderby") {
+						body["orderby"] = fOrderby
+					}
+					return nil
+				})
+				if err != nil {
+					return err
+				}
+				req := new(flashduty.ListRemoteConfigHistoryRequest)
+				if err := genBindBody(body, req); err != nil {
+					return err
+				}
+				out, _, err := ctx.Client.Applications.RemoteConfigReadHistoryList(cmdContext(ctx.Cmd), req)
+				if err != nil {
+					return err
+				}
+				return printGenericResult(ctx, out)
+			})
+		},
+	}
+	cmd.Flags().Int64Var(&fP, "page", 0, "Zero-based page index; offset is p multiplied by limit. (0-100000)")
+	cmd.Flags().Int64Var(&fLimit, "limit", 0, "Page size. Default 20, max 100. (max 100)")
+	cmd.Flags().StringVar(&fSearchAfterCtx, "search-after-ctx", "", "Request field ")
+	cmd.Flags().StringVar(&fApplicationID, "application-id", "", "RUM application ID. (required)")
+	cmd.Flags().BoolVar(&fAsc, "asc", false, "Ascending order. Default: false (descending).")
+	cmd.Flags().StringVar(&fOrderby, "orderby", "", "Sort field. Default: 'updated_at'. [updated_at, version]")
+	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
+	return cmd
+}
+
+func genApplicationsRemoteConfigReadPreviewCmd() *cobra.Command {
+	var dataJSON string
+	var fAppVersion string
+	var fApplicationID string
+	var fEnv string
+	var fSdk string
+	cmd := &cobra.Command{
+		Use:   "application-remote-config-preview <application-id>",
+		Short: "Preview remote config",
+		Long: `Preview remote config.
+
+Evaluate a draft remote configuration against a client context without publishing it.
+
+API: POST /rum/application/remote-config/preview (rum-application-remote-config-read-preview)
+
+Request fields:
+  --app-version string — App version the simulated client reports.
+  --application-id string (required) — RUM application ID.
+  --env string — Environment the simulated client reports.
+  --sdk string — SDK name and version the simulated client reports, e.g. 'web@2.4.1'.
+  config (object, via --data) — The whole per-application remote configuration. A change reaches an SDK asynchronously and is applied when that SDK creates its next session, so a running session never flips a decision mid-flight.
+    - activation (string) — How a change lands on a client that is already running: 'next_session' (the default, and what an empty value means) leaves running sessions untouched and applies the change to new sessions; 'immediate' ends the running session as soon as the change arrives so a new session starts under the new configuration. [next_session, immediate]
+    - custom (object) — Application-defined pass-through values handed to the host app verbatim. At most 5 keys, each key up to 64 bytes, each value up to 4 KB of JSON nested at most 3 levels, 16 KB in total. Anyone holding the public client token can read it.
+    - default (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.
+      - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]
+      - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)
+      - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)
+      - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)
+    - enabled (boolean) — Kill switch. When false the engine reports no values at all and SDKs fall back to their init values.
+    - refresh_on_foreground (boolean) — Let clients re-check the configuration when they return to the foreground instead of waiting for the next poll.
+    - rules (array<object>) — Targeting rules, evaluated in order; at most 20 per application.
+      - match (object) (required) — Key/value conditions the SDK's config request must equal. Keys are limited to 'env', 'app_version' and 'sdk'; values are at most 256 bytes.
+      - set (object) (required) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.
+        - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]
+        - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)
+        - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)
+        - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)
+
+Response fields ('data' envelope is unwrapped — these fields are at the top level):
+  - hit_rule_index (integer) — 0-based index of the rule that decided the result, or -1 when only the default applied.
+  - values (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.
+    - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]
+    - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)
+    - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)
+    - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)
+`,
+		Args:    requireBodyFieldOrExactArg("application_id", "application-id"),
+		Example: `  flashduty rum application-remote-config-preview --data '{"app_version":"2.14.3","application_id":"WoyQQ3BohkdtPivubEvE8o","env":"production","sdk":"web@2.4.1"}'`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runCommand(cmd, args, func(ctx *RunContext) error {
+				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
+					if err := genFoldPositional(args, body, "application_id", "string"); err != nil {
+						return err
+					}
+					if cmd.Flags().Changed("app-version") {
+						body["app_version"] = fAppVersion
+					}
+					if cmd.Flags().Changed("application-id") {
+						body["application_id"] = fApplicationID
+					}
+					if cmd.Flags().Changed("env") {
+						body["env"] = fEnv
+					}
+					if cmd.Flags().Changed("sdk") {
+						body["sdk"] = fSdk
+					}
+					return nil
+				})
+				if err != nil {
+					return err
+				}
+				req := new(flashduty.PreviewRemoteConfigRequest)
+				if err := genBindBody(body, req); err != nil {
+					return err
+				}
+				out, _, err := ctx.Client.Applications.RemoteConfigReadPreview(cmdContext(ctx.Cmd), req)
+				if err != nil {
+					return err
+				}
+				return printGenericResult(ctx, out)
+			})
+		},
+	}
+	cmd.Flags().StringVar(&fAppVersion, "app-version", "", "App version the simulated client reports.")
+	cmd.Flags().StringVar(&fApplicationID, "application-id", "", "RUM application ID. (required)")
+	cmd.Flags().StringVar(&fEnv, "env", "", "Environment the simulated client reports.")
+	cmd.Flags().StringVar(&fSdk, "sdk", "", "SDK name and version the simulated client reports, e.g. 'web@2.4.1'.")
+	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
+	return cmd
+}
+
+func genApplicationsRemoteConfigWriteHistoryRevertCmd() *cobra.Command {
+	var dataJSON string
+	var fApplicationID string
+	var fReason string
+	var fVersion int64
+	cmd := &cobra.Command{
+		Use:   "application-remote-config-history-revert <application-id>",
+		Short: "Revert remote config",
+		Long: `Revert remote config.
+
+Republish an earlier remote configuration version's content as a new version.
+
+API: POST /rum/application/remote-config/history/revert (rum-application-remote-config-write-history-revert)
+
+Request fields:
+  --application-id string (required) — RUM application ID.
+  --reason string — Operator's note. The console fills in 'rolled back to vN' when left empty. (≤255 chars)
+  --version int (required) — History version to republish. (min 1)
+
+Response fields ('data' envelope is unwrapped — these fields are at the top level):
+  - version (integer) — New version number created by the revert.
+`,
+		Args:    requireBodyFieldOrExactArg("application_id", "application-id"),
+		Example: `  flashduty rum application-remote-config-history-revert --data '{"application_id":"WoyQQ3BohkdtPivubEvE8o","reason":"Rolled back after the Q4 launch incident","version":7}'`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runCommand(cmd, args, func(ctx *RunContext) error {
+				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
+					if err := genFoldPositional(args, body, "application_id", "string"); err != nil {
+						return err
+					}
+					if cmd.Flags().Changed("application-id") {
+						body["application_id"] = fApplicationID
+					}
+					if cmd.Flags().Changed("reason") {
+						body["reason"] = fReason
+					}
+					if cmd.Flags().Changed("version") {
+						body["version"] = fVersion
+					}
+					return nil
+				})
+				if err != nil {
+					return err
+				}
+				req := new(flashduty.RevertRemoteConfigRequest)
+				if err := genBindBody(body, req); err != nil {
+					return err
+				}
+				out, _, err := ctx.Client.Applications.RemoteConfigWriteHistoryRevert(cmdContext(ctx.Cmd), req)
+				if err != nil {
+					return err
+				}
+				return printGenericResult(ctx, out)
+			})
+		},
+	}
+	cmd.Flags().StringVar(&fApplicationID, "application-id", "", "RUM application ID. (required)")
+	cmd.Flags().StringVar(&fReason, "reason", "", "Operator's note. The console fills in 'rolled back to vN' when left empty. (≤255 chars)")
+	cmd.Flags().Int64Var(&fVersion, "version", 0, "History version to republish. (required) (min 1)")
+	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
+	return cmd
+}
+
+func genApplicationsRemoteConfigWriteUpdateCmd() *cobra.Command {
+	var dataJSON string
+	var fApplicationID string
+	var fReason string
+	cmd := &cobra.Command{
+		Use:   "application-remote-config-update <application-id>",
+		Short: "Update remote config",
+		Long: `Update remote config.
+
+Publish a complete new remote configuration version for a RUM application.
+
+API: POST /rum/application/remote-config/update (rum-application-remote-config-write-update)
+
+Request fields:
+  --application-id string (required) — RUM application ID.
+  --reason string — Operator's note on why this version was published. Stored verbatim. (≤255 chars)
+  config (object, via --data) (required) — The whole per-application remote configuration. A change reaches an SDK asynchronously and is applied when that SDK creates its next session, so a running session never flips a decision mid-flight.
+    - activation (string) — How a change lands on a client that is already running: 'next_session' (the default, and what an empty value means) leaves running sessions untouched and applies the change to new sessions; 'immediate' ends the running session as soon as the change arrives so a new session starts under the new configuration. [next_session, immediate]
+    - custom (object) — Application-defined pass-through values handed to the host app verbatim. At most 5 keys, each key up to 64 bytes, each value up to 4 KB of JSON nested at most 3 levels, 16 KB in total. Anyone holding the public client token can read it.
+    - default (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.
+      - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]
+      - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)
+      - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)
+      - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)
+    - enabled (boolean) — Kill switch. When false the engine reports no values at all and SDKs fall back to their init values.
+    - refresh_on_foreground (boolean) — Let clients re-check the configuration when they return to the foreground instead of waiting for the next poll.
+    - rules (array<object>) — Targeting rules, evaluated in order; at most 20 per application.
+      - match (object) (required) — Key/value conditions the SDK's config request must equal. Keys are limited to 'env', 'app_version' and 'sdk'; values are at most 256 bytes.
+      - set (object) (required) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.
+        - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]
+        - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)
+        - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)
+        - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)
+
+Response fields ('data' envelope is unwrapped — these fields are at the top level):
+  - version (integer) — New published version number.
+`,
+		Args:    requireBodyFieldOrExactArg("application_id", "application-id"),
+		Example: `  flashduty rum application-remote-config-update --data '{"application_id":"WoyQQ3BohkdtPivubEvE8o","config":{"activation":"next_session","custom":{"feature_flags":{"checkout_v2":true}},"default":{"defaultPrivacyLevel":"mask-user-input","sessionReplaySampleRate":20,"sessionSampleRate":100,"traceSampleRate":100},"enabled":true,"refresh_on_foreground":false,"rules":[{"match":{"env":"production"},"set":{"defaultPrivacyLevel":"mask","sessionReplaySampleRate":0,"sessionSampleRate":5}}]},"reason":"Tighten replay sampling for the Q4 launch"}'`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runCommand(cmd, args, func(ctx *RunContext) error {
+				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
+					if err := genFoldPositional(args, body, "application_id", "string"); err != nil {
+						return err
+					}
+					if cmd.Flags().Changed("application-id") {
+						body["application_id"] = fApplicationID
+					}
+					if cmd.Flags().Changed("reason") {
+						body["reason"] = fReason
+					}
+					return nil
+				})
+				if err != nil {
+					return err
+				}
+				req := new(flashduty.UpdateRemoteConfigRequest)
+				if err := genBindBody(body, req); err != nil {
+					return err
+				}
+				out, _, err := ctx.Client.Applications.RemoteConfigWriteUpdate(cmdContext(ctx.Cmd), req)
+				if err != nil {
+					return err
+				}
+				return printGenericResult(ctx, out)
+			})
+		},
+	}
+	cmd.Flags().StringVar(&fApplicationID, "application-id", "", "RUM application ID. (required)")
+	cmd.Flags().StringVar(&fReason, "reason", "", "Operator's note on why this version was published. Stored verbatim. (≤255 chars)")
+	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
+	return cmd
+}
+
 func genApplicationsWebhookTestCmd() *cobra.Command {
 	var dataJSON string
 	var fApplicationID string
@@ -629,6 +1029,11 @@ func registerGeneratedApplications(root *cobra.Command) {
 	genAddLeaf(gRUM, genApplicationsReadInfoCmd())
 	genAddLeaf(gRUM, genApplicationsReadInfosCmd())
 	genAddLeaf(gRUM, genApplicationsReadListCmd())
+	genAddLeaf(gRUM, genApplicationsRemoteConfigReadGetCmd())
+	genAddLeaf(gRUM, genApplicationsRemoteConfigReadHistoryListCmd())
+	genAddLeaf(gRUM, genApplicationsRemoteConfigReadPreviewCmd())
+	genAddLeaf(gRUM, genApplicationsRemoteConfigWriteHistoryRevertCmd())
+	genAddLeaf(gRUM, genApplicationsRemoteConfigWriteUpdateCmd())
 	genAddLeaf(gRUM, genApplicationsWebhookTestCmd())
 	genAddLeaf(gRUM, genApplicationsWriteCreateCmd())
 	genAddLeaf(gRUM, genApplicationsWriteDeleteCmd())
diff --git a/internal/cli/zz_generated_data_sources.go b/internal/cli/zz_generated_data_sources.go
index 29acd45..6591eff 100644
--- a/internal/cli/zz_generated_data_sources.go
+++ b/internal/cli/zz_generated_data_sources.go
@@ -270,15 +270,15 @@ func genDataSourcesToolsInvokeCmd() *cobra.Command {
 		Short: "Invoke datasource tool",
 		Long: `Invoke datasource tool.
 
-Execute one deterministic tool against a configured datasource. Requires all currently online routable Edge sessions in the cluster to support the v0.71.0 base invoke protocol; individual tools may require a newer implementation. No tool catalog, automatic replay, or fallback to Agent/legacy diagnose. Request body limit 128 KiB; complete success response limit 1 MiB; tool timeout at most 25 seconds.
+Execute one deterministic diagnostic or query tool against a configured datasource.
 
 API: POST /monit/datasource/tools/invoke (monit-datasource-tools-invoke)
 
 Request fields:
   --account-id int — Optional consistency check; must equal the authenticated account.
   --datasource-id int (required) — Datasource ID from /monit/datasource/list. (min 1)
-  --tool string (required) — Single tool name prefixed by the datasource type, e.g. mysql.overview. Free SQL uses /monit/query/data; mysql.query and postgres.query are unsupported. (1-128 chars)
-  params (object, via --data) — Tool-specific JSON parameters; omitted means {}. Explicit null is invalid.
+  --tool string (required) — Single tool name prefixed by the datasource type. Diagnostic tools are defined by the executing Edge (e.g. 'mysql.overview'). Query tools are '<type>.query' where '<type>' is one of 'prometheus', 'mysql', 'postgres', 'oracle', 'clickhouse', 'elasticsearch', 'loki', 'victorialogs', 'sls', 'tencent_cls'; their 'params' follow 'PrometheusQueryParams', 'MySQLQueryParams', 'PostgresQueryParams', 'OracleQueryParams', 'ClickHouseQueryParams', 'ElasticsearchQueryParams', 'LokiQueryParams', 'VictoriaLogsQueryParams', 'SLSQueryParams', or 'TencentCLSQueryParams' respectively. (1-128 chars)
+  params (object, via --data) — Tool-specific JSON parameters; omitted means {}. Explicit null is invalid. Query tools ('<type>.query') use the per-datasource params schemas named in the 'tool' description.
 
 Response fields ('data' envelope is unwrapped — these fields are at the top level):
   - data (any) (required) — Tool-specific JSON evidence, preserved without conversion; never null. No nested legacy diagnose envelope.
@@ -288,8 +288,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
   - truncated (object)
     - reason (string) (required) — Why the result was truncated. Presence of this object indicates truncation.
 `,
-		Args:    requireBodyFieldOrExactArg("datasource_id", "datasource-id"),
-		Example: `  flashduty monit datasource-tools-invoke --data '{"datasource_id":10,"params":{},"tool":"mysql.overview"}'`,
+		Args: requireBodyFieldOrExactArg("datasource_id", "datasource-id"),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
 				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
@@ -324,7 +323,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 	}
 	cmd.Flags().Int64Var(&fAccountID, "account-id", 0, "Optional consistency check; must equal the authenticated account.")
 	cmd.Flags().Int64Var(&fDatasourceID, "datasource-id", 0, "Datasource ID from /monit/datasource/list. (required) (min 1)")
-	cmd.Flags().StringVar(&fTool, "tool", "", "Single tool name prefixed by the datasource type, e.g. mysql.overview. Free SQL uses /monit/query/data; mysql.query and postgres.query are unsupported. (required) (1-128 chars)")
+	cmd.Flags().StringVar(&fTool, "tool", "", "Single tool name prefixed by the datasource type. Diagnostic tools are defined by the executing Edge (e.g. 'mysql.overview'). Query tools are '<type>.query' where '<type>' is one of 'prometheus', 'mysql', 'postgres', 'oracle', 'clickhouse', 'elasticsearch', 'loki', 'victorialogs', 'sls', 'tencent_cls'; their 'params' follow 'PrometheusQueryParams', 'MySQLQueryParams', 'PostgresQueryParams', 'OracleQueryParams', 'ClickHouseQueryParams', 'ElasticsearchQueryParams', 'LokiQueryParams', 'VictoriaLogsQueryParams', 'SLSQueryParams', or 'TencentCLSQueryParams' respectively. (required) (1-128 chars)")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
 	return cmd
 }
diff --git a/internal/cli/zz_generated_manifest.go b/internal/cli/zz_generated_manifest.go
index 9a94201..8f39691 100644
--- a/internal/cli/zz_generated_manifest.go
+++ b/internal/cli/zz_generated_manifest.go
@@ -196,19 +196,17 @@ var generatedOpIDs = []string{
 	"monit-rule-read-audit-detail",
 	"monit-rule-read-audits",
 	"monit-rule-read-counter-channel",
-	"monit-rule-read-counter-node",
 	"monit-rule-read-counter-total",
-	"monit-rule-read-dstypes",
 	"monit-rule-read-export",
-	"monit-rule-read-info",
+	"monit-rule-read-info-v2",
 	"monit-rule-read-list",
-	"monit-rule-write-create",
+	"monit-rule-write-create-v2",
 	"monit-rule-write-delete",
 	"monit-rule-write-delete-batch",
 	"monit-rule-write-fields-update",
 	"monit-rule-write-import",
 	"monit-rule-write-move",
-	"monit-rule-write-update",
+	"monit-rule-write-update-v2",
 	"oncall-license-read-license-list",
 	"personInfos",
 	"postmortem-read-list-templates",
@@ -243,6 +241,11 @@ var generatedOpIDs = []string{
 	"rum-application-read-info",
 	"rum-application-read-infos",
 	"rum-application-read-list",
+	"rum-application-remote-config-read-get",
+	"rum-application-remote-config-read-history-list",
+	"rum-application-remote-config-read-preview",
+	"rum-application-remote-config-write-history-revert",
+	"rum-application-remote-config-write-update",
 	"rum-application-webhook-test",
 	"rum-application-write-create",
 	"rum-application-write-delete",
@@ -274,6 +277,7 @@ var generatedOpIDs = []string{
 	"rum-resource-read-info",
 	"rum-session-replay-read-metadata",
 	"rum-session-replay-read-segments",
+	"scheduleByPerson",
 	"scheduleCreate",
 	"scheduleDelete",
 	"scheduleInfo",
diff --git a/internal/cli/zz_generated_members.go b/internal/cli/zz_generated_members.go
index fe17b39..5724112 100644
--- a/internal/cli/zz_generated_members.go
+++ b/internal/cli/zz_generated_members.go
@@ -271,6 +271,7 @@ func genMembersMemberListCmd() *cobra.Command {
 	var fLimit int64
 	var fSearchAfterCtx string
 	var fAsc bool
+	var fMemberID int64
 	var fOrderby string
 	var fQuery string
 	var fRoleID int64
@@ -288,6 +289,7 @@ Request fields:
   --limit int — Page size. Defaults to 100 on the server when omitted or 0 (1-100)
   --search-after-ctx string
   --asc bool — Ascending order. Default: false (descending)
+  --member-id int — Filter by member ID. Return only the member with this ID.
   --orderby string — Sort field. Default: 'updated_at' [created_at, updated_at]
   --query string — Substring match on member name or email; if the keyword parses as a phone number, an exact phone match is also applied
   --role-id int — Filter by role ID. Get role IDs from 'POST /role/list' (built-in roles: 2=Admin, 6=Responder, 8=Viewer)
@@ -331,6 +333,9 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
 					if cmd.Flags().Changed("asc") {
 						body["asc"] = fAsc
 					}
+					if cmd.Flags().Changed("member-id") {
+						body["member_id"] = fMemberID
+					}
 					if cmd.Flags().Changed("orderby") {
 						body["orderby"] = fOrderby
 					}
@@ -361,6 +366,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
 	cmd.Flags().Int64Var(&fLimit, "limit", 0, "Page size. Defaults to 100 on the server when omitted or 0 (1-100)")
 	cmd.Flags().StringVar(&fSearchAfterCtx, "search-after-ctx", "", "Request field ")
 	cmd.Flags().BoolVar(&fAsc, "asc", false, "Ascending order. Default: false (descending)")
+	cmd.Flags().Int64Var(&fMemberID, "member-id", 0, "Filter by member ID. Return only the member with this ID.")
 	cmd.Flags().StringVar(&fOrderby, "orderby", "", "Sort field. Default: 'updated_at' [created_at, updated_at]")
 	cmd.Flags().StringVar(&fQuery, "query", "", "Substring match on member name or email; if the keyword parses as a phone number, an exact phone match is also applied")
 	cmd.Flags().Int64Var(&fRoleID, "role-id", 0, "Filter by role ID. Get role IDs from 'POST /role/list' (built-in roles: 2=Admin, 6=Responder, 8=Viewer)")
diff --git a/internal/cli/zz_generated_response_help.go b/internal/cli/zz_generated_response_help.go
index c1c94ac..85e861f 100644
--- a/internal/cli/zz_generated_response_help.go
+++ b/internal/cli/zz_generated_response_help.go
@@ -6,206 +6,211 @@ package cli
 // Response-fields help block. Curated commands look this up via responseHelp()
 // so they document the same output shape as the generated commands.
 var responseHelpBySDKMethod = map[string]string{
-	"A2aAgents.ReadGet":                         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - agent_card_name (string) — Agent name resolved from the remote card. Omitted until the card has been fetched.\n  - agent_card_skills (array<string>) — Skills advertised by the remote card. Omitted until the card has been fetched.\n  - agent_id (string) (required) — Unique A2A agent ID (prefix `a2a_`).\n  - agent_name (string) (required) — Agent display name.\n  - allow_insecure_oauth_http (boolean) — Allow non-loopback HTTP OAuth discovery/metadata endpoints for this agent instead of requiring HTTPS.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this agent's endpoint.\n  - auth_config (object) — Authentication config key-values. Values under credential-looking keys (name containing KEY, SECRET, TOKEN, PASSWORD, etc.) are masked. Omitted when empty.\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - auth_type (string) (required) — Authentication type for reaching the remote agent: `none`, `api_key`, or `bearer`. Rows created before validation was tightened may return an empty string, equivalent to `none`. [none, api_key, bearer]\n  - can_edit (boolean) (required) — Whether the caller may edit this agent.\n  - card_resolve_timeout (integer) (required) — Card-resolution timeout in seconds. Always 0 today — the API does not yet expose a way to set it.\n  - card_url (string) (required) — URL of the remote agent card.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the agent.\n  - environments (array<string>) (required) — Execution environments this agent is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - instructions (string) (required) — Natural-language instructions for the remote agent (formerly named `description`). (≤51200 chars)\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - status (string) (required) — Agent status. [enabled, disabled]\n  - streaming (boolean) (required) — Whether the remote agent supports streaming responses.\n  - task_timeout (integer) (required) — Single-task execution timeout in seconds. Always 0 today — the API does not yet expose a way to set it.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"A2aAgents.ReadList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Owning account ID.\n  - agent_card_name (string) — Agent name resolved from the remote card. Omitted until the card has been fetched.\n  - agent_card_skills (array<string>) — Skills advertised by the remote card. Omitted until the card has been fetched.\n  - agent_id (string) (required) — Unique A2A agent ID (prefix `a2a_`).\n  - agent_name (string) (required) — Agent display name.\n  - allow_insecure_oauth_http (boolean) — Allow non-loopback HTTP OAuth discovery/metadata endpoints for this agent instead of requiring HTTPS.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this agent's endpoint.\n  - auth_config (object) — Authentication config key-values. Values under credential-looking keys (name containing KEY, SECRET, TOKEN, PASSWORD, etc.) are masked. Omitted when empty.\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - auth_type (string) (required) — Authentication type for reaching the remote agent: `none`, `api_key`, or `bearer`. Rows created before validation was tightened may return an empty string, equivalent to `none`. [none, api_key, bearer]\n  - can_edit (boolean) (required) — Whether the caller may edit this agent.\n  - card_resolve_timeout (integer) (required) — Card-resolution timeout in seconds. Always 0 today — the API does not yet expose a way to set it.\n  - card_url (string) (required) — URL of the remote agent card.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the agent.\n  - environments (array<string>) (required) — Execution environments this agent is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - instructions (string) (required) — Natural-language instructions for the remote agent (formerly named `description`). (≤51200 chars)\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - status (string) (required) — Agent status. [enabled, disabled]\n  - streaming (boolean) (required) — Whether the remote agent supports streaming responses.\n  - task_timeout (integer) (required) — Single-task execution timeout in seconds. Always 0 today — the API does not yet expose a way to set it.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"A2aAgents.WriteCreate":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - agent_id (string) (required) — ID of the newly created agent.\n",
-	"Account.Info":                              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account identifier.\n  - account_name (string) (required) — Account name.\n  - avatar (string) (required) — Account avatar URL.\n  - country_code (string) (required) — ISO 3166-1 alpha-2 region code of the contact phone (e.g. \"CN\", \"US\", \"HK\").\n  - created_at (string) (required) — Account creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - domain (string) (required) — Primary account domain (login subdomain).\n  - email (string) (required) — Account contact email.\n  - extra_domains (array<string>) (required) — Additional account domains.\n  - locale (string) (required) — Account language preference (e.g. zh-CN, en-US).\n  - mp_account_id (string) — Account identifier on the marketplace platform. Omitted together with `mp_plat`.\n  - mp_plat (string) — Cloud marketplace platform the account was provisioned from. Omitted when the account did not come from a marketplace.\n  - phone (string) (required) — Account contact phone, masked for privacy.\n  - restrictions (object) — Account access restrictions. Omitted when none are configured.\n    - allow_subdomain (boolean) — Whether subdomains of the allowed email domains are also accepted.\n    - email_domains (array<string>) — Allowed login email domains.\n    - ips (array<string>) — Allowed source IP/CIDR whitelist.\n  - time_zone (string) (required) — Account default timezone (IANA name, e.g. Asia/Shanghai).\n",
-	"AlertEnrichment.EnrichmentReadInfo":        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Creation timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the rule set is not deleted; read endpoints never return soft-deleted rule sets, so this is effectively always omitted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) (required) — Integration ID.\n  - rules (array<object>) (required) — Ordered enrichment rules.\n    - if (array<object>) — Optional AND-filter list; the rule is skipped unless every filter matches. `null` when the rule has no condition. Filter keys come from the alert/change event vocabulary (e.g. `title`, `labels.severity`).\n      - key (string) (required) — Event key to match on (e.g. `labels.severity`, `title`). Must be non-empty. (≥1 chars)\n      - oper (string) (required) — Match operator. `IN` matches when any value matches; `NOTIN` matches when none of the values match. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to match against. Must contain at least one value.\n    - kind (string) (required) — Rule type. | Value | Meaning | |---|---| | `extraction` | Extract a value from the alert's `title`, `description`, or a `labels.*` key via regex or GJson, and write it to a label. | | `composition` | Render a Go `text/template` against the event and write the result to a label. | | `mapping` | Look up labels from a mapping schema or an external mapping API. | | `drop` | Remove the listed labels from the alert. | [extraction, composition, mapping, drop]\n    - settings (object) (required) — Rule-kind–specific settings. The shape depends on `kind`.\n      - api_id (string) — Mapping API ID (MongoDB ObjectID hex). Required when `mapping_type` is `api`.\n      - drop_labels (array<string>) — List of label keys to remove from the alert.\n      - g_json (string) — GJson path expression used to extract a value from a JSON-encoded field. Mutually exclusive with `pattern`.\n      - mapping_type (string) — Mapping source type. `schema` uses a mapping schema table; `api` calls an external HTTP API. [schema, api]\n      - override (boolean) — When `true`, overwrite the label if it already exists. Defaults to `false`.\n      - pattern (string) — RE2 regular expression applied to the source value. Must contain at least one capture group; the captured groups are joined with a space and written to `result_label`. Mutually exclusive with `g_json`.\n      - result_label (string) — Destination label key the extracted value is written to. Must match `^[a-zA-Z_][a-zA-Z0-9_]*$`.\n      - result_labels (array<string>) — Label keys to populate from the mapping lookup result. Each must match `^[a-zA-Z_][a-zA-Z0-9_]*$`.\n      - schema_id (string) — Mapping schema ID (MongoDB ObjectID hex). Required when `mapping_type` is `schema`.\n      - source_field (string) — Source field to extract from. Must be `title`, `description`, or a label key prefixed with `labels.` (e.g. `labels.env`).\n      - template (string) — Go `text/template` string (1–500 characters) rendered against the event struct — e.g. `{{.Title}}`, `{{.Description}}`, `{{.Labels.key}}`. Example: `{{.Labels.region}}-{{.Labels.env}}`. (1-500 chars)\n  - status (string) (required) — Rule set status: `enabled` (active) or `deleted` (soft-deleted). Read endpoints exclude soft-deleted rule sets, so responses always carry `enabled`. [enabled, deleted]\n  - updated_at (string) (required) — Last update timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n",
-	"AlertEnrichment.EnrichmentReadList":        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Creation timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the rule set is not deleted; read endpoints never return soft-deleted rule sets, so this is effectively always omitted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) (required) — Integration ID.\n  - rules (array<object>) (required) — Ordered enrichment rules.\n    - if (array<object>) — Optional AND-filter list; the rule is skipped unless every filter matches. `null` when the rule has no condition. Filter keys come from the alert/change event vocabulary (e.g. `title`, `labels.severity`).\n      - key (string) (required) — Event key to match on (e.g. `labels.severity`, `title`). Must be non-empty. (≥1 chars)\n      - oper (string) (required) — Match operator. `IN` matches when any value matches; `NOTIN` matches when none of the values match. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to match against. Must contain at least one value.\n    - kind (string) (required) — Rule type. | Value | Meaning | |---|---| | `extraction` | Extract a value from the alert's `title`, `description`, or a `labels.*` key via regex or GJson, and write it to a label. | | `composition` | Render a Go `text/template` against the event and write the result to a label. | | `mapping` | Look up labels from a mapping schema or an external mapping API. | | `drop` | Remove the listed labels from the alert. | [extraction, composition, mapping, drop]\n    - settings (object) (required) — Rule-kind–specific settings. The shape depends on `kind`.\n      - api_id (string) — Mapping API ID (MongoDB ObjectID hex). Required when `mapping_type` is `api`.\n      - drop_labels (array<string>) — List of label keys to remove from the alert.\n      - g_json (string) — GJson path expression used to extract a value from a JSON-encoded field. Mutually exclusive with `pattern`.\n      - mapping_type (string) — Mapping source type. `schema` uses a mapping schema table; `api` calls an external HTTP API. [schema, api]\n      - override (boolean) — When `true`, overwrite the label if it already exists. Defaults to `false`.\n      - pattern (string) — RE2 regular expression applied to the source value. Must contain at least one capture group; the captured groups are joined with a space and written to `result_label`. Mutually exclusive with `g_json`.\n      - result_label (string) — Destination label key the extracted value is written to. Must match `^[a-zA-Z_][a-zA-Z0-9_]*$`.\n      - result_labels (array<string>) — Label keys to populate from the mapping lookup result. Each must match `^[a-zA-Z_][a-zA-Z0-9_]*$`.\n      - schema_id (string) — Mapping schema ID (MongoDB ObjectID hex). Required when `mapping_type` is `schema`.\n      - source_field (string) — Source field to extract from. Must be `title`, `description`, or a label key prefixed with `labels.` (e.g. `labels.env`).\n      - template (string) — Go `text/template` string (1–500 characters) rendered against the event struct — e.g. `{{.Title}}`, `{{.Description}}`, `{{.Labels.key}}`. Example: `{{.Labels.region}}-{{.Labels.env}}`. (1-500 chars)\n  - status (string) (required) — Rule set status: `enabled` (active) or `deleted` (soft-deleted). Read endpoints exclude soft-deleted rule sets, so responses always carry `enabled`. [enabled, deleted]\n  - updated_at (string) (required) — Last update timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n",
-	"AlertEnrichment.FieldReadInfo":             "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - created_at (string) (required) — Creation timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - default_value (any) (required) — Default value. Type depends on `field_type`: `bool` for checkbox; `string` for single_select/text; `string[]` for multi_select; may be `null` if no default.\n  - deleted_at (string) — Deletion timestamp, Unix seconds. Only present for soft-deleted fields. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Optional free-text description. (≤499 chars)\n  - display_name (string) (required) — Human-readable name shown in the UI. (≤39 chars)\n  - field_id (string) (required) — Field ID — 24-character hex ObjectID.\n  - field_name (string) (required) — Machine name used in incident payloads under `fields.<field_name>`. Immutable. (≤39 chars)\n  - field_type (string) (required) — Field type. | Value | Meaning | |---|---| | `checkbox` | Checkbox; value is a bool, options are not supported. | | `multi_select` | Multi-select; value is a string array, each element must be one of options. | | `single_select` | Single-select; value is a string from options. | | `text` | Free text; value is a string. | [checkbox, multi_select, single_select, text]\n  - options (array<string>) (required) — Allowed choices for `single_select`/`multi_select` (non-empty unique string array). `null` or empty for `checkbox`/`text`.\n  - status (string) (required) — Field status: `enabled` (active), `disabled` (set only via internal helpers, not via the API), or `deleted` (soft-deleted). `/field/list` excludes `deleted`; `/field/info` may return it. [enabled, disabled, deleted]\n  - updated_at (string) (required) — Last update timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n  - value_type (string) (required) — Value type. `checkbox` is always `bool`; `single_select`/`multi_select`/`text` are always `string`. `float` is reserved and never occurs today. [string, bool, float]\n",
-	"AlertEnrichment.FieldReadList":             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Owning account ID.\n  - created_at (string) (required) — Creation timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - default_value (any) (required) — Default value. Type depends on `field_type`: `bool` for checkbox; `string` for single_select/text; `string[]` for multi_select; may be `null` if no default.\n  - deleted_at (string) — Deletion timestamp, Unix seconds. Only present for soft-deleted fields. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Optional free-text description. (≤499 chars)\n  - display_name (string) (required) — Human-readable name shown in the UI. (≤39 chars)\n  - field_id (string) (required) — Field ID — 24-character hex ObjectID.\n  - field_name (string) (required) — Machine name used in incident payloads under `fields.<field_name>`. Immutable. (≤39 chars)\n  - field_type (string) (required) — Field type. | Value | Meaning | |---|---| | `checkbox` | Checkbox; value is a bool, options are not supported. | | `multi_select` | Multi-select; value is a string array, each element must be one of options. | | `single_select` | Single-select; value is a string from options. | | `text` | Free text; value is a string. | [checkbox, multi_select, single_select, text]\n  - options (array<string>) (required) — Allowed choices for `single_select`/`multi_select` (non-empty unique string array). `null` or empty for `checkbox`/`text`.\n  - status (string) (required) — Field status: `enabled` (active), `disabled` (set only via internal helpers, not via the API), or `deleted` (soft-deleted). `/field/list` excludes `deleted`; `/field/info` may return it. [enabled, disabled, deleted]\n  - updated_at (string) (required) — Last update timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n  - value_type (string) (required) — Value type. `checkbox` is always `bool`; `single_select`/`multi_select`/`text` are always `string`. `float` is reserved and never occurs today. [string, bool, float]\n",
-	"AlertEnrichment.FieldWriteCreate":          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - field_id (string) (required) — Newly assigned field ID — 24-character hex ObjectID.\n  - field_name (string) (required) — Echo of the submitted `field_name`.\n",
-	"AlertEnrichment.MappingAPIReadInfo":        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - api_id (string) (required) — API ID (MongoDB ObjectID hex).\n  - api_name (string) (required) — API name.\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the API has not been soft-deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Description.\n  - headers (object) (required) — Custom request headers. `null` when none are configured.\n  - insecure_skip_verify (boolean) (required) — Whether TLS verification is skipped.\n  - retry_count (integer) (required) — Retry count.\n  - status (string) (required) — API status: `enabled` or `deleted` (soft-deleted). The list endpoint excludes `deleted` items; the info endpoint may return them. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID.\n  - timeout (integer) (required) — Request timeout in seconds.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n  - url (string) (required) — Endpoint URL.\n",
-	"AlertEnrichment.MappingAPIReadList":        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - api_id (string) (required) — API ID (MongoDB ObjectID hex).\n  - api_name (string) (required) — API name.\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the API has not been soft-deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Description.\n  - headers (object) (required) — Custom request headers. `null` when none are configured.\n  - insecure_skip_verify (boolean) (required) — Whether TLS verification is skipped.\n  - retry_count (integer) (required) — Retry count.\n  - status (string) (required) — API status: `enabled` or `deleted` (soft-deleted). The list endpoint excludes `deleted` items; the info endpoint may return them. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID.\n  - timeout (integer) (required) — Request timeout in seconds.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n  - url (string) (required) — Endpoint URL.\n",
-	"AlertEnrichment.MappingAPIWriteCreate":     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - api_id (string) (required) — Created API ID (MongoDB ObjectID hex).\n  - api_name (string) (required) — API name.\n",
-	"AlertEnrichment.MappingDataReadList":       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - fields (object) — All label key-value pairs of this row. Omitted when empty.\n  - key (string) — Composite row key — MD5 of the row's source label values (sorted by label name, joined with `:`). Omitted when empty.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"AlertEnrichment.MappingDataWriteUpsert":    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - keys (array<string>) (required) — Composite keys of upserted rows.\n",
-	"AlertEnrichment.MappingSchemaReadInfo":     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the schema has not been soft-deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Schema description.\n  - result_labels (array<string>) (required) — Output label names.\n  - schema_id (string) (required) — Schema ID (MongoDB ObjectID hex).\n  - schema_name (string) (required) — Schema name.\n  - source_labels (array<string>) (required) — Lookup key label names.\n  - status (string) (required) — Schema status: `enabled` or `deleted` (soft-deleted). The list endpoint excludes `deleted` items; the info endpoint may return them. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n",
-	"AlertEnrichment.MappingSchemaReadList":     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the schema has not been soft-deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Schema description.\n  - result_labels (array<string>) (required) — Output label names.\n  - schema_id (string) (required) — Schema ID (MongoDB ObjectID hex).\n  - schema_name (string) (required) — Schema name.\n  - source_labels (array<string>) (required) — Lookup key label names.\n  - status (string) (required) — Schema status: `enabled` or `deleted` (soft-deleted). The list endpoint excludes `deleted` items; the info endpoint may return them. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n",
-	"AlertEnrichment.MappingSchemaWriteCreate":  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - schema_id (string) (required) — Created schema ID (MongoDB ObjectID hex).\n  - schema_name (string) (required) — Schema name.\n",
-	"AlertRules.ReadAuditDetail":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — ID of the account that owns the rule.\n  - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n  - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n  - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n  - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n  - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n  - id (integer) (required) — Audit record ID.\n",
-	"AlertRules.ReadAudits":                     "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account that owns the rule.\n  - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n  - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n  - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n  - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n  - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n  - id (integer) (required) — Audit record ID.\n",
-	"AlertRules.ReadCounterTotal":               "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account this snapshot belongs to.\n  - clock (string) (required) — Sample timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - id (integer) (required) — ID of this snapshot record.\n  - num (integer) (required) — Rule count at the sample time.\n",
-	"AlertRules.ReadDstypes":                    "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Owning account ID. `0` for global types.\n  - id (integer) (required) — ID of the datasource type record.\n  - ident (string) (required) — Identifier used as the `ds_type` of rules, e.g. `prometheus`.\n  - name (string) (required) — Display name, e.g. `Prometheus`.\n  - weight (integer) (required) — Display order weight; higher appears first.\n",
-	"AlertRules.ReadExport":                     "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - annotations (object) — Custom annotation key-value pairs attached to alert events; keys must not start with `$` (reserved for query field references).\n  - cron_pattern (string) (required) — Evaluation schedule as a 6-field cron expression (seconds included) or `@every <duration>` (an integral number of seconds, at least 1s); `CRON_TZ=`/`TZ=` prefixes are rejected — set the timezone in `timezone` instead.\n  - debug_log_enabled (boolean) (required) — Whether to emit debug logs for this rule's evaluations; enable when troubleshooting.\n  - delay_seconds (integer) — Query time offset in seconds: each evaluation reads data as of `schedule time − delay_seconds` to tolerate ingestion lag; `0` means no offset.\n  - description (string) — Rule description in the format given by `description_type`, shown with alert events.\n  - description_type (string) — Format of `description`, `text` or `markdown`; treated as `text` when omitted. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list`; references by ID and is therefore immune to datasource renames.\n  - ds_list (array<string>) — Datasource name list with wildcard support; merged with `ds_ids` to decide which datasources the rule monitors — must be maintained by hand if a datasource is renamed.\n  - ds_type (string) (required) — Datasource type ident, e.g. `prometheus`; must be a datasource type (`ident`) that exists in the import target environment.\n  - enabled (boolean) (required) — Whether the rule is enabled; rules imported as disabled are not evaluated.\n  - enabled_times (array<object>) — Effective time windows; each entry has `days` (0–6, 0 = Sunday) and `stime`/`etime` (`HH:MM`), interpreted in the rule's `timezone`; an empty list disables the rule.\n    - days (array<integer>) — Days of week, 0 = Sunday.\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - labels (object) — Custom label key-value pairs attached to alert events produced by this rule.\n  - name (string) (required) — Rule name, up to 128 characters when imported.\n  - repeat_interval (integer) — Interval in seconds between repeated notifications for a firing alert; values below 1 fall back to the default of 3600.\n  - repeat_total (integer) — Maximum number of repeated notifications for the same alert; values below 1 fall back to the default of 3.\n  - rule_configs (object) — Rule evaluation configuration.\n    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery condition for any-data check. If omitted or `mode` is empty, treated as `nodata`.\n        - args (object) — Datasource-specific options for the recovery query, same convention as `queries[].args`; required for Elasticsearch datasources when `mode` is `ql`.\n        - condition (string) — Recovery expression. Required when `mode` is `ql`.\n        - mode (string) — `nodata` = recover when the query returns no data; `ql` = recover when the `condition` expression evaluates to true. When `mode` is `ql`, only a single query (`name=A`) is permitted. [nodata, ql]\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration.\n      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when `alert_on_empty_result` is enabled. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - resolve_timeout (integer) — Auto-resolve after N seconds.\n      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - critical (string) — Critical threshold expression referencing query results via `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; at least one severity must be configured.\n      - enabled (boolean) — Whether threshold checking is enabled.\n      - info (string) — Info threshold expression, same syntax as `critical`.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery evaluation configuration for threshold checks.\n        - args (object) — Datasource-specific extra parameters for the recovery query, using the same `<datasource>.<param>` key convention as query `args`. Omitted when empty.\n        - condition (string) — Recovery condition expression; required when `mode` is `threshold` or `ql`, and must be empty for `invert`.\n        - mode (string) — Recovery mode: `invert` = resolve when the alert expression no longer holds (`condition` stays empty); `threshold` = resolve when the `condition` threshold expression holds; `ql` = resolve when the `condition` query expression evaluates true. [invert, threshold, ql]\n        - value_fields (array<string>) — Numeric result fields the recovery `condition` references as `$A.<field>`; same semantics as the query's `value_fields`. Omitted when empty.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - warning (string) — Warning threshold expression, same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicate `expr`.\n      - args (object) — Datasource-specific query options keyed by the `<datasource>.<option>` convention (e.g. `es.type`, `tencent_cls.limit`); most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap `value_fields`; applies to table-shaped results (SQL/ES-style datasources).\n      - name (string) — Query identifier (letter, e.g. `A`). The name `R` is reserved and must not be used.\n      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as `$A.<field>` in threshold expressions); required for threshold checks unless the datasource is `prometheus`/`loki`/`victorialogs`; field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique `name` (not duplicating any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific options for the auxiliary query, same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Relate-query identifier.\n  - timezone (string) — Timezone in which the rule executes. IANA timezone name; defaults to `Asia/Shanghai`.\n",
-	"AlertRules.ReadInfo":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID. Filled by the server from the authenticated identity; do not provide.\n  - annotations (object) — Annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Channel IDs to send alerts to.\n  - created_at (string) (required) — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator user ID. Filled by the server from the current user; do not provide.\n  - creator_name (string) (required) — Creator name. Filled by the server; do not provide.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval descriptor. Must not start with `CRON_TZ=` or `TZ=`; use the `timezone` field instead.\n  - debug_log_enabled (boolean) (required) — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.\n  - delay_seconds (integer) (required) — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.\n  - description (string) — Rule description, in Markdown.\n  - description_type (string) — Format for the description. Defaults to `text` when omitted or empty. `text` = plain text; `markdown` = Markdown, rendered as Markdown in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource IDs, merged with `ds_list` to decide which datasources the rule monitors; IDs survive datasource renames. At least one of `ds_list` and `ds_ids` must be provided.\n  - ds_list (array<string>) — Data source name patterns (supports wildcards). At least one of `ds_list` / `ds_ids` must be non-empty; the two are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier; allowed values are listed by `POST /monit/rule/dstypes` (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Updating to `false` makes the server clean up the rule's active alerts.\n  - enabled_times (array<object>) — Time windows when the rule is active. Defaults to all days from 00:00 to 23:59 when omitted or empty.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to. Obtainable via `POST /monit/folder/list`.\n  - id (integer) (required) — Rule ID. Required for update; omit for create (assigned by the server).\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the same folder.\n  - repeat_interval (integer) — Notification repeat interval in seconds.\n  - repeat_total (integer) — Max number of repeat notifications.\n  - rule_configs (object) (required) — Check configuration: query list plus trigger/recovery conditions. Structure see `RuleConfigs`.\n    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery condition for any-data check. If omitted or `mode` is empty, treated as `nodata`.\n        - args (object) — Datasource-specific options for the recovery query, same convention as `queries[].args`; required for Elasticsearch datasources when `mode` is `ql`.\n        - condition (string) — Recovery expression. Required when `mode` is `ql`.\n        - mode (string) — `nodata` = recover when the query returns no data; `ql` = recover when the `condition` expression evaluates to true. When `mode` is `ql`, only a single query (`name=A`) is permitted. [nodata, ql]\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration.\n      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when `alert_on_empty_result` is enabled. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - resolve_timeout (integer) — Auto-resolve after N seconds.\n      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - critical (string) — Critical threshold expression referencing query results via `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; at least one severity must be configured.\n      - enabled (boolean) — Whether threshold checking is enabled.\n      - info (string) — Info threshold expression, same syntax as `critical`.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery evaluation configuration for threshold checks.\n        - args (object) — Datasource-specific extra parameters for the recovery query, using the same `<datasource>.<param>` key convention as query `args`. Omitted when empty.\n        - condition (string) — Recovery condition expression; required when `mode` is `threshold` or `ql`, and must be empty for `invert`.\n        - mode (string) — Recovery mode: `invert` = resolve when the alert expression no longer holds (`condition` stays empty); `threshold` = resolve when the `condition` threshold expression holds; `ql` = resolve when the `condition` query expression evaluates true. [invert, threshold, ql]\n        - value_fields (array<string>) — Numeric result fields the recovery `condition` references as `$A.<field>`; same semantics as the query's `value_fields`. Omitted when empty.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - warning (string) — Warning threshold expression, same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicate `expr`.\n      - args (object) — Datasource-specific query options keyed by the `<datasource>.<option>` convention (e.g. `es.type`, `tencent_cls.limit`); most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap `value_fields`; applies to table-shaped results (SQL/ES-style datasources).\n      - name (string) — Query identifier (letter, e.g. `A`). The name `R` is reserved and must not be used.\n      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as `$A.<field>` in threshold expressions); required for threshold checks unless the datasource is `prometheus`/`loki`/`victorialogs`; field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique `name` (not duplicating any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific options for the auxiliary query, same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Relate-query identifier.\n  - timezone (string) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); shortcuts and offsets such as `Local`, `UTC+8`, or `CST` are rejected. Treated as `Asia/Shanghai` if empty.\n  - updated_at (string) (required) — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updater_id (integer) (required) — Last updater user ID. Filled by the server; do not provide.\n  - updater_name (string) (required) — Last updater name. Filled by the server; do not provide.\n",
-	"AlertRules.ReadList":                       "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - active_alert_count (integer) (required) — Number of currently active (unrecovered) alerts fired by this rule. `triggered` equals `active_alert_count > 0`.\n  - created_at (string) (required) — Creation time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who created the rule.\n  - creator_name (string) (required) — Name of the user who created the rule.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron with seconds, e.g. `0 * * * * *`, or an `@every 30s` interval descriptor. Must not start with `CRON_TZ=` or `TZ=`; use the `timezone` field instead.\n  - debug_log_enabled (boolean) (required) — Whether debug logging is enabled.\n  - delay_seconds (integer) (required) — Evaluation delay in seconds.\n  - ds_type (string) (required) — Data source type, e.g. `prometheus`.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - folder_id (integer) (required) — Folder ID.\n  - id (integer) (required) — Unique rule ID.\n  - labels (object) (required) — Custom labels.\n  - name (string) (required) — Rule name.\n  - runtime_state (string) — Runtime evaluation state, derived from edge heartbeats and the edge-reported rule status. Omitted when the state is unavailable. | Value | Meaning | |---|---| | `disabled` | The rule is disabled. | | `offline` | The edge instance or cluster owning this rule is offline. | | `abnormal` | The edge reports evaluation errors. | | `stale` | The edge's runtime status report is outdated. | | `no_datasource` | No datasource currently matches the rule's `ds_list` / `ds_ids`. | | `config_pending` | The latest rule config has not been delivered to the edge yet. | | `waiting` | Enabled, but the edge has not reported runtime status yet. | | `normal` | Evaluating normally. | [disabled, offline, abnormal, stale, no_datasource, config_pending, waiting, normal]\n  - timezone (string) (required) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); shortcuts and offsets such as `Local`, `UTC+8`, or `CST` are rejected. Treated as `Asia/Shanghai` if empty.\n  - triggered (boolean) (required) — True if the rule currently has active alerts.\n  - updated_at (string) (required) — Last modification time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updater_id (integer) (required) — ID of the user who last modified the rule.\n  - updater_name (string) (required) — Name of the user who last modified the rule.\n",
-	"AlertRules.WriteCreate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID. Filled by the server from the authenticated identity; do not provide.\n  - annotations (object) — Annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Channel IDs to send alerts to.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide.\n  - creator_id (integer) — Creator user ID. Filled by the server from the current user; do not provide.\n  - creator_name (string) — Creator name. Filled by the server; do not provide.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval descriptor. Must not start with `CRON_TZ=` or `TZ=`; use the `timezone` field instead.\n  - debug_log_enabled (boolean) — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.\n  - delay_seconds (integer) — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.\n  - description (string) — Rule description, in Markdown.\n  - description_type (string) — Format for the description. Defaults to `text` when omitted or empty. `text` = plain text; `markdown` = Markdown, rendered as Markdown in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource IDs, merged with `ds_list` to decide which datasources the rule monitors; IDs survive datasource renames. At least one of `ds_list` and `ds_ids` must be provided.\n  - ds_list (array<string>) — Data source name patterns (supports wildcards). At least one of `ds_list` / `ds_ids` must be non-empty; the two are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier; allowed values are listed by `POST /monit/rule/dstypes` (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) — Whether the rule is enabled. Updating to `false` makes the server clean up the rule's active alerts.\n  - enabled_times (array<object>) — Time windows when the rule is active. Defaults to all days from 00:00 to 23:59 when omitted or empty.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to. Obtainable via `POST /monit/folder/list`.\n  - id (integer) — Rule ID. Required for update; omit for create (assigned by the server).\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the same folder.\n  - repeat_interval (integer) — Notification repeat interval in seconds.\n  - repeat_total (integer) — Max number of repeat notifications.\n  - rule_configs (object) (required) — Check configuration: query list plus trigger/recovery conditions. Structure see `RuleConfigs`.\n    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery condition for any-data check. If omitted or `mode` is empty, treated as `nodata`.\n        - args (object) — Datasource-specific options for the recovery query, same convention as `queries[].args`; required for Elasticsearch datasources when `mode` is `ql`.\n        - condition (string) — Recovery expression. Required when `mode` is `ql`.\n        - mode (string) — `nodata` = recover when the query returns no data; `ql` = recover when the `condition` expression evaluates to true. When `mode` is `ql`, only a single query (`name=A`) is permitted. [nodata, ql]\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration.\n      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when `alert_on_empty_result` is enabled. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - resolve_timeout (integer) — Auto-resolve after N seconds.\n      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - critical (string) — Critical threshold expression referencing query results via `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; at least one severity must be configured.\n      - enabled (boolean) — Whether threshold checking is enabled.\n      - info (string) — Info threshold expression, same syntax as `critical`.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery evaluation configuration for threshold checks.\n        - args (object) — Datasource-specific extra parameters for the recovery query, using the same `<datasource>.<param>` key convention as query `args`. Omitted when empty.\n        - condition (string) — Recovery condition expression; required when `mode` is `threshold` or `ql`, and must be empty for `invert`.\n        - mode (string) — Recovery mode: `invert` = resolve when the alert expression no longer holds (`condition` stays empty); `threshold` = resolve when the `condition` threshold expression holds; `ql` = resolve when the `condition` query expression evaluates true. [invert, threshold, ql]\n        - value_fields (array<string>) — Numeric result fields the recovery `condition` references as `$A.<field>`; same semantics as the query's `value_fields`. Omitted when empty.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - warning (string) — Warning threshold expression, same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicate `expr`.\n      - args (object) — Datasource-specific query options keyed by the `<datasource>.<option>` convention (e.g. `es.type`, `tencent_cls.limit`); most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap `value_fields`; applies to table-shaped results (SQL/ES-style datasources).\n      - name (string) — Query identifier (letter, e.g. `A`). The name `R` is reserved and must not be used.\n      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as `$A.<field>` in threshold expressions); required for threshold checks unless the datasource is `prometheus`/`loki`/`victorialogs`; field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique `name` (not duplicating any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific options for the auxiliary query, same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Relate-query identifier.\n  - timezone (string) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); shortcuts and offsets such as `Local`, `UTC+8`, or `CST` are rejected. Treated as `Asia/Shanghai` if empty.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide.\n  - updater_id (integer) — Last updater user ID. Filled by the server; do not provide.\n  - updater_name (string) — Last updater name. Filled by the server; do not provide.\n",
-	"AlertRules.WriteFieldsUpdate":              "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
-	"AlertRules.WriteImport":                    "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
-	"AlertRules.WriteMove":                      "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
-	"AlertRules.WriteUpdate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID. Filled by the server from the authenticated identity; do not provide.\n  - annotations (object) — Annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Channel IDs to send alerts to.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide.\n  - creator_id (integer) — Creator user ID. Filled by the server from the current user; do not provide.\n  - creator_name (string) — Creator name. Filled by the server; do not provide.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval descriptor. Must not start with `CRON_TZ=` or `TZ=`; use the `timezone` field instead.\n  - debug_log_enabled (boolean) — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.\n  - delay_seconds (integer) — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.\n  - description (string) — Rule description, in Markdown.\n  - description_type (string) — Format for the description. Defaults to `text` when omitted or empty. `text` = plain text; `markdown` = Markdown, rendered as Markdown in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource IDs, merged with `ds_list` to decide which datasources the rule monitors; IDs survive datasource renames. At least one of `ds_list` and `ds_ids` must be provided.\n  - ds_list (array<string>) — Data source name patterns (supports wildcards). At least one of `ds_list` / `ds_ids` must be non-empty; the two are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier; allowed values are listed by `POST /monit/rule/dstypes` (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) — Whether the rule is enabled. Updating to `false` makes the server clean up the rule's active alerts.\n  - enabled_times (array<object>) — Time windows when the rule is active. Defaults to all days from 00:00 to 23:59 when omitted or empty.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to. Obtainable via `POST /monit/folder/list`.\n  - id (integer) — Rule ID. Required for update; omit for create (assigned by the server).\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the same folder.\n  - repeat_interval (integer) — Notification repeat interval in seconds.\n  - repeat_total (integer) — Max number of repeat notifications.\n  - rule_configs (object) (required) — Check configuration: query list plus trigger/recovery conditions. Structure see `RuleConfigs`.\n    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery condition for any-data check. If omitted or `mode` is empty, treated as `nodata`.\n        - args (object) — Datasource-specific options for the recovery query, same convention as `queries[].args`; required for Elasticsearch datasources when `mode` is `ql`.\n        - condition (string) — Recovery expression. Required when `mode` is `ql`.\n        - mode (string) — `nodata` = recover when the query returns no data; `ql` = recover when the `condition` expression evaluates to true. When `mode` is `ql`, only a single query (`name=A`) is permitted. [nodata, ql]\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration.\n      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when `alert_on_empty_result` is enabled. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - resolve_timeout (integer) — Auto-resolve after N seconds.\n      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - critical (string) — Critical threshold expression referencing query results via `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; at least one severity must be configured.\n      - enabled (boolean) — Whether threshold checking is enabled.\n      - info (string) — Info threshold expression, same syntax as `critical`.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery evaluation configuration for threshold checks.\n        - args (object) — Datasource-specific extra parameters for the recovery query, using the same `<datasource>.<param>` key convention as query `args`. Omitted when empty.\n        - condition (string) — Recovery condition expression; required when `mode` is `threshold` or `ql`, and must be empty for `invert`.\n        - mode (string) — Recovery mode: `invert` = resolve when the alert expression no longer holds (`condition` stays empty); `threshold` = resolve when the `condition` threshold expression holds; `ql` = resolve when the `condition` query expression evaluates true. [invert, threshold, ql]\n        - value_fields (array<string>) — Numeric result fields the recovery `condition` references as `$A.<field>`; same semantics as the query's `value_fields`. Omitted when empty.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - warning (string) — Warning threshold expression, same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicate `expr`.\n      - args (object) — Datasource-specific query options keyed by the `<datasource>.<option>` convention (e.g. `es.type`, `tencent_cls.limit`); most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap `value_fields`; applies to table-shaped results (SQL/ES-style datasources).\n      - name (string) — Query identifier (letter, e.g. `A`). The name `R` is reserved and must not be used.\n      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as `$A.<field>` in threshold expressions); required for threshold checks unless the datasource is `prometheus`/`loki`/`victorialogs`; field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique `name` (not duplicating any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific options for the auxiliary query, same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Relate-query identifier.\n  - timezone (string) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); shortcuts and offsets such as `Local`, `UTC+8`, or `CST` are rejected. Treated as `Asia/Shanghai` if empty.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide.\n  - updater_id (integer) — Last updater user ID. Filled by the server; do not provide.\n  - updater_name (string) — Last updater name. Filled by the server; do not provide.\n",
-	"Alerts.EventReadList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n  - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Alerts.ReadEventList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n  - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Alerts.ReadFeed":                           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - created_at (string) (required) — Creation timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator. 0 for system-generated entries.\n  - deleted_at (string) — Soft-delete time, Unix epoch milliseconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - detail (object) (required) — Type-specific payload; the concrete shape is determined by `type`. May be `null` for entries stored without detail.\n    - comment (string) — Comment body.\n    - in_secs (integer) — Window in seconds over which the state changes were counted. Omitted when zero.\n    - max_changes (integer) — State-change count threshold that triggered flapping detection. Omitted when zero.\n    - mute_secs (integer) — Mute duration in seconds. Omitted when zero.\n    - owner_id (integer) — New owner member ID set on the target incident. Omitted when unchanged.\n    - rule_id (string) — Silence rule ID that muted the alert. Omitted when empty.\n    - rule_name (string) — Silence rule name, resolved at read time. Omitted when empty.\n    - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n    - source_alert_id (string) — ID of the source alert that triggered the inhibition. Omitted when empty.\n    - source_alert_title (string) — Title of the source alert, resolved at read time. Omitted when empty.\n    - source_alerts (array<object>) — Source alerts merged into the target incident. Omitted when empty.\n      - alert_id (string) — Alert ID (ObjectID hex string).\n      - title (string) — Alert title, resolved at read time. Omitted when empty.\n    - status (string) — Severity level. [Ok, Critical, Warning, Info]\n    - target_incident (object) — Incident the alerts were merged into. Omitted when not recorded.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - title (string) — New title set on the target incident. Omitted when unchanged.\n  - ref_id (string) (required) — ObjectID of the alert this entry references.\n  - type (string) (required) — Alert activity feed entry type. Each value identifies one alert lifecycle event; the matching `detail` payload shape is determined by this field. | Type | Meaning | |---|---| | `a_new` | Alert triggered by an incoming event. | | `a_update` | Alert severity or status changed on an incoming event. | | `a_comm` | Comment added on the alert. | | `a_merge` | Alert merged into an incident. | | `a_m_silence` | Alert muted by a silence rule. | | `a_m_inhibit` | Alert muted by an inhibit rule. | | `a_m_flapping` | Alert muted by flapping detection (historical data only; no longer produced). | | `a_ack` | Alert acknowledged (historical data only; alert-level acknowledgement has been removed). | | `a_unack` | Alert acknowledgement revoked (historical data only). | | `a_close` | Alert closed (historical data only; no longer produced). | [a_new, a_update, a_comm, a_merge, a_m_silence, a_m_inhibit, a_m_flapping, a_ack, a_unack, a_close]\n  - updated_at (string) (required) — Last update timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Alerts.ReadInfo":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Unique alert ID (ObjectID hex string).\n  - alert_key (string) — Deduplication key.\n  - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n  - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n  - channel_id (integer) — ID of the channel the alert belongs to.\n  - channel_name (string) — Display name of the channel.\n  - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated: use `integration_id` instead.\n  - data_source_name (string) — Deprecated: use `integration_name` instead.\n  - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n  - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Alert description.\n  - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) — Total number of raw events received by this alert.\n  - events (array<object>) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) — True if this alert has ever been silenced.\n  - images (array<object>) — Images attached to the alert.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - incident (object) — Associated incident, if any.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) — ID of the integration that produced this alert.\n  - integration_name (string) — Display name of the integration.\n  - integration_ref_id (string) — External reference ID of the integration.\n  - integration_type (string) — Type/plugin key of the integration.\n  - labels (object) — Label key-value pairs.\n  - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n  - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n  - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Alert title.\n  - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Alerts.ReadList":                           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Unique alert ID (ObjectID hex string).\n  - alert_key (string) — Deduplication key.\n  - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n  - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n  - channel_id (integer) — ID of the channel the alert belongs to.\n  - channel_name (string) — Display name of the channel.\n  - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated: use `integration_id` instead.\n  - data_source_name (string) — Deprecated: use `integration_name` instead.\n  - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n  - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Alert description.\n  - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) — Total number of raw events received by this alert.\n  - events (array<object>) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) — True if this alert has ever been silenced.\n  - images (array<object>) — Images attached to the alert.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - incident (object) — Associated incident, if any.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) — ID of the integration that produced this alert.\n  - integration_name (string) — Display name of the integration.\n  - integration_ref_id (string) — External reference ID of the integration.\n  - integration_type (string) — Type/plugin key of the integration.\n  - labels (object) — Label key-value pairs.\n  - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n  - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n  - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Alert title.\n  - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Alerts.ReadListByIDs":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Unique alert ID (ObjectID hex string).\n  - alert_key (string) — Deduplication key.\n  - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n  - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n  - channel_id (integer) — ID of the channel the alert belongs to.\n  - channel_name (string) — Display name of the channel.\n  - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated: use `integration_id` instead.\n  - data_source_name (string) — Deprecated: use `integration_name` instead.\n  - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n  - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Alert description.\n  - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) — Total number of raw events received by this alert.\n  - events (array<object>) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) — True if this alert has ever been silenced.\n  - images (array<object>) — Images attached to the alert.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - incident (object) — Associated incident, if any.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) — ID of the integration that produced this alert.\n  - integration_name (string) — Display name of the integration.\n  - integration_ref_id (string) — External reference ID of the integration.\n  - integration_type (string) — Type/plugin key of the integration.\n  - labels (object) — Label key-value pairs.\n  - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n  - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n  - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Alert title.\n  - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Alerts.ReadPipelineInfo":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Member ID who created the pipeline.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration ID this pipeline applies to.\n  - rules (array<object>) — Ordered list of processing rules.\n    - if (array<object>) — AND-filter list — the rule applies only when every condition matches. `null` or omitted means the rule applies to all events.\n      - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.<name>` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n      - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n      - vals (array<string>) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n    - kind (string) (required) — Rule type. Rules run in array order; when the `if` condition matches, the event is processed according to `kind`. | Value | Meaning | |---|---| | `title_reset` | Rewrites the event title from the `settings.title` template. | | `description_reset` | Rewrites the event description from the `settings.description` template. | | `severity_reset` | Resets the event severity and status to `settings.severity` (`Critical`/`Warning`/`Info`). | | `alert_drop` | Discards the matching event outright; no alert is created. | | `alert_inhibit` | Discards the event (inhibition) when an active source alert matching `settings.source_filters` and correlated via `settings.equals` exists. | [title_reset, description_reset, severity_reset, alert_drop, alert_inhibit]\n    - settings (object) — Kind-specific settings. Shape depends on `kind`: - `title_reset`: `{ \"title\": \"<string>\" }` - `description_reset`: `{ \"description\": \"<string>\" }` - `severity_reset`: `{ \"severity\": \"Critical\"|\"Warning\"|\"Info\" }` - `alert_drop`: `{}` (empty object) - `alert_inhibit`: `{ \"equals\": [\"<label_key>\", ...], \"source_filters\": <OrFilterGroup> }`\n      - description (string) — New description template.\n      - equals (array<string>) — Label keys whose values must be equal between the source and current alert for inhibition to apply.\n      - severity (string) — Target severity level. [Critical, Warning, Info]\n      - source_filters (array<object>) — AND-filter list identifying the source alerts to inhibit — every condition must match.\n        - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.<name>` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n        - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n        - vals (array<string>) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n      - title (string) — New title template. Supports Golang template syntax referencing alert fields.\n  - status (string) — Pipeline status. Always `enabled` in these responses — deleted pipelines are filtered out. [enabled]\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Member ID who last updated the pipeline.\n",
-	"Alerts.ReadPipelineList":                   "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Member ID who created the pipeline.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration ID this pipeline applies to.\n  - rules (array<object>) — Ordered list of processing rules.\n    - if (array<object>) — AND-filter list — the rule applies only when every condition matches. `null` or omitted means the rule applies to all events.\n      - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.<name>` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n      - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n      - vals (array<string>) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n    - kind (string) (required) — Rule type. Rules run in array order; when the `if` condition matches, the event is processed according to `kind`. | Value | Meaning | |---|---| | `title_reset` | Rewrites the event title from the `settings.title` template. | | `description_reset` | Rewrites the event description from the `settings.description` template. | | `severity_reset` | Resets the event severity and status to `settings.severity` (`Critical`/`Warning`/`Info`). | | `alert_drop` | Discards the matching event outright; no alert is created. | | `alert_inhibit` | Discards the event (inhibition) when an active source alert matching `settings.source_filters` and correlated via `settings.equals` exists. | [title_reset, description_reset, severity_reset, alert_drop, alert_inhibit]\n    - settings (object) — Kind-specific settings. Shape depends on `kind`: - `title_reset`: `{ \"title\": \"<string>\" }` - `description_reset`: `{ \"description\": \"<string>\" }` - `severity_reset`: `{ \"severity\": \"Critical\"|\"Warning\"|\"Info\" }` - `alert_drop`: `{}` (empty object) - `alert_inhibit`: `{ \"equals\": [\"<label_key>\", ...], \"source_filters\": <OrFilterGroup> }`\n      - description (string) — New description template.\n      - equals (array<string>) — Label keys whose values must be equal between the source and current alert for inhibition to apply.\n      - severity (string) — Target severity level. [Critical, Warning, Info]\n      - source_filters (array<object>) — AND-filter list identifying the source alerts to inhibit — every condition must match.\n      - title (string) — New title template. Supports Golang template syntax referencing alert fields.\n  - status (string) — Pipeline status. Always `enabled` in these responses — deleted pipelines are filtered out. [enabled]\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Member ID who last updated the pipeline.\n",
-	"Analytics.ByAccount":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgement_pct (number) — Acknowledgement rate (%): acknowledged incidents ÷ total incidents × 100, rounded to two decimals and capped at 100; 0 when the bucket has no incidents.\n  - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n  - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n  - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n  - mean_seconds_to_ack (number) — Mean time to first acknowledgement in seconds; 0 when no incident in the bucket was acknowledged.\n  - mean_seconds_to_close (number) — Mean time to close in seconds; 0 when no incident in the bucket was closed.\n  - noise_reduction_pct (number) — Noise reduction ratio (%): 100 − incidents ÷ alert events × 100, rounded to two decimals; 0 when there is no alert-event data or alert events do not exceed incidents.\n  - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n  - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n  - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n  - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n  - total_alert_cnt (integer) — Total number of alerts.\n  - total_alert_event_cnt (integer) — Total number of alert events.\n  - total_engaged_seconds (integer) — Total engaged time in seconds: each incident contributes the sum of close time minus acknowledgement time across its acknowledged responders.\n  - total_incident_cnt (integer) — Total number of incidents.\n  - total_incidents_acknowledged (integer) — Incidents that were acknowledged at least once.\n  - total_incidents_auto_closed (integer) — Incidents closed automatically because all alerts recovered.\n  - total_incidents_closed (integer) — Incidents that are closed.\n  - total_incidents_escalated (integer) — Incidents that were escalated at least once.\n  - total_incidents_manually_closed (integer) — Incidents closed manually.\n  - total_incidents_manually_escalated (integer) — Incidents escalated manually at least once.\n  - total_incidents_reassigned (integer) — Incidents that were reassigned at least once.\n  - total_incidents_timeout_closed (integer) — Incidents closed automatically on timeout.\n  - total_incidents_timeout_escalated (integer) — Incidents escalated on timeout at least once.\n  - total_interruptions (integer) — Total interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - total_notifications (integer) — Total number of notifications sent.\n  - total_seconds_to_ack (integer) — Total time to first acknowledgement in seconds.\n  - total_seconds_to_close (integer) — Total time to close in seconds.\n  - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Analytics.ByChannel":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgement_pct (number) — Acknowledgement rate (%): acknowledged incidents ÷ total incidents × 100, rounded to two decimals and capped at 100; 0 when the bucket has no incidents.\n  - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n  - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n  - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n  - mean_seconds_to_ack (number) — Mean time to first acknowledgement in seconds; 0 when no incident in the bucket was acknowledged.\n  - mean_seconds_to_close (number) — Mean time to close in seconds; 0 when no incident in the bucket was closed.\n  - noise_reduction_pct (number) — Noise reduction ratio (%): 100 − incidents ÷ alert events × 100, rounded to two decimals; 0 when there is no alert-event data or alert events do not exceed incidents.\n  - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n  - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n  - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n  - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n  - total_alert_cnt (integer) — Total number of alerts.\n  - total_alert_event_cnt (integer) — Total number of alert events.\n  - total_engaged_seconds (integer) — Total engaged time in seconds: each incident contributes the sum of close time minus acknowledgement time across its acknowledged responders.\n  - total_incident_cnt (integer) — Total number of incidents.\n  - total_incidents_acknowledged (integer) — Incidents that were acknowledged at least once.\n  - total_incidents_auto_closed (integer) — Incidents closed automatically because all alerts recovered.\n  - total_incidents_closed (integer) — Incidents that are closed.\n  - total_incidents_escalated (integer) — Incidents that were escalated at least once.\n  - total_incidents_manually_closed (integer) — Incidents closed manually.\n  - total_incidents_manually_escalated (integer) — Incidents escalated manually at least once.\n  - total_incidents_reassigned (integer) — Incidents that were reassigned at least once.\n  - total_incidents_timeout_closed (integer) — Incidents closed automatically on timeout.\n  - total_incidents_timeout_escalated (integer) — Incidents escalated on timeout at least once.\n  - total_interruptions (integer) — Total interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - total_notifications (integer) — Total number of notifications sent.\n  - total_seconds_to_ack (integer) — Total time to first acknowledgement in seconds.\n  - total_seconds_to_close (integer) — Total time to close in seconds.\n  - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Analytics.ByResponder":                     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgement_pct (number) — This responder's acknowledgement rate (%): acknowledged incidents ÷ involved incidents × 100, rounded to two decimals and capped at 100; 0 when the responder has no incidents.\n  - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n  - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n  - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n  - mean_seconds_to_ack (number) — This responder's mean time to acknowledgement in seconds; 0 when the responder acknowledged nothing.\n  - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n  - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n  - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n  - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n  - total_engaged_seconds (integer) — This responder's total engaged time in seconds: each incident contributes close time minus their acknowledgement time.\n  - total_incident_cnt (integer) — Incidents this responder was involved in.\n  - total_incidents_acknowledged (integer) — Incidents acknowledged by this responder.\n  - total_incidents_escalated (integer) — This responder's incidents that were escalated at least once.\n  - total_incidents_manually_escalated (integer) — This responder's incidents escalated manually.\n  - total_incidents_reassigned (integer) — Incidents reassigned away from this responder.\n  - total_incidents_timeout_escalated (integer) — This responder's incidents escalated on timeout.\n  - total_interruptions (integer) — Interruptions for this responder: notifications sent via app push, SMS, or voice call; consecutive notifications within 60 seconds count as one.\n  - total_notifications (integer) — Total notifications sent to this responder.\n  - total_seconds_to_ack (integer) — This responder's total time to acknowledgement in seconds: each incident contributes acknowledgement time minus assignment time.\n  - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Analytics.ByTeam":                          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgement_pct (number) — Acknowledgement rate (%): acknowledged incidents ÷ total incidents × 100, rounded to two decimals and capped at 100; 0 when the bucket has no incidents.\n  - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n  - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n  - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n  - mean_seconds_to_ack (number) — Mean time to first acknowledgement in seconds; 0 when no incident in the bucket was acknowledged.\n  - mean_seconds_to_close (number) — Mean time to close in seconds; 0 when no incident in the bucket was closed.\n  - noise_reduction_pct (number) — Noise reduction ratio (%): 100 − incidents ÷ alert events × 100, rounded to two decimals; 0 when there is no alert-event data or alert events do not exceed incidents.\n  - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n  - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n  - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n  - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n  - total_alert_cnt (integer) — Total number of alerts.\n  - total_alert_event_cnt (integer) — Total number of alert events.\n  - total_engaged_seconds (integer) — Total engaged time in seconds: each incident contributes the sum of close time minus acknowledgement time across its acknowledged responders.\n  - total_incident_cnt (integer) — Total number of incidents.\n  - total_incidents_acknowledged (integer) — Incidents that were acknowledged at least once.\n  - total_incidents_auto_closed (integer) — Incidents closed automatically because all alerts recovered.\n  - total_incidents_closed (integer) — Incidents that are closed.\n  - total_incidents_escalated (integer) — Incidents that were escalated at least once.\n  - total_incidents_manually_closed (integer) — Incidents closed manually.\n  - total_incidents_manually_escalated (integer) — Incidents escalated manually at least once.\n  - total_incidents_reassigned (integer) — Incidents that were reassigned at least once.\n  - total_incidents_timeout_closed (integer) — Incidents closed automatically on timeout.\n  - total_incidents_timeout_escalated (integer) — Incidents escalated on timeout at least once.\n  - total_interruptions (integer) — Total interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - total_notifications (integer) — Total number of notifications sent.\n  - total_seconds_to_ack (integer) — Total time to first acknowledgement in seconds.\n  - total_seconds_to_close (integer) — Total time to close in seconds.\n  - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Analytics.IncidentList":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgements (integer) — Number of acknowledgements.\n  - active_alert_cnt (integer) — Number of alerts still active (not recovered).\n  - alert_cnt (integer) — Total number of alerts aggregated into the incident.\n  - alert_event_cnt (integer) — Total number of alert events associated with the incident; each report of an alert counts as one event.\n  - assigned_to (object) — Current assignment target for the incident; `null` when the incident has no assignment record.\n    - assigned_at (string) — Unix timestamp (seconds) when this assignment was made. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) driving the assignment.\n    - escalate_rule_name (string) — Display name of the escalation rule.\n    - id (string) — Internal assignment record ID.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - person_ids (array<integer>) — Member IDs assigned directly to this incident.\n    - type (string) — Assignment type. | Value | Meaning | |---|---| | `assign` | Initial assignment when the incident is created manually. | | `reassign` | Re-assignment of an existing incident. | | `escalate` | Assignment triggered by escalation policy advancement. | | `reopen` | Assignment restarted from the first layer after the incident is reopened. | [assign, reassign, escalate, reopen]\n  - assignments (integer) — Number of assignments.\n  - channel_id (integer) — ID of the channel the incident belongs to.\n  - channel_name (string) — Name of the channel the incident belongs to.\n  - closed_by (string) — How the incident was closed: `auto`, `timeout`, or `manually`. Empty string while the incident is still open. [auto, timeout, manually]\n  - closer_id (integer) — Member ID of the person who closed the incident. Omitted when 0 (not closed manually).\n  - closer_name (string) — Display name of the person who closed the incident. Omitted when empty.\n  - created_at (string) — Incident creation time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Person ID of the incident creator.\n  - creator_name (string) — Display name of the incident creator.\n  - description (string) — Incident description. Omitted when empty.\n  - engaged_seconds (integer) — Total engaged time in seconds across acknowledged responders, each contributing close time minus their acknowledgement time; 0 if not closed.\n  - escalations (integer) — Total escalations, the sum of `timeout_escalations` and `manual_escalations`.\n  - ever_muted (boolean) — Whether the incident was ever muted by noise reduction. Omitted when false.\n  - fields (object) — Custom fields of the incident. Always omitted in this response (reserved for export).\n  - frequency (string) — Frequency classification: `frequent` or `rare`. Omitted when not classified. [frequent, rare]\n  - hours (string) — Time-of-day bucket of the creation time in the account timezone: `work` = Mon–Fri 08:00–19:00, `sleep` = 23:00–08:00 daily, `off` = all other times. [work, off, sleep]\n  - incident_id (string) — Incident ID, unique within the account.\n  - interruptions (integer) — Number of interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - labels (object) — Incident labels as key-value pairs. Always omitted in this response (reserved for export).\n  - manual_escalations (integer) — Manually triggered escalations.\n  - notifications (integer) — Total number of notifications sent.\n  - owner_id (integer) — Member ID of the incident owner. Omitted when 0 (no owner).\n  - owner_name (string) — Display name of the incident owner. Omitted when empty.\n  - progress (string) — Incident progress state — one of `Triggered`, `Processing`, `Closed`. [Triggered, Processing, Closed]\n  - reassignments (integer) — Number of reassignments.\n  - responders (array<object>) — Responders with per-person assignment and acknowledgement times.\n    - acknowledged_at (string) — Acknowledgement time, as a Unix timestamp in seconds; 0 if not acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Responder's identity in an external chat tool (e.g. Slack); only present when backfilled by an external system.\n    - assigned_at (string) — Assignment time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Responder email. Omitted when empty.\n    - person_id (integer) — Person ID of the responder.\n    - person_name (string) — Responder display name. Omitted when empty.\n  - seconds_to_ack (integer) — Seconds from incident creation to the first acknowledgement; 0 if never acknowledged.\n  - seconds_to_close (integer) — Seconds from incident creation to close; 0 if not closed.\n  - severity (string) — Incident severity. [Critical, Warning, Info]\n  - snoozed_before (string) — Unix timestamp in seconds until which the incident is snoozed. Omitted when the incident is not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) — ID of the team that owns the incident.\n  - team_name (string) — Name of the team that owns the incident.\n  - timeout_escalations (integer) — Escalations triggered by timeout.\n  - title (string) — Incident title.\n",
-	"Analytics.TopkAlertsByLabel":               "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - hours (string) — Hour bucket when `split_hours` is enabled: `work`, `sleep`, or `off`. Omitted when `split_hours` is false. [work, sleep, off]\n  - label (string) — Aggregation key value (check name or resource identifier).\n  - total_alert_cnt (integer) — Total number of alerts in this label-value bucket.\n  - total_alert_event_cnt (integer) — Total number of raw alert events in this label-value bucket.\n",
-	"Applications.ReadInfo":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
-	"Applications.ReadInfos":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
-	"Applications.ReadList":                     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
-	"Applications.WebhookTest":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - message (string) (required) — `ok` on success, otherwise the delivery error message.\n  - ok (boolean) (required) — Whether the webhook endpoint accepted the sample event.\n  - status_code (integer) (required) — HTTP status code returned by the webhook endpoint. 0 when the request did not receive a response.\n",
-	"Applications.WriteCreate":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - application_id (string) — Auto-generated unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token for RUM SDK initialization.\n",
-	"Artifacts.ReadGet":                         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - can_edit (boolean) (required) — Whether the caller may manage this artifact (rename, transfer, delete, share): the creator, any member of the owning team, or a manager of the source session.\n  - content_type (string) (required) — MIME type of the file.\n  - created_at (string) (required) — Unix timestamp in milliseconds when the artifact was published. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_name (string) (required) — Creator's display name.\n  - file_id (string) (required) — Presented-file ID (`pf_` prefix) currently holding the artifact's bytes. Changes on every republish.\n  - is_mine (boolean) (required) — Whether the caller is the creator.\n  - name (string) (required) — Underlying file name including extension.\n  - person_id (integer) (required) — Person (member) ID of the creator.\n  - public_url (string) — Anonymous public link — a console `/share/artifact/<artifact_id>` page served entirely from CDN. Present only while shared; anyone with the link can view it, no login required.\n  - session_id (string) (required) — Source session ID (`sess_` prefix) that produced the file.\n  - session_title (string) — Source session's title. Omitted when the session has been deleted.\n  - share_enabled (boolean) — Whether anonymous public sharing is on. Omitted when false.\n  - share_file_id (string) — Presented-file ID the public snapshot was materialized from. When `share_enabled` is true and `file_id` differs from `share_file_id`, the public snapshot is stale — call `/safari/artifact/gallery/share/sync` to refresh it.\n  - shared_at (string) — Unix timestamp in milliseconds of the last share enable or snapshot sync. Present only while shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) — Person ID of the member who enabled sharing. Present only while shared.\n  - size (integer) (required) — File size in bytes.\n  - team_id (integer) (required) — Owning team ID. `0` means a personal artifact (creator-only management); a positive value means team-owned.\n  - team_name (string) — Owning team's display name. Omitted for personal artifacts.\n  - title (string) (required) — Display title in the gallery.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the artifact was last updated (rename, transfer, or republish). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Artifacts.ReadGetFileState":                "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - file_id (string) (required) — Echoes the requested presented-file ID.\n  - gallery_path (string) (required) — Console-relative path of the artifact page: `/ai-sre/artifacts/<artifact_id>`.\n  - title (string) (required) — Gallery display title of the published artifact.\n",
-	"Artifacts.ReadList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - can_edit (boolean) (required) — Whether the caller may manage this artifact (rename, transfer, delete, share): the creator, any member of the owning team, or a manager of the source session.\n  - content_type (string) (required) — MIME type of the file.\n  - created_at (string) (required) — Unix timestamp in milliseconds when the artifact was published. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_name (string) (required) — Creator's display name.\n  - file_id (string) (required) — Presented-file ID (`pf_` prefix) currently holding the artifact's bytes. Changes on every republish.\n  - is_mine (boolean) (required) — Whether the caller is the creator.\n  - name (string) (required) — Underlying file name including extension.\n  - person_id (integer) (required) — Person (member) ID of the creator.\n  - public_url (string) — Anonymous public link — a console `/share/artifact/<artifact_id>` page served entirely from CDN. Present only while shared; anyone with the link can view it, no login required.\n  - session_id (string) (required) — Source session ID (`sess_` prefix) that produced the file.\n  - session_title (string) — Source session's title. Omitted when the session has been deleted.\n  - share_enabled (boolean) — Whether anonymous public sharing is on. Omitted when false.\n  - share_file_id (string) — Presented-file ID the public snapshot was materialized from. When `share_enabled` is true and `file_id` differs from `share_file_id`, the public snapshot is stale — call `/safari/artifact/gallery/share/sync` to refresh it.\n  - shared_at (string) — Unix timestamp in milliseconds of the last share enable or snapshot sync. Present only while shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) — Person ID of the member who enabled sharing. Present only while shared.\n  - size (integer) (required) — File size in bytes.\n  - team_id (integer) (required) — Owning team ID. `0` means a personal artifact (creator-only management); a positive value means team-owned.\n  - team_name (string) — Owning team's display name. Omitted for personal artifacts.\n  - title (string) (required) — Display title in the gallery.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the artifact was last updated (rename, transfer, or republish). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Artifacts.ReadSign":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - content_type (string) (required) — MIME type of the file.\n  - download_url (string) (required) — Relative URL (`/safari/artifact/stream?...`) that serves the file as an attachment. Prepend the API base `https://api.flashcat.cloud` before use; expires with `expires_in`.\n  - expires_in (integer) (required) — Validity of both URLs in seconds (300).\n  - name (string) (required) — File name including extension.\n  - preview_url (string) (required) — Same as `download_url` but served inline for browser preview.\n  - size (integer) (required) — File size in bytes.\n",
-	"Artifacts.WritePublish":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - gallery_path (string) (required) — Console-relative path of the artifact page: `/ai-sre/artifacts/<artifact_id>`.\n  - title (string) (required) — Gallery display title.\n",
-	"Artifacts.WriteShareEnable":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - public_url (string) (required) — Anonymous public link served entirely from CDN. Anyone with the link can view the content, no login required.\n  - share_enabled (boolean) (required) — Always `true` in this response.\n  - shared_at (string) (required) — Unix timestamp in milliseconds of the last share enable or snapshot sync. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) (required) — Person ID of the member who enabled sharing.\n",
-	"Artifacts.WriteShareSync":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - public_url (string) (required) — Anonymous public link served entirely from CDN. Anyone with the link can view the content, no login required.\n  - share_enabled (boolean) (required) — Always `true` in this response.\n  - shared_at (string) (required) — Unix timestamp in milliseconds of the last share enable or snapshot sync. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) (required) — Person ID of the member who enabled sharing.\n",
-	"Artifacts.WriteUpdate":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - can_edit (boolean) (required) — Whether the caller may manage this artifact (rename, transfer, delete, share): the creator, any member of the owning team, or a manager of the source session.\n  - content_type (string) (required) — MIME type of the file.\n  - created_at (string) (required) — Unix timestamp in milliseconds when the artifact was published. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_name (string) (required) — Creator's display name.\n  - file_id (string) (required) — Presented-file ID (`pf_` prefix) currently holding the artifact's bytes. Changes on every republish.\n  - is_mine (boolean) (required) — Whether the caller is the creator.\n  - name (string) (required) — Underlying file name including extension.\n  - person_id (integer) (required) — Person (member) ID of the creator.\n  - public_url (string) — Anonymous public link — a console `/share/artifact/<artifact_id>` page served entirely from CDN. Present only while shared; anyone with the link can view it, no login required.\n  - session_id (string) (required) — Source session ID (`sess_` prefix) that produced the file.\n  - session_title (string) — Source session's title. Omitted when the session has been deleted.\n  - share_enabled (boolean) — Whether anonymous public sharing is on. Omitted when false.\n  - share_file_id (string) — Presented-file ID the public snapshot was materialized from. When `share_enabled` is true and `file_id` differs from `share_file_id`, the public snapshot is stale — call `/safari/artifact/gallery/share/sync` to refresh it.\n  - shared_at (string) — Unix timestamp in milliseconds of the last share enable or snapshot sync. Present only while shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) — Person ID of the member who enabled sharing. Present only while shared.\n  - size (integer) (required) — File size in bytes.\n  - team_id (integer) (required) — Owning team ID. `0` means a personal artifact (creator-only management); a positive value means team-owned.\n  - team_name (string) — Owning team's display name. Omitted for personal artifacts.\n  - title (string) (required) — Display title in the gallery.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the artifact was last updated (rename, transfer, or republish). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"AuditLogs.OperationList":                   "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - name (string) (required) — Stable machine-readable operation name for use as a filter.\n  - name_cn (string) (required) — Human-readable Chinese label shown in the console.\n",
-	"AuditLogs.Search":                          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account.\n  - body (string) (required) — JSON-encoded request body. Bodies containing sensitive fields are base64url-encoded instead; bodies over 10 KB are replaced by a truncation placeholder.\n  - created_at (string) (required) — Timestamp of the operation in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - credential_id (integer) (required) — ID of the credential (the app key ID) when `credential_type` is `app_key`; 0 otherwise.\n  - credential_type (string) (required) — Credential type used for the call. `app_key` when authenticated with an app key; empty string for member sessions.\n  - ip (string) (required) — Client IP address of the caller.\n  - is_dangerous (boolean) (required) — True if this is flagged as a high-risk operation.\n  - is_write (boolean) (required) — True for mutating operations; false for read-only ones.\n  - member_id (integer) (required) — ID of the member who performed the action. 0 when the action was performed by the account principal itself.\n  - member_name (string) (required) — Display name of the member. Empty when `member_id` is 0.\n  - operation (string) (required) — Stable machine-readable operation name, e.g. `template:write:create`.\n  - operation_name (string) (required) — Human-readable Chinese label of the operation (e.g. `创建模板`).\n  - params (array<object>) (required) — URL path parameters as an array of key-value pairs, or an empty array when none.\n    - Key (string) — Name of a URL path parameter (the `:xxx` placeholder in the route).\n    - Value (string) — The actual value of that path parameter in this request.\n  - principal_kind (string) (required) — Kind of the caller. `member` — an interactive member session; `service` — an app key credential. [member, service]\n  - request_id (string) (required) — Unique request ID for correlation.\n",
-	"Automations.RuleReadGet":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n  - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - cron_expr (string) (required) — Normalized 5-field cron expression.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - environment_id (string) (required) — BYOC Runner ID.\n  - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n  - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n  - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n  - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n  - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n  - name (string) (required) — Rule name.\n  - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n  - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n  - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n  - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n  - owner_id (integer) (required) — Creator person ID.\n  - prompt (string) (required) — Task prompt.\n  - rule_id (string) (required) — Rule ID.\n  - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n  - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n  - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n  - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n  - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n  - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Automations.RuleReadList":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rules (array<object>) (required) — Array of automation rules for the current page, used with `total` for pagination.\n    - account_id (integer) (required) — Account ID.\n    - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n    - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - cron_expr (string) (required) — Normalized 5-field cron expression.\n    - enabled (boolean) (required) — Whether the rule is enabled.\n    - environment_id (string) (required) — BYOC Runner ID.\n    - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n    - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n    - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n    - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n    - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n    - name (string) (required) — Rule name.\n    - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n    - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n    - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n    - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n    - owner_id (integer) (required) — Creator person ID.\n    - prompt (string) (required) — Task prompt.\n    - rule_id (string) (required) — Rule ID.\n    - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n    - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n    - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n    - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n    - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n    - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - total (integer) (required) — Total count.\n",
-	"Automations.RuleWriteCreate":               "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n  - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - cron_expr (string) (required) — Normalized 5-field cron expression.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - environment_id (string) (required) — BYOC Runner ID.\n  - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n  - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n  - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n  - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n  - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n  - name (string) (required) — Rule name.\n  - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n  - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n  - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n  - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n  - owner_id (integer) (required) — Creator person ID.\n  - prompt (string) (required) — Task prompt.\n  - rule_id (string) (required) — Rule ID.\n  - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n  - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n  - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n  - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n  - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n  - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Automations.RuleWriteRun":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - preflight (object) (required) — Readiness checks computed before a manual run is allowed to start.\n    - app_name (string) (required) — App the rule is scoped to. Currently always ai-sre; manual runs are only supported for that app.\n    - checks (array<string>) (required) — Names of the readiness checks performed, in order. Current fixed set: rule_loaded, actor_authorized, app_allowed, runtime_scope_resolved, rule_config_valid.\n    - ok (boolean) (required) — Whether all readiness checks passed. Always true in a response that reaches the caller — a failed preflight returns a 400/403 error instead of a payload with ok=false.\n    - owner_id (integer) (required) — Rule owner person ID.\n    - scope (string) (required) — Resolved run scope for this run; mirrors the rule's run_scope. One of: `person` (personal rule, runs as its creator), `team` (team rule, runs under the owning team). [person, team]\n    - team_id (integer) (required) — Rule's scope team ID; 0 means a personal rule.\n    - warnings (array<string>) — Non-fatal warnings surfaced during preflight. Omitted or empty when there are none.\n  - rule_id (string) (required) — Rule ID that was run.\n  - run (object) — Reference to the run started by a manual trigger.\n    - run_id (string) (required) — Run ID, always populated once a run is created.\n    - session_id (string) — AI SRE session ID for this run. Always populated in a 200 response, since the call only returns after the session has started.\n  - trigger_kind (string) (required) — Always manual for this operation. [manual]\n",
-	"Automations.RuleWriteUpdate":               "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n  - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - cron_expr (string) (required) — Normalized 5-field cron expression.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - environment_id (string) (required) — BYOC Runner ID.\n  - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n  - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n  - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n  - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n  - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n  - name (string) (required) — Rule name.\n  - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n  - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n  - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n  - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n  - owner_id (integer) (required) — Creator person ID.\n  - prompt (string) (required) — Task prompt.\n  - rule_id (string) (required) — Rule ID.\n  - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n  - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n  - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n  - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n  - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n  - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Automations.RunReadList":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - runs (array<object>) (required) — Array of run records for the given `rule_id`, filtered by the request's status/trigger-kind/time-range and paginated.\n    - account_id (integer) (required) — Account ID.\n    - attempts (integer) (required) — Attempt count.\n    - completed_at (string) (required) — Completion time, Unix milliseconds. 0 means not completed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - duration_ms (integer) (required) — Duration in milliseconds.\n    - error_code (string) (required) — Error code; empty when the run did not fail.\n    - error_message (string) (required) — Error message; empty when the run did not fail.\n    - kind (string) (required) — Run kind; runs listed for a rule are always `automation_rule`. [automation_rule]\n    - occurrence_key (string) (required) — Idempotency key for this occurrence.\n    - result_json (object) (required) — Raw run result JSON (carries the run's `session_id` once started); null when empty.\n    - rule_id (string) (required) — Rule ID.\n    - run_id (string) (required) — Run ID.\n    - session_id (string) — Session created for this run, extracted from `result_json`. Omitted when the run has not (yet) started a session.\n    - session_name (string) — Display name of the run's session, stamped via a batch lookup. Omitted when empty or when the lookup fails.\n    - started_at (string) (required) — Start time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - stats_json (object) (required) — Raw run statistics JSON; null when empty.\n    - status (string) (required) — Run status. One of (the first three are in-flight, the rest terminal): | Value | Meaning | | --- | --- | | `queued` | Enqueued, waiting for a worker | | `running` | Executing | | `retrying` | An attempt failed and a retry is scheduled | | `succeeded` | Completed successfully | | `partial` | Partially succeeded (currently only produced by memory-consolidation runs; rule runs never reach it) | | `failed` | Terminal failure, no further retries | | `skipped` | Not executed (e.g. grace period expired, trigger or rule invalid); the reason is kept on the run record | | `abandoned` | Still in-flight past the stale threshold and swept as never-completed (e.g. worker died) | | `blocked` | Terminal: the run produced output but ended with a connector waiting on a human to complete authorization (distinct from `failed`) | [queued, running, retrying, succeeded, partial, failed, skipped, abandoned, blocked]\n    - trigger_kind (string) (required) — Trigger kind. One of: | Value | Meaning | | --- | --- | | `schedule` | Fired by the rule's schedule trigger | | `debug` | Debug run (reserved; current rule runs never carry this kind) | | `manual` | Triggered manually by a user | | `http_post` | Fired via the rule's HTTP POST webhook | | `oncall_incident` | Fired by an on-call incident event | [schedule, debug, manual, http_post, oncall_incident]\n    - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - total (integer) (required) — Total count.\n",
-	"Automations.TemplateReadList":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - templates (array<object>) (required) — Array of built-in automation templates, with display text localized by the request `locale` (falling back to request headers).\n    - description (string) (required) — Template description.\n    - enabled (boolean) (required) — Whether a rule created from this template starts out enabled (prefill value).\n    - icon (string) (required) — Icon identifier.\n    - name (string) (required) — Template name.\n    - prompt (string) (required) — Template prompt.\n",
-	"Calendars.CalEventList":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID. Only present for private events.\n  - cal_id (string) (required) — Calendar ID. For public events this is a locale key such as zh-cn.china.official.\n  - created_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Creator person ID. Only present for private events.\n  - description (string) (required) — Event description.\n  - end_at (string) (required) — Event end date (YYYY-MM-DD, exclusive).\n  - event_id (string) (required) — Event ID.\n  - is_off (boolean) (required) — Whether the event marks a non-working day.\n  - start_at (string) (required) — Event start date (YYYY-MM-DD).\n  - summary (string) (required) — Event summary.\n  - updated_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Calendars.CalEventUpsert":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - cal_id (string) (required) — Calendar ID.\n  - event_id (string) (required) — Event ID (existing or newly generated).\n  - summary (string) (required) — Event summary.\n",
-	"Calendars.CalendarCreate":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - cal_id (string) (required) — ID of the newly created calendar (format cal.<uuid>).\n  - cal_name (string) (required) — Calendar display name.\n",
-	"Calendars.CalendarInfo":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - cal_id (string) (required) — Calendar ID.\n  - cal_name (string) (required) — Calendar display name.\n  - created_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator person ID.\n  - description (string) (required) — Calendar description.\n  - extra_cal_ids (array<string>) — Inherited public-holiday calendar IDs. Omitted when empty.\n  - kind (string) (required) — Calendar kind. `region.official.holiday` is a public regional holiday calendar (served by the central holiday service), `religion.holiday` is a public religious holiday calendar (reserved, currently no data), and `personal` is an account-created personal/team calendar. [region.official.holiday, religion.holiday, personal]\n  - status (string) (required) — Calendar status. `enabled` means usable; `deleted` means removed and never returned by list endpoints. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID (0 when not assigned).\n  - timezone (string) (required) — IANA timezone.\n  - updated_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater person ID.\n  - workdays (array<integer>) — Workday numbers (0 = Sunday, 6 = Saturday). Omitted when empty.\n",
-	"Calendars.CalendarList":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - cal_id (string) (required) — Calendar ID.\n  - cal_name (string) (required) — Calendar display name.\n  - created_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator person ID.\n  - description (string) (required) — Calendar description.\n  - extra_cal_ids (array<string>) — Inherited public-holiday calendar IDs. Omitted when empty.\n  - kind (string) (required) — Calendar kind. `region.official.holiday` is a public regional holiday calendar (served by the central holiday service), `religion.holiday` is a public religious holiday calendar (reserved, currently no data), and `personal` is an account-created personal/team calendar. [region.official.holiday, religion.holiday, personal]\n  - status (string) (required) — Calendar status. `enabled` means usable; `deleted` means removed and never returned by list endpoints. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID (0 when not assigned).\n  - timezone (string) (required) — IANA timezone.\n  - updated_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater person ID.\n  - workdays (array<integer>) — Workday numbers (0 = Sunday, 6 = Saturday). Omitted when empty.\n",
-	"Changes.List":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account this change belongs to.\n  - change_id (string) — Change ID, a MongoDB ObjectID hex string.\n  - change_key (string) — Stable key that groups events belonging to the same change.\n  - change_status (string) — Current lifecycle status of the change. | Value | Meaning | |---|---| | `Planned` | Planned, not started. | | `Ready` | Ready for execution. | | `Processing` | Being executed. | | `Canceled` | Canceled. | | `Done` | Completed. | [Planned, Ready, Processing, Canceled, Done]\n  - channel_id (integer) — Collaboration channel this change is routed to.\n  - channel_name (string) — Name of the collaboration channel.\n  - channel_status (string) — Status of the collaboration channel: `enabled` or `disabled`. [enabled, disabled]\n  - description (string) — Change description.\n  - end_time (string) — Unix timestamp in seconds when the change ended. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - events (array<object>) — Underlying change events, returned only when include_events is true.\n    - account_id (integer) — Account this change event belongs to.\n    - change_key (string) — Stable key that groups events belonging to the same change.\n    - change_status (string) — Lifecycle status of the change event, reported by the change source as execution progresses. | Value | Meaning | |---|---| | `Planned` | Planned, not started. | | `Ready` | Ready for execution. | | `Processing` | Being executed. | | `Canceled` | Canceled. | | `Done` | Completed. | [Planned, Ready, Processing, Canceled, Done]\n    - channel_id (integer) — Collaboration channel this change event is routed to.\n    - created_at (string) — Unix timestamp in seconds when the change event was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - deleted_at (string) — Unix timestamp in seconds when the change event was deleted. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Change event description.\n    - event_id (string) — Change event ID, a MongoDB ObjectID hex string.\n    - event_time (string) — Unix timestamp in seconds when the change event occurred. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - integration_id (integer) — Integration that reported this change event.\n    - labels (object) — Key-value labels attached to the change event.\n    - link (string) — External link to the source change record.\n    - title (string) — Change event title.\n    - updated_at (string) — Unix timestamp in seconds when the change event was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration that reported this change.\n  - integration_name (string) — Name of the reporting integration.\n  - labels (object) — Key-value labels attached to the change.\n  - last_time (string) — Unix timestamp in seconds of the most recent change activity. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - link (string) — External link to the source change record.\n  - start_time (string) — Unix timestamp in seconds when the change started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Change title.\n",
-	"Channels.ChannelCreate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - channel_id (integer) (required) — Newly created channel ID.\n  - channel_name (string) (required) — Channel name echoed back from the request.\n  - external_report_token (string) — External report token. Emitted only when external reporting is enabled.\n",
-	"Channels.ChannelEscalateRuleCreate":        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — Newly created rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name echoed back from the request.\n",
-	"Channels.ChannelEscalateRuleInfo":          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - aggr_window (integer) (required) — Delay window in seconds.\n  - channel_id (integer) (required) — Channel the rule belongs to.\n  - channel_name (string) — Channel name, populated for cross-channel listing responses.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - filters (object) (required) — Incident-level match conditions (OR-of-AND tree): the rule is matched against the incident the alert was grouped into, not against the alert itself. Omit or leave empty to apply the rule to all incidents in the channel.\n  - layers (array<object>) (required) — Escalation levels in order.\n    - escalate_window (integer) — Wait before moving to the next level, in minutes. (0-720)\n    - force_escalate (boolean) — When true, always escalate regardless of acknowledgement.\n    - max_times (integer) — Max repeat notifications within the level. (0-6)\n    - notify_step (number) — Repeat interval in minutes. (0.5-120)\n    - target (object) (required) — Notification target. At least one of `person_ids`, `team_ids`, `schedule_to_role_ids`, or `emails` must be set, together with either `by` or `webhooks`.\n      - by (object) — Per-severity personal notification channels. Required unless `webhooks` is provided.\n        - critical (array<string>) — Notify channels used for Critical severity. Personal channels: `sms`, `voice`, `email`, `push`; IM group-chat channels: `feishu_app:<chat_id>`, `dingtalk_app:<chat_id>`, `wecom_app:<chat_id>`, `slack_app:<chat_id>`, `teams_app:<chat_id>`.\n        - follow_preference (boolean) — When true, use each responder's personal preference instead of the lists below.\n        - info (array<string>) — Notify channels used for Info severity. Values as for `critical`.\n        - warning (array<string>) — Notify channels used for Warning severity. Values as for `critical`.\n      - emails (array<string>) — Email addresses to notify (push-only scenarios).\n      - person_ids (array<integer>) — Member IDs to notify directly.\n      - schedule_to_role_ids (object) — Map of schedule ID to the role IDs on that schedule to notify.\n      - team_ids (array<integer>) — Team IDs to notify.\n      - webhooks (array<object>) — Group chat / webhook targets. Required unless `by` is provided.\n        - settings (object) (required) — Type-specific settings (chat IDs, URLs, etc.).\n        - type (string) (required) — Webhook type, one of `feishu`, `feishu_app`, `dingtalk`, `dingtalk_app`, `wecom`, `slack`, `slack_app`, `teams_app`, `telegram`, `zoom`.\n  - priority (integer) (required) — Evaluation priority. Lower runs first.\n  - rule_id (string) (required) — Escalation rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - status (string) (required) — Rule status: `enabled` means active, `disabled` means paused, `deleted` is soft-deleted (possible only from the detail endpoint; lists never return deleted rules). [enabled, disabled, deleted]\n  - template_id (string) (required) — Notification template ID (MongoDB ObjectID).\n  - time_filters (array<object>) (required) — Recurring time windows during which the rule applies.\n    - cal_id (string) — Optional calendar ID; restricts the window to days matching the calendar.\n    - end (string) — End of the window in `HH:MM`.\n    - is_off (boolean) — When true, match days marked as days-off in the calendar.\n    - repeat (array<integer>) — Days of the week this window repeats on. Empty means every day.\n    - start (string) — Start of the window in `HH:MM`.\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID that last updated the rule.\n",
-	"Channels.ChannelEscalateRuleList":          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Owning account ID.\n  - aggr_window (integer) (required) — Delay window in seconds.\n  - channel_id (integer) (required) — Channel the rule belongs to.\n  - channel_name (string) — Channel name, populated for cross-channel listing responses.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - filters (object) (required) — Incident-level match conditions (OR-of-AND tree): the rule is matched against the incident the alert was grouped into, not against the alert itself. Omit or leave empty to apply the rule to all incidents in the channel.\n  - layers (array<object>) (required) — Escalation levels in order.\n    - escalate_window (integer) — Wait before moving to the next level, in minutes. (0-720)\n    - force_escalate (boolean) — When true, always escalate regardless of acknowledgement.\n    - max_times (integer) — Max repeat notifications within the level. (0-6)\n    - notify_step (number) — Repeat interval in minutes. (0.5-120)\n    - target (object) (required) — Notification target. At least one of `person_ids`, `team_ids`, `schedule_to_role_ids`, or `emails` must be set, together with either `by` or `webhooks`.\n      - by (object) — Per-severity personal notification channels. Required unless `webhooks` is provided.\n      - emails (array<string>) — Email addresses to notify (push-only scenarios).\n      - person_ids (array<integer>) — Member IDs to notify directly.\n      - schedule_to_role_ids (object) — Map of schedule ID to the role IDs on that schedule to notify.\n      - team_ids (array<integer>) — Team IDs to notify.\n      - webhooks (array<object>) — Group chat / webhook targets. Required unless `by` is provided.\n  - priority (integer) (required) — Evaluation priority. Lower runs first.\n  - rule_id (string) (required) — Escalation rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - status (string) (required) — Rule status: `enabled` means active, `disabled` means paused, `deleted` is soft-deleted (possible only from the detail endpoint; lists never return deleted rules). [enabled, disabled, deleted]\n  - template_id (string) (required) — Notification template ID (MongoDB ObjectID).\n  - time_filters (array<object>) (required) — Recurring time windows during which the rule applies.\n    - cal_id (string) — Optional calendar ID; restricts the window to days matching the calendar.\n    - end (string) — End of the window in `HH:MM`.\n    - is_off (boolean) — When true, match days marked as days-off in the calendar.\n    - repeat (array<integer>) — Days of the week this window repeats on. Empty means every day.\n    - start (string) — Start of the window in `HH:MM`.\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID that last updated the rule.\n",
-	"Channels.ChannelInfo":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Owning account ID.\n  - active_incident_highest_severity (string) — Highest severity among the channel's active (triggered or processing) incidents: `Critical`, `Warning` or `Info`. Omitted when there are no active incidents. [Critical, Warning, Info]\n  - auto_resolve_mode (string) — How the auto-resolve timer is reset. `trigger` (default) starts the timer once when the incident is triggered — later merged alerts do not affect it; `update` restarts the timer from the latest alert time whenever a new alert merges into the incident. [trigger, update]\n  - auto_resolve_timeout (integer) — Auto-resolve timeout in seconds. 0 disables auto-resolve.\n  - channel_id (integer) — Channel ID.\n  - channel_name (string) — Channel name.\n  - created_at (string) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Member ID who created the channel.\n  - creator_name (string) — Name of the member who created the channel (resolved from the member directory; empty when unavailable).\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Non-zero only for soft-deleted channels. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Free-form description.\n  - disable_auto_close (boolean) — When true, automatic incident closing is disabled.\n  - disable_outlier_detection (boolean) — When true, outlier incident detection is disabled.\n  - event_group (object) — Alert event merge configuration.\n    - is_enabled (boolean) — When true, repeated events merge into the existing alert; when false, every event creates a separate alert. Defaults to true.\n    - time_window (integer) — Merge window in minutes, 1-1440 (24 h); accounts with the extended limit may use up to 10080 (7 days). Defaults to 1440. (min 1)\n  - external_report_token (string) — Token granted to external reporters. Omitted unless external reporting is enabled on the channel.\n  - flapping (object) — Flapping detection configuration.\n    - in_mins (integer) — Observation window in minutes. (1-1440)\n    - is_disabled (boolean) — Disable flapping detection.\n    - max_changes (integer) — Max state changes allowed within `in_mins`. (2-100)\n    - mute_mins (integer) — Mute duration in minutes after flapping is detected. (0-1440)\n  - group (object) — Alert grouping configuration.\n    - all_equals_required (boolean) — When true, all listed keys must be present for grouping.\n    - cases (array<object>) — Per-filter grouping overrides.\n      - equals (array<string>) (required) — Grouping keys for matching alerts. Supported values: `title`, `description`, `severity`, or any `labels.<name>`.\n      - if (array<object>) (required) — AND-ed match conditions evaluated against stored alert fields.\n        - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.<name>` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n        - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n        - vals (array<string>) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n    - equals (array<array<string>>) — Groups of label keys whose equality defines a bucket.\n    - i_keys (array<string>) — Label keys used for intelligent grouping embeddings.\n    - i_score_threshold (number) — Intelligent grouping similarity threshold. (0.5-1)\n    - method (string) (required) — Grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n    - storm_threshold (integer) — Alert storm threshold. (0-10000)\n    - storm_thresholds (array<integer>) — Multi-level storm thresholds.\n    - time_window (integer) — Grouping time window in minutes. Default max is 1440 minutes (24 h); extended accounts may allow up to 43200 minutes (30 days). (min 0)\n    - window_type (string) — Window type, default `tumbling`. `tumbling` is a fixed window counted from incident creation — once it expires, new alerts open a new incident; `sliding` is a sliding window counted from the incident's most recent alert, extended each time a new alert merges in. [tumbling, sliding]\n  - is_external_report_enabled (boolean) — Whether external reporters can file incidents into this channel.\n  - is_private (boolean) — When true, the channel is visible only to its managing teams.\n  - is_starred (boolean) — Whether the current user has starred this channel. Present only in `POST /channel/list` responses.\n  - last_incident_at (string) — Time of the most recent incident, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - managing_team_ids (array<integer>) — Additional teams that can manage the channel.\n  - progress_to_incident_cnts (object) — Incident counts by progress over the last 30 days.\n    - Processing (integer) (required) — Count of processing incidents in the last 30 days.\n    - Triggered (integer) (required) — Count of triggered incidents in the last 30 days.\n  - status (string) — Channel status. `enabled` receives and processes events normally; `disabled` drops incoming events outright; `deleted` is returned only when fetching a channel by ID — list endpoints never return it. [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - team_name (string) — Owning team name (resolved from the team directory; empty when unavailable).\n  - updated_at (string) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Channels.ChannelInfos":                     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - channel_id (integer) (required) — Channel ID.\n  - channel_name (string) (required) — Channel name.\n  - status (string) — Channel status: `enabled` processes events normally; `disabled` discards incoming events; `deleted` is soft-deleted. [enabled, disabled, deleted]\n",
-	"Channels.ChannelInhibitRuleCreate":         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — Newly created rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name echoed back from the request.\n",
-	"Channels.ChannelInhibitRuleList":           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account the rule belongs to.\n  - channel_id (integer) (required) — ID of the channel the rule belongs to.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - equals (array<string>) (required) — Field keys whose values must be equal between the source (inhibiting) alert and the target (suppressed) alert, e.g. `data_source_id` or `labels.cluster`.\n  - is_directly_discard (boolean) (required) — When true, matching alert events are discarded entirely; when false, alerts are still recorded but marked as muted by this rule.\n  - rule_id (string) (required) — Rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - source_filters (object) (required) — Conditions the source alert must match, evaluated against stored active alerts. Supported keys: `status`, `incident_status`, `alert_status`, `severity`, `incident_severity`, `alert_severity`, `title`, `description`, or any `labels.<name>`. Empty makes the rule inert.\n  - status (string) (required) — Rule status: `enabled` or `disabled`; deleted rules never appear in the list. [enabled, disabled]\n  - target_filters (object) (required) — Conditions the incoming target alert event must match to be suppressed; empty means every event is a target.\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the user who last updated the rule.\n",
-	"Channels.ChannelList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Owning account ID.\n  - active_incident_highest_severity (string) — Highest severity among the channel's active (triggered or processing) incidents: `Critical`, `Warning` or `Info`. Omitted when there are no active incidents. [Critical, Warning, Info]\n  - auto_resolve_mode (string) — How the auto-resolve timer is reset. `trigger` (default) starts the timer once when the incident is triggered — later merged alerts do not affect it; `update` restarts the timer from the latest alert time whenever a new alert merges into the incident. [trigger, update]\n  - auto_resolve_timeout (integer) — Auto-resolve timeout in seconds. 0 disables auto-resolve.\n  - channel_id (integer) — Channel ID.\n  - channel_name (string) — Channel name.\n  - created_at (string) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Member ID who created the channel.\n  - creator_name (string) — Name of the member who created the channel (resolved from the member directory; empty when unavailable).\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Non-zero only for soft-deleted channels. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Free-form description.\n  - disable_auto_close (boolean) — When true, automatic incident closing is disabled.\n  - disable_outlier_detection (boolean) — When true, outlier incident detection is disabled.\n  - event_group (object) — Alert event merge configuration.\n    - is_enabled (boolean) — When true, repeated events merge into the existing alert; when false, every event creates a separate alert. Defaults to true.\n    - time_window (integer) — Merge window in minutes, 1-1440 (24 h); accounts with the extended limit may use up to 10080 (7 days). Defaults to 1440. (min 1)\n  - external_report_token (string) — Token granted to external reporters. Omitted unless external reporting is enabled on the channel.\n  - flapping (object) — Flapping detection configuration.\n    - in_mins (integer) — Observation window in minutes. (1-1440)\n    - is_disabled (boolean) — Disable flapping detection.\n    - max_changes (integer) — Max state changes allowed within `in_mins`. (2-100)\n    - mute_mins (integer) — Mute duration in minutes after flapping is detected. (0-1440)\n  - group (object) — Alert grouping configuration.\n    - all_equals_required (boolean) — When true, all listed keys must be present for grouping.\n    - cases (array<object>) — Per-filter grouping overrides.\n      - equals (array<string>) (required) — Grouping keys for matching alerts. Supported values: `title`, `description`, `severity`, or any `labels.<name>`.\n      - if (array<object>) (required) — AND-ed match conditions evaluated against stored alert fields.\n    - equals (array<array<string>>) — Groups of label keys whose equality defines a bucket.\n    - i_keys (array<string>) — Label keys used for intelligent grouping embeddings.\n    - i_score_threshold (number) — Intelligent grouping similarity threshold. (0.5-1)\n    - method (string) (required) — Grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n    - storm_threshold (integer) — Alert storm threshold. (0-10000)\n    - storm_thresholds (array<integer>) — Multi-level storm thresholds.\n    - time_window (integer) — Grouping time window in minutes. Default max is 1440 minutes (24 h); extended accounts may allow up to 43200 minutes (30 days). (min 0)\n    - window_type (string) — Window type, default `tumbling`. `tumbling` is a fixed window counted from incident creation — once it expires, new alerts open a new incident; `sliding` is a sliding window counted from the incident's most recent alert, extended each time a new alert merges in. [tumbling, sliding]\n  - is_external_report_enabled (boolean) — Whether external reporters can file incidents into this channel.\n  - is_private (boolean) — When true, the channel is visible only to its managing teams.\n  - is_starred (boolean) — Whether the current user has starred this channel. Present only in `POST /channel/list` responses.\n  - last_incident_at (string) — Time of the most recent incident, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - managing_team_ids (array<integer>) — Additional teams that can manage the channel.\n  - progress_to_incident_cnts (object) — Incident counts by progress over the last 30 days.\n    - Processing (integer) (required) — Count of processing incidents in the last 30 days.\n    - Triggered (integer) (required) — Count of triggered incidents in the last 30 days.\n  - status (string) — Channel status. `enabled` receives and processes events normally; `disabled` drops incoming events outright; `deleted` is returned only when fetching a channel by ID — list endpoints never return it. [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - team_name (string) — Owning team name (resolved from the team directory; empty when unavailable).\n  - updated_at (string) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Channels.ChannelSilenceRuleCreate":         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — Newly created rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name echoed back from the request.\n",
-	"Channels.ChannelSilenceRuleList":           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account the rule belongs to.\n  - channel_id (integer) (required) — ID of the channel the rule belongs to.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - filters (object) (required) — Alert event match conditions; matching events are silenced within the time window.\n  - from_incident_id (string) — Incident the rule is attached to. Always present; the zero ObjectID `000000000000000000000000` means the rule was not created from an incident.\n  - is_auto_delete (boolean) — When true, the silence rule is automatically deleted after its time window expires. Defaults to false.\n  - is_directly_discard (boolean) (required) — When true, silenced alerts are dropped instead of suppressed into incidents.\n  - is_effective (boolean) (required) — Whether the rule's time window covers the current moment, evaluated at response time.\n  - rule_id (string) (required) — Rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - status (string) (required) — Rule status: `enabled` or `disabled`; deleted rules never appear in the list. [enabled, disabled]\n  - time_filter (object) (required) — One-off silence window. Present with zero values when the rule uses recurring `time_filters` instead.\n    - end_time (integer) (required) — Window end, Unix timestamp in seconds. Must be greater than 0.\n    - start_time (integer) (required) — Window start, Unix timestamp in seconds. Must be greater than 0 and less than `end_time`.\n  - time_filters (array<object>) (required) — Recurring silence windows. Empty when the rule uses a one-off `time_filter`.\n    - cal_id (string) — Optional calendar ID; restricts the window to days matching the calendar.\n    - end (string) — End of the window in `HH:MM`.\n    - is_off (boolean) — When true, match days marked as days-off in the calendar.\n    - repeat (array<integer>) — Days of the week this window repeats on. Empty means every day.\n    - start (string) — Start of the window in `HH:MM`.\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the user who last updated the rule.\n",
-	"Channels.ChannelUnsubscribeRuleCreate":     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — Newly created rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name echoed back from the request.\n",
-	"Channels.ChannelUnsubscribeRuleList":       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account the rule belongs to.\n  - channel_id (integer) (required) — ID of the channel the rule belongs to.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - filters (object) (required) — Alert event match conditions (OR-of-AND); matching events are discarded entirely. Empty means the rule matches nothing.\n  - rule_id (string) (required) — Rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - status (string) (required) — Rule status: `enabled` or `disabled`; deleted rules never appear in the list. [enabled, disabled]\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the user who last updated the rule.\n",
-	"Channels.ChannelUpdate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - external_report_token (string) — Newly generated token for external reporters. Only returned when `is_external_report_enabled` is set to `true` in the request. Callers should store this value; it cannot be retrieved afterwards.\n",
-	"Channels.RouteInfo":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - cases (array<object>) — Ordered list of case branches.\n    - channel_ids (array<integer>) — Target channel IDs. Required when `routing_mode` is `standard` (or empty); returned as `null` for `name_mapping`.\n    - fallthrough (boolean) — If `true`, evaluation continues to the next case after this one matches; otherwise matching stops at the first hit.\n    - if (array<object>) (required) — List of match conditions that are AND-ed together.\n      - key (string) (required) — Field key to match against the alert event (e.g. `alert_severity`, `labels.service`).\n      - oper (string) (required) — Match operator. `IN` matches when the field value is one of `vals`; `NOTIN` matches when it is not. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to compare against. Each value may be a literal string, a wildcard (`*`, `?`), a regular expression wrapped in slashes (`/pattern/`), a CIDR (`cidr:10.0.0.0/8`), or a numeric comparison (`num:lt:100`).\n    - name_mapping_label (string) — Label key whose value is used as the target channel name. Required when `routing_mode` is `name_mapping`.\n    - routing_mode (string) — Routing mode. `standard` (default, also used when left empty) routes to the fixed channel IDs; `name_mapping` resolves channels by reading a label value from the alert event. [standard, name_mapping]\n  - created_at (string) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the person who created the rule.\n  - default (object) — Default branch used when no case matches (or all matched cases yield no valid channels).\n    - channel_ids (array<integer>) — Channel IDs to fall back to.\n  - deleted_at (string) — Soft-delete timestamp, Unix seconds. Omitted when the rule is active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration the rule belongs to.\n  - sections (array<object>) — Optional sections that visually group cases.\n    - name (string) (required) — Section name. Must be unique within the rule.\n    - position (integer) (required) — Index in `cases` where this section starts. Must be between 0 and the length of `cases`.\n  - status (string) — Route status. `enabled` means active; `deleted` means removed, visible only in historical versions. [enabled, deleted]\n  - updated_at (string) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the person who performed the last update.\n  - version (integer) (required) — Monotonic version number, incremented on each update. Use it for optimistic concurrency control.\n",
-	"Channels.RouteList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - cases (array<object>) — Ordered list of case branches.\n    - channel_ids (array<integer>) — Target channel IDs. Required when `routing_mode` is `standard` (or empty); returned as `null` for `name_mapping`.\n    - fallthrough (boolean) — If `true`, evaluation continues to the next case after this one matches; otherwise matching stops at the first hit.\n    - if (array<object>) (required) — List of match conditions that are AND-ed together.\n      - key (string) (required) — Field key to match against the alert event (e.g. `alert_severity`, `labels.service`).\n      - oper (string) (required) — Match operator. `IN` matches when the field value is one of `vals`; `NOTIN` matches when it is not. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to compare against. Each value may be a literal string, a wildcard (`*`, `?`), a regular expression wrapped in slashes (`/pattern/`), a CIDR (`cidr:10.0.0.0/8`), or a numeric comparison (`num:lt:100`).\n    - name_mapping_label (string) — Label key whose value is used as the target channel name. Required when `routing_mode` is `name_mapping`.\n    - routing_mode (string) — Routing mode. `standard` (default, also used when left empty) routes to the fixed channel IDs; `name_mapping` resolves channels by reading a label value from the alert event. [standard, name_mapping]\n  - created_at (string) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the person who created the rule.\n  - default (object) — Default branch used when no case matches (or all matched cases yield no valid channels).\n    - channel_ids (array<integer>) — Channel IDs to fall back to.\n  - deleted_at (string) — Soft-delete timestamp, Unix seconds. Omitted when the rule is active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration the rule belongs to.\n  - sections (array<object>) — Optional sections that visually group cases.\n    - name (string) (required) — Section name. Must be unique within the rule.\n    - position (integer) (required) — Index in `cases` where this section starts. Must be between 0 and the length of `cases`.\n  - status (string) — Route status. `enabled` means active; `deleted` means removed, visible only in historical versions. [enabled, deleted]\n  - updated_at (string) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the person who performed the last update.\n  - version (integer) (required) — Monotonic version number, incremented on each update. Use it for optimistic concurrency control.\n",
-	"DataSources.ReadInfo":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"DataSources.ReadList":                      "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"DataSources.ReadSLSProjects":               "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - count (integer) (required) — Number of projects in this page.\n  - projects (array<object>) (required) — Projects in the current page.\n    - createTime (string) (required) — Creation time, Unix seconds rendered as a string, e.g. `\"1524539357\"`.\n    - dataRedundancyType (string) — Data redundancy type: `LRS` = locally redundant storage, `ZRS` = zone-redundant storage. Omitted when not set. [LRS, ZRS]\n    - description (string) (required) — Project description.\n    - lastModifyTime (string) (required) — Last modification time, Unix seconds rendered as a string.\n    - location (string) — Storage location, e.g. `cn-beijing-b`. Omitted when not set.\n    - owner (string) (required) — Owner Aliyun account ID; empty when not returned by SLS.\n    - projectName (string) (required) — Project name.\n    - region (string) (required) — Region ID, e.g. `cn-shanghai`.\n    - status (string) (required) — Project status, e.g. `Normal`.\n  - total (integer) (required) — Total number of projects matching `query`, independent of pagination.\n",
-	"DataSources.ToolsInvoke":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - data (any) (required) — Tool-specific JSON evidence, preserved without conversion; never null. No nested legacy diagnose envelope.\n  - datasource_id (integer) (required) — Datasource ID from /monit/datasource/list. (min 1)\n  - summary (string) — Optional non-empty summary.\n  - tool (string) (required) — Executed tool name matching the request.\n  - truncated (object)\n    - reason (string) (required) — Why the result was truncated. Presence of this object indicates truncation.\n",
-	"DataSources.WriteCreate":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"DataSources.WriteUpdate":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Diagnostics.QueryData":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - format (string) (required) — Public result-contract version. It is independent of the internal monit-edge query protocol version. Fixed at `query_result.v1`, which defines the structure of the `result` field. [query_result.v1]\n  - result (object) (required) — Exactly one natural result shape, selected by `kind`.\n    - frames (array<object>) — Typed table or time-series frames. A response can contain more than one frame.\n      - fields (array<object>) (required) — Columns of the frame; all fields share the same `values` length and row i is composed of each field's `values[i]`.\n        - labels (object) — Series labels. Present on the float field of a time-series frame.\n        - name (string) (required) — Column name; on a time-series float field, series are distinguished by `labels` and `name` is usually the metric name.\n        - type (string) (required) — Value type governing `values` encoding: `string` = strings or null, `float` = numbers or `NaN`/`±Inf` strings or null, `time` = RFC 3339 Nano strings or null. [string, float, time]\n        - values (array<any>) (required) — All values of this column in row order; length matches the other fields in the frame.\n      - kind (string) (required) — Frame type: `table` for a generic table, `time_series` for a series (exactly one time field and one float field). [table, time_series]\n    - kind (string) (required) — Result-kind discriminator, always `frames`, indicating the `frames` payload of typed table/time-series frames. [frames, records, samples]\n    - records (array<any>) — Schema-flexible records. Records may have different fields, contain nested JSON, or be null. Integers outside JavaScript's safe range are encoded as decimal strings.\n    - samples (array<object>) — Instant samples with their complete label sets.\n      - labels (object) (required) — The sample's full label set; may be an empty object but is always present.\n      - value (any) (required) — Finite numeric value or a JSON-safe representation of a non-finite float.\n",
-	"ErrorIngestionRules.Create":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — ID assigned to the new rule.\n  - rule_name (string) (required) — Echo of the created rule's name.\n",
-	"ErrorIngestionRules.HistoryList":           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - rules (array<object>) (required) — The application's complete rule list as of this version.\n    - account_id (integer) (required) — Account ID.\n    - application_id (string) (required) — RUM application ID the rule belongs to.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the row was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID who created the rule.\n    - deleted_at (string) (required) — Unix timestamp in milliseconds when the row was soft-deleted; `0` when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Rule description.\n    - filters (array<array<object>>) (required) — The rule's filter conditions as of this snapshot version.\n      - key (string) (required) — Field key. One of `error.usr_id`, `error.usr_email`, `error.error_type`, `error.error_message`, `error.error_stack`, `error.view_url`, `error.env`, `error.version`, `error.service`, `error.browser_name`, `error.browser_version`, `error.fingerprint`, `error.is_crash`, or a `context.`-prefixed custom context path (up to 3 levels deep).\n      - oper (string) (required) — Match mode: `IN` matches when the field value matches any entry in `vals`; `NOTIN` matches when it matches none. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to match against, at least 1 entry. Each entry is an exact string, or a special pattern using wildcards (`*`/`?`), a regexp wrapped in `/`, a `cidr:`-prefixed CIDR match, or a `num:lt|le|gt|ge:`-prefixed numeric comparison.\n    - id (integer) (required) — Internal row ID.\n    - rule_id (string) (required) — Rule ID.\n    - rule_name (string) (required) — Rule name.\n    - status (string) (required) — The rule's status as of this snapshot version. [enabled, disabled]\n    - updated_at (string) (required) — Unix timestamp in milliseconds when the row was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID who last updated the rule.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when this snapshot was recorded. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID whose action triggered this snapshot.\n  - updated_by_name (string) (required) — Display name of the member whose action triggered this snapshot.\n  - version (integer) (required) — History version number, incrementing from 1.\n",
-	"ErrorIngestionRules.List":                  "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Unix timestamp in milliseconds when the rule was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description, up to 512 characters.\n  - filters (array<array<object>>) (required) — The rule's filter conditions.\n    - key (string) (required) — Field key. One of `error.usr_id`, `error.usr_email`, `error.error_type`, `error.error_message`, `error.error_stack`, `error.view_url`, `error.env`, `error.version`, `error.service`, `error.browser_name`, `error.browser_version`, `error.fingerprint`, `error.is_crash`, or a `context.`-prefixed custom context path (up to 3 levels deep).\n    - oper (string) (required) — Match mode: `IN` matches when the field value matches any entry in `vals`; `NOTIN` matches when it matches none. [IN, NOTIN]\n    - vals (array<string>) (required) — Values to match against, at least 1 entry. Each entry is an exact string, or a special pattern using wildcards (`*`/`?`), a regexp wrapped in `/`, a `cidr:`-prefixed CIDR match, or a `num:lt|le|gt|ge:`-prefixed numeric comparison.\n  - rule_id (string) (required) — Rule ID.\n  - rule_name (string) (required) — Rule name, 1-128 characters. Not required to be unique within the application.\n  - status (string) (required) — Current status of the rule. [enabled, disabled]\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the rule was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Facets.FacetCount":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - count (integer) (required) — Number of events with this facet value in the time range.\n  - facet_value (any) (required) — The facet value. Type matches the field's `value_type`.\n",
-	"Facets.FieldList":                          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID. 0 for built-in fields.\n  - description (string) (required) — Description of what this field captures.\n  - edit_able (boolean) (required) — True if this is a custom field that can be edited by the user.\n  - enum_values (array<any>) (required) — Predefined enumerable values for this field. Element type matches the field's `value_type`: string for `string`, number for `number`, boolean for `boolean`. Empty when the field has no fixed set of values.\n  - field_key (string) (required) — Unique field key, e.g. `error.type`.\n  - field_name (string) (required) — Human-readable field name.\n  - group (string) (required) — Display group for this field.\n  - is_facet (boolean) (required) — True if value distribution counting is supported for this field.\n  - queryable (boolean) (required) — True if this field can be used in DQL/SQL queries.\n  - scopes (array<string>) (required) — RUM scopes this field appears in.\n  - show_type (string) (required) — Display type in the analytics UI. One of `list` (shown as an enumerated value list; only this type supports facet counting) or `range` (filtered and shown as a numeric/time range). [list, range]\n  - status (string) (required) — Field status, e.g. `active`.\n  - unit_family (string) (required) — Measurement unit family, e.g. `time`, `bytes`. Empty for dimensionless fields.\n  - unit_name (string) (required) — Specific measurement unit, e.g. `millisecond`, `byte`.\n  - value_type (string) (required) — Data type of the field value. One of: | Value | Meaning | |---|---| | `string` | String | | `number` | Numeric | | `boolean` | Boolean | | `array<string>` | Array of strings | | `array<number>` | Array of numbers | | `array<boolean>` | Array of booleans | [string, number, boolean, array<string>, array<number>, array<boolean>]\n",
-	"ImIntegrations.List":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account this integration belongs to.\n  - category (string) (required) — Plugin category; `im` for the IM integrations returned here.\n  - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Person who created the integration.\n  - data_source_id (integer) (required) — Integration ID.\n  - description (string) (required) — Integration description.\n  - exclusive_data_source_id (integer) (required) — Legacy exclusive-integration linkage; deprecated.\n  - integration_id (integer) (required) — Integration ID, alias of data_source_id.\n  - integration_key (string) (required) — Push key used by alert sources to send to this integration.\n  - last_time (string) (required) — Unix timestamp in seconds of the most recent activity in this datasource. Always `0` — this endpoint does not populate the field. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - name (string) (required) — Integration name.\n  - no_editable (boolean) (required) — Whether the integration is read-only.\n  - plugin_id (integer) (required) — Plugin ID backing this integration.\n  - plugin_type (string) (required) — Plugin type identifier of the IM integration, for example `feishu_app`, `dingtalk_app`, `wecom_app`, `slack_app`, or `teams_app`.\n  - plugin_type_name (string) (required) — Localized display name of the integration plugin type.\n  - ref_id (string) (required) — External reference ID of the integration.\n  - settings (object) (required) — Plugin-specific configuration of the integration.\n  - status (string) (required) — Integration status: `enabled` or `disabled`. Deleted integrations are never returned. [enabled, disabled]\n  - team_id (integer) (required) — Team that owns this integration.\n  - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Person who last updated the integration.\n",
-	"Incidents.AlertList":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n  - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n  - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n  - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n  - channel_id (integer) (required) — Channel ID.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n  - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n  - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n  - data_source_type (string) — Deprecated. Use `integration_type`.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Alert description.\n  - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n  - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - incident (object) — Parent incident reference, if the alert has been merged into one.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) (required) — Integration ID that produced the alert.\n  - integration_name (string) (required) — Integration display name.\n  - integration_ref_id (string) (required) — Integration reference ID.\n  - integration_type (string) (required) — Integration type string.\n  - labels (object) (required) — Alert labels.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) (required) — Primary responder email, if any.\n  - responder_name (string) (required) — Primary responder name, if any.\n  - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) (required) — Alert title.\n  - title_rule (string) (required) — Title rendering rule.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.CommentTypeCreate":               "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - comment_type_id (string) (required) — ID of the created comment type (24-character hex ObjectID).\n  - item (object) (required) — An account-level comment type that can be attached to incident comments.\n    - account_id (integer) (required) — Account ID that owns the comment type.\n    - color (string) (required) — Label color as a hex value in #RRGGBB format (stored uppercase).\n    - comment_type_id (string) (required) — Comment type ID (24-character hex ObjectID).\n    - created_at (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - creator_id (integer) (required) — ID of the user who created the comment type.\n    - name (string) (required) — Display name of the comment type. Unique within the account (case-insensitive, trimmed). (≤40 chars)\n    - position (integer) (required) — 1-based display position of the comment type.\n    - updated_at (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — ID of the user who last updated the comment type.\n",
-	"Incidents.CommentTypeList":                 "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the comment type.\n  - color (string) (required) — Label color as a hex value in #RRGGBB format (stored uppercase).\n  - comment_type_id (string) (required) — Comment type ID (24-character hex ObjectID).\n  - created_at (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who created the comment type.\n  - name (string) (required) — Display name of the comment type. Unique within the account (case-insensitive, trimmed). (≤40 chars)\n  - position (integer) (required) — 1-based display position of the comment type.\n  - updated_at (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the user who last updated the comment type.\n",
-	"Incidents.Create":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - incident_id (string) (required) — Newly created incident ID (MongoDB ObjectID).\n  - title (string) (required) — Echoes the incident title from the request.\n",
-	"Incidents.CustomActionDo":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - message (string) — Error message if the action's HTTP call failed; omitted on success.\n",
-	"Incidents.Feed":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - created_at (string) (required) — Creation timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — User ID of the actor. `0` means system-generated.\n  - deleted_at (string) — Soft-delete timestamp (ms). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - detail (object) (required) — Type-specific payload. The concrete shape is determined by `type`; `null` when the entry has no structured detail.\n    - added_assignee_ids (array<integer>) — Member IDs added as assignees.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - assignee_ids (array<integer>) — Assignee member IDs.\n    - by (string) — Delivery channel or method label.\n    - chat_id (string) — Chat group identifier.\n    - chat_name (string) — Chat group display name.\n    - chats (array<object>) — Per-chat delivery records.\n      - chat_id (string) — Chat group identifier.\n      - chat_name (string) — Chat group display name.\n      - data_source_id (integer) — Integration data source ID used to send the notification.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n    - comment (string) — Form summary recorded as a timeline comment. Omitted when no acknowledgement form summary was submitted.\n    - comment_type (object) — Resolved display of an account-level comment type, populated at read time from the current type definition.\n      - color (string) (required) — Badge color in #RRGGBB format.\n      - id (string) (required) — Comment type ID (MongoDB ObjectID).\n      - name (string) (required) — Display name of the comment type. (≤40 chars)\n    - comment_type_id (string) — ObjectID of the account-level comment type attached to the comment.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - field_name (string) — Name of the custom field that was updated.\n    - fire_type (string) — Whether this is the first fire or a refire. `fire`: the first notification for this escalation layer; `refire`: a repeat notification to the same layer when the incident remains unhandled, sent at the layer's notify interval and capped by the layer's maximum refire count. [fire, refire]\n    - from (string) — Source that triggered the resolve. | Value | Meaning | |---|---| | `voice` | Phone-call (voice DTMF) action. | | `console` | Console (Web UI) action. | | `card` | IM notification card button (DingTalk/Feishu/Slack/Teams). | | `wcard` | WeCom notification card button. | | `event` | Event-driven: auto-close when all related alerts recover to Ok, or a close synced from an external ITSM system. | | `autorslv` | Auto-resolve: closed by the system after no new alerts within the channel's auto-resolve timeout. | | `autorefresh` | Card auto-refresh (reserved; never appears on resolve feeds). | | `escalation` | Escalation flow (reserved; never appears on resolve feeds). | [voice, console, card, wcard, event, autorslv, autorefresh, escalation]\n    - from_description (string) — Description before the update.\n    - from_priority (string) — Priority label before the update.\n    - from_status (string) — Status label before the update.\n    - from_title (string) — Title before the update.\n    - from_type (string) — Work item type before the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `from_type` is always `action` in this event. [action, follow_up]\n    - id (string) — Opaque assignment ID generated by the server.\n    - images (array<object>) — Images from the acknowledgement form, recorded on the timeline entry only. Omitted when none were submitted.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - in_mins (integer) — Window length in minutes.\n    - integration_id (integer) — Integration ID that executed the action.\n    - integration_name (string) — Integration display name.\n    - item_type (string) — Work item type. `action`: an action item anchored to the incident itself, convertible to `follow_up` later; `follow_up`: an improvement item anchored to a post-mortem, requiring the incident to be linked to that post-mortem at creation. [action, follow_up]\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - max_changes (integer) — Maximum state changes allowed within the window.\n    - minutes (integer) — Snooze duration in minutes.\n    - msg_id (string) — Upstream message ID returned by the delivery channel.\n    - mute_mins (integer) — Mute duration in minutes once flapping is detected.\n    - mute_reply (boolean) — Whether replies to this comment are muted.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - owner_id (integer) — Member ID that performed the merge.\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - persons (array<object>) — Per-person delivery records.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n      - person_id (integer) — Recipient member ID.\n      - sms_content (string) — SMS text delivered to the recipient; present on SMS deliveries.\n    - plugin_type (string) — Chat integration plugin type.\n    - post_mortem_id (string) — ID of the post-mortem the work item is bound to.\n    - progress (string) — Progress note entered at acknowledgement.\n    - reason (string) — Reason why the incident was reopened.\n    - remove_source_incidents (boolean) — True if the source incidents were removed after merging.\n    - removed_assignee_ids (array<integer>) — Member IDs removed from assignees.\n    - reporter_email (string) — Email of the reporter when the incident was created externally.\n    - rid (string) — Notification record ID.\n    - robots (array<object>) — Per-robot delivery records.\n      - alias (string) — Robot alias.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n      - token (string) — Robot token or identifier.\n    - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n    - share_link (string) — Shareable join link for the war room.\n    - snoozedBefore (integer) — Unix timestamp at which the prior snooze was scheduled to end.\n    - source_alerts (array<object>) — Source alerts merged into the target incident. Omitted when empty.\n      - alert_id (string) — Alert ID (ObjectID hex string).\n      - title (string) — Alert title, resolved at read time. Omitted when empty.\n    - source_incidents (array<object>) — Source incidents that were merged.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - source_responders (array<integer>) — Responder member IDs carried over from the source incidents.\n    - status (string) — Work item status label (e.g. `open`, `done`).\n    - target_incident (object) — Brief incident reference embedded in an alert.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - threshold (integer) — Storm threshold that was reached.\n    - title (string) — Initial incident title.\n    - to (array<integer>) — Member IDs that received the assignment.\n    - to_description (string) — Description after the update.\n    - to_priority (string) — Priority label after the update.\n    - to_status (string) — Status label after the update.\n    - to_type (string) — Work item type after the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `to_type` is always `follow_up` in this event, and a successful conversion immediately tries to bind the incident's post-mortem. [action, follow_up]\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n    - work_item_id (string) — Work item ID.\n  - ref_id (string) (required) — ObjectID of the source alert or incident this entry references.\n  - type (string) (required) — Incident timeline entry type. Each value identifies one lifecycle event; the matching `detail` payload shape is determined by this field. Incident types are prefixed with `i_`. | Type | Meaning | |---|---| | `i_new` | Incident Created: A new incident was created automatically or manually. | | `i_assign` | Assigned: Incident was assigned to responders. | | `i_a_rspd` | Responder Added: Additional responders joined the incident. | | `i_notify` | Notification dispatched through a channel at a specific escalation level. | | `i_storm` | Alert storm threshold reached on the incident. | | `i_snooze` | Notifications snoozed for a given duration. | | `i_wake` | Snooze cancelled and notifications resumed. | | `i_ack` | Acknowledged: Responder confirmed they are working on the incident. | | `i_unack` | Acknowledgement removed. | | `i_comm` | Comment: Responder logged progress or key information. | | `i_rslv` | Resolved: Incident was marked as resolved. | | `i_reopen` | Reopened: Resolved incident was reopened, possibly due to recurrence. | | `i_merge` | Merged: Multiple related incidents were merged into one. | | `i_r_title` | Title updated. | | `i_r_desc` | Description updated. | | `i_r_impact` | Impact updated. | | `i_r_rc` | Root cause updated. | | `i_r_rsltn` | Resolution updated. | | `i_r_severity` | Severity Changed: Incident severity level was adjusted. | | `i_r_field` | Custom field value updated. | | `i_m_flapping` | Incident muted by flapping detection. | | `i_m_reply` | Mute reply marker on a comment. | | `i_custom` | Action: Automated action or script was triggered. | | `i_wr_create` | War Room Created: Chat group was created for collaborative response. | | `i_wr_delete` | War room chat group deleted. | | `i_auto_refresh` | Card auto-refresh event posted back to the timeline. | | `i_wi_created` | Work Item Created: An Action or Follow-up was created. | | `i_wi_updated` | Work Item Updated: Title, description, status, or priority was changed. | | `i_wi_assignees` | Work Item Assignees Changed: Assignees were updated. | | `i_wi_completed` | Work Item Completed: An assignee marked the work item complete. | | `i_wi_converted` | Work Item Converted: An Action was converted to a Follow-up. | | `i_wi_bound` | Work Item Bound: A converted Follow-up was bound to a post-mortem. | | `i_wi_deleted` | Work Item Deleted: An Action or Follow-up was soft-deleted. | | `a_merge` | Alert Merged: An alert was merged into an existing incident. | [i_new, i_assign, i_a_rspd, i_notify, i_storm, i_snooze, i_wake, i_ack, i_unack, i_comm, i_rslv, i_reopen, i_merge, i_r_title, i_r_desc, i_r_impact, i_r_rc, i_r_rsltn, i_r_severity, i_r_field, i_m_flapping, i_m_reply, i_custom, i_wr_create, i_wr_delete, i_auto_refresh, i_wi_created, i_wi_updated, i_wi_assignees, i_wi_completed, i_wi_converted, i_wi_bound, i_wi_deleted, a_merge]\n  - updated_at (string) (required) — Last update timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.Info":                            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n        - alt (string) — Alt text.\n        - href (string) — Optional link URL when the image is clicked.\n        - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.List":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.ListByIDs":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.PastList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - score (number) (required) — Similarity score from the vector search.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.PostMortemInfo":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - basics (object) (required) — Basics aggregated automatically from the linked incidents: highest severity, earliest start / latest close time, total duration, and responders.\n    - incidents_earliest_start_seconds (integer) (required) — Earliest start time among linked incidents (seconds).\n    - incidents_highest_severity (string) (required) — Highest severity among linked incidents.\n    - incidents_latest_close_seconds (integer) (required) — Latest close time among linked incidents (seconds).\n    - incidents_total_duration_seconds (integer) (required) — Cumulative duration in seconds.\n    - responders (array<object>) (required) — Responders involved in the incident(s).\n      - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - as (string) — Role label of this responder.\n      - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - email (string) — Member email, filled by the server.\n      - person_id (integer) (required) — Responder member ID.\n      - person_name (string) — Member display name, filled by the server.\n  - content (object) (required) — Post-mortem body; the object holds a single `content` field whose value is a BlockNote JSON string.\n    - content (string) (required) — Report body content (BlockNote JSON).\n  - follow_ups (string) (required) — Follow-up action items rendered as a single string.\n  - meta (object) (required) — Post-mortem metadata (lightweight shape used in lists).\n    - account_id (integer) (required) — Account ID.\n    - author_ids (array<integer>) (required) — Member IDs that contributed to the report.\n    - channel_id (integer) (required) — Owning channel ID. 0 if none.\n    - channel_name (string) (required) — Channel name, filled by the server.\n    - created_at_seconds (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - generation (integer) (required) — Collaboration document generation. Incremented by each full content reset; 0 for legacy documents.\n    - incident_ids (array<string>) (required) — Linked incident IDs.\n    - is_private (boolean) (required) — When true, only team members and admins can view.\n    - media_count (integer) (required) — Number of uploaded media files.\n    - post_mortem_id (string) (required) — Deterministic post-mortem ID derived from account and incident IDs.\n    - revision (integer) (required) — Content revision for optimistic concurrency. Monotonically increases on collaborative saves and full content resets.\n    - status (string) (required) — Post-mortem status. `drafting` means still being edited; `published` means published. [drafting, published]\n    - team_id (integer) (required) — Owning team ID. 0 if none.\n    - template_id (string) (required) — Template used to initialize the report.\n    - title (string) (required) — Report title.\n    - updated_at_seconds (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.PostMortemList":                  "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - author_ids (array<integer>) (required) — Member IDs that contributed to the report.\n  - channel_id (integer) (required) — Owning channel ID. 0 if none.\n  - channel_name (string) (required) — Channel name, filled by the server.\n  - created_at_seconds (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - generation (integer) (required) — Collaboration document generation. Incremented by each full content reset; 0 for legacy documents.\n  - incident_ids (array<string>) (required) — Linked incident IDs.\n  - is_private (boolean) (required) — When true, only team members and admins can view.\n  - media_count (integer) (required) — Number of uploaded media files.\n  - post_mortem_id (string) (required) — Deterministic post-mortem ID derived from account and incident IDs.\n  - revision (integer) (required) — Content revision for optimistic concurrency. Monotonically increases on collaborative saves and full content resets.\n  - status (string) (required) — Post-mortem status. `drafting` means still being edited; `published` means published. [drafting, published]\n  - team_id (integer) (required) — Owning team ID. 0 if none.\n  - template_id (string) (required) — Template used to initialize the report.\n  - title (string) (required) — Report title.\n  - updated_at_seconds (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.PostMortemWriteResetContent":     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - generation (integer) (required) — New collaboration document generation after the reset.\n  - markdown_bytes (integer) (required) — UTF-8 byte length of the accepted Markdown content.\n  - markdown_sha256 (string) (required) — SHA-256 hex digest of the accepted Markdown content.\n  - post_mortem_id (string) (required) — ID of the reset post-mortem report.\n  - previous_generation (integer) (required) — Collaboration document generation before the reset.\n  - previous_revision (integer) (required) — Content revision before the reset.\n  - revision (integer) (required) — New content revision after the reset.\n",
-	"Incidents.PostmortemReadListTemplates":     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the template. 0 for built-in templates.\n  - content (string) (required) — BlockNote JSON content used to initialize the report body.\n  - content_markdown (string) (required) — Markdown version of the template content, used by AI generation.\n  - created_at_seconds (string) (required) — Unix timestamp in seconds when the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Template description.\n  - name (string) (required) — Template name shown in the console.\n  - team_id (integer) (required) — Managing team ID. Built-in templates use 0.\n  - template_id (string) (required) — Template ID. Built-in templates use a stable `post_mortem_default_tmpl_*` ID.\n  - updated_at_seconds (string) (required) — Unix timestamp in seconds when the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.PostmortemReadTemplateInfo":      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns the template. 0 for built-in templates.\n  - content (string) (required) — BlockNote JSON content used to initialize the report body.\n  - content_markdown (string) (required) — Markdown version of the template content, used by AI generation.\n  - created_at_seconds (string) (required) — Unix timestamp in seconds when the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Template description.\n  - name (string) (required) — Template name shown in the console.\n  - team_id (integer) (required) — Managing team ID. Built-in templates use 0.\n  - template_id (string) (required) — Template ID. Built-in templates use a stable `post_mortem_default_tmpl_*` ID.\n  - updated_at_seconds (string) (required) — Unix timestamp in seconds when the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.PostmortemWriteInit":             "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - basics (object) (required) — Basics aggregated automatically from the linked incidents: highest severity, earliest start / latest close time, total duration, and responders.\n    - incidents_earliest_start_seconds (integer) (required) — Earliest start time among linked incidents (seconds).\n    - incidents_highest_severity (string) (required) — Highest severity among linked incidents.\n    - incidents_latest_close_seconds (integer) (required) — Latest close time among linked incidents (seconds).\n    - incidents_total_duration_seconds (integer) (required) — Cumulative duration in seconds.\n    - responders (array<object>) (required) — Responders involved in the incident(s).\n      - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - as (string) — Role label of this responder.\n      - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - email (string) — Member email, filled by the server.\n      - person_id (integer) (required) — Responder member ID.\n      - person_name (string) — Member display name, filled by the server.\n  - content (object) (required) — Post-mortem body; the object holds a single `content` field whose value is a BlockNote JSON string.\n    - content (string) (required) — Report body content (BlockNote JSON).\n  - follow_ups (string) (required) — Follow-up action items rendered as a single string.\n  - meta (object) (required) — Post-mortem metadata (lightweight shape used in lists).\n    - account_id (integer) (required) — Account ID.\n    - author_ids (array<integer>) (required) — Member IDs that contributed to the report.\n    - channel_id (integer) (required) — Owning channel ID. 0 if none.\n    - channel_name (string) (required) — Channel name, filled by the server.\n    - created_at_seconds (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - generation (integer) (required) — Collaboration document generation. Incremented by each full content reset; 0 for legacy documents.\n    - incident_ids (array<string>) (required) — Linked incident IDs.\n    - is_private (boolean) (required) — When true, only team members and admins can view.\n    - media_count (integer) (required) — Number of uploaded media files.\n    - post_mortem_id (string) (required) — Deterministic post-mortem ID derived from account and incident IDs.\n    - revision (integer) (required) — Content revision for optimistic concurrency. Monotonically increases on collaborative saves and full content resets.\n    - status (string) (required) — Post-mortem status. `drafting` means still being edited; `published` means published. [drafting, published]\n    - team_id (integer) (required) — Owning team ID. 0 if none.\n    - template_id (string) (required) — Template used to initialize the report.\n    - title (string) (required) — Report title.\n    - updated_at_seconds (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.PostmortemWriteUpsertTemplate":   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns the template. 0 for built-in templates.\n  - content (string) (required) — BlockNote JSON content used to initialize the report body.\n  - content_markdown (string) (required) — Markdown version of the template content, used by AI generation.\n  - created_at_seconds (string) (required) — Unix timestamp in seconds when the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Template description.\n  - name (string) (required) — Template name shown in the console.\n  - team_id (integer) (required) — Managing team ID. Built-in templates use 0.\n  - template_id (string) (required) — Template ID. Built-in templates use a stable `post_mortem_default_tmpl_*` ID.\n  - updated_at_seconds (string) (required) — Unix timestamp in seconds when the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Incidents.ReadGetWarRoomDefaultObservers":  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - observers (array<object>) — Historical responders suggested as default war-room observers.\n    - account_id (integer) (required) — Account this person belongs to.\n    - as (string) — Role the person holds in the related context.\n    - avatar (string) — URL of the person's avatar image.\n    - email (string) — Email address of the person.\n    - locale (string) — Preferred language locale of the person.\n    - person_id (integer) (required) — Person ID.\n    - person_name (string) — Display name of the person.\n    - phone (string) — Phone number of the person.\n    - status (string) — Current status of the person.\n    - time_zone (string) — Time zone of the person.\n",
-	"Incidents.ServiceDeskPlusRequestReadList":  "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - channel_id (integer) (required) — Channel ID for the incident.\n  - channel_name (string) (required) — Channel name for the incident.\n  - created_at (string) (required) — Mapping record creation time, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error_message (string) — Error message when synchronization failed. Usually absent on successful records.\n  - incident_id (string) (required) — Associated Flashduty incident ID.\n  - incident_title (string) (required) — Associated incident title.\n  - integration_id (integer) (required) — ServiceDeskPlus integration ID.\n  - request_id (string) (required) — ServiceDeskPlus request ID.\n  - request_link (string) (required) — ServiceDeskPlus request detail URL.\n  - status (string) (required) — Synchronization status. [success, failed]\n",
-	"Incidents.WarRoomCreate":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - chat_name (string) (required) — Chat/group display name.\n  - share_link (string) (required) — Join link for the war room, if provided by the IM.\n",
-	"Incidents.WarRoomDetail":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - chat_name (string) (required) — Chat/group display name.\n  - share_link (string) (required) — Join link for the war room, if provided by the IM.\n",
-	"Incidents.WarRoomList":                     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the war room.\n  - incident_id (string) (required) — Associated incident ID (MongoDB ObjectID).\n  - integration_id (integer) (required) — IM integration ID.\n  - plugin_type (string) (required) — IM plugin type (e.g. `feishu`, `dingtalk`, `wecom`, `slack`).\n  - status (string) (required) — War room record status: `enabled` active, `deleted` disbanded. [enabled, deleted]\n",
-	"Incidents.WorkItemBindPostMortem":          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n  - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n  - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID of the creator.\n  - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n  - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n  - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n  - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n  - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n  - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n  - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n  - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n  - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last updater.\n  - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n  - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n",
-	"Incidents.WorkItemComplete":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
-	"Incidents.WorkItemConvert":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
-	"Incidents.WorkItemCreate":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key and no new item was created.\n  - item (object) (required) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n",
-	"Incidents.WorkItemDelete":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
-	"Incidents.WorkItemList":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n  - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n  - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID of the creator.\n  - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n  - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n  - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n  - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n  - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n  - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n  - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n  - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n  - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last updater.\n  - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n  - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n",
-	"Incidents.WorkItemResetAssignees":          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
-	"Incidents.WorkItemUpdate":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
-	"Integrations.DatasourceImPersonTryLink":    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - new_linked_person_ids (array<integer>) (required) — Person IDs newly linked during this call.\n",
-	"Integrations.Detail":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - attempt (integer) (required) — Attempt sequence number.\n  - channel_id (integer) — Channel ID when applicable.\n  - channel_name (string) — Name of the associated channel, resolved at query time.\n  - duration (integer) (required) — Total elapsed time of the attempt in milliseconds.\n  - endpoint (string) (required) — Destination URL.\n  - error_message (string) — Error message when delivery failed.\n  - event_id (string) (required) — Event ID.\n  - event_time (string) (required) — Event time formatted as `YYYY-MM-DD HH:MM:SS.ffffff`.\n  - event_type (string) (required) — Event type code. `i_*` values are incident events (for example `i_new` = incident created); `a_*` values are alert events (for example `a_new` = alert triggered).\n  - integration_id (integer) (required) — Integration ID.\n  - ref_id (string) — Source object ID.\n  - ref_title (string) — Title of the source incident or alert, resolved at query time.\n  - request_body (string) — Outbound request body payload.\n  - request_headers (string) — Serialized outbound request headers.\n  - response_body (string) — Response body.\n  - response_headers (string) — Serialized response headers.\n  - status (string) (required) — Delivery outcome. [success, failed]\n  - status_code (integer) (required) — HTTP status code.\n  - webhook_type (string) (required) — Source object kind: `incident` or `alert`. [incident, alert]\n",
-	"Integrations.List":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - attempt (integer) (required) — Attempt sequence number.\n  - channel_id (integer) — Channel ID associated with the event, when applicable.\n  - duration (integer) (required) — Total elapsed time of the attempt in milliseconds.\n  - endpoint (string) (required) — Destination URL.\n  - error_message (string) — Error message when delivery failed.\n  - event_id (string) (required) — Unique event identifier for the delivery attempt.\n  - event_time (string) (required) — Event time formatted as `YYYY-MM-DD HH:MM:SS.ffffff`.\n  - event_type (string) (required) — Event type code. `i_*` values are incident events (for example `i_new` = incident created); `a_*` values are alert events (for example `a_new` = alert triggered).\n  - integration_id (integer) (required) — Integration ID that triggered the webhook.\n  - ref_id (string) — Source object ID (incident ID or alert ID).\n  - request_body (string) — Outbound request body payload.\n  - request_headers (string) — Serialized outbound request headers.\n  - response_body (string) — Response body returned by the destination.\n  - response_headers (string) — Serialized response headers from the destination.\n  - status (string) (required) — Delivery outcome. [success, failed]\n  - status_code (integer) (required) — HTTP status code returned by the destination.\n  - webhook_type (string) (required) — Source object kind: `incident` or `alert`. [incident, alert]\n",
-	"IssuePresetSeverityRules.Create":           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - priority (integer) (required) — Evaluation order assigned to the new rule (always the current lowest precedence, i.e. current max + 1).\n  - rule_id (string) (required) — ID of the newly created rule.\n  - rule_name (string) (required) — Echo of the rule's display name.\n",
-	"IssuePresetSeverityRules.HistoryList":      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - rules (array<object>) (required) — Full rule set captured immediately before the mutation that produced this snapshot. Empty for the very first snapshot.\n    - account_id (integer) (required) — Account ID the rule belongs to.\n    - application_id (string) (required) — RUM application ID the rule belongs to.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the rule was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID who originally created the rule.\n    - deleted_at (string) (required) — Unix timestamp in milliseconds the rule was soft-deleted; `0` means not deleted. Always `0` in practice, since deleted rules are excluded before a snapshot is taken. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Rule description. May be empty.\n    - filters (array<array<object>>) (required) — OR-of-ANDs filter structure: the outer array is OR'd, each inner array is AND'd. A rule matches an error when at least one inner AND-group fully matches.\n      - key (string) (required) — Filter attribute key. Only these Error-level attributes are supported for preset severity rules. | Value | Meaning | |---|---| | `error.usr_id` | User ID | | `error.usr_email` | User email | | `error.view_url` | Full URL of the page where the error occurred | | `error.view_url_path` | URL path of the page where the error occurred | | `error.error_type` | Error type | | `error.error_message` | Error message | | `error.env` | Environment (e.g. production/staging) | | `error.service` | Service name | | `error.device_type` | Device type | | `error.os_name` | Operating system name | | `error.browser_name` | Browser name | | `error.is_crash` | Whether the error is a crash (boolean) | [error.usr_id, error.usr_email, error.view_url, error.view_url_path, error.error_type, error.error_message, error.env, error.service, error.device_type, error.os_name, error.browser_name, error.is_crash]\n      - oper (string) (required) — Match semantics: `IN` matches when the field's value matches any of `vals`; `NOTIN` matches when it matches none of them (and matches when the field is absent). [IN, NOTIN]\n      - vals (array<string>) (required) — Values to match against. Each entry supports exact string match, wildcard (`*`/`?`), regex (wrap in `/.../`), CIDR (`cidr:10.0.0.0/8`) for IP-shaped values, or numeric comparison (`num:gt:100`, `num:le:50`, etc.).\n    - id (integer) (required) — Internal auto-increment row ID. Not stable across a history revert — reverting reinserts rows with new IDs.\n    - priority (integer) (required) — Evaluation order at snapshot time; `1` is highest precedence.\n    - rule_id (string) (required) — Unique rule ID.\n    - rule_name (string) (required) — Rule display name.\n    - severity (string) (required) — Severity assigned to errors matching this rule. [Critical, Warning, Info]\n    - status (string) (required) — Rule status at snapshot time. [enabled, disabled]\n    - updated_at (string) (required) — Unix timestamp in milliseconds when the rule was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID who last updated the rule as of snapshot time.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the snapshot was written. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID who triggered the mutation this snapshot precedes.\n  - updated_by_name (string) (required) — Display name of `updated_by` at the time of the change.\n  - version (integer) (required) — Monotonically increasing snapshot version number, starting at 1.\n",
-	"IssuePresetSeverityRules.List":             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Unix timestamp in milliseconds when the rule was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description. May be empty.\n  - filters (array<array<object>>) (required) — OR-of-ANDs filter structure: the outer array is OR'd, each inner array is AND'd. A rule matches an error when at least one inner AND-group fully matches.\n    - key (string) (required) — Filter attribute key. Only these Error-level attributes are supported for preset severity rules. | Value | Meaning | |---|---| | `error.usr_id` | User ID | | `error.usr_email` | User email | | `error.view_url` | Full URL of the page where the error occurred | | `error.view_url_path` | URL path of the page where the error occurred | | `error.error_type` | Error type | | `error.error_message` | Error message | | `error.env` | Environment (e.g. production/staging) | | `error.service` | Service name | | `error.device_type` | Device type | | `error.os_name` | Operating system name | | `error.browser_name` | Browser name | | `error.is_crash` | Whether the error is a crash (boolean) | [error.usr_id, error.usr_email, error.view_url, error.view_url_path, error.error_type, error.error_message, error.env, error.service, error.device_type, error.os_name, error.browser_name, error.is_crash]\n    - oper (string) (required) — Match semantics: `IN` matches when the field's value matches any of `vals`; `NOTIN` matches when it matches none of them (and matches when the field is absent). [IN, NOTIN]\n    - vals (array<string>) (required) — Values to match against. Each entry supports exact string match, wildcard (`*`/`?`), regex (wrap in `/.../`), CIDR (`cidr:10.0.0.0/8`) for IP-shaped values, or numeric comparison (`num:gt:100`, `num:le:50`, etc.).\n  - priority (integer) (required) — Evaluation order among the application's rules. `1` is evaluated first (highest precedence); the first enabled rule whose filters match wins.\n  - rule_id (string) (required) — Unique rule ID.\n  - rule_name (string) (required) — Rule display name.\n  - severity (string) (required) — Severity assigned to errors matching this rule. [Critical, Warning, Info]\n  - status (string) (required) — Only enabled rules are evaluated against incoming errors. [enabled, disabled]\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the rule was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Issues.ReadInfo":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - age (integer) — Time span between the first and most recent occurrence, in seconds.\n  - application_id (string) — ID of the RUM application this issue belongs to.\n  - application_name (string) — Name of the owning application, resolved by `application_id` at query time (reflects the application's current name).\n  - created_at (string) — Issue creation time (client time of the first error event), Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error (object) — Representative error of this issue, taken from the error event that created it.\n    - message (string) — Normalized error message, truncated to at most 512 characters.\n    - type (string) — Error type, from the error event's `error_type` field as reported by the SDK.\n  - error_count (integer) — Total error occurrences.\n  - first_seen (object) — Information about the issue's first occurrence (time and application version).\n    - timestamp (string) — Client time of the first error event, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (string) — Application version at first occurrence; empty string when the event carries no version.\n  - is_crash (boolean) — Whether the error caused an app crash.\n  - issue_id (string) — Unique issue ID.\n  - last_seen (object) — Information about the issue's most recent occurrence (time and application version).\n    - timestamp (string) — Client time of the most recent error event, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (string) — Application version at the most recent occurrence; empty string when the event carries no version.\n  - regression (object) — Regression metadata. Present only when a previously resolved issue re-occurred.\n    - regressed_at (string) — Time the regression was detected, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - regressed_at_version (string) — Application version in which the regression was observed.\n    - resolved_at (string) — When the issue was resolved before this regression, as a Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - resolved_at (string) — Time the issue was marked resolved, Unix timestamp in milliseconds; 0 while unresolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - resolved_by (integer) — Person ID of the user who marked the issue resolved; 0 while unresolved.\n  - service (string) — Name of the service that produced this issue, taken from the error event's `service` field.\n  - session_count (integer) — Affected user sessions.\n  - severity (string) — Issue severity: `Critical`, `Warning`, or `Info`. Empty string on legacy issues created before severity existed. [Critical, Warning, Info]\n  - status (string) — Triage status of the issue; soft-deleted (`deleted`) issues are never returned. | Value | Meaning | |---|---| | `for_review` | Pending triage | | `reviewed` | Reviewed | | `ignored` | Ignored | | `resolved` | Resolved | [for_review, reviewed, ignored, resolved]\n  - suspected_cause (object) — Suspected root cause analysis, determined automatically (rules or AI) or set manually by a user.\n    - person_id (integer) — Person ID of the user who manually set the cause; 0 when `source` is `auto`.\n    - reason (string) — Explanation for the cause determination, generated only by AI analysis; empty string when AI is disabled or analysis has not run.\n    - source (string) — Origin of the cause: `auto` for system-determined, `user` for manually set. [auto, user]\n    - value (string) — Suspected cause category. One of: | Value | Meaning | |---|---| | `api.failed_request` | API request failure (e.g. HTTP 4xx/5xx responses) | | `network.error` | Network connectivity error (offline, aborted requests, etc.) | | `code.exception` | Code exception (Syntax/Reference/Range and similar runtime errors) | | `code.invalid_object_access` | Invalid object access (e.g. reading a property of `undefined`/`null`) | | `code.invalid_argument` | Invalid argument passed to a function | | `unknown` | Cause could not be determined | [api.failed_request, network.error, code.exception, code.invalid_object_access, code.invalid_argument, unknown]\n  - team_id (integer) — ID of the team owning this issue, copied from the owning application's `team_id` at issue creation.\n  - updated_at (string) — Time the issue was last updated, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - versions (array<string>) — Deduplicated list of application versions in which this issue has occurred; may contain an empty string for events without version info.\n",
-	"Issues.ReadList":                           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - age (integer) — Time span between the first and most recent occurrence, in seconds.\n  - application_id (string) — ID of the RUM application this issue belongs to.\n  - application_name (string) — Name of the owning application, resolved by `application_id` at query time (reflects the application's current name).\n  - created_at (string) — Issue creation time (client time of the first error event), Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error (object) — Representative error of this issue, taken from the error event that created it.\n    - message (string) — Normalized error message, truncated to at most 512 characters.\n    - type (string) — Error type, from the error event's `error_type` field as reported by the SDK.\n  - error_count (integer) — Total error occurrences.\n  - first_seen (object) — Information about the issue's first occurrence (time and application version).\n    - timestamp (string) — Client time of the first error event, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (string) — Application version at first occurrence; empty string when the event carries no version.\n  - is_crash (boolean) — Whether the error caused an app crash.\n  - issue_id (string) — Unique issue ID.\n  - last_seen (object) — Information about the issue's most recent occurrence (time and application version).\n    - timestamp (string) — Client time of the most recent error event, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (string) — Application version at the most recent occurrence; empty string when the event carries no version.\n  - regression (object) — Regression metadata. Present only when a previously resolved issue re-occurred.\n    - regressed_at (string) — Time the regression was detected, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - regressed_at_version (string) — Application version in which the regression was observed.\n    - resolved_at (string) — When the issue was resolved before this regression, as a Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - resolved_at (string) — Time the issue was marked resolved, Unix timestamp in milliseconds; 0 while unresolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - resolved_by (integer) — Person ID of the user who marked the issue resolved; 0 while unresolved.\n  - service (string) — Name of the service that produced this issue, taken from the error event's `service` field.\n  - session_count (integer) — Affected user sessions.\n  - severity (string) — Issue severity: `Critical`, `Warning`, or `Info`. Empty string on legacy issues created before severity existed. [Critical, Warning, Info]\n  - status (string) — Triage status of the issue; soft-deleted (`deleted`) issues are never returned. | Value | Meaning | |---|---| | `for_review` | Pending triage | | `reviewed` | Reviewed | | `ignored` | Ignored | | `resolved` | Resolved | [for_review, reviewed, ignored, resolved]\n  - suspected_cause (object) — Suspected root cause analysis, determined automatically (rules or AI) or set manually by a user.\n    - person_id (integer) — Person ID of the user who manually set the cause; 0 when `source` is `auto`.\n    - reason (string) — Explanation for the cause determination, generated only by AI analysis; empty string when AI is disabled or analysis has not run.\n    - source (string) — Origin of the cause: `auto` for system-determined, `user` for manually set. [auto, user]\n    - value (string) — Suspected cause category. One of: | Value | Meaning | |---|---| | `api.failed_request` | API request failure (e.g. HTTP 4xx/5xx responses) | | `network.error` | Network connectivity error (offline, aborted requests, etc.) | | `code.exception` | Code exception (Syntax/Reference/Range and similar runtime errors) | | `code.invalid_object_access` | Invalid object access (e.g. reading a property of `undefined`/`null`) | | `code.invalid_argument` | Invalid argument passed to a function | | `unknown` | Cause could not be determined | [api.failed_request, network.error, code.exception, code.invalid_object_access, code.invalid_argument, unknown]\n  - team_id (integer) — ID of the team owning this issue, copied from the owning application's `team_id` at issue creation.\n  - updated_at (string) — Time the issue was last updated, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - versions (array<string>) — Deduplicated list of application versions in which this issue has occurred; may contain an empty string for events without version info.\n",
-	"Knowledge.FileReadGet":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - content_b64 (string) (required) — Base64-encoded file content; decodes to UTF-8 text.\n  - file (object) (required) — Metadata of one file inside a knowledge pack. Content is fetched separately via file/get.\n    - checksum (string) (required) — SHA-256 hex digest of the file content.\n    - content_type (string) (required) — MIME type; inferred from the file extension when not set on upload.\n    - file_id (string) (required) — File ID (`kfl_` prefix).\n    - pack_id (string) (required) — ID of the knowledge pack that contains the file.\n    - rel_path (string) (required) — Path relative to the pack root, e.g. `runbooks/restart.md`.\n    - size_bytes (integer) (required) — File size in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the file was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Person ID of the member who last modified the file.\n",
-	"Knowledge.FileReadList":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - files (array<object>) (required) — Array of files in the specified knowledge pack; empty array when the pack has no files.\n    - checksum (string) (required) — SHA-256 hex digest of the file content.\n    - content_type (string) (required) — MIME type; inferred from the file extension when not set on upload.\n    - file_id (string) (required) — File ID (`kfl_` prefix).\n    - pack_id (string) (required) — ID of the knowledge pack that contains the file.\n    - rel_path (string) (required) — Path relative to the pack root, e.g. `runbooks/restart.md`.\n    - size_bytes (integer) (required) — File size in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the file was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Person ID of the member who last modified the file.\n  - total (integer) (required) — Total number of files in the pack.\n",
-	"Knowledge.FileWriteDelete":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - warnings (array<object>) — Non-blocking warnings after deletion; `code=still_referenced_by` means the (force-)deleted file is still @ref-referenced by other files in the pack (`refs` lists the referrers). Absent when there are no warnings (omitempty).\n    - code (string) (required) — Warning code. One of: `unresolved_reference` (an @ref in the written file's content points to a file that does not exist in the pack; `ref` carries it), `still_referenced_by` (the deleted file is still @ref-referenced by other files in the pack; `refs` lists the referrers). [unresolved_reference, still_referenced_by]\n    - ref (string) — Single reference related to the warning.\n    - refs (array<string>) — Multiple references related to the warning.\n",
-	"Knowledge.FileWritePut":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - file (object) (required) — Metadata of one file inside a knowledge pack. Content is fetched separately via file/get.\n    - checksum (string) (required) — SHA-256 hex digest of the file content.\n    - content_type (string) (required) — MIME type; inferred from the file extension when not set on upload.\n    - file_id (string) (required) — File ID (`kfl_` prefix).\n    - pack_id (string) (required) — ID of the knowledge pack that contains the file.\n    - rel_path (string) (required) — Path relative to the pack root, e.g. `runbooks/restart.md`.\n    - size_bytes (integer) (required) — File size in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the file was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Person ID of the member who last modified the file.\n  - warnings (array<object>) — Non-blocking warnings after a successful write; `code=unresolved_reference` means an @ref in the file content points to a file that does not exist in the pack. Absent when there are no warnings (omitempty).\n    - code (string) (required) — Warning code. One of: `unresolved_reference` (an @ref in the written file's content points to a file that does not exist in the pack; `ref` carries it), `still_referenced_by` (the deleted file is still @ref-referenced by other files in the pack; `refs` lists the referrers). [unresolved_reference, still_referenced_by]\n    - ref (string) — Single reference related to the warning.\n    - refs (array<string>) — Multiple references related to the warning.\n",
-	"Knowledge.PackReadGet":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - files (array<object>) (required) — Array of files in this knowledge pack; empty array when the pack has no files.\n    - checksum (string) (required) — SHA-256 hex digest of the file content.\n    - content_type (string) (required) — MIME type; inferred from the file extension when not set on upload.\n    - file_id (string) (required) — File ID (`kfl_` prefix).\n    - pack_id (string) (required) — ID of the knowledge pack that contains the file.\n    - rel_path (string) (required) — Path relative to the pack root, e.g. `runbooks/restart.md`.\n    - size_bytes (integer) (required) — File size in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the file was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Person ID of the member who last modified the file.\n  - pack (object) (required) — A knowledge pack — a versioned file tree staged into every AI SRE sandbox at session start. One pack exists per (account, scope, scope_id).\n    - account_id (integer) (required) — Account that owns the pack.\n    - can_edit (boolean) (required) — Whether the caller can edit this pack.\n    - created_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Person ID of the member who created the pack.\n    - duty_version (integer) (required) — Pack version at which DUTY.md was last authored or re-affirmed. When `version` is greater, DUTY.md no longer reflects every file in the pack.\n    - file_count (integer) (required) — Number of files in the pack.\n    - pack_id (string) (required) — Knowledge pack ID (`kpk_` prefix).\n    - scope (string) (required) — Pack scope. `channel` is a legacy scope; new packs are `account` or `team`. [account, team, channel]\n    - scope_id (integer) (required) — Scope owner: the account ID for `account` scope, the team ID for `team` scope.\n    - team_name (string) — Display name of the owning team (team scope only). Omitted when empty (account scope, or the team name could not be resolved).\n    - total_bytes (integer) (required) — Total size of all files in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (integer) (required) — Pack version, incremented on every file change.\n",
-	"Knowledge.PackReadList":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - packs (array<object>) (required) — Array of visible knowledge packs after filtering (current page), used with `total` for pagination.\n    - account_id (integer) (required) — Account that owns the pack.\n    - can_edit (boolean) (required) — Whether the caller can edit this pack.\n    - created_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Person ID of the member who created the pack.\n    - duty_version (integer) (required) — Pack version at which DUTY.md was last authored or re-affirmed. When `version` is greater, DUTY.md no longer reflects every file in the pack.\n    - file_count (integer) (required) — Number of files in the pack.\n    - pack_id (string) (required) — Knowledge pack ID (`kpk_` prefix).\n    - scope (string) (required) — Pack scope. `channel` is a legacy scope; new packs are `account` or `team`. [account, team, channel]\n    - scope_id (integer) (required) — Scope owner: the account ID for `account` scope, the team ID for `team` scope.\n    - team_name (string) — Display name of the owning team (team scope only). Omitted when empty (account scope, or the team name could not be resolved).\n    - total_bytes (integer) (required) — Total size of all files in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (integer) (required) — Pack version, incremented on every file change.\n  - total (integer) (required) — Total number of packs after filtering, before pagination.\n",
-	"Knowledge.PackWriteDelete":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - ok (boolean) (required) — True when the pack was deleted.\n",
-	"Knowledge.PackWriteEnsure":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account that owns the pack.\n  - can_edit (boolean) (required) — Whether the caller can edit this pack.\n  - created_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Person ID of the member who created the pack.\n  - duty_version (integer) (required) — Pack version at which DUTY.md was last authored or re-affirmed. When `version` is greater, DUTY.md no longer reflects every file in the pack.\n  - file_count (integer) (required) — Number of files in the pack.\n  - pack_id (string) (required) — Knowledge pack ID (`kpk_` prefix).\n  - scope (string) (required) — Pack scope. `channel` is a legacy scope; new packs are `account` or `team`. [account, team, channel]\n  - scope_id (integer) (required) — Scope owner: the account ID for `account` scope, the team ID for `team` scope.\n  - team_name (string) — Display name of the owning team (team scope only). Omitted when empty (account scope, or the team name could not be resolved).\n  - total_bytes (integer) (required) — Total size of all files in bytes.\n  - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (integer) (required) — Pack version, incremented on every file change.\n",
-	"Knowledge.PackWriteUpdate":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account that owns the pack.\n  - can_edit (boolean) (required) — Whether the caller can edit this pack.\n  - created_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Person ID of the member who created the pack.\n  - duty_version (integer) (required) — Pack version at which DUTY.md was last authored or re-affirmed. When `version` is greater, DUTY.md no longer reflects every file in the pack.\n  - file_count (integer) (required) — Number of files in the pack.\n  - pack_id (string) (required) — Knowledge pack ID (`kpk_` prefix).\n  - scope (string) (required) — Pack scope. `channel` is a legacy scope; new packs are `account` or `team`. [account, team, channel]\n  - scope_id (integer) (required) — Scope owner: the account ID for `account` scope, the team ID for `team` scope.\n  - team_name (string) — Display name of the owning team (team scope only). Omitted when empty (account scope, or the team name could not be resolved).\n  - total_bytes (integer) (required) — Total size of all files in bytes.\n  - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (integer) (required) — Pack version, incremented on every file change.\n",
-	"Licenses.List":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Unix timestamp when a fixed license was assigned. `0` for temporary licenses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - person_id (integer) (required) — ID of the licensed person.\n  - person_name (string) (required) — Display name of the licensed person.\n  - type (string) (required) — License assignment type. `fixed` is explicitly assigned; `temporary` is held from the active license window. [fixed, temporary]\n  - updated_at (string) (required) — Unix timestamp when a fixed license was last changed. `0` for temporary licenses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Person ID that last changed a fixed license. `0` for temporary licenses.\n",
-	"McpServers.ReadServerGet":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - ai_description (string) — LLM-generated description, preferred over `description` when present. Omitted when not yet generated.\n  - allow_insecure_oauth_http (boolean) — Allow this server's OAuth token exchange over plaintext HTTP; testing use only. Omitted when false.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this server; testing use only. Omitted when false.\n  - args (array<string>) — Command arguments (stdio transport).\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - call_timeout (integer) (required) — Tool-call timeout in seconds (0 = server default, 60s).\n  - can_edit (boolean) (required) — Whether the caller may edit this server.\n  - command (string) — Executable command (stdio transport only).\n  - connect_timeout (integer) (required) — Connection timeout in seconds (0 = server default, 10s).\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the server.\n  - description (string) (required) — Server description.\n  - env (object) — Environment variables (stdio transport). Secret values are masked.\n  - environments (array<string>) (required) — Execution environments this server is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - headers (object) — HTTP headers (sse / streamable-http). Secret values are masked.\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - proxy_url (string) — Outbound proxy URL used to reach the server.\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - server_id (string) (required) — Unique MCP server ID (prefix `mcp_`).\n  - server_name (string) (required) — MCP server name, unique within its scope (account-wide or one team), case-insensitive.\n  - source_template_name (string) — Marketplace template this connector was installed from; empty for user-authored.\n  - status (string) (required) — Server status. [enabled, disabled]\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - transport (string) (required) — Transport protocol. One of: `stdio` (standard I/O to a local subprocess), `sse` (standalone SSE, the legacy MCP transport), `streamable-http` (the newer HTTP streaming transport). [stdio, sse, streamable-http]\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - url (string) — Server URL (sse / streamable-http transport).\n",
-	"McpServers.ReadServerList":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - servers (array<object>) (required) — MCP servers on this page.\n    - account_id (integer) (required) — Owning account ID.\n    - ai_description (string) — LLM-generated description, preferred over `description` when present. Omitted when not yet generated.\n    - allow_insecure_oauth_http (boolean) — Allow this server's OAuth token exchange over plaintext HTTP; testing use only. Omitted when false.\n    - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this server; testing use only. Omitted when false.\n    - args (array<string>) — Command arguments (stdio transport).\n    - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n    - call_timeout (integer) (required) — Tool-call timeout in seconds (0 = server default, 60s).\n    - can_edit (boolean) (required) — Whether the caller may edit this server.\n    - command (string) — Executable command (stdio transport only).\n    - connect_timeout (integer) (required) — Connection timeout in seconds (0 = server default, 10s).\n    - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID that created the server.\n    - description (string) (required) — Server description.\n    - env (object) — Environment variables (stdio transport). Secret values are masked.\n    - environments (array<string>) (required) — Execution environments this server is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n    - headers (object) — HTTP headers (sse / streamable-http). Secret values are masked.\n    - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n    - proxy_url (string) — Outbound proxy URL used to reach the server.\n    - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n    - server_id (string) (required) — Unique MCP server ID (prefix `mcp_`).\n    - server_name (string) (required) — MCP server name, unique within its scope (account-wide or one team), case-insensitive.\n    - source_template_name (string) — Marketplace template this connector was installed from; empty for user-authored.\n    - status (string) (required) — Server status. [enabled, disabled]\n    - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n    - transport (string) (required) — Transport protocol. One of: `stdio` (standard I/O to a local subprocess), `sse` (standalone SSE, the legacy MCP transport), `streamable-http` (the newer HTTP streaming transport). [stdio, sse, streamable-http]\n    - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - url (string) — Server URL (sse / streamable-http transport).\n  - total (integer) (required) — Total number of matching servers.\n",
-	"McpServers.WriteServerCreate":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - ai_description (string) — LLM-generated description, preferred over `description` when present. Omitted when not yet generated.\n  - allow_insecure_oauth_http (boolean) — Allow this server's OAuth token exchange over plaintext HTTP; testing use only. Omitted when false.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this server; testing use only. Omitted when false.\n  - args (array<string>) — Command arguments (stdio transport).\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - call_timeout (integer) (required) — Tool-call timeout in seconds (0 = server default, 60s).\n  - can_edit (boolean) (required) — Whether the caller may edit this server.\n  - command (string) — Executable command (stdio transport only).\n  - connect_timeout (integer) (required) — Connection timeout in seconds (0 = server default, 10s).\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the server.\n  - description (string) (required) — Server description.\n  - env (object) — Environment variables (stdio transport). Secret values are masked.\n  - environments (array<string>) (required) — Execution environments this server is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - headers (object) — HTTP headers (sse / streamable-http). Secret values are masked.\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - proxy_url (string) — Outbound proxy URL used to reach the server.\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - server_id (string) (required) — Unique MCP server ID (prefix `mcp_`).\n  - server_name (string) (required) — MCP server name, unique within its scope (account-wide or one team), case-insensitive.\n  - source_template_name (string) — Marketplace template this connector was installed from; empty for user-authored.\n  - status (string) (required) — Server status. [enabled, disabled]\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - transport (string) (required) — Transport protocol. One of: `stdio` (standard I/O to a local subprocess), `sse` (standalone SSE, the legacy MCP transport), `streamable-http` (the newer HTTP streaming transport). [stdio, sse, streamable-http]\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - url (string) — Server URL (sse / streamable-http transport).\n",
-	"McpServers.WriteServerUpdate":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - ai_description (string) — LLM-generated description, preferred over `description` when present. Omitted when not yet generated.\n  - allow_insecure_oauth_http (boolean) — Allow this server's OAuth token exchange over plaintext HTTP; testing use only. Omitted when false.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this server; testing use only. Omitted when false.\n  - args (array<string>) — Command arguments (stdio transport).\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - call_timeout (integer) (required) — Tool-call timeout in seconds (0 = server default, 60s).\n  - can_edit (boolean) (required) — Whether the caller may edit this server.\n  - command (string) — Executable command (stdio transport only).\n  - connect_timeout (integer) (required) — Connection timeout in seconds (0 = server default, 10s).\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the server.\n  - description (string) (required) — Server description.\n  - env (object) — Environment variables (stdio transport). Secret values are masked.\n  - environments (array<string>) (required) — Execution environments this server is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - headers (object) — HTTP headers (sse / streamable-http). Secret values are masked.\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - proxy_url (string) — Outbound proxy URL used to reach the server.\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - server_id (string) (required) — Unique MCP server ID (prefix `mcp_`).\n  - server_name (string) (required) — MCP server name, unique within its scope (account-wide or one team), case-insensitive.\n  - source_template_name (string) — Marketplace template this connector was installed from; empty for user-authored.\n  - status (string) (required) — Server status. [enabled, disabled]\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - transport (string) (required) — Transport protocol. One of: `stdio` (standard I/O to a local subprocess), `sse` (standalone SSE, the legacy MCP transport), `streamable-http` (the newer HTTP streaming transport). [stdio, sse, streamable-http]\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - url (string) — Server URL (sse / streamable-http transport).\n",
-	"Members.MemberInfo":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_avatar (string) (required) — Account avatar URL\n  - account_email (string) (required) — Account email\n  - account_id (integer) (required) — Account ID\n  - account_locale (string) — Account-level locale preference (e.g. zh-CN or en-US). Omitted when the account has none set.\n  - account_name (string) (required) — Account name\n  - account_role_ids (array<integer>) (required) — Assigned role IDs\n  - account_time_zone (string) — Account-level time zone (e.g. Asia/Shanghai). Omitted when the account has none set.\n  - avatar (string) (required) — Member avatar URL\n  - country_code (string) (required) — ISO 3166-1 alpha-2 region code of the member's contact phone (e.g. \"CN\", \"US\", \"HK\").\n  - created_at (string) (required) — Member creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - domain (string) (required) — Account domain\n  - email (string) (required) — Email address\n  - email_verified (boolean) (required) — Whether email is verified\n  - is_external (boolean) (required) — Whether provisioned via SSO\n  - locale (string) — Member's locale preference. Omitted when the member has none set.\n  - member_id (integer) (required) — Member ID\n  - member_name (string) (required) — Member display name\n  - mp_account_id (string) — Account identifier on the marketplace platform. Omitted together with `mp_plat`.\n  - mp_plat (string) — Cloud marketplace platform the account was provisioned from. Omitted when the account did not come from a marketplace.\n  - phone (string) (required) — Masked phone number\n  - phone_verified (boolean) (required) — Whether phone is verified\n  - time_zone (string) — Member's IANA time zone. Omitted when the member has none set.\n",
-	"Members.MemberInvite":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - member_id (integer) — Member ID\n  - member_name (string) — Member display name\n",
-	"Members.MemberList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID\n  - account_role_ids (array<integer>) (required) — Role IDs\n  - avatar (string) (required) — Avatar URL\n  - country_code (string) (required) — ISO 3166-1 alpha-2 region code of the member's contact phone (e.g. \"CN\", \"US\", \"HK\").\n  - created_at (string) (required) — Creation timestamp (Unix seconds) CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - email (string) (required) — Email address\n  - email_verified (boolean) (required) — Email verified\n  - is_external (boolean) (required) — Provisioned via SSO\n  - locale (string) — Member's locale preference (e.g. `zh-CN`). Omitted when empty — the list endpoint does not populate it.\n  - member_id (integer) (required) — Member ID\n  - member_name (string) (required) — Display name\n  - phone (string) (required) — Masked phone number\n  - phone_verified (boolean) (required) — Phone verified\n  - ref_id (string) (required) — External reference ID\n  - status (string) (required) — Member status. `enabled` — active member; `pending` — invited but not yet accepted; `deleted` — removed from the organization. [enabled, pending, deleted]\n  - time_zone (string) — Member's IANA time zone (e.g. `Asia/Shanghai`). Omitted when empty — the list endpoint does not populate it.\n  - updated_at (string) (required) — Update timestamp (Unix seconds) CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Members.PersonInfos":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID\n  - as (string) — Principal kind: `account` — the account owner principal; `member` — an organization member. [account, member]\n  - avatar (string) — Avatar URL. Omitted when empty.\n  - email (string) — Email address. Omitted when empty.\n  - email_verified (boolean) (required) — Email verified\n  - locale (string) — Locale. Omitted when empty.\n  - person_id (integer) (required) — Person ID\n  - person_name (string) — Display name. Omitted when empty.\n  - phone (string) — Phone number. Omitted when empty — this endpoint never populates it.\n  - phone_verified (boolean) (required) — Whether the phone is verified. Always false in this endpoint's response.\n  - status (string) — Person status. `enabled` — active; `pending` — invited but not yet accepted; `deleted` — removed. Omitted when empty. [enabled, pending, deleted]\n  - time_zone (string) — Time zone. Omitted when empty.\n",
-	"NotificationTemplates.ReadInfo":            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — ID of the owning account.\n  - created_at (string) (required) — Unix epoch seconds the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - deleted_at (string) — Unix epoch seconds the template was soft-deleted. Absent (omitempty) when the template is live. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Free-form description.\n  - dingtalk (string) (required) — DingTalk robot message template source.\n  - dingtalk_app (string) (required) — DingTalk app message template source.\n  - email (string) (required) — Email body template source (Go `html/template` syntax).\n  - feishu (string) (required) — Feishu robot message template source.\n  - feishu_app (string) (required) — Feishu app message template source.\n  - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.\n  - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.\n  - slack (string) (required) — Slack robot message template source.\n  - slack_app (string) (required) — Slack app message template source.\n  - sms (string) (required) — SMS template source (Go `text/template` syntax).\n  - status (string) (required) — Template lifecycle status. `enabled` templates can be referenced by escalation policies for notifications; `disabled` templates are no longer used for new notifications; `deleted` templates are never returned by list endpoints. [enabled, disabled, deleted]\n  - team_id (integer) (required) — ID of the team this template is scoped to, or 0 for account-wide.\n  - teams_app (string) (required) — Microsoft Teams app message template source.\n  - telegram (string) (required) — Telegram bot message template source.\n  - template_id (string) (required) — Template ID.\n  - template_name (string) (required) — Unique template name within the account.\n  - updated_at (string) (required) — Unix epoch seconds the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - voice (string) (required) — Voice call script template source.\n  - wecom (string) (required) — WeCom robot message template source.\n  - wecom_app (string) (required) — WeCom app message template source.\n  - zoom (string) (required) — Zoom bot message template source.\n",
-	"NotificationTemplates.ReadList":            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the owning account.\n  - created_at (string) (required) — Unix epoch seconds the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - deleted_at (string) — Unix epoch seconds the template was soft-deleted. Absent (omitempty) when the template is live. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Free-form description.\n  - dingtalk (string) (required) — DingTalk robot message template source.\n  - dingtalk_app (string) (required) — DingTalk app message template source.\n  - email (string) (required) — Email body template source (Go `html/template` syntax).\n  - feishu (string) (required) — Feishu robot message template source.\n  - feishu_app (string) (required) — Feishu app message template source.\n  - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.\n  - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.\n  - slack (string) (required) — Slack robot message template source.\n  - slack_app (string) (required) — Slack app message template source.\n  - sms (string) (required) — SMS template source (Go `text/template` syntax).\n  - status (string) (required) — Template lifecycle status. `enabled` templates can be referenced by escalation policies for notifications; `disabled` templates are no longer used for new notifications; `deleted` templates are never returned by list endpoints. [enabled, disabled, deleted]\n  - team_id (integer) (required) — ID of the team this template is scoped to, or 0 for account-wide.\n  - teams_app (string) (required) — Microsoft Teams app message template source.\n  - telegram (string) (required) — Telegram bot message template source.\n  - template_id (string) (required) — Template ID.\n  - template_name (string) (required) — Unique template name within the account.\n  - updated_at (string) (required) — Unix epoch seconds the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - voice (string) (required) — Voice call script template source.\n  - wecom (string) (required) — WeCom robot message template source.\n  - wecom_app (string) (required) — WeCom app message template source.\n  - zoom (string) (required) — Zoom bot message template source.\n",
-	"NotificationTemplates.ReadPreview":         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - content (string) (required) — Rendered template output, present when success is true.\n  - fixed_fields (array<object>) — Fixed incident-card fields returned for supported IM previews after the requested hiding rules are applied.\n    - field (string) (required) — Incident-card field name. | Value | Meaning | |---|---| | `channel` | Name of the alert channel that produced the incident; returned only when non-empty. | | `snoozed_before` | Snooze-until timestamp formatted as `YYYY-MM-DD HH:MM:SS`; returned only while the incident is snoozed. | | `severity` | Incident severity label; returned only when non-empty. | | `responders` | Names of the current responders, separated by spaces; returned only when the incident has responders. | | `aggregate_alert_count` | Number of alerts aggregated into the incident; returned only when greater than 1. | [channel, snoozed_before, severity, responders, aggregate_alert_count]\n    - value (string) (required) — Rendered display value for the fixed field.\n  - message (string) (required) — Error message describing why rendering failed, present when success is false.\n  - success (boolean) (required) — Whether the template rendered without errors.\n",
-	"NotificationTemplates.WriteCreate":         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - template_id (string) (required) — Newly created template ID.\n  - template_name (string) (required) — Template name echoed from the request.\n",
-	"Resources.Info":                            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns this resource.\n  - action.days (integer) (required) — Retention period in days for action (user interaction) data.\n  - created_at (string) (required) — Unix timestamp in seconds when the resource was created. Also anchors the start of the first billing window. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error.days (integer) (required) — Retention period in days for error data.\n  - expired_at (string) — Unix timestamp in seconds when the on-premises license expires. Only present on on-premises deployments; omitted entirely for SaaS accounts. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - long_task.days (integer) (required) — Retention period in days for long-task data.\n  - offering_id (integer) (required) — ID of the offering (SKU) this resource was provisioned from.\n  - order_id (string) (required) — ID of the order that provisioned this resource. Empty for resources provisioned outside the order flow (e.g. on-premises).\n  - product (string) (required) — Product code for this resource. Always `rum` for this endpoint. [rum]\n  - resource.days (integer) (required) — Retention period in days for resource (network request) data.\n  - resource_id (string) (required) — Unique resource identifier for the account's RUM resource.\n  - resource_name (string) (required) — Display name of the resource.\n  - session.days (integer) (required) — Retention period in days for session data.\n  - session_investigate.free_cnt (integer) (required) — Free quota for investigate sessions per application, per billing window.\n  - session_investigate.used_cnt (integer) (required) — Number of investigate (error tracking) sessions used in the current billing window.\n  - session_limit_reached (boolean) (required) — `true` when a `version=free` account has exceeded its combined free session quota across all applications. Always `false` for non-free plans.\n  - session_measure.free_cnt (integer) (required) — Free quota for measure sessions per application, per billing window.\n  - session_measure.used_cnt (integer) (required) — Number of measure (performance) sessions used in the current billing window.\n  - session_replay.free_cnt (integer) (required) — Free quota for session-replay sessions per application, per billing window.\n  - session_replay.used_cnt (integer) (required) — Number of session-replay sessions used in the current billing window.\n  - status (string) (required) — Status of the resource. A resource with status `deleted` or `destroyed` never reaches this field — the operation returns `ResourceNotFound` for those instead. [enabled, disabled]\n  - updated_at (string) (required) — Unix timestamp in seconds when the resource was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (string) (required) — Plan version of this resource. One of `free` (free plan) or `professional` (professional plan). [free, professional]\n  - view.days (integer) (required) — Retention period in days for view (page/screen) data.\n  - window_end_time (string) (required) — Unix timestamp in seconds for the end of the current 30-day billing window. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - window_start_time (string) (required) — Unix timestamp in seconds for the start of the current 30-day billing window. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"RolesPermissions.ReadInfo":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Unix epoch seconds the role was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Role description.\n  - editable (boolean) (required) — False for built-in roles which cannot be modified.\n  - permission_ids (array<integer>) (required) — IDs of permissions granted by this role.\n  - role_id (integer) (required) — Unique role ID.\n  - role_name (string) (required) — Role display name.\n  - status (string) (required) — Role status. [enabled, disabled]\n  - updated_at (string) (required) — Unix epoch seconds the role was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"RolesPermissions.ReadList":                 "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Unix epoch seconds the role was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Role description.\n  - editable (boolean) (required) — False for built-in roles which cannot be modified.\n  - permission_ids (array<integer>) (required) — IDs of permissions granted by this role.\n  - role_id (integer) (required) — Unique role ID.\n  - role_name (string) (required) — Role display name.\n  - status (string) (required) — Role status. [enabled, disabled]\n  - updated_at (string) (required) — Unix epoch seconds the role was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"RolesPermissions.ReadListPermission":       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Owning account ID. Omitted when 0, i.e. for system-level permissions.\n  - class (string) (required) — Permission class (e.g., 'On-call', 'Organization').\n  - description (string) (required) — Human-readable permission description.\n  - id (integer) (required) — Unique permission ID.\n  - is_granted (boolean) (required) — Whether this permission is granted to the roles given in `role_ids`. Always present in this endpoint's response; `false` entries only appear when `with_all` is true.\n  - permission_name (string) (required) — Permission display name.\n  - permission_type (string) (required) — Whether this is a read or manage permission. `read`: view-only permission (read/list/query); `manage`: administrative permission covering mutations (create, update, delete, configure). [read, manage]\n  - scope (string) (required) — Functional scope the permission applies to. | value | meaning | | --- | --- | | `account` | Account settings and API keys | | `organization` | Members, teams, roles, audit | | `on-call` | On-call incident management | | `monit` | Monitoring | | `rum` | Real user monitoring | | `ai-sre` | AI SRE features | | `custom_menu` | Account-defined custom menu pages (on-premises only) | [account, organization, on-call, monit, rum, ai-sre, custom_menu]\n  - source (string) (required) — Origin of the permission. `system` — seeded built-in permission; `account` — dynamic permission created for this account (e.g. custom menus). [system, account]\n  - source_ref (string) — Primary key of the source object (e.g. the custom menu ID) for account-scoped permissions. Omitted when empty.\n  - status (string) (required) — Permission status. `enabled` — active; `deleted` — removed (deleted permissions are filtered out and never returned). [enabled, deleted]\n",
-	"RolesPermissions.ReadListPermissionFactor": "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - factor_name (string) (required) — Factor identifier (e.g., 'template:read:info').\n  - factor_type (string) (required) — Factor type. `api`: backend API factor — `factor_name` is the API name (e.g. `skill:write:upload`), enforced at the gateway; `button`: UI action factor, used by the role-config page to render action toggles; `visit`: page-visit factor (custom menu pages use this type); `menu`: menu-visibility factor (legacy, no current seed data); `url`: page route-path factor (legacy, no current seed data). [api, button, visit, menu, url]\n  - source (string) — Origin of the factor. `system` — seeded built-in factor; `account` — dynamic factor created for this account (e.g. custom menus). [system, account]\n  - source_ref (string) — Primary key of the source object (e.g. the custom menu ID) for account-scoped factors. Omitted when empty.\n",
-	"RolesPermissions.WriteUpsert":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - role_id (integer) (required) — Created or updated role ID.\n  - role_name (string) (required) — Role name echoed from the request.\n",
-	"Schedules.Create":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - schedule_id (integer) (required) — ID of the newly created schedule.\n",
-	"Schedules.Info":                            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n        - alias (string) (required) — Channel alias.\n        - chat_ids (array<string>) (required) — Chat IDs.\n        - data_source_id (integer) (required) — Data source ID.\n        - sign_secret (string) (required) — Signature secret.\n        - token (string) (required) — Webhook token.\n        - verify_token (string) (required) — Verification token.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
-	"Schedules.Infos":                           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
-	"Schedules.List":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
-	"Schedules.Preview":                         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n        - alias (string) (required) — Channel alias.\n        - chat_ids (array<string>) (required) — Chat IDs.\n        - data_source_id (integer) (required) — Data source ID.\n        - sign_secret (string) (required) — Signature secret.\n        - token (string) (required) — Webhook token.\n        - verify_token (string) (required) — Verification token.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
-	"Schedules.Self":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
-	"SessionReplay.Metadata":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - application (object) — Application the session belongs to.\n    - id (string) — RUM application ID the session belongs to.\n  - device (object) — Device that recorded the session.\n    - type (string) — Device type recorded for the session, e.g. `desktop`, `mobile`, `tablet`.\n  - foreground_periods (array<object>) — Foreground periods across the session (mobile sessions only; empty for web).\n    - end (string) — Unix timestamp in milliseconds when the foreground period ended. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - start (string) — Unix timestamp in milliseconds when the foreground period started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - view_id (string) — View ID active during this foreground period.\n  - session (object) — Session bounds and state.\n    - end (string) — Unix timestamp in milliseconds when the session ended (or was last updated, if still active). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - is_active (boolean) — Whether the session was still active as of the last recorded event.\n    - server_time_delta (integer) — Clock skew in milliseconds between the client and Flashduty's servers, added to client timestamps for correction.\n    - source (string) — SDK platform that recorded the session. Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n    - start (string) — Unix timestamp in milliseconds when the session started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - views (array<object>) — Every view recorded during the session, in chronological order.\n    - container_source (string) — SDK platform of the container app, when this view is embedded (e.g. a WebView inside a native app). Omitted when the view is not embedded.\n    - container_view_id (string) — View ID of the containing view, when this view is embedded. Omitted when the view is not embedded.\n    - end (string) — Unix timestamp in milliseconds when the view ended. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - is_active (boolean) — Whether the view was still active as of the last recorded event.\n    - loading_type (string) — How the view was entered, e.g. `initial_load`, `route_change`.\n    - name (string) — View name, typically the route or screen name.\n    - server_time_delta (integer) — Clock skew in milliseconds between the client and Flashduty's servers, added to client timestamps for correction.\n    - source (string) — SDK platform that recorded the view. Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n    - start (string) — Unix timestamp in milliseconds when the view started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - url (string) — URL (web) or screen identifier (mobile) associated with the view.\n    - view_id (string) — Unique ID of the view within the session.\n",
-	"SessionReplay.Segments":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - items (array<string>) — Presigned, time-limited URLs (valid 1 hour) for downloading each segment's raw compressed bytes.\n  - search_after_ctx (string) — Pagination cursor to pass as `search_after_ctx` on the next call. Empty when this page was the last one.\n",
-	"Sessions.ReadInfo":                         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - events (array<object>) (required) — Recent events, ascending by (created_at, event_id).\n    - actions (object) — ADK actions envelope (state deltas, transfers, escalation).\n    - author (string) — Event author (e.g. user, the agent name).\n    - branch (string) — ADK branch path for nested agents.\n    - content (object) — ADK content envelope {role, parts:[...]}.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the event was written. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - error_code (string) — Error code when the event represents a failure.\n    - error_message (string) — Human-readable error message, when present.\n    - event_id (string) (required) — Event identifier.\n    - invocation_id (string) — ADK invocation id grouping a turn.\n    - partial (boolean) (required) — True for a streaming partial chunk.\n    - session_id (string) (required) — Owning session id.\n    - status (string) — Event status. One of: `normal` (a live event included in the context fed to the model), `compressed` (folded into a compaction summary boundary event; no longer loaded for the model, kept as history only). [normal, compressed]\n    - turn_complete (boolean) (required) — True on the terminal event of a turn.\n    - usage_metadata (object) — Per-turn token usage metadata.\n  - has_more_older (boolean) (required) — True when older events remain beyond this page.\n  - search_after_ctx (string) — Opaque keyset cursor; pass back as search_after_ctx to fetch the next older page. Omitted when has_more_older is false.\n  - session (object) (required) — One agent session row.\n    - access_source (string) — How the caller received access to this session. Omitted when no access source is resolved. One of: | Value | Meaning | | --- | --- | | `owner` | Caller is the session creator (full access) | | `team_member` | Caller belongs to the session's bound team (full access) | | `manager` | Manager grant (reserved; never produced by the current version) | | `share_link` | Granted via a valid share link (view/fork only; cannot continue or manage) | | `participant` | Same-account non-member granted via a participable team session (view/continue/fork only) | [owner, team_member, manager, share_link, participant]\n    - app_name (string) (required) — Agent app that owns the session.\n    - archived_at (string) (required) — Unix timestamp in milliseconds when archived; 0 means not archived. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - bound_environment (object) — The runner or cloud sandbox the session is bound to. Null until the first message.\n      - id (string) (required) — Environment identifier: a cloud sandbox ID for `cloud` bindings, a runner/environment ID for `byoc` bindings.\n      - kind (string) (required) — Environment kind bound to the session: `cloud` (managed sandbox) or `byoc` (self-hosted runner). [cloud, byoc]\n      - name (string) — Human-readable environment name; empty for cloud bindings using the default allowlist.\n      - status (string) — Live binding health, namespaced by kind: BYOC uses online/pending/offline/deleted; cloud uses available/rebuilding/expired. [online, pending, offline, deleted, available, rebuilding, expired]\n    - can_continue (boolean) (required) — True when the caller can add a new turn to this session.\n    - can_fork (boolean) (required) — True when the caller can fork this session.\n    - can_manage (boolean) (required) — True when the caller may rename/archive/delete the session; personal sessions are creator-only, team sessions allow the creator, account admin, or team member.\n    - can_view (boolean) (required) — True when the caller can view this session.\n    - context_resolved (object) — Snapshot of the three-tier knowledge-pack resolution for this session.\n      - account_pack_id (string) — Resolved account-scoped pack id.\n      - incident_id (string) — Bound incident id, when war-room originated.\n      - resolved_at_ms (string) (required) — Unix timestamp in milliseconds when the packs were resolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - team_pack_id (string) — Resolved team-scoped pack id.\n      - versions (object) — Per-pack resolved version map.\n    - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.\n    - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.\n    - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_turn_tokens (integer) (required) — Total tokens (input+output+reasoning) for the in-flight round across the parent and its subagents; only computed by session/get while the session is running, always 0 in session/list responses and when idle.\n    - current_turn_wait_ms (integer) (required) — Accumulated ask_user human-wait duration in milliseconds for the current round; resets to 0 at the start of each new round.\n    - entry_kind (string) — Surface that created the session. One of: | Value | Meaning | | --- | --- | | `web` | Created from the web console | | `im` | Created from an IM client (IM bot / IM H5) | | `api` | Created via the public API | | `automation` | Created by an automation rule (unattended run) | | `subagent` | Child session spawned by a parent's agent_dispatch (audit label; at runtime it executes on the web tool surface) | [web, im, api, automation, subagent]\n    - has_unread (boolean) (required) — True when there is assistant output the caller has not yet viewed.\n    - incognito (boolean) (required) — True for incognito (non-persisted-memory) sessions.\n    - is_mine (boolean) (required) — True when the caller created this session.\n    - is_running (boolean) (required) — True when an agent turn is currently in flight for this session.\n    - last_event_at (string) — Unix timestamp in milliseconds of the most recent assistant-side event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - parent_session_id (string) — Parent session id for subagent (child) sessions; empty otherwise.\n    - person_id (string) (required) — Creator person id.\n    - pinned_at (string) (required) — Caller's per-user pin time as a Unix timestamp in milliseconds; 0 means not pinned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - session_id (string) (required) — Session identifier.\n    - session_name (string) (required) — Session title; may be empty for untitled sessions.\n    - share_enabled (boolean) (required) — True when the session's share link is active.\n    - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.\n    - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.\n    - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.\n    - status (string) (required) — Lifecycle status. One of: `enabled` (active), `deleted` (soft-deleted, no longer accessible). [enabled, deleted]\n    - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.\n    - team_name (string) — Resolved team name; empty for unbound rows or deleted teams.\n    - template_staging_round_id (string) — Current save→validate round id (template-assistant only); empty otherwise.\n    - token_usage (object) — Cumulative session-level token rollup across all turns. The account-billing source of truth.\n      - cached_tokens (integer) (required) — Portion of input_tokens served from the prompt cache.\n      - input_tokens (integer) (required) — Total prompt (input) tokens, including the cached portion.\n      - output_tokens (integer) (required) — Total generated (output) tokens.\n      - reasoning_tokens (integer) (required) — Total reasoning/thinking tokens.\n    - updated_at (string) (required) — Unix timestamp in milliseconds of the last session update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - suggest_init (boolean) (required) — Account-wide onboarding flag: true when the account has zero knowledge packs in any scope; not specific to this session.\n",
-	"Sessions.ReadList":                         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - sessions (array<object>) (required) — The page of sessions.\n    - access_source (string) — How the caller received access to this session. Omitted when no access source is resolved. One of: | Value | Meaning | | --- | --- | | `owner` | Caller is the session creator (full access) | | `team_member` | Caller belongs to the session's bound team (full access) | | `manager` | Manager grant (reserved; never produced by the current version) | | `share_link` | Granted via a valid share link (view/fork only; cannot continue or manage) | | `participant` | Same-account non-member granted via a participable team session (view/continue/fork only) | [owner, team_member, manager, share_link, participant]\n    - app_name (string) (required) — Agent app that owns the session.\n    - archived_at (string) (required) — Unix timestamp in milliseconds when archived; 0 means not archived. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - bound_environment (object) — The runner or cloud sandbox the session is bound to. Null until the first message.\n      - id (string) (required) — Environment identifier: a cloud sandbox ID for `cloud` bindings, a runner/environment ID for `byoc` bindings.\n      - kind (string) (required) — Environment kind bound to the session: `cloud` (managed sandbox) or `byoc` (self-hosted runner). [cloud, byoc]\n      - name (string) — Human-readable environment name; empty for cloud bindings using the default allowlist.\n      - status (string) — Live binding health, namespaced by kind: BYOC uses online/pending/offline/deleted; cloud uses available/rebuilding/expired. [online, pending, offline, deleted, available, rebuilding, expired]\n    - can_continue (boolean) (required) — True when the caller can add a new turn to this session.\n    - can_fork (boolean) (required) — True when the caller can fork this session.\n    - can_manage (boolean) (required) — True when the caller may rename/archive/delete the session; personal sessions are creator-only, team sessions allow the creator, account admin, or team member.\n    - can_view (boolean) (required) — True when the caller can view this session.\n    - context_resolved (object) — Snapshot of the three-tier knowledge-pack resolution for this session.\n      - account_pack_id (string) — Resolved account-scoped pack id.\n      - incident_id (string) — Bound incident id, when war-room originated.\n      - resolved_at_ms (string) (required) — Unix timestamp in milliseconds when the packs were resolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - team_pack_id (string) — Resolved team-scoped pack id.\n      - versions (object) — Per-pack resolved version map.\n    - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.\n    - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.\n    - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_turn_tokens (integer) (required) — Total tokens (input+output+reasoning) for the in-flight round across the parent and its subagents; only computed by session/get while the session is running, always 0 in session/list responses and when idle.\n    - current_turn_wait_ms (integer) (required) — Accumulated ask_user human-wait duration in milliseconds for the current round; resets to 0 at the start of each new round.\n    - entry_kind (string) — Surface that created the session. One of: | Value | Meaning | | --- | --- | | `web` | Created from the web console | | `im` | Created from an IM client (IM bot / IM H5) | | `api` | Created via the public API | | `automation` | Created by an automation rule (unattended run) | | `subagent` | Child session spawned by a parent's agent_dispatch (audit label; at runtime it executes on the web tool surface) | [web, im, api, automation, subagent]\n    - has_unread (boolean) (required) — True when there is assistant output the caller has not yet viewed.\n    - incognito (boolean) (required) — True for incognito (non-persisted-memory) sessions.\n    - is_mine (boolean) (required) — True when the caller created this session.\n    - is_running (boolean) (required) — True when an agent turn is currently in flight for this session.\n    - last_event_at (string) — Unix timestamp in milliseconds of the most recent assistant-side event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - parent_session_id (string) — Parent session id for subagent (child) sessions; empty otherwise.\n    - person_id (string) (required) — Creator person id.\n    - pinned_at (string) (required) — Caller's per-user pin time as a Unix timestamp in milliseconds; 0 means not pinned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - session_id (string) (required) — Session identifier.\n    - session_name (string) (required) — Session title; may be empty for untitled sessions.\n    - share_enabled (boolean) (required) — True when the session's share link is active.\n    - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.\n    - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.\n    - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.\n    - status (string) (required) — Lifecycle status. One of: `enabled` (active), `deleted` (soft-deleted, no longer accessible). [enabled, deleted]\n    - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.\n    - team_name (string) — Resolved team name; empty for unbound rows or deleted teams.\n    - template_staging_round_id (string) — Current save→validate round id (template-assistant only); empty otherwise.\n    - token_usage (object) — Cumulative session-level token rollup across all turns. The account-billing source of truth.\n      - cached_tokens (integer) (required) — Portion of input_tokens served from the prompt cache.\n      - input_tokens (integer) (required) — Total prompt (input) tokens, including the cached portion.\n      - output_tokens (integer) (required) — Total generated (output) tokens.\n      - reasoning_tokens (integer) (required) — Total reasoning/thinking tokens.\n    - updated_at (string) (required) — Unix timestamp in milliseconds of the last session update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - suggest_init (boolean) (required) — Account-wide onboarding flag: true when the account has zero knowledge packs in any scope; not dependent on this call's filters.\n  - total (integer) (required) — Total number of sessions matching the filter (ignoring pagination).\n",
-	"Skills.ReadGet":                            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - author (string) — Skill author.\n  - can_edit (boolean) (required) — Whether the caller may edit this skill.\n  - checksum (string) — SHA-256 checksum of the skill zip.\n  - content (string) — Full SKILL.md content. Omitted in list responses.\n  - created (boolean) — Set only on install-from-session responses: true = fresh install, false = in-place update.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the skill.\n  - description (string) (required) — Human-readable description from the SKILL.md frontmatter.\n  - description_en (string) — Optional English description. English-locale UI responses prefer this over `description`; the skill catalog also uses it as a stable selection signal when `description` is localized for display.\n  - is_modified (boolean) (required) — True when a marketplace-sourced skill was edited locally (auto-update skips it).\n  - license (string) — Skill license.\n  - s3_key (string) — Object-storage key of the skill zip.\n  - skill_id (string) (required) — Unique skill ID (prefix `skill_`).\n  - skill_name (string) (required) — Skill name, unique within its scope (account-wide or within one team).\n  - source_template_name (string) — Marketplace template this skill was installed from; empty for user-authored.\n  - source_template_version (string) — Template version at install time.\n  - status (string) (required) — Skill status. Deleted skills are excluded from every API response, so only these two values are ever returned. [enabled, disabled]\n  - tags (array<string>) — Tags parsed from the frontmatter.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - tools (array<string>) — Required tools (builtin or `mcp:server/tool`).\n  - update_available (boolean) (required) — True when the marketplace has a newer template version.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - venues (array<string>) — Execution-environment kinds (EnvironmentKind strings, e.g. `byoc`) the skill is restricted to. Omitted when empty, which means the skill is available in all venues.\n  - version (string) — Skill version from the frontmatter.\n",
-	"Skills.ReadList":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - skills (array<object>) (required) — Skills on this page.\n    - account_id (integer) (required) — Owning account ID.\n    - author (string) — Skill author.\n    - can_edit (boolean) (required) — Whether the caller may edit this skill.\n    - checksum (string) — SHA-256 checksum of the skill zip.\n    - content (string) — Full SKILL.md content. Omitted in list responses.\n    - created (boolean) — Set only on install-from-session responses: true = fresh install, false = in-place update.\n    - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID that created the skill.\n    - description (string) (required) — Human-readable description from the SKILL.md frontmatter.\n    - description_en (string) — Optional English description. English-locale UI responses prefer this over `description`; the skill catalog also uses it as a stable selection signal when `description` is localized for display.\n    - is_modified (boolean) (required) — True when a marketplace-sourced skill was edited locally (auto-update skips it).\n    - license (string) — Skill license.\n    - s3_key (string) — Object-storage key of the skill zip.\n    - skill_id (string) (required) — Unique skill ID (prefix `skill_`).\n    - skill_name (string) (required) — Skill name, unique within its scope (account-wide or within one team).\n    - source_template_name (string) — Marketplace template this skill was installed from; empty for user-authored.\n    - source_template_version (string) — Template version at install time.\n    - status (string) (required) — Skill status. Deleted skills are excluded from every API response, so only these two values are ever returned. [enabled, disabled]\n    - tags (array<string>) — Tags parsed from the frontmatter.\n    - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n    - tools (array<string>) — Required tools (builtin or `mcp:server/tool`).\n    - update_available (boolean) (required) — True when the marketplace has a newer template version.\n    - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - venues (array<string>) — Execution-environment kinds (EnvironmentKind strings, e.g. `byoc`) the skill is restricted to. Omitted when empty, which means the skill is available in all venues.\n    - version (string) — Skill version from the frontmatter.\n  - total (integer) (required) — Total number of matching skills.\n",
-	"Skills.WriteUpdate":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - author (string) — Skill author.\n  - can_edit (boolean) (required) — Whether the caller may edit this skill.\n  - checksum (string) — SHA-256 checksum of the skill zip.\n  - content (string) — Full SKILL.md content. Omitted in list responses.\n  - created (boolean) — Set only on install-from-session responses: true = fresh install, false = in-place update.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the skill.\n  - description (string) (required) — Human-readable description from the SKILL.md frontmatter.\n  - description_en (string) — Optional English description. English-locale UI responses prefer this over `description`; the skill catalog also uses it as a stable selection signal when `description` is localized for display.\n  - is_modified (boolean) (required) — True when a marketplace-sourced skill was edited locally (auto-update skips it).\n  - license (string) — Skill license.\n  - s3_key (string) — Object-storage key of the skill zip.\n  - skill_id (string) (required) — Unique skill ID (prefix `skill_`).\n  - skill_name (string) (required) — Skill name, unique within its scope (account-wide or within one team).\n  - source_template_name (string) — Marketplace template this skill was installed from; empty for user-authored.\n  - source_template_version (string) — Template version at install time.\n  - status (string) (required) — Skill status. Deleted skills are excluded from every API response, so only these two values are ever returned. [enabled, disabled]\n  - tags (array<string>) — Tags parsed from the frontmatter.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - tools (array<string>) — Required tools (builtin or `mcp:server/tool`).\n  - update_available (boolean) (required) — True when the marketplace has a newer template version.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - venues (array<string>) — Execution-environment kinds (EnvironmentKind strings, e.g. `byoc`) the skill is restricted to. Omitted when empty, which means the skill is available in all venues.\n  - version (string) — Skill version from the frontmatter.\n",
-	"Sourcemaps.List":                           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) — Upload timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - git_commit_sha (string) — Git commit SHA for this build.\n  - git_repository_url (string) — Git repository URL associated with this build.\n  - key (string) — Storage key uniquely identifying this sourcemap file.\n  - metadata (object) — Platform-specific metadata: `minified_url` (browser/react-native/harmony/miniprogram); `build_id`, `variant`, `version_code` (android mappings), plus `arch`, `lib_name`, `code_id` (android/harmony/electron native symbols); `uuid` (ios); `build_id`, `platform`, `arch`, `flavor`, `code_id`, `debug_id` (flutter); `subpackage`, `minified_url` (miniprogram). Omitted when empty.\n  - minified_path (string) — Deprecated. Storage path of the minified file; present only on JavaScript records.\n  - minified_url (string) — Deprecated. URL of the minified file; present only on JavaScript and miniprogram records. New integrations should read `metadata.minified_url`.\n  - service (string) — Application or service name.\n  - size (integer) — File size in bytes.\n  - sourcemap_path (string) — Deprecated. Storage path of the sourcemap file; present only on JavaScript and miniprogram records.\n  - type (string) — Platform store this record belongs to. JavaScript rows always report `browser` (including HarmonyOS ArkTS and React Native uploads); native-symbol rows always report `android` (including HarmonyOS native and Electron uploads). | Value | Store | |---|---| | `browser` | JavaScript sourcemap store | | `android` | Android mapping store, or the shared native symbol store | | `ios` | iOS dSYM store | | `miniprogram` | WeChat mini program sourcemap store | | `flutter` | Flutter Dart AOT symbol store | [browser, android, ios, miniprogram, flutter]\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (string) — Application version string.\n",
-	"Sourcemaps.StackEnrich":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - frames (array<object>) (required) — Error stack frames after symbolication (via sourcemap, dSYM, NDK symbol tables, etc.).\n    - address (string) — iOS or native memory address.\n    - class_name (string) — Android Java/Kotlin class name.\n    - code_snippets (array<object>) — Source-code snippets around this frame. Omitted when no snippet was extracted (for example the source content was unavailable or `near` was not requested).\n      - code (string) (required) — Source code on that line.\n      - line (integer) (required) — Source line number.\n    - column (integer) — Column number for JavaScript or Flutter frames.\n    - converted (boolean) (required) — Whether the frame was successfully symbolicated or deobfuscated.\n    - file (string) — Source file, URL, or module path.\n    - function (string) — Function or method name.\n    - line (integer) — Line number.\n    - method_name (string) — Android Java/Kotlin method name without class prefix.\n    - module (string) — iOS Swift/Objective-C module name.\n    - native_address (string) — Unity IL native address.\n    - offset (integer) — Symbol offset from function start.\n    - original_frame (object) — The original minified/obfuscated frame before enrichment. Omitted when the processor did not retain one.\n      - address (string) — iOS or native memory address.\n      - class_name (string) — Android Java/Kotlin class name.\n      - column (integer) — Column number for JavaScript or Flutter frames.\n      - file (string) — Source file, URL, or module path.\n      - function (string) — Function or method name.\n      - line (integer) — Line number.\n      - method_name (string) — Android Java/Kotlin method name without class prefix.\n      - module (string) — iOS Swift/Objective-C module name.\n      - native_address (string) — Unity IL native address.\n      - offset (integer) — Symbol offset from function start.\n    - third_party (boolean) — Whether the frame is from third-party or system libraries (Android and native symbolication only). Omitted when `false`.\n",
-	"StatusPages.ChangeActiveList":              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - affected_components (array<object>) — Components currently affected by this event, with their resulting status. Omitted when no components are affected.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n    - status (string) (required) — Current status of the component affected by the change. Severity increases: `operational` < `degraded` = `under_maintenance` < `partial_outage` < `full_outage`; incident-type changes may use the first four, maintenance-type changes only `operational` and `under_maintenance`. | Value | Meaning | |---|---| | `operational` | Operating normally. | | `degraded` | Degraded performance. | | `partial_outage` | Partial outage. | | `full_outage` | Full outage. | | `under_maintenance` | Under maintenance. | [operational, degraded, partial_outage, full_outage, under_maintenance]\n  - auto_update_by_schedule (boolean) — Maintenance only: whether the status advances automatically based on the scheduled window. Omitted when false.\n  - change_id (integer) (required) — Event ID.\n  - close_at_seconds (string) — Event close time in Unix seconds. For maintenances this is the scheduled end time; for closed events, the time the event reached its terminal status (`resolved`/`completed`). Omitted when not set. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description (Markdown). Omitted when empty.\n  - is_retrospective (boolean) — Whether this event is a retrospective (historical) one. Omitted when false.\n  - linked_change_ids (array<string>) — Linked event IDs (related incidents, deployments, etc.). Omitted when empty.\n  - notify_subscribers (boolean) — Whether subscribers were notified about this event. Omitted when false.\n  - page_id (integer) — Parent status page ID. Omitted when 0 (never for stored events).\n  - responder_ids (array<integer>) — Member IDs responsible for this event. Omitted when no responders are assigned.\n  - start_at_seconds (string) — Event start time in Unix seconds, derived from the first timeline update. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (string) — Current event status. Incident statuses: `investigating`/`identified`/`monitoring`/`resolved`. Maintenance statuses: `scheduled`/`ongoing`/`completed`. Omitted when empty (never for stored events). [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n  - title (string) (required) — Event title.\n  - type (string) (required) — Change type. `incident` is an unplanned outage; `maintenance` is a planned maintenance. The type determines which status values are valid. [incident, maintenance]\n  - updates (array<object>) — Timeline updates attached to this event, ordered by time. Omitted when the event has no timeline updates.\n    - at_seconds (string) (required) — Update timestamp in Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_changes (array<object>) — Component status transitions applied by this update. Omitted when the update changes no component statuses.\n      - component_id (string) (required) — Component ID.\n      - component_name (string) — Component display name. Populated by the backend on read; ignored on write. Omitted when empty.\n      - status (string) (required) — New component status. Incidents support `operational`/`degraded`/`partial_outage`/`full_outage`; maintenances support `operational`/`under_maintenance`. [operational, degraded, partial_outage, full_outage, under_maintenance]\n    - description (string) — Update description (Markdown). Omitted when empty.\n    - status (string) — Change status after this update. Omitted when the update does not change the overall status. The first four values apply to incident-type changes, the last three to maintenance-type changes. | Value | Meaning | |---|---| | `investigating` | Investigating (incident). | | `identified` | Root cause identified (incident). | | `monitoring` | Fix deployed, monitoring (incident). | | `resolved` | Resolved (incident). | | `scheduled` | Scheduled (maintenance). | | `ongoing` | In progress (maintenance). | | `completed` | Completed (maintenance). | [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n    - update_id (string) (required) — Update ID.\n",
-	"StatusPages.ChangeCreate":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - change_id (integer) (required) — Newly created event ID.\n  - change_name (string) (required) — Event title (echoed from the request).\n",
-	"StatusPages.ChangeInfo":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - affected_components (array<object>) — Components currently affected by this event, with their resulting status. Omitted when no components are affected.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n    - status (string) (required) — Current status of the component affected by the change. Severity increases: `operational` < `degraded` = `under_maintenance` < `partial_outage` < `full_outage`; incident-type changes may use the first four, maintenance-type changes only `operational` and `under_maintenance`. | Value | Meaning | |---|---| | `operational` | Operating normally. | | `degraded` | Degraded performance. | | `partial_outage` | Partial outage. | | `full_outage` | Full outage. | | `under_maintenance` | Under maintenance. | [operational, degraded, partial_outage, full_outage, under_maintenance]\n  - auto_update_by_schedule (boolean) — Maintenance only: whether the status advances automatically based on the scheduled window. Omitted when false.\n  - change_id (integer) (required) — Event ID.\n  - close_at_seconds (string) — Event close time in Unix seconds. For maintenances this is the scheduled end time; for closed events, the time the event reached its terminal status (`resolved`/`completed`). Omitted when not set. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description (Markdown). Omitted when empty.\n  - is_retrospective (boolean) — Whether this event is a retrospective (historical) one. Omitted when false.\n  - linked_change_ids (array<string>) — Linked event IDs (related incidents, deployments, etc.). Omitted when empty.\n  - notify_subscribers (boolean) — Whether subscribers were notified about this event. Omitted when false.\n  - page_id (integer) — Parent status page ID. Omitted when 0 (never for stored events).\n  - responder_ids (array<integer>) — Member IDs responsible for this event. Omitted when no responders are assigned.\n  - start_at_seconds (string) — Event start time in Unix seconds, derived from the first timeline update. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (string) — Current event status. Incident statuses: `investigating`/`identified`/`monitoring`/`resolved`. Maintenance statuses: `scheduled`/`ongoing`/`completed`. Omitted when empty (never for stored events). [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n  - title (string) (required) — Event title.\n  - type (string) (required) — Change type. `incident` is an unplanned outage; `maintenance` is a planned maintenance. The type determines which status values are valid. [incident, maintenance]\n  - updates (array<object>) — Timeline updates attached to this event, ordered by time. Omitted when the event has no timeline updates.\n    - at_seconds (string) (required) — Update timestamp in Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_changes (array<object>) — Component status transitions applied by this update. Omitted when the update changes no component statuses.\n      - component_id (string) (required) — Component ID.\n      - component_name (string) — Component display name. Populated by the backend on read; ignored on write. Omitted when empty.\n      - status (string) (required) — New component status. Incidents support `operational`/`degraded`/`partial_outage`/`full_outage`; maintenances support `operational`/`under_maintenance`. [operational, degraded, partial_outage, full_outage, under_maintenance]\n    - description (string) — Update description (Markdown). Omitted when empty.\n    - status (string) — Change status after this update. Omitted when the update does not change the overall status. The first four values apply to incident-type changes, the last three to maintenance-type changes. | Value | Meaning | |---|---| | `investigating` | Investigating (incident). | | `identified` | Root cause identified (incident). | | `monitoring` | Fix deployed, monitoring (incident). | | `resolved` | Resolved (incident). | | `scheduled` | Scheduled (maintenance). | | `ongoing` | In progress (maintenance). | | `completed` | Completed (maintenance). | [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n    - update_id (string) (required) — Update ID.\n",
-	"StatusPages.ChangeList":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - affected_components (array<object>) — Components currently affected by this event, with their resulting status. Omitted when no components are affected.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n    - status (string) (required) — Current status of the component affected by the change. Severity increases: `operational` < `degraded` = `under_maintenance` < `partial_outage` < `full_outage`; incident-type changes may use the first four, maintenance-type changes only `operational` and `under_maintenance`. | Value | Meaning | |---|---| | `operational` | Operating normally. | | `degraded` | Degraded performance. | | `partial_outage` | Partial outage. | | `full_outage` | Full outage. | | `under_maintenance` | Under maintenance. | [operational, degraded, partial_outage, full_outage, under_maintenance]\n  - auto_update_by_schedule (boolean) — Maintenance only: whether the status advances automatically based on the scheduled window. Omitted when false.\n  - change_id (integer) (required) — Event ID.\n  - close_at_seconds (string) — Event close time in Unix seconds. For maintenances this is the scheduled end time; for closed events, the time the event reached its terminal status (`resolved`/`completed`). Omitted when not set. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description (Markdown). Omitted when empty.\n  - is_retrospective (boolean) — Whether this event is a retrospective (historical) one. Omitted when false.\n  - linked_change_ids (array<string>) — Linked event IDs (related incidents, deployments, etc.). Omitted when empty.\n  - notify_subscribers (boolean) — Whether subscribers were notified about this event. Omitted when false.\n  - page_id (integer) — Parent status page ID. Omitted when 0 (never for stored events).\n  - responder_ids (array<integer>) — Member IDs responsible for this event. Omitted when no responders are assigned.\n  - start_at_seconds (string) — Event start time in Unix seconds, derived from the first timeline update. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (string) — Current event status. Incident statuses: `investigating`/`identified`/`monitoring`/`resolved`. Maintenance statuses: `scheduled`/`ongoing`/`completed`. Omitted when empty (never for stored events). [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n  - title (string) (required) — Event title.\n  - type (string) (required) — Change type. `incident` is an unplanned outage; `maintenance` is a planned maintenance. The type determines which status values are valid. [incident, maintenance]\n  - updates (array<object>) — Timeline updates attached to this event, ordered by time. Omitted when the event has no timeline updates.\n    - at_seconds (string) (required) — Update timestamp in Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_changes (array<object>) — Component status transitions applied by this update. Omitted when the update changes no component statuses.\n      - component_id (string) (required) — Component ID.\n      - component_name (string) — Component display name. Populated by the backend on read; ignored on write. Omitted when empty.\n      - status (string) (required) — New component status. Incidents support `operational`/`degraded`/`partial_outage`/`full_outage`; maintenances support `operational`/`under_maintenance`. [operational, degraded, partial_outage, full_outage, under_maintenance]\n    - description (string) — Update description (Markdown). Omitted when empty.\n    - status (string) — Change status after this update. Omitted when the update does not change the overall status. The first four values apply to incident-type changes, the last three to maintenance-type changes. | Value | Meaning | |---|---| | `investigating` | Investigating (incident). | | `identified` | Root cause identified (incident). | | `monitoring` | Fix deployed, monitoring (incident). | | `resolved` | Resolved (incident). | | `scheduled` | Scheduled (maintenance). | | `ongoing` | In progress (maintenance). | | `completed` | Completed (maintenance). | [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n    - update_id (string) (required) — Update ID.\n",
-	"StatusPages.ChangeTimelineCreate":          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - update_id (string) (required) — Newly created update ID.\n",
-	"StatusPages.ComponentUpsert":               "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - component_ids (array<string>) (required) — IDs of the created or updated components, in the same order as the request.\n",
-	"StatusPages.Create":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - page_id (integer) (required) — Created status page ID.\n  - page_name (string) (required) — Created status page name.\n  - page_url_name (string) (required) — Final URL-safe slug assigned to the status page.\n",
-	"StatusPages.DraftCreate":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Creation time in Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - draft_id (string) (required) — Draft ID matching `draft_[A-Za-z0-9]{22}`; the console review link carries it.\n",
-	"StatusPages.Info":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - components (array<object>) (required) — Components tracked on the status page.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n  - contact_info (string) — Get-in-touch contact, a mailto or website URL. Omitted when not set.\n  - custom_domain (string) — Custom domain pointing to the status page. Omitted when not set.\n  - custom_links (array<object>) — Custom navigation links shown on the status page. Omitted when not set.\n  - dark_logo (string) — Dark-mode logo image of the status page. Omitted when not set.\n  - date_view (string) — How the timeline displays change dates. `calendar` uses a calendar view; `list` uses a list view. Omitted when not set. [calendar, list]\n  - display_uptime_mode (string) — How uptime is displayed. `chart_and_percentage` shows both the uptime chart and the percentage figure; `chart` shows only the chart; `none` hides uptime entirely. Omitted when not set. [chart_and_percentage, chart, none]\n  - favicon (string) — Favicon of the status page. Omitted when not set.\n  - logo (string) — Logo image of the status page. Omitted when not set.\n  - logo_url (string) — URL opened when the logo is clicked. Omitted when not set.\n  - managed_domain_feature_enabled (boolean) (required) — Whether the managed custom-domain feature is enabled for this page. `true` for public pages, always `false` for internal pages.\n  - name (string) (required) — Display name of the status page.\n  - page_footer (string) — Footer content of the status page. Omitted when not set.\n  - page_header (string) — Header content of the status page. Omitted when not set.\n  - page_id (integer) (required) — Status page ID.\n  - sections (array<object>) (required) — Sections grouping the components.\n    - description (string) (required) — Section description.\n    - hide_all (boolean) (required) — Whether the section and its components are hidden from summary endpoints.\n    - hide_uptime (boolean) (required) — Whether uptime data is hidden from summary responses.\n    - name (string) (required) — Section name.\n    - order_id (integer) — Display order of the section. Omitted when 0.\n    - section_id (string) — Section ID. Omitted when empty.\n  - subscription (object) (required) — Subscription channel toggles.\n    - email (boolean) (required) — Whether email subscription is enabled.\n    - im (boolean) (required) — Whether IM subscription is enabled.\n  - template_preference (string) — Preferred event template type: `pre_defined` or `message`. Omitted when never set.\n  - type (string) (required) — Page visibility type. `public` pages are accessible to anyone and use email subscriptions; `internal` pages are restricted to account members and use IM subscriptions. [public, internal]\n  - url_name (string) (required) — URL-safe slug, unique per account.\n",
-	"StatusPages.MigrateEmailSubscribers":       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - job_id (string) (required) — Migration job ID. Use this to poll status or request cancellation.\n",
-	"StatusPages.MigrateStructure":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - job_id (string) (required) — Migration job ID. Use this to poll status or request cancellation.\n",
-	"StatusPages.MigrationStatus":               "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owner account ID.\n  - created_at (string) (required) — Job creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error (string) — Terminal error message when `status` is `failed`. Omitted when the job has not failed.\n  - job_id (string) (required) — Migration job ID.\n  - phase (string) (required) — Current migration phase. `structure` imports the page structure (sections and components); `history` imports historical incidents, maintenances, and incident templates; `subscribers` imports email subscribers. [structure, history, subscribers]\n  - progress (object) (required) — Per-entity progress counters.\n    - completed_steps (integer) (required) — Steps completed so far.\n    - components_imported (integer) (required) — Number of components imported from the source status page.\n    - incidents_imported (integer) (required) — Number of historical incidents imported.\n    - maintenances_imported (integer) (required) — Number of scheduled maintenances imported.\n    - sections_imported (integer) (required) — Number of sections (Atlassian component groups) imported from the source status page.\n    - subscribers_imported (integer) (required) — Number of email subscribers successfully imported.\n    - subscribers_skipped (integer) (required) — Number of subscribers skipped (e.g. because they would create duplicates).\n    - templates_imported (integer) (required) — Number of incident templates successfully imported; templates that fail are skipped and recorded in `warnings`.\n    - total_steps (integer) (required) — Total steps this job will perform.\n    - warnings (array<string>) — Non-fatal warnings recorded during the job. Omitted when empty.\n  - source_page_id (string) (required) — Atlassian Statuspage source page ID.\n  - status (string) (required) — Current job status. | Value | Meaning | |---|---| | `running` | In progress. | | `completed` | Finished successfully. | | `failed` | Failed; the `error` field holds the reason. | | `cancelled` | Canceled by request. | [running, completed, failed, cancelled]\n  - target_page_id (integer) (required) — Flashduty target status page ID. Set once the job produces one, or supplied up front for subscriber migration.\n  - updated_at (string) (required) — Last status update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"StatusPages.ReadPageList":                  "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - components (array<object>) (required) — Components tracked on the status page.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n  - contact_info (string) — Get-in-touch contact, a mailto or website URL. Omitted when not set.\n  - custom_domain (string) — Custom domain pointing to the status page. Omitted when not set.\n  - custom_links (array<object>) — Custom navigation links shown on the status page. Omitted when not set.\n  - dark_logo (string) — Dark-mode logo image of the status page. Omitted when not set.\n  - date_view (string) — How the timeline displays change dates. `calendar` uses a calendar view; `list` uses a list view. Omitted when not set. [calendar, list]\n  - display_uptime_mode (string) — How uptime is displayed. `chart_and_percentage` shows both the uptime chart and the percentage figure; `chart` shows only the chart; `none` hides uptime entirely. Omitted when not set. [chart_and_percentage, chart, none]\n  - favicon (string) — Favicon of the status page. Omitted when not set.\n  - logo (string) — Logo image of the status page. Omitted when not set.\n  - logo_url (string) — URL opened when the logo is clicked. Omitted when not set.\n  - name (string) (required) — Display name of the status page.\n  - page_footer (string) — Footer content of the status page. Omitted when not set.\n  - page_header (string) — Header content of the status page. Omitted when not set.\n  - page_id (integer) (required) — Status page ID.\n  - sections (array<object>) (required) — Sections grouping the components.\n    - description (string) (required) — Section description.\n    - hide_all (boolean) (required) — Whether the section and its components are hidden from summary endpoints.\n    - hide_uptime (boolean) (required) — Whether uptime data is hidden from summary responses.\n    - name (string) (required) — Section name.\n    - order_id (integer) — Display order of the section. Omitted when 0.\n    - section_id (string) — Section ID. Omitted when empty.\n  - subscription (object) (required) — Subscription channel toggles.\n    - email (boolean) (required) — Whether email subscription is enabled.\n    - im (boolean) (required) — Whether IM subscription is enabled.\n  - template_preference (string) — Preferred event template type: `pre_defined` or `message`. Omitted when never set.\n  - type (string) (required) — Page visibility type. `public` pages are accessible to anyone and use email subscriptions; `internal` pages are restricted to account members and use IM subscriptions. [public, internal]\n  - url_name (string) (required) — URL-safe slug, unique per account.\n",
-	"StatusPages.SectionUpsert":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - section_ids (array<string>) (required) — IDs of the created or updated sections, in the same order as the request.\n",
-	"StatusPages.SubscriberList":                "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - all (boolean) (required) — Whether the subscriber is subscribed to all components.\n  - components (array<object>) (required) — Components this subscriber has subscribed to.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n  - locale (string) — Preferred locale for notifications. Omitted when empty.\n  - method (string) (required) — Subscription notification method. `email` is email subscription (public pages); `im` is IM subscription (internal pages). Determined by the page type. [email, im]\n  - recipient (string) (required) — Subscriber recipient: email address for public pages, user ID for internal pages.\n",
-	"StatusPages.TemplateList":                  "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - description (string) — Template body text (Markdown).\n  - messages (object) — Notification text (Markdown) per event status. Keys are change statuses valid for the template's `type` (for example `investigating` or `resolved` for incidents); the value is the text used when the event reaches that status.\n  - status (string) — Change status the template maps to. Incidents use `investigating`/`identified`/`monitoring`/`resolved`; maintenances use `scheduled`/`ongoing`/`completed`. [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n  - template_id (string) — Template ID. Omit to create a new template; supply to update an existing one.\n  - title (string) — Template title.\n  - type (string) — Change type the template applies to: `incident` unplanned incident, `maintenance` planned maintenance. [incident, maintenance]\n",
-	"StatusPages.TemplateUpsert":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - template_id (string) (required) — ID of the created or updated template.\n",
-	"Teams.ReadInfo":                            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - created_at (string) (required) — Unix epoch seconds the team was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - creator_name (string) (required) — Display name of the creator. Not populated by current endpoints — always an empty string; resolve `creator_id` via `POST /person/infos`.\n  - description (string) (required) — Free-form description.\n  - person_ids (array<integer>) (required) — Member IDs of team members.\n  - ref_id (string) (required) — External reference ID for third-party HR system integration.\n  - status (string) (required) — Team status. `enabled` — active; `deleted` — soft-deleted (only possible when fetching a deleted team by `team_id`; list and name/ref_id lookups exclude deleted teams). [enabled, deleted]\n  - team_id (integer) (required) — Unique team ID.\n  - team_name (string) (required) — Team display name. 1–39 characters, unique per account.\n  - updated_at (string) (required) — Unix epoch seconds the team was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - updated_by_name (string) (required) — Display name of the last editor.\n",
-	"Teams.ReadInfos":                           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - person_ids (array<integer>) (required) — Array of person IDs belonging to the team; empty array (never null) when the team has no members.\n  - team_id (integer) (required) — Team ID.\n  - team_name (string) (required) — Team name.\n",
-	"Teams.ReadList":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Owning account ID.\n  - created_at (string) (required) — Unix epoch seconds the team was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - creator_name (string) (required) — Display name of the creator. Not populated by current endpoints — always an empty string; resolve `creator_id` via `POST /person/infos`.\n  - description (string) (required) — Free-form description.\n  - person_ids (array<integer>) (required) — Member IDs of team members.\n  - ref_id (string) (required) — External reference ID for third-party HR system integration.\n  - status (string) (required) — Team status. `enabled` — active; `deleted` — soft-deleted (only possible when fetching a deleted team by `team_id`; list and name/ref_id lookups exclude deleted teams). [enabled, deleted]\n  - team_id (integer) (required) — Unique team ID.\n  - team_name (string) (required) — Team display name. 1–39 characters, unique per account.\n  - updated_at (string) (required) — Unix epoch seconds the team was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - updated_by_name (string) (required) — Display name of the last editor.\n",
-	"Teams.WriteUpsert":                         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - team_id (integer) (required) — Created or updated team ID.\n  - team_name (string) (required) — Team name echoed from the request.\n",
+	"A2aAgents.ReadGet":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - agent_card_name (string) — Agent name resolved from the remote card. Omitted until the card has been fetched.\n  - agent_card_skills (array<string>) — Skills advertised by the remote card. Omitted until the card has been fetched.\n  - agent_id (string) (required) — Unique A2A agent ID (prefix `a2a_`).\n  - agent_name (string) (required) — Agent display name.\n  - allow_insecure_oauth_http (boolean) — Allow non-loopback HTTP OAuth discovery/metadata endpoints for this agent instead of requiring HTTPS.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this agent's endpoint.\n  - auth_config (object) — Authentication config key-values. Values under credential-looking keys (name containing KEY, SECRET, TOKEN, PASSWORD, etc.) are masked. Omitted when empty.\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - auth_type (string) (required) — Authentication type for reaching the remote agent: `none`, `api_key`, or `bearer`. Rows created before validation was tightened may return an empty string, equivalent to `none`. [none, api_key, bearer]\n  - can_edit (boolean) (required) — Whether the caller may edit this agent.\n  - card_resolve_timeout (integer) (required) — Card-resolution timeout in seconds. Always 0 today — the API does not yet expose a way to set it.\n  - card_url (string) (required) — URL of the remote agent card.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the agent.\n  - environments (array<string>) (required) — Execution environments this agent is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - instructions (string) (required) — Natural-language instructions for the remote agent (formerly named `description`). (≤51200 chars)\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - status (string) (required) — Agent status. [enabled, disabled]\n  - streaming (boolean) (required) — Whether the remote agent supports streaming responses.\n  - task_timeout (integer) (required) — Single-task execution timeout in seconds. Always 0 today — the API does not yet expose a way to set it.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"A2aAgents.ReadList":                          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Owning account ID.\n  - agent_card_name (string) — Agent name resolved from the remote card. Omitted until the card has been fetched.\n  - agent_card_skills (array<string>) — Skills advertised by the remote card. Omitted until the card has been fetched.\n  - agent_id (string) (required) — Unique A2A agent ID (prefix `a2a_`).\n  - agent_name (string) (required) — Agent display name.\n  - allow_insecure_oauth_http (boolean) — Allow non-loopback HTTP OAuth discovery/metadata endpoints for this agent instead of requiring HTTPS.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this agent's endpoint.\n  - auth_config (object) — Authentication config key-values. Values under credential-looking keys (name containing KEY, SECRET, TOKEN, PASSWORD, etc.) are masked. Omitted when empty.\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - auth_type (string) (required) — Authentication type for reaching the remote agent: `none`, `api_key`, or `bearer`. Rows created before validation was tightened may return an empty string, equivalent to `none`. [none, api_key, bearer]\n  - can_edit (boolean) (required) — Whether the caller may edit this agent.\n  - card_resolve_timeout (integer) (required) — Card-resolution timeout in seconds. Always 0 today — the API does not yet expose a way to set it.\n  - card_url (string) (required) — URL of the remote agent card.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the agent.\n  - environments (array<string>) (required) — Execution environments this agent is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - instructions (string) (required) — Natural-language instructions for the remote agent (formerly named `description`). (≤51200 chars)\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - status (string) (required) — Agent status. [enabled, disabled]\n  - streaming (boolean) (required) — Whether the remote agent supports streaming responses.\n  - task_timeout (integer) (required) — Single-task execution timeout in seconds. Always 0 today — the API does not yet expose a way to set it.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"A2aAgents.WriteCreate":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - agent_id (string) (required) — ID of the newly created agent.\n",
+	"Account.Info":                                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account identifier.\n  - account_name (string) (required) — Account name.\n  - avatar (string) (required) — Account avatar URL.\n  - country_code (string) (required) — ISO 3166-1 alpha-2 region code of the contact phone (e.g. \"CN\", \"US\", \"HK\").\n  - created_at (string) (required) — Account creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - domain (string) (required) — Primary account domain (login subdomain).\n  - email (string) (required) — Account contact email.\n  - extra_domains (array<string>) (required) — Additional account domains.\n  - locale (string) (required) — Account language preference (e.g. zh-CN, en-US).\n  - mp_account_id (string) — Account identifier on the marketplace platform. Omitted together with `mp_plat`.\n  - mp_plat (string) — Cloud marketplace platform the account was provisioned from. Omitted when the account did not come from a marketplace.\n  - phone (string) (required) — Account contact phone, masked for privacy.\n  - restrictions (object) — Account access restrictions. Omitted when none are configured.\n    - allow_subdomain (boolean) — Whether subdomains of the allowed email domains are also accepted.\n    - email_domains (array<string>) — Allowed login email domains.\n    - ips (array<string>) — Allowed source IP/CIDR whitelist.\n  - time_zone (string) (required) — Account default timezone (IANA name, e.g. Asia/Shanghai).\n",
+	"AlertEnrichment.EnrichmentReadInfo":          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Creation timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the rule set is not deleted; read endpoints never return soft-deleted rule sets, so this is effectively always omitted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) (required) — Integration ID.\n  - rules (array<object>) (required) — Ordered enrichment rules.\n    - if (array<object>) — Optional AND-filter list; the rule is skipped unless every filter matches. `null` when the rule has no condition. Filter keys come from the alert/change event vocabulary (e.g. `title`, `labels.severity`).\n      - key (string) (required) — Event key to match on (e.g. `labels.severity`, `title`). Must be non-empty. (≥1 chars)\n      - oper (string) (required) — Match operator. `IN` matches when any value matches; `NOTIN` matches when none of the values match. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to match against. Must contain at least one value.\n    - kind (string) (required) — Rule type. | Value | Meaning | |---|---| | `extraction` | Extract a value from the alert's `title`, `description`, or a `labels.*` key via regex or GJson, and write it to a label. | | `composition` | Render a Go `text/template` against the event and write the result to a label. | | `mapping` | Look up labels from a mapping schema or an external mapping API. | | `drop` | Remove the listed labels from the alert. | [extraction, composition, mapping, drop]\n    - settings (object) (required) — Rule-kind–specific settings. The shape depends on `kind`.\n      - api_id (string) — Mapping API ID (MongoDB ObjectID hex). Required when `mapping_type` is `api`.\n      - drop_labels (array<string>) — List of label keys to remove from the alert.\n      - g_json (string) — GJson path expression used to extract a value from a JSON-encoded field. Mutually exclusive with `pattern`.\n      - mapping_type (string) — Mapping source type. `schema` uses a mapping schema table; `api` calls an external HTTP API. [schema, api]\n      - override (boolean) — When `true`, overwrite the label if it already exists. Defaults to `false`.\n      - pattern (string) — RE2 regular expression applied to the source value. Must contain at least one capture group; the captured groups are joined with a space and written to `result_label`. Mutually exclusive with `g_json`.\n      - result_label (string) — Destination label key the extracted value is written to. Must match `^[a-zA-Z_][a-zA-Z0-9_]*$`.\n      - result_labels (array<string>) — Label keys to populate from the mapping lookup result. Each must match `^[a-zA-Z_][a-zA-Z0-9_]*$`.\n      - schema_id (string) — Mapping schema ID (MongoDB ObjectID hex). Required when `mapping_type` is `schema`.\n      - source_field (string) — Source field to extract from. Must be `title`, `description`, or a label key prefixed with `labels.` (e.g. `labels.env`).\n      - template (string) — Go `text/template` string (1–500 characters) rendered against the event struct — e.g. `{{.Title}}`, `{{.Description}}`, `{{.Labels.key}}`. Example: `{{.Labels.region}}-{{.Labels.env}}`. (1-500 chars)\n  - status (string) (required) — Rule set status: `enabled` (active) or `deleted` (soft-deleted). Read endpoints exclude soft-deleted rule sets, so responses always carry `enabled`. [enabled, deleted]\n  - updated_at (string) (required) — Last update timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n",
+	"AlertEnrichment.EnrichmentReadList":          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Creation timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the rule set is not deleted; read endpoints never return soft-deleted rule sets, so this is effectively always omitted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) (required) — Integration ID.\n  - rules (array<object>) (required) — Ordered enrichment rules.\n    - if (array<object>) — Optional AND-filter list; the rule is skipped unless every filter matches. `null` when the rule has no condition. Filter keys come from the alert/change event vocabulary (e.g. `title`, `labels.severity`).\n      - key (string) (required) — Event key to match on (e.g. `labels.severity`, `title`). Must be non-empty. (≥1 chars)\n      - oper (string) (required) — Match operator. `IN` matches when any value matches; `NOTIN` matches when none of the values match. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to match against. Must contain at least one value.\n    - kind (string) (required) — Rule type. | Value | Meaning | |---|---| | `extraction` | Extract a value from the alert's `title`, `description`, or a `labels.*` key via regex or GJson, and write it to a label. | | `composition` | Render a Go `text/template` against the event and write the result to a label. | | `mapping` | Look up labels from a mapping schema or an external mapping API. | | `drop` | Remove the listed labels from the alert. | [extraction, composition, mapping, drop]\n    - settings (object) (required) — Rule-kind–specific settings. The shape depends on `kind`.\n      - api_id (string) — Mapping API ID (MongoDB ObjectID hex). Required when `mapping_type` is `api`.\n      - drop_labels (array<string>) — List of label keys to remove from the alert.\n      - g_json (string) — GJson path expression used to extract a value from a JSON-encoded field. Mutually exclusive with `pattern`.\n      - mapping_type (string) — Mapping source type. `schema` uses a mapping schema table; `api` calls an external HTTP API. [schema, api]\n      - override (boolean) — When `true`, overwrite the label if it already exists. Defaults to `false`.\n      - pattern (string) — RE2 regular expression applied to the source value. Must contain at least one capture group; the captured groups are joined with a space and written to `result_label`. Mutually exclusive with `g_json`.\n      - result_label (string) — Destination label key the extracted value is written to. Must match `^[a-zA-Z_][a-zA-Z0-9_]*$`.\n      - result_labels (array<string>) — Label keys to populate from the mapping lookup result. Each must match `^[a-zA-Z_][a-zA-Z0-9_]*$`.\n      - schema_id (string) — Mapping schema ID (MongoDB ObjectID hex). Required when `mapping_type` is `schema`.\n      - source_field (string) — Source field to extract from. Must be `title`, `description`, or a label key prefixed with `labels.` (e.g. `labels.env`).\n      - template (string) — Go `text/template` string (1–500 characters) rendered against the event struct — e.g. `{{.Title}}`, `{{.Description}}`, `{{.Labels.key}}`. Example: `{{.Labels.region}}-{{.Labels.env}}`. (1-500 chars)\n  - status (string) (required) — Rule set status: `enabled` (active) or `deleted` (soft-deleted). Read endpoints exclude soft-deleted rule sets, so responses always carry `enabled`. [enabled, deleted]\n  - updated_at (string) (required) — Last update timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n",
+	"AlertEnrichment.FieldReadInfo":               "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - created_at (string) (required) — Creation timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - default_value (any) (required) — Default value. Type depends on `field_type`: `bool` for checkbox; `string` for single_select/text; `string[]` for multi_select; may be `null` if no default.\n  - deleted_at (string) — Deletion timestamp, Unix seconds. Only present for soft-deleted fields. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Optional free-text description. (≤499 chars)\n  - display_name (string) (required) — Human-readable name shown in the UI. (≤39 chars)\n  - field_id (string) (required) — Field ID — 24-character hex ObjectID.\n  - field_name (string) (required) — Machine name used in incident payloads under `fields.<field_name>`. Immutable. (≤39 chars)\n  - field_type (string) (required) — Field type. | Value | Meaning | |---|---| | `checkbox` | Checkbox; value is a bool, options are not supported. | | `multi_select` | Multi-select; value is a string array, each element must be one of options. | | `single_select` | Single-select; value is a string from options. | | `text` | Free text; value is a string. | [checkbox, multi_select, single_select, text]\n  - options (array<string>) (required) — Allowed choices for `single_select`/`multi_select` (non-empty unique string array). `null` or empty for `checkbox`/`text`.\n  - status (string) (required) — Field status: `enabled` (active), `disabled` (set only via internal helpers, not via the API), or `deleted` (soft-deleted). `/field/list` excludes `deleted`; `/field/info` may return it. [enabled, disabled, deleted]\n  - updated_at (string) (required) — Last update timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n  - value_type (string) (required) — Value type. `checkbox` is always `bool`; `single_select`/`multi_select`/`text` are always `string`. `float` is reserved and never occurs today. [string, bool, float]\n",
+	"AlertEnrichment.FieldReadList":               "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Owning account ID.\n  - created_at (string) (required) — Creation timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - default_value (any) (required) — Default value. Type depends on `field_type`: `bool` for checkbox; `string` for single_select/text; `string[]` for multi_select; may be `null` if no default.\n  - deleted_at (string) — Deletion timestamp, Unix seconds. Only present for soft-deleted fields. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Optional free-text description. (≤499 chars)\n  - display_name (string) (required) — Human-readable name shown in the UI. (≤39 chars)\n  - field_id (string) (required) — Field ID — 24-character hex ObjectID.\n  - field_name (string) (required) — Machine name used in incident payloads under `fields.<field_name>`. Immutable. (≤39 chars)\n  - field_type (string) (required) — Field type. | Value | Meaning | |---|---| | `checkbox` | Checkbox; value is a bool, options are not supported. | | `multi_select` | Multi-select; value is a string array, each element must be one of options. | | `single_select` | Single-select; value is a string from options. | | `text` | Free text; value is a string. | [checkbox, multi_select, single_select, text]\n  - options (array<string>) (required) — Allowed choices for `single_select`/`multi_select` (non-empty unique string array). `null` or empty for `checkbox`/`text`.\n  - status (string) (required) — Field status: `enabled` (active), `disabled` (set only via internal helpers, not via the API), or `deleted` (soft-deleted). `/field/list` excludes `deleted`; `/field/info` may return it. [enabled, disabled, deleted]\n  - updated_at (string) (required) — Last update timestamp, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n  - value_type (string) (required) — Value type. `checkbox` is always `bool`; `single_select`/`multi_select`/`text` are always `string`. `float` is reserved and never occurs today. [string, bool, float]\n",
+	"AlertEnrichment.FieldWriteCreate":            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - field_id (string) (required) — Newly assigned field ID — 24-character hex ObjectID.\n  - field_name (string) (required) — Echo of the submitted `field_name`.\n",
+	"AlertEnrichment.MappingAPIReadInfo":          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - api_id (string) (required) — API ID (MongoDB ObjectID hex).\n  - api_name (string) (required) — API name.\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the API has not been soft-deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Description.\n  - headers (object) (required) — Custom request headers. `null` when none are configured.\n  - insecure_skip_verify (boolean) (required) — Whether TLS verification is skipped.\n  - retry_count (integer) (required) — Retry count.\n  - status (string) (required) — API status: `enabled` or `deleted` (soft-deleted). The list endpoint excludes `deleted` items; the info endpoint may return them. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID.\n  - timeout (integer) (required) — Request timeout in seconds.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n  - url (string) (required) — Endpoint URL.\n",
+	"AlertEnrichment.MappingAPIReadList":          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - api_id (string) (required) — API ID (MongoDB ObjectID hex).\n  - api_name (string) (required) — API name.\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the API has not been soft-deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Description.\n  - headers (object) (required) — Custom request headers. `null` when none are configured.\n  - insecure_skip_verify (boolean) (required) — Whether TLS verification is skipped.\n  - retry_count (integer) (required) — Retry count.\n  - status (string) (required) — API status: `enabled` or `deleted` (soft-deleted). The list endpoint excludes `deleted` items; the info endpoint may return them. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID.\n  - timeout (integer) (required) — Request timeout in seconds.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n  - url (string) (required) — Endpoint URL.\n",
+	"AlertEnrichment.MappingAPIWriteCreate":       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - api_id (string) (required) — Created API ID (MongoDB ObjectID hex).\n  - api_name (string) (required) — API name.\n",
+	"AlertEnrichment.MappingDataReadList":         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - fields (object) — All label key-value pairs of this row. Omitted when empty.\n  - key (string) — Composite row key — MD5 of the row's source label values (sorted by label name, joined with `:`). Omitted when empty.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"AlertEnrichment.MappingDataWriteUpsert":      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - keys (array<string>) (required) — Composite keys of upserted rows.\n",
+	"AlertEnrichment.MappingSchemaReadInfo":       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the schema has not been soft-deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Schema description.\n  - result_labels (array<string>) (required) — Output label names.\n  - schema_id (string) (required) — Schema ID (MongoDB ObjectID hex).\n  - schema_name (string) (required) — Schema name.\n  - source_labels (array<string>) (required) — Lookup key label names.\n  - status (string) (required) — Schema status: `enabled` or `deleted` (soft-deleted). The list endpoint excludes `deleted` items; the info endpoint may return them. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n",
+	"AlertEnrichment.MappingSchemaReadList":       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) — Creation time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator member ID.\n  - deleted_at (string) — Deletion time, Unix seconds. Omitted when the schema has not been soft-deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Schema description.\n  - result_labels (array<string>) (required) — Output label names.\n  - schema_id (string) (required) — Schema ID (MongoDB ObjectID hex).\n  - schema_name (string) (required) — Schema name.\n  - source_labels (array<string>) (required) — Lookup key label names.\n  - status (string) (required) — Schema status: `enabled` or `deleted` (soft-deleted). The list endpoint excludes `deleted` items; the info endpoint may return them. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID.\n  - updated_at (string) — Last update time, Unix seconds. Omitted when 0 (legacy records). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater member ID.\n",
+	"AlertEnrichment.MappingSchemaWriteCreate":    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - schema_id (string) (required) — Created schema ID (MongoDB ObjectID hex).\n  - schema_name (string) (required) — Schema name.\n",
+	"AlertRules.ReadAuditDetail":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — ID of the account that owns the rule.\n  - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n  - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n  - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n  - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n  - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n  - id (integer) (required) — Audit record ID.\n",
+	"AlertRules.ReadAudits":                       "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account that owns the rule.\n  - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n  - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n  - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n  - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n  - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n  - id (integer) (required) — Audit record ID.\n",
+	"AlertRules.ReadCounterTotal":                 "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account this snapshot belongs to.\n  - clock (string) (required) — Sample timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - id (integer) (required) — ID of this snapshot record.\n  - num (integer) (required) — Rule count at the sample time.\n",
+	"AlertRules.ReadExport":                       "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - annotations (object) — Custom annotation key-value pairs attached to alert events; keys must not start with `$` (reserved for query field references).\n  - cron_pattern (string) (required) — Evaluation schedule as a 6-field cron expression (seconds included) or `@every <duration>` (an integral number of seconds, at least 1s); `CRON_TZ=`/`TZ=` prefixes are rejected — set the timezone in `timezone` instead.\n  - debug_log_enabled (boolean) (required) — Whether to emit debug logs for this rule's evaluations; enable when troubleshooting.\n  - delay_seconds (integer) — Query time offset in seconds: each evaluation reads data as of `schedule time − delay_seconds` to tolerate ingestion lag; `0` means no offset.\n  - description (string) — Rule description in the format given by `description_type`, shown with alert events.\n  - description_type (string) — Format of `description`, `text` or `markdown`; treated as `text` when omitted. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list`; references by ID and is therefore immune to datasource renames.\n  - ds_list (array<string>) — Datasource name list with wildcard support; merged with `ds_ids` to decide which datasources the rule monitors — must be maintained by hand if a datasource is renamed.\n  - ds_type (string) (required) — Datasource type ident, e.g. `prometheus`; must be a datasource type (`ident`) that exists in the import target environment.\n  - enabled (boolean) (required) — Whether the rule is enabled; rules imported as disabled are not evaluated.\n  - enabled_times (array<object>) — Effective time windows; each entry has `days` (0–6, 0 = Sunday) and `stime`/`etime` (`HH:MM`), interpreted in the rule's `timezone`; an empty list disables the rule.\n    - days (array<integer>) — Days of week, 0 = Sunday.\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - labels (object) — Custom label key-value pairs attached to alert events produced by this rule.\n  - name (string) (required) — Rule name, up to 128 characters when imported.\n  - repeat_interval (integer) — Interval in seconds between repeated notifications for a firing alert; values below 1 fall back to the default of 3600.\n  - repeat_total (integer) — Maximum number of repeated notifications for the same alert; values below 1 fall back to the default of 3.\n  - rule_configs (object) — Rule evaluation configuration.\n    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery condition for any-data check. If omitted or `mode` is empty, treated as `nodata`.\n        - args (object) — Datasource-specific options for the recovery query, same convention as `queries[].args`; required for Elasticsearch datasources when `mode` is `ql`.\n        - condition (string) — Recovery expression. Required when `mode` is `ql`.\n        - mode (string) — `nodata` = recover when the query returns no data; `ql` = recover when the `condition` expression evaluates to true. When `mode` is `ql`, only a single query (`name=A`) is permitted. [nodata, ql]\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration.\n      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when `alert_on_empty_result` is enabled. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - resolve_timeout (integer) — Auto-resolve after N seconds.\n      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - critical (string) — Critical threshold expression referencing query results via `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; at least one severity must be configured.\n      - enabled (boolean) — Whether threshold checking is enabled.\n      - info (string) — Info threshold expression, same syntax as `critical`.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery evaluation configuration for threshold checks.\n        - args (object) — Datasource-specific extra parameters for the recovery query, using the same `<datasource>.<param>` key convention as query `args`. Omitted when empty.\n        - condition (string) — Recovery condition expression; required when `mode` is `threshold` or `ql`, and must be empty for `invert`.\n        - mode (string) — Recovery mode: `invert` = resolve when the alert expression no longer holds (`condition` stays empty); `threshold` = resolve when the `condition` threshold expression holds; `ql` = resolve when the `condition` query expression evaluates true. [invert, threshold, ql]\n        - value_fields (array<string>) — Numeric result fields the recovery `condition` references as `$A.<field>`; same semantics as the query's `value_fields`. Omitted when empty.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - warning (string) — Warning threshold expression, same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicate `expr`.\n      - args (object) — Datasource-specific query options keyed by the `<datasource>.<option>` convention (e.g. `es.type`, `tencent_cls.limit`); most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap `value_fields`; applies to table-shaped results (SQL/ES-style datasources).\n      - name (string) — Query identifier (letter, e.g. `A`). The name `R` is reserved and must not be used.\n      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as `$A.<field>` in threshold expressions); required for threshold checks unless the datasource is `prometheus`/`loki`/`victorialogs`; field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique `name` (not duplicating any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific options for the auxiliary query, same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Relate-query identifier.\n  - timezone (string) — Timezone in which the rule executes. IANA timezone name; defaults to `Asia/Shanghai`.\n",
+	"AlertRules.ReadInfoV2":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.\n    - kind (string) (required) — Entry type; currently only `dashboard` is supported. [dashboard]\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
+	"AlertRules.ReadList":                         "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - active_alert_count (integer) (required) — Number of currently active (unrecovered) alerts fired by this rule. `triggered` equals `active_alert_count > 0`.\n  - created_at (string) (required) — Creation time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who created the rule.\n  - creator_name (string) (required) — Name of the user who created the rule.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron with seconds, e.g. `0 * * * * *`, or an `@every 30s` interval descriptor. Must not start with `CRON_TZ=` or `TZ=`; use the `timezone` field instead.\n  - debug_log_enabled (boolean) (required) — Whether debug logging is enabled.\n  - delay_seconds (integer) (required) — Evaluation delay in seconds.\n  - ds_type (string) (required) — Data source type, e.g. `prometheus`.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - folder_id (integer) (required) — Folder ID.\n  - id (integer) (required) — Unique rule ID.\n  - labels (object) (required) — Custom labels.\n  - name (string) (required) — Rule name.\n  - runtime_state (string) — Runtime evaluation state, derived from edge heartbeats and the edge-reported rule status. Omitted when the state is unavailable. | Value | Meaning | |---|---| | `disabled` | The rule is disabled. | | `offline` | The edge instance or cluster owning this rule is offline. | | `abnormal` | The edge reports evaluation errors. | | `stale` | The edge's runtime status report is outdated. | | `no_datasource` | No datasource currently matches the rule's `ds_list` / `ds_ids`. | | `config_pending` | The latest rule config has not been delivered to the edge yet. | | `waiting` | Enabled, but the edge has not reported runtime status yet. | | `normal` | Evaluating normally. | [disabled, offline, abnormal, stale, no_datasource, config_pending, waiting, normal]\n  - timezone (string) (required) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); shortcuts and offsets such as `Local`, `UTC+8`, or `CST` are rejected. Treated as `Asia/Shanghai` if empty.\n  - triggered (boolean) (required) — True if the rule currently has active alerts.\n  - updated_at (string) (required) — Last modification time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updater_id (integer) (required) — ID of the user who last modified the rule.\n  - updater_name (string) (required) — Name of the user who last modified the rule.\n",
+	"AlertRules.WriteCreateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.\n    - kind (string) (required) — Entry type; currently only `dashboard` is supported. [dashboard]\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
+	"AlertRules.WriteFieldsUpdate":                "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
+	"AlertRules.WriteImport":                      "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
+	"AlertRules.WriteMove":                        "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
+	"AlertRules.WriteUpdateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.\n    - kind (string) (required) — Entry type; currently only `dashboard` is supported. [dashboard]\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
+	"Alerts.EventReadList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n  - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Alerts.ReadEventList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n  - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Alerts.ReadFeed":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - created_at (string) (required) — Creation timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator. 0 for system-generated entries.\n  - deleted_at (string) — Soft-delete time, Unix epoch milliseconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - detail (object) (required) — Type-specific payload; the concrete shape is determined by `type`. May be `null` for entries stored without detail.\n    - comment (string) — Comment body.\n    - in_secs (integer) — Window in seconds over which the state changes were counted. Omitted when zero.\n    - max_changes (integer) — State-change count threshold that triggered flapping detection. Omitted when zero.\n    - mute_secs (integer) — Mute duration in seconds. Omitted when zero.\n    - owner_id (integer) — New owner member ID set on the target incident. Omitted when unchanged.\n    - rule_id (string) — Silence rule ID that muted the alert. Omitted when empty.\n    - rule_name (string) — Silence rule name, resolved at read time. Omitted when empty.\n    - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n    - source_alert_id (string) — ID of the source alert that triggered the inhibition. Omitted when empty.\n    - source_alert_title (string) — Title of the source alert, resolved at read time. Omitted when empty.\n    - source_alerts (array<object>) — Source alerts merged into the target incident. Omitted when empty.\n      - alert_id (string) — Alert ID (ObjectID hex string).\n      - title (string) — Alert title, resolved at read time. Omitted when empty.\n    - status (string) — Severity level. [Ok, Critical, Warning, Info]\n    - target_incident (object) — Incident the alerts were merged into. Omitted when not recorded.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - title (string) — New title set on the target incident. Omitted when unchanged.\n  - ref_id (string) (required) — ObjectID of the alert this entry references.\n  - type (string) (required) — Alert activity feed entry type. Each value identifies one alert lifecycle event; the matching `detail` payload shape is determined by this field. | Type | Meaning | |---|---| | `a_new` | Alert triggered by an incoming event. | | `a_update` | Alert severity or status changed on an incoming event. | | `a_comm` | Comment added on the alert. | | `a_merge` | Alert merged into an incident. | | `a_m_silence` | Alert muted by a silence rule. | | `a_m_inhibit` | Alert muted by an inhibit rule. | | `a_m_flapping` | Alert muted by flapping detection (historical data only; no longer produced). | | `a_ack` | Alert acknowledged (historical data only; alert-level acknowledgement has been removed). | | `a_unack` | Alert acknowledgement revoked (historical data only). | | `a_close` | Alert closed (historical data only; no longer produced). | [a_new, a_update, a_comm, a_merge, a_m_silence, a_m_inhibit, a_m_flapping, a_ack, a_unack, a_close]\n  - updated_at (string) (required) — Last update timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Alerts.ReadInfo":                             "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Unique alert ID (ObjectID hex string).\n  - alert_key (string) — Deduplication key.\n  - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n  - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n  - channel_id (integer) — ID of the channel the alert belongs to.\n  - channel_name (string) — Display name of the channel.\n  - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated: use `integration_id` instead.\n  - data_source_name (string) — Deprecated: use `integration_name` instead.\n  - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n  - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Alert description.\n  - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) — Total number of raw events received by this alert.\n  - events (array<object>) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) — True if this alert has ever been silenced.\n  - images (array<object>) — Images attached to the alert.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - incident (object) — Associated incident, if any.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) — ID of the integration that produced this alert.\n  - integration_name (string) — Display name of the integration.\n  - integration_ref_id (string) — External reference ID of the integration.\n  - integration_type (string) — Type/plugin key of the integration.\n  - labels (object) — Label key-value pairs.\n  - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n  - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n  - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Alert title.\n  - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Alerts.ReadList":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Unique alert ID (ObjectID hex string).\n  - alert_key (string) — Deduplication key.\n  - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n  - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n  - channel_id (integer) — ID of the channel the alert belongs to.\n  - channel_name (string) — Display name of the channel.\n  - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated: use `integration_id` instead.\n  - data_source_name (string) — Deprecated: use `integration_name` instead.\n  - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n  - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Alert description.\n  - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) — Total number of raw events received by this alert.\n  - events (array<object>) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) — True if this alert has ever been silenced.\n  - images (array<object>) — Images attached to the alert.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - incident (object) — Associated incident, if any.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) — ID of the integration that produced this alert.\n  - integration_name (string) — Display name of the integration.\n  - integration_ref_id (string) — External reference ID of the integration.\n  - integration_type (string) — Type/plugin key of the integration.\n  - labels (object) — Label key-value pairs.\n  - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n  - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n  - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Alert title.\n  - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Alerts.ReadListByIDs":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Unique alert ID (ObjectID hex string).\n  - alert_key (string) — Deduplication key.\n  - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n  - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n  - channel_id (integer) — ID of the channel the alert belongs to.\n  - channel_name (string) — Display name of the channel.\n  - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated: use `integration_id` instead.\n  - data_source_name (string) — Deprecated: use `integration_name` instead.\n  - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n  - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Alert description.\n  - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) — Total number of raw events received by this alert.\n  - events (array<object>) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) — True if this alert has ever been silenced.\n  - images (array<object>) — Images attached to the alert.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - incident (object) — Associated incident, if any.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) — ID of the integration that produced this alert.\n  - integration_name (string) — Display name of the integration.\n  - integration_ref_id (string) — External reference ID of the integration.\n  - integration_type (string) — Type/plugin key of the integration.\n  - labels (object) — Label key-value pairs.\n  - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n  - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n  - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Alert title.\n  - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Alerts.ReadPipelineInfo":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Member ID who created the pipeline.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration ID this pipeline applies to.\n  - rules (array<object>) — Ordered list of processing rules.\n    - if (array<object>) — AND-filter list — the rule applies only when every condition matches. `null` or omitted means the rule applies to all events.\n      - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.<name>` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n      - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n      - vals (array<string>) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n    - kind (string) (required) — Rule type. Rules run in array order; when the `if` condition matches, the event is processed according to `kind`. | Value | Meaning | |---|---| | `title_reset` | Rewrites the event title from the `settings.title` template. | | `description_reset` | Rewrites the event description from the `settings.description` template. | | `severity_reset` | Resets the event severity and status to `settings.severity` (`Critical`/`Warning`/`Info`). | | `alert_drop` | Discards the matching event outright; no alert is created. | | `alert_inhibit` | Discards the event (inhibition) when an active source alert matching `settings.source_filters` and correlated via `settings.equals` exists. | [title_reset, description_reset, severity_reset, alert_drop, alert_inhibit]\n    - settings (object) — Kind-specific settings. Shape depends on `kind`: - `title_reset`: `{ \"title\": \"<string>\" }` - `description_reset`: `{ \"description\": \"<string>\" }` - `severity_reset`: `{ \"severity\": \"Critical\"|\"Warning\"|\"Info\" }` - `alert_drop`: `{}` (empty object) - `alert_inhibit`: `{ \"equals\": [\"<label_key>\", ...], \"source_filters\": <OrFilterGroup> }`\n      - description (string) — New description template.\n      - equals (array<string>) — Label keys whose values must be equal between the source and current alert for inhibition to apply.\n      - severity (string) — Target severity level. [Critical, Warning, Info]\n      - source_filters (array<object>) — AND-filter list identifying the source alerts to inhibit — every condition must match.\n        - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.<name>` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n        - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n        - vals (array<string>) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n      - title (string) — New title template. Supports Golang template syntax referencing alert fields.\n  - status (string) — Pipeline status. Always `enabled` in these responses — deleted pipelines are filtered out. [enabled]\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Member ID who last updated the pipeline.\n",
+	"Alerts.ReadPipelineList":                     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Member ID who created the pipeline.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration ID this pipeline applies to.\n  - rules (array<object>) — Ordered list of processing rules.\n    - if (array<object>) — AND-filter list — the rule applies only when every condition matches. `null` or omitted means the rule applies to all events.\n      - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.<name>` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n      - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n      - vals (array<string>) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n    - kind (string) (required) — Rule type. Rules run in array order; when the `if` condition matches, the event is processed according to `kind`. | Value | Meaning | |---|---| | `title_reset` | Rewrites the event title from the `settings.title` template. | | `description_reset` | Rewrites the event description from the `settings.description` template. | | `severity_reset` | Resets the event severity and status to `settings.severity` (`Critical`/`Warning`/`Info`). | | `alert_drop` | Discards the matching event outright; no alert is created. | | `alert_inhibit` | Discards the event (inhibition) when an active source alert matching `settings.source_filters` and correlated via `settings.equals` exists. | [title_reset, description_reset, severity_reset, alert_drop, alert_inhibit]\n    - settings (object) — Kind-specific settings. Shape depends on `kind`: - `title_reset`: `{ \"title\": \"<string>\" }` - `description_reset`: `{ \"description\": \"<string>\" }` - `severity_reset`: `{ \"severity\": \"Critical\"|\"Warning\"|\"Info\" }` - `alert_drop`: `{}` (empty object) - `alert_inhibit`: `{ \"equals\": [\"<label_key>\", ...], \"source_filters\": <OrFilterGroup> }`\n      - description (string) — New description template.\n      - equals (array<string>) — Label keys whose values must be equal between the source and current alert for inhibition to apply.\n      - severity (string) — Target severity level. [Critical, Warning, Info]\n      - source_filters (array<object>) — AND-filter list identifying the source alerts to inhibit — every condition must match.\n      - title (string) — New title template. Supports Golang template syntax referencing alert fields.\n  - status (string) — Pipeline status. Always `enabled` in these responses — deleted pipelines are filtered out. [enabled]\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Member ID who last updated the pipeline.\n",
+	"Analytics.ByAccount":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgement_pct (number) — Acknowledgement rate (%): acknowledged incidents ÷ total incidents × 100, rounded to two decimals and capped at 100; 0 when the bucket has no incidents.\n  - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n  - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n  - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n  - mean_seconds_to_ack (number) — Mean time to first acknowledgement in seconds; 0 when no incident in the bucket was acknowledged.\n  - mean_seconds_to_close (number) — Mean time to close in seconds; 0 when no incident in the bucket was closed.\n  - noise_reduction_pct (number) — Noise reduction ratio (%): 100 − incidents ÷ alert events × 100, rounded to two decimals; 0 when there is no alert-event data or alert events do not exceed incidents.\n  - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n  - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n  - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n  - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n  - total_alert_cnt (integer) — Total number of alerts.\n  - total_alert_event_cnt (integer) — Total number of alert events.\n  - total_engaged_seconds (integer) — Total engaged time in seconds: each incident contributes the sum of close time minus acknowledgement time across its acknowledged responders.\n  - total_incident_cnt (integer) — Total number of incidents.\n  - total_incidents_acknowledged (integer) — Incidents that were acknowledged at least once.\n  - total_incidents_auto_closed (integer) — Incidents closed automatically because all alerts recovered.\n  - total_incidents_closed (integer) — Incidents that are closed.\n  - total_incidents_escalated (integer) — Incidents that were escalated at least once.\n  - total_incidents_manually_closed (integer) — Incidents closed manually.\n  - total_incidents_manually_escalated (integer) — Incidents escalated manually at least once.\n  - total_incidents_reassigned (integer) — Incidents that were reassigned at least once.\n  - total_incidents_timeout_closed (integer) — Incidents closed automatically on timeout.\n  - total_incidents_timeout_escalated (integer) — Incidents escalated on timeout at least once.\n  - total_interruptions (integer) — Total interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - total_notifications (integer) — Total number of notifications sent.\n  - total_seconds_to_ack (integer) — Total time to first acknowledgement in seconds.\n  - total_seconds_to_close (integer) — Total time to close in seconds.\n  - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Analytics.ByChannel":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgement_pct (number) — Acknowledgement rate (%): acknowledged incidents ÷ total incidents × 100, rounded to two decimals and capped at 100; 0 when the bucket has no incidents.\n  - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n  - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n  - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n  - mean_seconds_to_ack (number) — Mean time to first acknowledgement in seconds; 0 when no incident in the bucket was acknowledged.\n  - mean_seconds_to_close (number) — Mean time to close in seconds; 0 when no incident in the bucket was closed.\n  - noise_reduction_pct (number) — Noise reduction ratio (%): 100 − incidents ÷ alert events × 100, rounded to two decimals; 0 when there is no alert-event data or alert events do not exceed incidents.\n  - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n  - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n  - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n  - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n  - total_alert_cnt (integer) — Total number of alerts.\n  - total_alert_event_cnt (integer) — Total number of alert events.\n  - total_engaged_seconds (integer) — Total engaged time in seconds: each incident contributes the sum of close time minus acknowledgement time across its acknowledged responders.\n  - total_incident_cnt (integer) — Total number of incidents.\n  - total_incidents_acknowledged (integer) — Incidents that were acknowledged at least once.\n  - total_incidents_auto_closed (integer) — Incidents closed automatically because all alerts recovered.\n  - total_incidents_closed (integer) — Incidents that are closed.\n  - total_incidents_escalated (integer) — Incidents that were escalated at least once.\n  - total_incidents_manually_closed (integer) — Incidents closed manually.\n  - total_incidents_manually_escalated (integer) — Incidents escalated manually at least once.\n  - total_incidents_reassigned (integer) — Incidents that were reassigned at least once.\n  - total_incidents_timeout_closed (integer) — Incidents closed automatically on timeout.\n  - total_incidents_timeout_escalated (integer) — Incidents escalated on timeout at least once.\n  - total_interruptions (integer) — Total interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - total_notifications (integer) — Total number of notifications sent.\n  - total_seconds_to_ack (integer) — Total time to first acknowledgement in seconds.\n  - total_seconds_to_close (integer) — Total time to close in seconds.\n  - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Analytics.ByResponder":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgement_pct (number) — This responder's acknowledgement rate (%): acknowledged incidents ÷ involved incidents × 100, rounded to two decimals and capped at 100; 0 when the responder has no incidents.\n  - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n  - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n  - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n  - mean_seconds_to_ack (number) — This responder's mean time to acknowledgement in seconds; 0 when the responder acknowledged nothing.\n  - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n  - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n  - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n  - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n  - total_engaged_seconds (integer) — This responder's total engaged time in seconds: each incident contributes close time minus their acknowledgement time.\n  - total_incident_cnt (integer) — Incidents this responder was involved in.\n  - total_incidents_acknowledged (integer) — Incidents acknowledged by this responder.\n  - total_incidents_escalated (integer) — This responder's incidents that were escalated at least once.\n  - total_incidents_manually_escalated (integer) — This responder's incidents escalated manually.\n  - total_incidents_reassigned (integer) — Incidents reassigned away from this responder.\n  - total_incidents_timeout_escalated (integer) — This responder's incidents escalated on timeout.\n  - total_interruptions (integer) — Interruptions for this responder: notifications sent via app push, SMS, or voice call; consecutive notifications within 60 seconds count as one.\n  - total_notifications (integer) — Total notifications sent to this responder.\n  - total_seconds_to_ack (integer) — This responder's total time to acknowledgement in seconds: each incident contributes acknowledgement time minus assignment time.\n  - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Analytics.ByTeam":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgement_pct (number) — Acknowledgement rate (%): acknowledged incidents ÷ total incidents × 100, rounded to two decimals and capped at 100; 0 when the bucket has no incidents.\n  - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n  - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n  - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n  - mean_seconds_to_ack (number) — Mean time to first acknowledgement in seconds; 0 when no incident in the bucket was acknowledged.\n  - mean_seconds_to_close (number) — Mean time to close in seconds; 0 when no incident in the bucket was closed.\n  - noise_reduction_pct (number) — Noise reduction ratio (%): 100 − incidents ÷ alert events × 100, rounded to two decimals; 0 when there is no alert-event data or alert events do not exceed incidents.\n  - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n  - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n  - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n  - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n  - total_alert_cnt (integer) — Total number of alerts.\n  - total_alert_event_cnt (integer) — Total number of alert events.\n  - total_engaged_seconds (integer) — Total engaged time in seconds: each incident contributes the sum of close time minus acknowledgement time across its acknowledged responders.\n  - total_incident_cnt (integer) — Total number of incidents.\n  - total_incidents_acknowledged (integer) — Incidents that were acknowledged at least once.\n  - total_incidents_auto_closed (integer) — Incidents closed automatically because all alerts recovered.\n  - total_incidents_closed (integer) — Incidents that are closed.\n  - total_incidents_escalated (integer) — Incidents that were escalated at least once.\n  - total_incidents_manually_closed (integer) — Incidents closed manually.\n  - total_incidents_manually_escalated (integer) — Incidents escalated manually at least once.\n  - total_incidents_reassigned (integer) — Incidents that were reassigned at least once.\n  - total_incidents_timeout_closed (integer) — Incidents closed automatically on timeout.\n  - total_incidents_timeout_escalated (integer) — Incidents escalated on timeout at least once.\n  - total_interruptions (integer) — Total interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - total_notifications (integer) — Total number of notifications sent.\n  - total_seconds_to_ack (integer) — Total time to first acknowledgement in seconds.\n  - total_seconds_to_close (integer) — Total time to close in seconds.\n  - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Analytics.IncidentList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgements (integer) — Number of acknowledgements.\n  - active_alert_cnt (integer) — Number of alerts still active (not recovered).\n  - alert_cnt (integer) — Total number of alerts aggregated into the incident.\n  - alert_event_cnt (integer) — Total number of alert events associated with the incident; each report of an alert counts as one event.\n  - assigned_to (object) — Current assignment target for the incident; `null` when the incident has no assignment record.\n    - assigned_at (string) — Unix timestamp (seconds) when this assignment was made. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) driving the assignment.\n    - escalate_rule_name (string) — Display name of the escalation rule.\n    - id (string) — Internal assignment record ID.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - person_ids (array<integer>) — Member IDs assigned directly to this incident.\n    - type (string) — Assignment type. | Value | Meaning | |---|---| | `assign` | Initial assignment when the incident is created manually. | | `reassign` | Re-assignment of an existing incident. | | `escalate` | Assignment triggered by escalation policy advancement. | | `reopen` | Assignment restarted from the first layer after the incident is reopened. | [assign, reassign, escalate, reopen]\n  - assignments (integer) — Number of assignments.\n  - channel_id (integer) — ID of the channel the incident belongs to.\n  - channel_name (string) — Name of the channel the incident belongs to.\n  - closed_by (string) — How the incident was closed: `auto`, `timeout`, or `manually`. Empty string while the incident is still open. [auto, timeout, manually]\n  - closer_id (integer) — Member ID of the person who closed the incident. Omitted when 0 (not closed manually).\n  - closer_name (string) — Display name of the person who closed the incident. Omitted when empty.\n  - created_at (string) — Incident creation time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Person ID of the incident creator.\n  - creator_name (string) — Display name of the incident creator.\n  - description (string) — Incident description. Omitted when empty.\n  - engaged_seconds (integer) — Total engaged time in seconds across acknowledged responders, each contributing close time minus their acknowledgement time; 0 if not closed.\n  - escalations (integer) — Total escalations, the sum of `timeout_escalations` and `manual_escalations`.\n  - ever_muted (boolean) — Whether the incident was ever muted by noise reduction. Omitted when false.\n  - fields (object) — Custom fields of the incident. Always omitted in this response (reserved for export).\n  - frequency (string) — Frequency classification: `frequent` or `rare`. Omitted when not classified. [frequent, rare]\n  - hours (string) — Time-of-day bucket of the creation time in the account timezone: `work` = Mon–Fri 08:00–19:00, `sleep` = 23:00–08:00 daily, `off` = all other times. [work, off, sleep]\n  - incident_id (string) — Incident ID, unique within the account.\n  - interruptions (integer) — Number of interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - labels (object) — Incident labels as key-value pairs. Always omitted in this response (reserved for export).\n  - manual_escalations (integer) — Manually triggered escalations.\n  - notifications (integer) — Total number of notifications sent.\n  - owner_id (integer) — Member ID of the incident owner. Omitted when 0 (no owner).\n  - owner_name (string) — Display name of the incident owner. Omitted when empty.\n  - progress (string) — Incident progress state — one of `Triggered`, `Processing`, `Closed`. [Triggered, Processing, Closed]\n  - reassignments (integer) — Number of reassignments.\n  - responders (array<object>) — Responders with per-person assignment and acknowledgement times.\n    - acknowledged_at (string) — Acknowledgement time, as a Unix timestamp in seconds; 0 if not acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Responder's identity in an external chat tool (e.g. Slack); only present when backfilled by an external system.\n    - assigned_at (string) — Assignment time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Responder email. Omitted when empty.\n    - person_id (integer) — Person ID of the responder.\n    - person_name (string) — Responder display name. Omitted when empty.\n  - seconds_to_ack (integer) — Seconds from incident creation to the first acknowledgement; 0 if never acknowledged.\n  - seconds_to_close (integer) — Seconds from incident creation to close; 0 if not closed.\n  - severity (string) — Incident severity. [Critical, Warning, Info]\n  - snoozed_before (string) — Unix timestamp in seconds until which the incident is snoozed. Omitted when the incident is not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) — ID of the team that owns the incident.\n  - team_name (string) — Name of the team that owns the incident.\n  - timeout_escalations (integer) — Escalations triggered by timeout.\n  - title (string) — Incident title.\n",
+	"Analytics.TopkAlertsByLabel":                 "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - hours (string) — Hour bucket when `split_hours` is enabled: `work`, `sleep`, or `off`. Omitted when `split_hours` is false. [work, sleep, off]\n  - label (string) — Aggregation key value (check name or resource identifier).\n  - total_alert_cnt (integer) — Total number of alerts in this label-value bucket.\n  - total_alert_event_cnt (integer) — Total number of raw alert events in this label-value bucket.\n",
+	"Applications.ReadInfo":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
+	"Applications.ReadInfos":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
+	"Applications.ReadList":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
+	"Applications.RemoteConfigReadGet":            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - config (object) — The whole per-application remote configuration. A change reaches an SDK asynchronously and is applied when that SDK creates its next session, so a running session never flips a decision mid-flight.\n    - activation (string) — How a change lands on a client that is already running: `next_session` (the default, and what an empty value means) leaves running sessions untouched and applies the change to new sessions; `immediate` ends the running session as soon as the change arrives so a new session starts under the new configuration. [next_session, immediate]\n    - custom (object) — Application-defined pass-through values handed to the host app verbatim. At most 5 keys, each key up to 64 bytes, each value up to 4 KB of JSON nested at most 3 levels, 16 KB in total. Anyone holding the public client token can read it.\n    - default (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n      - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]\n      - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)\n      - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)\n      - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)\n    - enabled (boolean) — Kill switch. When false the engine reports no values at all and SDKs fall back to their init values.\n    - refresh_on_foreground (boolean) — Let clients re-check the configuration when they return to the foreground instead of waiting for the next poll.\n    - rules (array<object>) — Targeting rules, evaluated in order; at most 20 per application.\n      - match (object) (required) — Key/value conditions the SDK's config request must equal. Keys are limited to `env`, `app_version` and `sdk`; values are at most 256 bytes.\n      - set (object) (required) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n        - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]\n        - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)\n        - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)\n        - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)\n  - updated_at (string) — Unix timestamp in milliseconds - when the current version was published. 0 when never configured. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (integer) — Version the live configuration is stored under. 0 means the application has never been configured.\n",
+	"Applications.RemoteConfigReadHistoryList":    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - config (object) — The whole per-application remote configuration. A change reaches an SDK asynchronously and is applied when that SDK creates its next session, so a running session never flips a decision mid-flight.\n    - activation (string) — How a change lands on a client that is already running: `next_session` (the default, and what an empty value means) leaves running sessions untouched and applies the change to new sessions; `immediate` ends the running session as soon as the change arrives so a new session starts under the new configuration. [next_session, immediate]\n    - custom (object) — Application-defined pass-through values handed to the host app verbatim. At most 5 keys, each key up to 64 bytes, each value up to 4 KB of JSON nested at most 3 levels, 16 KB in total. Anyone holding the public client token can read it.\n    - default (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n      - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]\n      - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)\n      - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)\n      - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)\n    - enabled (boolean) — Kill switch. When false the engine reports no values at all and SDKs fall back to their init values.\n    - refresh_on_foreground (boolean) — Let clients re-check the configuration when they return to the foreground instead of waiting for the next poll.\n    - rules (array<object>) — Targeting rules, evaluated in order; at most 20 per application.\n      - match (object) (required) — Key/value conditions the SDK's config request must equal. Keys are limited to `env`, `app_version` and `sdk`; values are at most 256 bytes.\n      - set (object) (required) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n  - content_hash (string) — Hash of the configuration content; lets the console identify versions with identical content.\n  - equivalent_to (integer) — Earliest version carrying the same content, when that is not this version itself.\n  - reason (string) — Operator's note left when the version was published. Empty when none was given.\n  - updated_at (string) — Unix timestamp in milliseconds - when the version was published. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — ID of the member who published the version.\n  - updated_by_name (string) — Name of the member who published the version.\n  - version (integer) — Version number, unique within the application.\n",
+	"Applications.RemoteConfigReadPreview":        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - hit_rule_index (integer) — 0-based index of the rule that decided the result, or -1 when only the default applied.\n  - values (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n    - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]\n    - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)\n    - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)\n    - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)\n",
+	"Applications.RemoteConfigWriteHistoryRevert": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - version (integer) — New version number created by the revert.\n",
+	"Applications.RemoteConfigWriteUpdate":        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - version (integer) — New published version number.\n",
+	"Applications.WebhookTest":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - message (string) (required) — `ok` on success, otherwise the delivery error message.\n  - ok (boolean) (required) — Whether the webhook endpoint accepted the sample event.\n  - status_code (integer) (required) — HTTP status code returned by the webhook endpoint. 0 when the request did not receive a response.\n",
+	"Applications.WriteCreate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - application_id (string) — Auto-generated unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token for RUM SDK initialization.\n",
+	"Artifacts.ReadGet":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - can_edit (boolean) (required) — Whether the caller may manage this artifact (rename, transfer, delete, share): the creator, any member of the owning team, or a manager of the source session.\n  - content_type (string) (required) — MIME type of the file.\n  - created_at (string) (required) — Unix timestamp in milliseconds when the artifact was published. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_name (string) (required) — Creator's display name.\n  - file_id (string) (required) — Presented-file ID (`pf_` prefix) currently holding the artifact's bytes. Changes on every republish.\n  - is_mine (boolean) (required) — Whether the caller is the creator.\n  - name (string) (required) — Underlying file name including extension.\n  - person_id (integer) (required) — Person (member) ID of the creator.\n  - public_url (string) — Anonymous public link — a console `/share/artifact/<artifact_id>` page served entirely from CDN. Present only while shared; anyone with the link can view it, no login required.\n  - session_id (string) (required) — Source session ID (`sess_` prefix) that produced the file.\n  - session_title (string) — Source session's title. Omitted when the session has been deleted.\n  - share_enabled (boolean) — Whether anonymous public sharing is on. Omitted when false.\n  - share_file_id (string) — Presented-file ID the public snapshot was materialized from. When `share_enabled` is true and `file_id` differs from `share_file_id`, the public snapshot is stale — call `/safari/artifact/gallery/share/sync` to refresh it.\n  - shared_at (string) — Unix timestamp in milliseconds of the last share enable or snapshot sync. Present only while shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) — Person ID of the member who enabled sharing. Present only while shared.\n  - size (integer) (required) — File size in bytes.\n  - team_id (integer) (required) — Owning team ID. `0` means a personal artifact (creator-only management); a positive value means team-owned.\n  - team_name (string) — Owning team's display name. Omitted for personal artifacts.\n  - title (string) (required) — Display title in the gallery.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the artifact was last updated (rename, transfer, or republish). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Artifacts.ReadGetFileState":                  "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - file_id (string) (required) — Echoes the requested presented-file ID.\n  - gallery_path (string) (required) — Console-relative path of the artifact page: `/ai-sre/artifacts/<artifact_id>`.\n  - title (string) (required) — Gallery display title of the published artifact.\n",
+	"Artifacts.ReadList":                          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - can_edit (boolean) (required) — Whether the caller may manage this artifact (rename, transfer, delete, share): the creator, any member of the owning team, or a manager of the source session.\n  - content_type (string) (required) — MIME type of the file.\n  - created_at (string) (required) — Unix timestamp in milliseconds when the artifact was published. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_name (string) (required) — Creator's display name.\n  - file_id (string) (required) — Presented-file ID (`pf_` prefix) currently holding the artifact's bytes. Changes on every republish.\n  - is_mine (boolean) (required) — Whether the caller is the creator.\n  - name (string) (required) — Underlying file name including extension.\n  - person_id (integer) (required) — Person (member) ID of the creator.\n  - public_url (string) — Anonymous public link — a console `/share/artifact/<artifact_id>` page served entirely from CDN. Present only while shared; anyone with the link can view it, no login required.\n  - session_id (string) (required) — Source session ID (`sess_` prefix) that produced the file.\n  - session_title (string) — Source session's title. Omitted when the session has been deleted.\n  - share_enabled (boolean) — Whether anonymous public sharing is on. Omitted when false.\n  - share_file_id (string) — Presented-file ID the public snapshot was materialized from. When `share_enabled` is true and `file_id` differs from `share_file_id`, the public snapshot is stale — call `/safari/artifact/gallery/share/sync` to refresh it.\n  - shared_at (string) — Unix timestamp in milliseconds of the last share enable or snapshot sync. Present only while shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) — Person ID of the member who enabled sharing. Present only while shared.\n  - size (integer) (required) — File size in bytes.\n  - team_id (integer) (required) — Owning team ID. `0` means a personal artifact (creator-only management); a positive value means team-owned.\n  - team_name (string) — Owning team's display name. Omitted for personal artifacts.\n  - title (string) (required) — Display title in the gallery.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the artifact was last updated (rename, transfer, or republish). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Artifacts.ReadSign":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - content_type (string) (required) — MIME type of the file.\n  - download_url (string) (required) — Relative URL (`/safari/artifact/stream?...`) that serves the file as an attachment. Prepend the API base `https://api.flashcat.cloud` before use; expires with `expires_in`.\n  - expires_in (integer) (required) — Validity of both URLs in seconds (300).\n  - name (string) (required) — File name including extension.\n  - preview_url (string) (required) — Same as `download_url` but served inline for browser preview.\n  - size (integer) (required) — File size in bytes.\n",
+	"Artifacts.WritePublish":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - gallery_path (string) (required) — Console-relative path of the artifact page: `/ai-sre/artifacts/<artifact_id>`.\n  - title (string) (required) — Gallery display title.\n",
+	"Artifacts.WriteShareEnable":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - public_url (string) (required) — Anonymous public link served entirely from CDN. Anyone with the link can view the content, no login required.\n  - share_enabled (boolean) (required) — Always `true` in this response.\n  - shared_at (string) (required) — Unix timestamp in milliseconds of the last share enable or snapshot sync. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) (required) — Person ID of the member who enabled sharing.\n",
+	"Artifacts.WriteShareSync":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - public_url (string) (required) — Anonymous public link served entirely from CDN. Anyone with the link can view the content, no login required.\n  - share_enabled (boolean) (required) — Always `true` in this response.\n  - shared_at (string) (required) — Unix timestamp in milliseconds of the last share enable or snapshot sync. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) (required) — Person ID of the member who enabled sharing.\n",
+	"Artifacts.WriteUpdate":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - can_edit (boolean) (required) — Whether the caller may manage this artifact (rename, transfer, delete, share): the creator, any member of the owning team, or a manager of the source session.\n  - content_type (string) (required) — MIME type of the file.\n  - created_at (string) (required) — Unix timestamp in milliseconds when the artifact was published. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_name (string) (required) — Creator's display name.\n  - file_id (string) (required) — Presented-file ID (`pf_` prefix) currently holding the artifact's bytes. Changes on every republish.\n  - is_mine (boolean) (required) — Whether the caller is the creator.\n  - name (string) (required) — Underlying file name including extension.\n  - person_id (integer) (required) — Person (member) ID of the creator.\n  - public_url (string) — Anonymous public link — a console `/share/artifact/<artifact_id>` page served entirely from CDN. Present only while shared; anyone with the link can view it, no login required.\n  - session_id (string) (required) — Source session ID (`sess_` prefix) that produced the file.\n  - session_title (string) — Source session's title. Omitted when the session has been deleted.\n  - share_enabled (boolean) — Whether anonymous public sharing is on. Omitted when false.\n  - share_file_id (string) — Presented-file ID the public snapshot was materialized from. When `share_enabled` is true and `file_id` differs from `share_file_id`, the public snapshot is stale — call `/safari/artifact/gallery/share/sync` to refresh it.\n  - shared_at (string) — Unix timestamp in milliseconds of the last share enable or snapshot sync. Present only while shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) — Person ID of the member who enabled sharing. Present only while shared.\n  - size (integer) (required) — File size in bytes.\n  - team_id (integer) (required) — Owning team ID. `0` means a personal artifact (creator-only management); a positive value means team-owned.\n  - team_name (string) — Owning team's display name. Omitted for personal artifacts.\n  - title (string) (required) — Display title in the gallery.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the artifact was last updated (rename, transfer, or republish). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"AuditLogs.OperationList":                     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - name (string) (required) — Stable machine-readable operation name for use as a filter.\n  - name_cn (string) (required) — Human-readable Chinese label shown in the console.\n",
+	"AuditLogs.Search":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account.\n  - body (string) (required) — JSON-encoded request body. Bodies containing sensitive fields are base64url-encoded instead; bodies over 10 KB are replaced by a truncation placeholder.\n  - created_at (string) (required) — Timestamp of the operation in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - credential_id (integer) (required) — ID of the credential (the app key ID) when `credential_type` is `app_key`; 0 otherwise.\n  - credential_type (string) (required) — Credential type used for the call. `app_key` when authenticated with an app key; empty string for member sessions.\n  - ip (string) (required) — Client IP address of the caller.\n  - is_dangerous (boolean) (required) — True if this is flagged as a high-risk operation.\n  - is_write (boolean) (required) — True for mutating operations; false for read-only ones.\n  - member_id (integer) (required) — ID of the member who performed the action. 0 when the action was performed by the account principal itself.\n  - member_name (string) (required) — Display name of the member. Empty when `member_id` is 0.\n  - operation (string) (required) — Stable machine-readable operation name, e.g. `template:write:create`.\n  - operation_name (string) (required) — Human-readable Chinese label of the operation (e.g. `创建模板`).\n  - params (array<object>) (required) — URL path parameters as an array of key-value pairs, or an empty array when none.\n    - Key (string) — Name of a URL path parameter (the `:xxx` placeholder in the route).\n    - Value (string) — The actual value of that path parameter in this request.\n  - principal_kind (string) (required) — Kind of the caller. `member` — an interactive member session; `service` — an app key credential. [member, service]\n  - request_id (string) (required) — Unique request ID for correlation.\n",
+	"Automations.RuleReadGet":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n  - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - cron_expr (string) (required) — Normalized 5-field cron expression.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - environment_id (string) (required) — BYOC Runner ID.\n  - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n  - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n  - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n  - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n  - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n  - name (string) (required) — Rule name.\n  - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n  - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n  - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n  - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n  - owner_id (integer) (required) — Creator person ID.\n  - prompt (string) (required) — Task prompt.\n  - rule_id (string) (required) — Rule ID.\n  - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n  - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n  - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n  - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n  - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n  - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Automations.RuleReadList":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rules (array<object>) (required) — Array of automation rules for the current page, used with `total` for pagination.\n    - account_id (integer) (required) — Account ID.\n    - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n    - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - cron_expr (string) (required) — Normalized 5-field cron expression.\n    - enabled (boolean) (required) — Whether the rule is enabled.\n    - environment_id (string) (required) — BYOC Runner ID.\n    - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n    - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n    - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n    - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n    - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n    - name (string) (required) — Rule name.\n    - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n    - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n    - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n    - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n    - owner_id (integer) (required) — Creator person ID.\n    - prompt (string) (required) — Task prompt.\n    - rule_id (string) (required) — Rule ID.\n    - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n    - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n    - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n    - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n    - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n    - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - total (integer) (required) — Total count.\n",
+	"Automations.RuleWriteCreate":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n  - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - cron_expr (string) (required) — Normalized 5-field cron expression.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - environment_id (string) (required) — BYOC Runner ID.\n  - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n  - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n  - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n  - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n  - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n  - name (string) (required) — Rule name.\n  - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n  - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n  - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n  - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n  - owner_id (integer) (required) — Creator person ID.\n  - prompt (string) (required) — Task prompt.\n  - rule_id (string) (required) — Rule ID.\n  - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n  - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n  - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n  - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n  - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n  - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Automations.RuleWriteRun":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - preflight (object) (required) — Readiness checks computed before a manual run is allowed to start.\n    - app_name (string) (required) — App the rule is scoped to. Currently always ai-sre; manual runs are only supported for that app.\n    - checks (array<string>) (required) — Names of the readiness checks performed, in order. Current fixed set: rule_loaded, actor_authorized, app_allowed, runtime_scope_resolved, rule_config_valid.\n    - ok (boolean) (required) — Whether all readiness checks passed. Always true in a response that reaches the caller — a failed preflight returns a 400/403 error instead of a payload with ok=false.\n    - owner_id (integer) (required) — Rule owner person ID.\n    - scope (string) (required) — Resolved run scope for this run; mirrors the rule's run_scope. One of: `person` (personal rule, runs as its creator), `team` (team rule, runs under the owning team). [person, team]\n    - team_id (integer) (required) — Rule's scope team ID; 0 means a personal rule.\n    - warnings (array<string>) — Non-fatal warnings surfaced during preflight. Omitted or empty when there are none.\n  - rule_id (string) (required) — Rule ID that was run.\n  - run (object) — Reference to the run started by a manual trigger.\n    - run_id (string) (required) — Run ID, always populated once a run is created.\n    - session_id (string) — AI SRE session ID for this run. Always populated in a 200 response, since the call only returns after the session has started.\n  - trigger_kind (string) (required) — Always manual for this operation. [manual]\n",
+	"Automations.RuleWriteUpdate":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n  - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - cron_expr (string) (required) — Normalized 5-field cron expression.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - environment_id (string) (required) — BYOC Runner ID.\n  - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n  - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n  - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n  - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n  - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n  - name (string) (required) — Rule name.\n  - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n  - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n  - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n  - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n  - owner_id (integer) (required) — Creator person ID.\n  - prompt (string) (required) — Task prompt.\n  - rule_id (string) (required) — Rule ID.\n  - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n  - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n  - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n  - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n  - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n  - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Automations.RunReadList":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - runs (array<object>) (required) — Array of run records for the given `rule_id`, filtered by the request's status/trigger-kind/time-range and paginated.\n    - account_id (integer) (required) — Account ID.\n    - attempts (integer) (required) — Attempt count.\n    - completed_at (string) (required) — Completion time, Unix milliseconds. 0 means not completed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - duration_ms (integer) (required) — Duration in milliseconds.\n    - error_code (string) (required) — Error code; empty when the run did not fail.\n    - error_message (string) (required) — Error message; empty when the run did not fail.\n    - kind (string) (required) — Run kind; runs listed for a rule are always `automation_rule`. [automation_rule]\n    - occurrence_key (string) (required) — Idempotency key for this occurrence.\n    - result_json (object) (required) — Raw run result JSON (carries the run's `session_id` once started); null when empty.\n    - rule_id (string) (required) — Rule ID.\n    - run_id (string) (required) — Run ID.\n    - session_id (string) — Session created for this run, extracted from `result_json`. Omitted when the run has not (yet) started a session.\n    - session_name (string) — Display name of the run's session, stamped via a batch lookup. Omitted when empty or when the lookup fails.\n    - started_at (string) (required) — Start time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - stats_json (object) (required) — Raw run statistics JSON; null when empty.\n    - status (string) (required) — Run status. One of (the first three are in-flight, the rest terminal): | Value | Meaning | | --- | --- | | `queued` | Enqueued, waiting for a worker | | `running` | Executing | | `retrying` | An attempt failed and a retry is scheduled | | `succeeded` | Completed successfully | | `partial` | Partially succeeded (currently only produced by memory-consolidation runs; rule runs never reach it) | | `failed` | Terminal failure, no further retries | | `skipped` | Not executed (e.g. grace period expired, trigger or rule invalid); the reason is kept on the run record | | `abandoned` | Still in-flight past the stale threshold and swept as never-completed (e.g. worker died) | | `blocked` | Terminal: the run produced output but ended with a connector waiting on a human to complete authorization (distinct from `failed`) | [queued, running, retrying, succeeded, partial, failed, skipped, abandoned, blocked]\n    - trigger_kind (string) (required) — Trigger kind. One of: | Value | Meaning | | --- | --- | | `schedule` | Fired by the rule's schedule trigger | | `debug` | Debug run (reserved; current rule runs never carry this kind) | | `manual` | Triggered manually by a user | | `http_post` | Fired via the rule's HTTP POST webhook | | `oncall_incident` | Fired by an on-call incident event | [schedule, debug, manual, http_post, oncall_incident]\n    - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - total (integer) (required) — Total count.\n",
+	"Automations.TemplateReadList":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - templates (array<object>) (required) — Array of built-in automation templates, with display text localized by the request `locale` (falling back to request headers).\n    - description (string) (required) — Template description.\n    - enabled (boolean) (required) — Whether a rule created from this template starts out enabled (prefill value).\n    - icon (string) (required) — Icon identifier.\n    - name (string) (required) — Template name.\n    - prompt (string) (required) — Template prompt.\n",
+	"Calendars.CalEventList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID. Only present for private events.\n  - cal_id (string) (required) — Calendar ID. For public events this is a locale key such as zh-cn.china.official.\n  - created_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Creator person ID. Only present for private events.\n  - description (string) (required) — Event description.\n  - end_at (string) (required) — Event end date (YYYY-MM-DD, exclusive).\n  - event_id (string) (required) — Event ID.\n  - is_off (boolean) (required) — Whether the event marks a non-working day.\n  - start_at (string) (required) — Event start date (YYYY-MM-DD).\n  - summary (string) (required) — Event summary.\n  - updated_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Calendars.CalEventUpsert":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - cal_id (string) (required) — Calendar ID.\n  - event_id (string) (required) — Event ID (existing or newly generated).\n  - summary (string) (required) — Event summary.\n",
+	"Calendars.CalendarCreate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - cal_id (string) (required) — ID of the newly created calendar (format cal.<uuid>).\n  - cal_name (string) (required) — Calendar display name.\n",
+	"Calendars.CalendarInfo":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - cal_id (string) (required) — Calendar ID.\n  - cal_name (string) (required) — Calendar display name.\n  - created_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator person ID.\n  - description (string) (required) — Calendar description.\n  - extra_cal_ids (array<string>) — Inherited public-holiday calendar IDs. Omitted when empty.\n  - kind (string) (required) — Calendar kind. `region.official.holiday` is a public regional holiday calendar (served by the central holiday service), `religion.holiday` is a public religious holiday calendar (reserved, currently no data), and `personal` is an account-created personal/team calendar. [region.official.holiday, religion.holiday, personal]\n  - status (string) (required) — Calendar status. `enabled` means usable; `deleted` means removed and never returned by list endpoints. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID (0 when not assigned).\n  - timezone (string) (required) — IANA timezone.\n  - updated_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater person ID.\n  - workdays (array<integer>) — Workday numbers (0 = Sunday, 6 = Saturday). Omitted when empty.\n",
+	"Calendars.CalendarList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - cal_id (string) (required) — Calendar ID.\n  - cal_name (string) (required) — Calendar display name.\n  - created_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Creator person ID.\n  - description (string) (required) — Calendar description.\n  - extra_cal_ids (array<string>) — Inherited public-holiday calendar IDs. Omitted when empty.\n  - kind (string) (required) — Calendar kind. `region.official.holiday` is a public regional holiday calendar (served by the central holiday service), `religion.holiday` is a public religious holiday calendar (reserved, currently no data), and `personal` is an account-created personal/team calendar. [region.official.holiday, religion.holiday, personal]\n  - status (string) (required) — Calendar status. `enabled` means usable; `deleted` means removed and never returned by list endpoints. [enabled, deleted]\n  - team_id (integer) (required) — Owning team ID (0 when not assigned).\n  - timezone (string) (required) — IANA timezone.\n  - updated_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Last updater person ID.\n  - workdays (array<integer>) — Workday numbers (0 = Sunday, 6 = Saturday). Omitted when empty.\n",
+	"Changes.List":                                "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account this change belongs to.\n  - change_id (string) — Change ID, a MongoDB ObjectID hex string.\n  - change_key (string) — Stable key that groups events belonging to the same change.\n  - change_status (string) — Current lifecycle status of the change. | Value | Meaning | |---|---| | `Planned` | Planned, not started. | | `Ready` | Ready for execution. | | `Processing` | Being executed. | | `Canceled` | Canceled. | | `Done` | Completed. | [Planned, Ready, Processing, Canceled, Done]\n  - channel_id (integer) — Collaboration channel this change is routed to.\n  - channel_name (string) — Name of the collaboration channel.\n  - channel_status (string) — Status of the collaboration channel: `enabled` or `disabled`. [enabled, disabled]\n  - description (string) — Change description.\n  - end_time (string) — Unix timestamp in seconds when the change ended. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - events (array<object>) — Underlying change events, returned only when include_events is true.\n    - account_id (integer) — Account this change event belongs to.\n    - change_key (string) — Stable key that groups events belonging to the same change.\n    - change_status (string) — Lifecycle status of the change event, reported by the change source as execution progresses. | Value | Meaning | |---|---| | `Planned` | Planned, not started. | | `Ready` | Ready for execution. | | `Processing` | Being executed. | | `Canceled` | Canceled. | | `Done` | Completed. | [Planned, Ready, Processing, Canceled, Done]\n    - channel_id (integer) — Collaboration channel this change event is routed to.\n    - created_at (string) — Unix timestamp in seconds when the change event was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - deleted_at (string) — Unix timestamp in seconds when the change event was deleted. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Change event description.\n    - event_id (string) — Change event ID, a MongoDB ObjectID hex string.\n    - event_time (string) — Unix timestamp in seconds when the change event occurred. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - integration_id (integer) — Integration that reported this change event.\n    - labels (object) — Key-value labels attached to the change event.\n    - link (string) — External link to the source change record.\n    - title (string) — Change event title.\n    - updated_at (string) — Unix timestamp in seconds when the change event was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration that reported this change.\n  - integration_name (string) — Name of the reporting integration.\n  - labels (object) — Key-value labels attached to the change.\n  - last_time (string) — Unix timestamp in seconds of the most recent change activity. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - link (string) — External link to the source change record.\n  - start_time (string) — Unix timestamp in seconds when the change started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Change title.\n",
+	"Channels.ChannelCreate":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - channel_id (integer) (required) — Newly created channel ID.\n  - channel_name (string) (required) — Channel name echoed back from the request.\n  - external_report_token (string) — External report token. Emitted only when external reporting is enabled.\n",
+	"Channels.ChannelEscalateRuleCreate":          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — Newly created rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name echoed back from the request.\n",
+	"Channels.ChannelEscalateRuleInfo":            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - aggr_window (integer) (required) — Delay window in seconds.\n  - channel_id (integer) (required) — Channel the rule belongs to.\n  - channel_name (string) — Channel name, populated for cross-channel listing responses.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - filters (object) (required) — Incident-level match conditions (OR-of-AND tree): the rule is matched against the incident the alert was grouped into, not against the alert itself. Omit or leave empty to apply the rule to all incidents in the channel.\n  - layers (array<object>) (required) — Escalation levels in order.\n    - escalate_window (integer) — Wait before moving to the next level, in minutes. (0-720)\n    - force_escalate (boolean) — When true, always escalate regardless of acknowledgement.\n    - max_times (integer) — Max repeat notifications within the level. (0-6)\n    - notify_step (number) — Repeat interval in minutes. (0.5-120)\n    - target (object) (required) — Notification target. At least one of `person_ids`, `team_ids`, `schedule_to_role_ids`, or `emails` must be set, together with either `by` or `webhooks`.\n      - by (object) — Per-severity personal notification channels. Required unless `webhooks` is provided.\n        - critical (array<string>) — Notify channels used for Critical severity. Personal channels: `sms`, `voice`, `email`, `push`; IM group-chat channels: `feishu_app:<chat_id>`, `dingtalk_app:<chat_id>`, `wecom_app:<chat_id>`, `slack_app:<chat_id>`, `teams_app:<chat_id>`.\n        - follow_preference (boolean) — When true, use each responder's personal preference instead of the lists below.\n        - info (array<string>) — Notify channels used for Info severity. Values as for `critical`.\n        - warning (array<string>) — Notify channels used for Warning severity. Values as for `critical`.\n      - emails (array<string>) — Email addresses to notify (push-only scenarios).\n      - person_ids (array<integer>) — Member IDs to notify directly.\n      - schedule_to_role_ids (object) — Map of schedule ID to the role IDs on that schedule to notify.\n      - team_ids (array<integer>) — Team IDs to notify.\n      - webhooks (array<object>) — Group chat / webhook targets. Required unless `by` is provided.\n        - settings (object) (required) — Type-specific settings (chat IDs, URLs, etc.).\n        - type (string) (required) — Webhook type, one of `feishu`, `feishu_app`, `dingtalk`, `dingtalk_app`, `wecom`, `slack`, `slack_app`, `teams_app`, `telegram`, `zoom`.\n  - priority (integer) (required) — Evaluation priority. Lower runs first.\n  - rule_id (string) (required) — Escalation rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - status (string) (required) — Rule status: `enabled` means active, `disabled` means paused, `deleted` is soft-deleted (possible only from the detail endpoint; lists never return deleted rules). [enabled, disabled, deleted]\n  - template_id (string) (required) — Notification template ID (MongoDB ObjectID).\n  - time_filters (array<object>) (required) — Recurring time windows during which the rule applies.\n    - cal_id (string) — Optional calendar ID; restricts the window to days matching the calendar.\n    - end (string) — End of the window in `HH:MM`.\n    - is_off (boolean) — When true, match days marked as days-off in the calendar.\n    - repeat (array<integer>) — Days of the week this window repeats on. Empty means every day.\n    - start (string) — Start of the window in `HH:MM`.\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID that last updated the rule.\n",
+	"Channels.ChannelEscalateRuleList":            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Owning account ID.\n  - aggr_window (integer) (required) — Delay window in seconds.\n  - channel_id (integer) (required) — Channel the rule belongs to.\n  - channel_name (string) — Channel name, populated for cross-channel listing responses.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - filters (object) (required) — Incident-level match conditions (OR-of-AND tree): the rule is matched against the incident the alert was grouped into, not against the alert itself. Omit or leave empty to apply the rule to all incidents in the channel.\n  - layers (array<object>) (required) — Escalation levels in order.\n    - escalate_window (integer) — Wait before moving to the next level, in minutes. (0-720)\n    - force_escalate (boolean) — When true, always escalate regardless of acknowledgement.\n    - max_times (integer) — Max repeat notifications within the level. (0-6)\n    - notify_step (number) — Repeat interval in minutes. (0.5-120)\n    - target (object) (required) — Notification target. At least one of `person_ids`, `team_ids`, `schedule_to_role_ids`, or `emails` must be set, together with either `by` or `webhooks`.\n      - by (object) — Per-severity personal notification channels. Required unless `webhooks` is provided.\n      - emails (array<string>) — Email addresses to notify (push-only scenarios).\n      - person_ids (array<integer>) — Member IDs to notify directly.\n      - schedule_to_role_ids (object) — Map of schedule ID to the role IDs on that schedule to notify.\n      - team_ids (array<integer>) — Team IDs to notify.\n      - webhooks (array<object>) — Group chat / webhook targets. Required unless `by` is provided.\n  - priority (integer) (required) — Evaluation priority. Lower runs first.\n  - rule_id (string) (required) — Escalation rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - status (string) (required) — Rule status: `enabled` means active, `disabled` means paused, `deleted` is soft-deleted (possible only from the detail endpoint; lists never return deleted rules). [enabled, disabled, deleted]\n  - template_id (string) (required) — Notification template ID (MongoDB ObjectID).\n  - time_filters (array<object>) (required) — Recurring time windows during which the rule applies.\n    - cal_id (string) — Optional calendar ID; restricts the window to days matching the calendar.\n    - end (string) — End of the window in `HH:MM`.\n    - is_off (boolean) — When true, match days marked as days-off in the calendar.\n    - repeat (array<integer>) — Days of the week this window repeats on. Empty means every day.\n    - start (string) — Start of the window in `HH:MM`.\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID that last updated the rule.\n",
+	"Channels.ChannelInfo":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Owning account ID.\n  - active_incident_highest_severity (string) — Highest severity among the channel's active (triggered or processing) incidents: `Critical`, `Warning` or `Info`. Omitted when there are no active incidents. [Critical, Warning, Info]\n  - auto_resolve_mode (string) — How the auto-resolve timer is reset. `trigger` (default) starts the timer once when the incident is triggered — later merged alerts do not affect it; `update` restarts the timer from the latest alert time whenever a new alert merges into the incident. [trigger, update]\n  - auto_resolve_timeout (integer) — Auto-resolve timeout in seconds. 0 disables auto-resolve.\n  - channel_id (integer) — Channel ID.\n  - channel_name (string) — Channel name.\n  - created_at (string) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Member ID who created the channel.\n  - creator_name (string) — Name of the member who created the channel (resolved from the member directory; empty when unavailable).\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Non-zero only for soft-deleted channels. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Free-form description.\n  - disable_auto_close (boolean) — When true, automatic incident closing is disabled.\n  - disable_outlier_detection (boolean) — When true, outlier incident detection is disabled.\n  - event_group (object) — Alert event merge configuration.\n    - is_enabled (boolean) — When true, repeated events merge into the existing alert; when false, every event creates a separate alert. Defaults to true.\n    - time_window (integer) — Merge window in minutes, 1-1440 (24 h); accounts with the extended limit may use up to 10080 (7 days). Defaults to 1440. (min 1)\n  - external_report_token (string) — Token granted to external reporters. Omitted unless external reporting is enabled on the channel.\n  - flapping (object) — Flapping detection configuration.\n    - in_mins (integer) — Observation window in minutes. (1-1440)\n    - is_disabled (boolean) — Disable flapping detection.\n    - max_changes (integer) — Max state changes allowed within `in_mins`. (2-100)\n    - mute_mins (integer) — Mute duration in minutes after flapping is detected. (0-1440)\n  - group (object) — Alert grouping configuration.\n    - all_equals_required (boolean) — When true, all listed keys must be present for grouping.\n    - cases (array<object>) — Per-filter grouping overrides.\n      - equals (array<string>) (required) — Grouping keys for matching alerts. Supported values: `title`, `description`, `severity`, or any `labels.<name>`.\n      - if (array<object>) (required) — AND-ed match conditions evaluated against stored alert fields.\n        - key (string) (required) — Field name to filter on. Use plain names for built-in alert fields (e.g. `alert_severity`, `alert_key`, `check`, `resource`, `service`, `cluster`) or the `labels.<name>` prefix for custom alert labels (e.g. `labels.env`, `labels.region`).\n        - oper (string) (required) — Filter operator. `IN` — value must match one of `vals`; `NOTIN` — value must not match any of `vals`. Supports regex patterns wrapped in `/pattern/`. [IN, NOTIN]\n        - vals (array<string>) (required) — List of values to match against. Each entry is a plain string or a `/regex/` pattern.\n    - equals (array<array<string>>) — Groups of label keys whose equality defines a bucket.\n    - i_keys (array<string>) — Label keys used for intelligent grouping embeddings.\n    - i_score_threshold (number) — Intelligent grouping similarity threshold. (0.5-1)\n    - method (string) (required) — Grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n    - storm_threshold (integer) — Alert storm threshold. (0-10000)\n    - storm_thresholds (array<integer>) — Multi-level storm thresholds.\n    - time_window (integer) — Grouping time window in minutes. Default max is 1440 minutes (24 h); extended accounts may allow up to 43200 minutes (30 days). (min 0)\n    - window_type (string) — Window type, default `tumbling`. `tumbling` is a fixed window counted from incident creation — once it expires, new alerts open a new incident; `sliding` is a sliding window counted from the incident's most recent alert, extended each time a new alert merges in. [tumbling, sliding]\n  - is_external_report_enabled (boolean) — Whether external reporters can file incidents into this channel.\n  - is_private (boolean) — When true, the channel is visible only to its managing teams.\n  - is_starred (boolean) — Whether the current user has starred this channel. Present only in `POST /channel/list` responses.\n  - last_incident_at (string) — Time of the most recent incident, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - managing_team_ids (array<integer>) — Additional teams that can manage the channel.\n  - progress_to_incident_cnts (object) — Incident counts by progress over the last 30 days.\n    - Processing (integer) (required) — Count of processing incidents in the last 30 days.\n    - Triggered (integer) (required) — Count of triggered incidents in the last 30 days.\n  - status (string) — Channel status. `enabled` receives and processes events normally; `disabled` drops incoming events outright; `deleted` is returned only when fetching a channel by ID — list endpoints never return it. [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - team_name (string) — Owning team name (resolved from the team directory; empty when unavailable).\n  - updated_at (string) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Channels.ChannelInfos":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - channel_id (integer) (required) — Channel ID.\n  - channel_name (string) (required) — Channel name.\n  - status (string) — Channel status: `enabled` processes events normally; `disabled` discards incoming events; `deleted` is soft-deleted. [enabled, disabled, deleted]\n",
+	"Channels.ChannelInhibitRuleCreate":           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — Newly created rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name echoed back from the request.\n",
+	"Channels.ChannelInhibitRuleList":             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account the rule belongs to.\n  - channel_id (integer) (required) — ID of the channel the rule belongs to.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - equals (array<string>) (required) — Field keys whose values must be equal between the source (inhibiting) alert and the target (suppressed) alert, e.g. `data_source_id` or `labels.cluster`.\n  - is_directly_discard (boolean) (required) — When true, matching alert events are discarded entirely; when false, alerts are still recorded but marked as muted by this rule.\n  - rule_id (string) (required) — Rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - source_filters (object) (required) — Conditions the source alert must match, evaluated against stored active alerts. Supported keys: `status`, `incident_status`, `alert_status`, `severity`, `incident_severity`, `alert_severity`, `title`, `description`, or any `labels.<name>`. Empty makes the rule inert.\n  - status (string) (required) — Rule status: `enabled` or `disabled`; deleted rules never appear in the list. [enabled, disabled]\n  - target_filters (object) (required) — Conditions the incoming target alert event must match to be suppressed; empty means every event is a target.\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the user who last updated the rule.\n",
+	"Channels.ChannelList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Owning account ID.\n  - active_incident_highest_severity (string) — Highest severity among the channel's active (triggered or processing) incidents: `Critical`, `Warning` or `Info`. Omitted when there are no active incidents. [Critical, Warning, Info]\n  - auto_resolve_mode (string) — How the auto-resolve timer is reset. `trigger` (default) starts the timer once when the incident is triggered — later merged alerts do not affect it; `update` restarts the timer from the latest alert time whenever a new alert merges into the incident. [trigger, update]\n  - auto_resolve_timeout (integer) — Auto-resolve timeout in seconds. 0 disables auto-resolve.\n  - channel_id (integer) — Channel ID.\n  - channel_name (string) — Channel name.\n  - created_at (string) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Member ID who created the channel.\n  - creator_name (string) — Name of the member who created the channel (resolved from the member directory; empty when unavailable).\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Non-zero only for soft-deleted channels. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Free-form description.\n  - disable_auto_close (boolean) — When true, automatic incident closing is disabled.\n  - disable_outlier_detection (boolean) — When true, outlier incident detection is disabled.\n  - event_group (object) — Alert event merge configuration.\n    - is_enabled (boolean) — When true, repeated events merge into the existing alert; when false, every event creates a separate alert. Defaults to true.\n    - time_window (integer) — Merge window in minutes, 1-1440 (24 h); accounts with the extended limit may use up to 10080 (7 days). Defaults to 1440. (min 1)\n  - external_report_token (string) — Token granted to external reporters. Omitted unless external reporting is enabled on the channel.\n  - flapping (object) — Flapping detection configuration.\n    - in_mins (integer) — Observation window in minutes. (1-1440)\n    - is_disabled (boolean) — Disable flapping detection.\n    - max_changes (integer) — Max state changes allowed within `in_mins`. (2-100)\n    - mute_mins (integer) — Mute duration in minutes after flapping is detected. (0-1440)\n  - group (object) — Alert grouping configuration.\n    - all_equals_required (boolean) — When true, all listed keys must be present for grouping.\n    - cases (array<object>) — Per-filter grouping overrides.\n      - equals (array<string>) (required) — Grouping keys for matching alerts. Supported values: `title`, `description`, `severity`, or any `labels.<name>`.\n      - if (array<object>) (required) — AND-ed match conditions evaluated against stored alert fields.\n    - equals (array<array<string>>) — Groups of label keys whose equality defines a bucket.\n    - i_keys (array<string>) — Label keys used for intelligent grouping embeddings.\n    - i_score_threshold (number) — Intelligent grouping similarity threshold. (0.5-1)\n    - method (string) (required) — Grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n    - storm_threshold (integer) — Alert storm threshold. (0-10000)\n    - storm_thresholds (array<integer>) — Multi-level storm thresholds.\n    - time_window (integer) — Grouping time window in minutes. Default max is 1440 minutes (24 h); extended accounts may allow up to 43200 minutes (30 days). (min 0)\n    - window_type (string) — Window type, default `tumbling`. `tumbling` is a fixed window counted from incident creation — once it expires, new alerts open a new incident; `sliding` is a sliding window counted from the incident's most recent alert, extended each time a new alert merges in. [tumbling, sliding]\n  - is_external_report_enabled (boolean) — Whether external reporters can file incidents into this channel.\n  - is_private (boolean) — When true, the channel is visible only to its managing teams.\n  - is_starred (boolean) — Whether the current user has starred this channel. Present only in `POST /channel/list` responses.\n  - last_incident_at (string) — Time of the most recent incident, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - managing_team_ids (array<integer>) — Additional teams that can manage the channel.\n  - progress_to_incident_cnts (object) — Incident counts by progress over the last 30 days.\n    - Processing (integer) (required) — Count of processing incidents in the last 30 days.\n    - Triggered (integer) (required) — Count of triggered incidents in the last 30 days.\n  - status (string) — Channel status. `enabled` receives and processes events normally; `disabled` drops incoming events outright; `deleted` is returned only when fetching a channel by ID — list endpoints never return it. [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - team_name (string) — Owning team name (resolved from the team directory; empty when unavailable).\n  - updated_at (string) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Channels.ChannelSilenceRuleCreate":           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — Newly created rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name echoed back from the request.\n",
+	"Channels.ChannelSilenceRuleList":             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account the rule belongs to.\n  - channel_id (integer) (required) — ID of the channel the rule belongs to.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - filters (object) (required) — Alert event match conditions; matching events are silenced within the time window.\n  - from_incident_id (string) — Incident the rule is attached to. Always present; the zero ObjectID `000000000000000000000000` means the rule was not created from an incident.\n  - is_auto_delete (boolean) — When true, the silence rule is automatically deleted after its time window expires. Defaults to false.\n  - is_directly_discard (boolean) (required) — When true, silenced alerts are dropped instead of suppressed into incidents.\n  - is_effective (boolean) (required) — Whether the rule's time window covers the current moment, evaluated at response time.\n  - rule_id (string) (required) — Rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - status (string) (required) — Rule status: `enabled` or `disabled`; deleted rules never appear in the list. [enabled, disabled]\n  - time_filter (object) (required) — One-off silence window. Present with zero values when the rule uses recurring `time_filters` instead.\n    - end_time (integer) (required) — Window end, Unix timestamp in seconds. Must be greater than 0.\n    - start_time (integer) (required) — Window start, Unix timestamp in seconds. Must be greater than 0 and less than `end_time`.\n  - time_filters (array<object>) (required) — Recurring silence windows. Empty when the rule uses a one-off `time_filter`.\n    - cal_id (string) — Optional calendar ID; restricts the window to days matching the calendar.\n    - end (string) — End of the window in `HH:MM`.\n    - is_off (boolean) — When true, match days marked as days-off in the calendar.\n    - repeat (array<integer>) — Days of the week this window repeats on. Empty means every day.\n    - start (string) — Start of the window in `HH:MM`.\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the user who last updated the rule.\n",
+	"Channels.ChannelUnsubscribeRuleCreate":       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — Newly created rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name echoed back from the request.\n",
+	"Channels.ChannelUnsubscribeRuleList":         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account the rule belongs to.\n  - channel_id (integer) (required) — ID of the channel the rule belongs to.\n  - created_at (string) (required) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_at (string) — Deletion time, Unix timestamp in seconds. Omitted unless the rule is soft-deleted; deleted rules are excluded from list responses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description.\n  - filters (object) (required) — Alert event match conditions (OR-of-AND); matching events are discarded entirely. Empty means the rule matches nothing.\n  - rule_id (string) (required) — Rule ID (MongoDB ObjectID).\n  - rule_name (string) (required) — Rule name.\n  - status (string) (required) — Rule status: `enabled` or `disabled`; deleted rules never appear in the list. [enabled, disabled]\n  - updated_at (string) (required) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the user who last updated the rule.\n",
+	"Channels.ChannelUpdate":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - external_report_token (string) — Newly generated token for external reporters. Only returned when `is_external_report_enabled` is set to `true` in the request. Callers should store this value; it cannot be retrieved afterwards.\n",
+	"Channels.RouteInfo":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - cases (array<object>) — Ordered list of case branches.\n    - channel_ids (array<integer>) — Target channel IDs. Required when `routing_mode` is `standard` (or empty); returned as `null` for `name_mapping`.\n    - fallthrough (boolean) — If `true`, evaluation continues to the next case after this one matches; otherwise matching stops at the first hit.\n    - if (array<object>) (required) — List of match conditions that are AND-ed together.\n      - key (string) (required) — Field key to match against the alert event (e.g. `alert_severity`, `labels.service`).\n      - oper (string) (required) — Match operator. `IN` matches when the field value is one of `vals`; `NOTIN` matches when it is not. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to compare against. Each value may be a literal string, a wildcard (`*`, `?`), a regular expression wrapped in slashes (`/pattern/`), a CIDR (`cidr:10.0.0.0/8`), or a numeric comparison (`num:lt:100`).\n    - name_mapping_label (string) — Label key whose value is used as the target channel name. Required when `routing_mode` is `name_mapping`.\n    - routing_mode (string) — Routing mode. `standard` (default, also used when left empty) routes to the fixed channel IDs; `name_mapping` resolves channels by reading a label value from the alert event. [standard, name_mapping]\n  - created_at (string) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the person who created the rule.\n  - default (object) — Default branch used when no case matches (or all matched cases yield no valid channels).\n    - channel_ids (array<integer>) — Channel IDs to fall back to.\n  - deleted_at (string) — Soft-delete timestamp, Unix seconds. Omitted when the rule is active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration the rule belongs to.\n  - sections (array<object>) — Optional sections that visually group cases.\n    - name (string) (required) — Section name. Must be unique within the rule.\n    - position (integer) (required) — Index in `cases` where this section starts. Must be between 0 and the length of `cases`.\n  - status (string) — Route status. `enabled` means active; `deleted` means removed, visible only in historical versions. [enabled, deleted]\n  - updated_at (string) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the person who performed the last update.\n  - version (integer) (required) — Monotonic version number, incremented on each update. Use it for optimistic concurrency control.\n",
+	"Channels.RouteList":                          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - cases (array<object>) — Ordered list of case branches.\n    - channel_ids (array<integer>) — Target channel IDs. Required when `routing_mode` is `standard` (or empty); returned as `null` for `name_mapping`.\n    - fallthrough (boolean) — If `true`, evaluation continues to the next case after this one matches; otherwise matching stops at the first hit.\n    - if (array<object>) (required) — List of match conditions that are AND-ed together.\n      - key (string) (required) — Field key to match against the alert event (e.g. `alert_severity`, `labels.service`).\n      - oper (string) (required) — Match operator. `IN` matches when the field value is one of `vals`; `NOTIN` matches when it is not. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to compare against. Each value may be a literal string, a wildcard (`*`, `?`), a regular expression wrapped in slashes (`/pattern/`), a CIDR (`cidr:10.0.0.0/8`), or a numeric comparison (`num:lt:100`).\n    - name_mapping_label (string) — Label key whose value is used as the target channel name. Required when `routing_mode` is `name_mapping`.\n    - routing_mode (string) — Routing mode. `standard` (default, also used when left empty) routes to the fixed channel IDs; `name_mapping` resolves channels by reading a label value from the alert event. [standard, name_mapping]\n  - created_at (string) — Creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the person who created the rule.\n  - default (object) — Default branch used when no case matches (or all matched cases yield no valid channels).\n    - channel_ids (array<integer>) — Channel IDs to fall back to.\n  - deleted_at (string) — Soft-delete timestamp, Unix seconds. Omitted when the rule is active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - integration_id (integer) — Integration the rule belongs to.\n  - sections (array<object>) — Optional sections that visually group cases.\n    - name (string) (required) — Section name. Must be unique within the rule.\n    - position (integer) (required) — Index in `cases` where this section starts. Must be between 0 and the length of `cases`.\n  - status (string) — Route status. `enabled` means active; `deleted` means removed, visible only in historical versions. [enabled, deleted]\n  - updated_at (string) — Last update time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the person who performed the last update.\n  - version (integer) (required) — Monotonic version number, incremented on each update. Use it for optimistic concurrency control.\n",
+	"DataSources.ReadInfo":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"DataSources.ReadList":                        "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"DataSources.ReadSLSProjects":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - count (integer) (required) — Number of projects in this page.\n  - projects (array<object>) (required) — Projects in the current page.\n    - createTime (string) (required) — Creation time, Unix seconds rendered as a string, e.g. `\"1524539357\"`.\n    - dataRedundancyType (string) — Data redundancy type: `LRS` = locally redundant storage, `ZRS` = zone-redundant storage. Omitted when not set. [LRS, ZRS]\n    - description (string) (required) — Project description.\n    - lastModifyTime (string) (required) — Last modification time, Unix seconds rendered as a string.\n    - location (string) — Storage location, e.g. `cn-beijing-b`. Omitted when not set.\n    - owner (string) (required) — Owner Aliyun account ID; empty when not returned by SLS.\n    - projectName (string) (required) — Project name.\n    - region (string) (required) — Region ID, e.g. `cn-shanghai`.\n    - status (string) (required) — Project status, e.g. `Normal`.\n  - total (integer) (required) — Total number of projects matching `query`, independent of pagination.\n",
+	"DataSources.ToolsInvoke":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - data (any) (required) — Tool-specific JSON evidence, preserved without conversion; never null. No nested legacy diagnose envelope.\n  - datasource_id (integer) (required) — Datasource ID from /monit/datasource/list. (min 1)\n  - summary (string) — Optional non-empty summary.\n  - tool (string) (required) — Executed tool name matching the request.\n  - truncated (object)\n    - reason (string) (required) — Why the result was truncated. Presence of this object indicates truncation.\n",
+	"DataSources.WriteCreate":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"DataSources.WriteUpdate":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Diagnostics.QueryData":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - format (string) (required) — Public result-contract version. It is independent of the internal monit-edge query protocol version. Fixed at `query_result.v1`, which defines the structure of the `result` field. [query_result.v1]\n  - result (object) (required) — Exactly one natural result shape, selected by `kind`.\n    - frames (array<object>) — Typed table or time-series frames. A response can contain more than one frame.\n      - fields (array<object>) (required) — Columns of the frame; all fields share the same `values` length and row i is composed of each field's `values[i]`.\n        - labels (object) — Series labels. Present on the float field of a time-series frame.\n        - name (string) (required) — Column name; on a time-series float field, series are distinguished by `labels` and `name` is usually the metric name.\n        - type (string) (required) — Value type governing `values` encoding: `string` = strings or null, `float` = numbers or `NaN`/`±Inf` strings or null, `time` = RFC 3339 Nano strings or null. [string, float, time]\n        - values (array<any>) (required) — All values of this column in row order; length matches the other fields in the frame.\n      - kind (string) (required) — Frame type: `table` for a generic table, `time_series` for a series (exactly one time field and one float field). [table, time_series]\n    - kind (string) (required) — Result-kind discriminator, always `frames`, indicating the `frames` payload of typed table/time-series frames. [frames, records, samples]\n    - records (array<any>) — Schema-flexible records. Records may have different fields, contain nested JSON, or be null. Integers outside JavaScript's safe range are encoded as decimal strings.\n    - samples (array<object>) — Instant samples with their complete label sets.\n      - labels (object) (required) — The sample's full label set; may be an empty object but is always present.\n      - value (any) (required) — Finite numeric value or a JSON-safe representation of a non-finite float.\n",
+	"ErrorIngestionRules.Create":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rule_id (string) (required) — ID assigned to the new rule.\n  - rule_name (string) (required) — Echo of the created rule's name.\n",
+	"ErrorIngestionRules.HistoryList":             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - rules (array<object>) (required) — The application's complete rule list as of this version.\n    - account_id (integer) (required) — Account ID.\n    - application_id (string) (required) — RUM application ID the rule belongs to.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the row was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID who created the rule.\n    - deleted_at (string) (required) — Unix timestamp in milliseconds when the row was soft-deleted; `0` when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Rule description.\n    - filters (array<array<object>>) (required) — The rule's filter conditions as of this snapshot version.\n      - key (string) (required) — Field key. One of `error.usr_id`, `error.usr_email`, `error.error_type`, `error.error_message`, `error.error_stack`, `error.view_url`, `error.env`, `error.version`, `error.service`, `error.browser_name`, `error.browser_version`, `error.fingerprint`, `error.is_crash`, or a `context.`-prefixed custom context path (up to 3 levels deep).\n      - oper (string) (required) — Match mode: `IN` matches when the field value matches any entry in `vals`; `NOTIN` matches when it matches none. [IN, NOTIN]\n      - vals (array<string>) (required) — Values to match against, at least 1 entry. Each entry is an exact string, or a special pattern using wildcards (`*`/`?`), a regexp wrapped in `/`, a `cidr:`-prefixed CIDR match, or a `num:lt|le|gt|ge:`-prefixed numeric comparison.\n    - id (integer) (required) — Internal row ID.\n    - rule_id (string) (required) — Rule ID.\n    - rule_name (string) (required) — Rule name.\n    - status (string) (required) — The rule's status as of this snapshot version. [enabled, disabled]\n    - updated_at (string) (required) — Unix timestamp in milliseconds when the row was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID who last updated the rule.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when this snapshot was recorded. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID whose action triggered this snapshot.\n  - updated_by_name (string) (required) — Display name of the member whose action triggered this snapshot.\n  - version (integer) (required) — History version number, incrementing from 1.\n",
+	"ErrorIngestionRules.List":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Unix timestamp in milliseconds when the rule was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description, up to 512 characters.\n  - filters (array<array<object>>) (required) — The rule's filter conditions.\n    - key (string) (required) — Field key. One of `error.usr_id`, `error.usr_email`, `error.error_type`, `error.error_message`, `error.error_stack`, `error.view_url`, `error.env`, `error.version`, `error.service`, `error.browser_name`, `error.browser_version`, `error.fingerprint`, `error.is_crash`, or a `context.`-prefixed custom context path (up to 3 levels deep).\n    - oper (string) (required) — Match mode: `IN` matches when the field value matches any entry in `vals`; `NOTIN` matches when it matches none. [IN, NOTIN]\n    - vals (array<string>) (required) — Values to match against, at least 1 entry. Each entry is an exact string, or a special pattern using wildcards (`*`/`?`), a regexp wrapped in `/`, a `cidr:`-prefixed CIDR match, or a `num:lt|le|gt|ge:`-prefixed numeric comparison.\n  - rule_id (string) (required) — Rule ID.\n  - rule_name (string) (required) — Rule name, 1-128 characters. Not required to be unique within the application.\n  - status (string) (required) — Current status of the rule. [enabled, disabled]\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the rule was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Facets.FacetCount":                           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - count (integer) (required) — Number of events with this facet value in the time range.\n  - facet_value (any) (required) — The facet value. Type matches the field's `value_type`.\n",
+	"Facets.FieldList":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID. 0 for built-in fields.\n  - description (string) (required) — Description of what this field captures.\n  - edit_able (boolean) (required) — True if this is a custom field that can be edited by the user.\n  - enum_values (array<any>) (required) — Predefined enumerable values for this field. Element type matches the field's `value_type`: string for `string`, number for `number`, boolean for `boolean`. Empty when the field has no fixed set of values.\n  - field_key (string) (required) — Unique field key, e.g. `error.type`.\n  - field_name (string) (required) — Human-readable field name.\n  - group (string) (required) — Display group for this field.\n  - is_facet (boolean) (required) — True if value distribution counting is supported for this field.\n  - queryable (boolean) (required) — True if this field can be used in DQL/SQL queries.\n  - scopes (array<string>) (required) — RUM scopes this field appears in.\n  - show_type (string) (required) — Display type in the analytics UI. One of `list` (shown as an enumerated value list; only this type supports facet counting) or `range` (filtered and shown as a numeric/time range). [list, range]\n  - status (string) (required) — Field status, e.g. `active`.\n  - unit_family (string) (required) — Measurement unit family, e.g. `time`, `bytes`. Empty for dimensionless fields.\n  - unit_name (string) (required) — Specific measurement unit, e.g. `millisecond`, `byte`.\n  - value_type (string) (required) — Data type of the field value. One of: | Value | Meaning | |---|---| | `string` | String | | `number` | Numeric | | `boolean` | Boolean | | `array<string>` | Array of strings | | `array<number>` | Array of numbers | | `array<boolean>` | Array of booleans | [string, number, boolean, array<string>, array<number>, array<boolean>]\n",
+	"ImIntegrations.List":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account this integration belongs to.\n  - category (string) (required) — Plugin category; `im` for the IM integrations returned here.\n  - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Person who created the integration.\n  - data_source_id (integer) (required) — Integration ID.\n  - description (string) (required) — Integration description.\n  - exclusive_data_source_id (integer) (required) — Legacy exclusive-integration linkage; deprecated.\n  - integration_id (integer) (required) — Integration ID, alias of data_source_id.\n  - integration_key (string) (required) — Push key used by alert sources to send to this integration.\n  - last_time (string) (required) — Unix timestamp in seconds of the most recent activity in this datasource. Always `0` — this endpoint does not populate the field. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - name (string) (required) — Integration name.\n  - no_editable (boolean) (required) — Whether the integration is read-only.\n  - plugin_id (integer) (required) — Plugin ID backing this integration.\n  - plugin_type (string) (required) — Plugin type identifier of the IM integration, for example `feishu_app`, `dingtalk_app`, `wecom_app`, `slack_app`, or `teams_app`.\n  - plugin_type_name (string) (required) — Localized display name of the integration plugin type.\n  - ref_id (string) (required) — External reference ID of the integration.\n  - settings (object) (required) — Plugin-specific configuration of the integration.\n  - status (string) (required) — Integration status: `enabled` or `disabled`. Deleted integrations are never returned. [enabled, disabled]\n  - team_id (integer) (required) — Team that owns this integration.\n  - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Person who last updated the integration.\n",
+	"Incidents.AlertList":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n  - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n  - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n  - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n  - channel_id (integer) (required) — Channel ID.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n  - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n  - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n  - data_source_type (string) — Deprecated. Use `integration_type`.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Alert description.\n  - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n  - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - incident (object) — Parent incident reference, if the alert has been merged into one.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) (required) — Integration ID that produced the alert.\n  - integration_name (string) (required) — Integration display name.\n  - integration_ref_id (string) (required) — Integration reference ID.\n  - integration_type (string) (required) — Integration type string.\n  - labels (object) (required) — Alert labels.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) (required) — Primary responder email, if any.\n  - responder_name (string) (required) — Primary responder name, if any.\n  - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) (required) — Alert title.\n  - title_rule (string) (required) — Title rendering rule.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.CommentTypeCreate":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - comment_type_id (string) (required) — ID of the created comment type (24-character hex ObjectID).\n  - item (object) (required) — An account-level comment type that can be attached to incident comments.\n    - account_id (integer) (required) — Account ID that owns the comment type.\n    - color (string) (required) — Label color as a hex value in #RRGGBB format (stored uppercase).\n    - comment_type_id (string) (required) — Comment type ID (24-character hex ObjectID).\n    - created_at (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - creator_id (integer) (required) — ID of the user who created the comment type.\n    - name (string) (required) — Display name of the comment type. Unique within the account (case-insensitive, trimmed). (≤40 chars)\n    - position (integer) (required) — 1-based display position of the comment type.\n    - updated_at (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — ID of the user who last updated the comment type.\n",
+	"Incidents.CommentTypeList":                   "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the comment type.\n  - color (string) (required) — Label color as a hex value in #RRGGBB format (stored uppercase).\n  - comment_type_id (string) (required) — Comment type ID (24-character hex ObjectID).\n  - created_at (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who created the comment type.\n  - name (string) (required) — Display name of the comment type. Unique within the account (case-insensitive, trimmed). (≤40 chars)\n  - position (integer) (required) — 1-based display position of the comment type.\n  - updated_at (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the user who last updated the comment type.\n",
+	"Incidents.Create":                            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - incident_id (string) (required) — Newly created incident ID (MongoDB ObjectID).\n  - title (string) (required) — Echoes the incident title from the request.\n",
+	"Incidents.CustomActionDo":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - message (string) — Error message if the action's HTTP call failed; omitted on success.\n",
+	"Incidents.Feed":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - created_at (string) (required) — Creation timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — User ID of the actor. `0` means system-generated.\n  - deleted_at (string) — Soft-delete timestamp (ms). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - detail (object) (required) — Type-specific payload. The concrete shape is determined by `type`; `null` when the entry has no structured detail.\n    - added_assignee_ids (array<integer>) — Member IDs added as assignees.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - assignee_ids (array<integer>) — Assignee member IDs.\n    - by (string) — Delivery channel or method label.\n    - chat_id (string) — Chat group identifier.\n    - chat_name (string) — Chat group display name.\n    - chats (array<object>) — Per-chat delivery records.\n      - chat_id (string) — Chat group identifier.\n      - chat_name (string) — Chat group display name.\n      - data_source_id (integer) — Integration data source ID used to send the notification.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n    - comment (string) — Form summary recorded as a timeline comment. Omitted when no acknowledgement form summary was submitted.\n    - comment_type (object) — Resolved display of an account-level comment type, populated at read time from the current type definition.\n      - color (string) (required) — Badge color in #RRGGBB format.\n      - id (string) (required) — Comment type ID (MongoDB ObjectID).\n      - name (string) (required) — Display name of the comment type. (≤40 chars)\n    - comment_type_id (string) — ObjectID of the account-level comment type attached to the comment.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - field_name (string) — Name of the custom field that was updated.\n    - fire_type (string) — Whether this is the first fire or a refire. `fire`: the first notification for this escalation layer; `refire`: a repeat notification to the same layer when the incident remains unhandled, sent at the layer's notify interval and capped by the layer's maximum refire count. [fire, refire]\n    - from (string) — Source that triggered the resolve. | Value | Meaning | |---|---| | `voice` | Phone-call (voice DTMF) action. | | `console` | Console (Web UI) action. | | `card` | IM notification card button (DingTalk/Feishu/Slack/Teams). | | `wcard` | WeCom notification card button. | | `event` | Event-driven: auto-close when all related alerts recover to Ok, or a close synced from an external ITSM system. | | `autorslv` | Auto-resolve: closed by the system after no new alerts within the channel's auto-resolve timeout. | | `autorefresh` | Card auto-refresh (reserved; never appears on resolve feeds). | | `escalation` | Escalation flow (reserved; never appears on resolve feeds). | [voice, console, card, wcard, event, autorslv, autorefresh, escalation]\n    - from_description (string) — Description before the update.\n    - from_priority (string) — Priority label before the update.\n    - from_status (string) — Status label before the update.\n    - from_title (string) — Title before the update.\n    - from_type (string) — Work item type before the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `from_type` is always `action` in this event. [action, follow_up]\n    - id (string) — Opaque assignment ID generated by the server.\n    - images (array<object>) — Images from the acknowledgement form, recorded on the timeline entry only. Omitted when none were submitted.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - in_mins (integer) — Window length in minutes.\n    - integration_id (integer) — Integration ID that executed the action.\n    - integration_name (string) — Integration display name.\n    - item_type (string) — Work item type. `action`: an action item anchored to the incident itself, convertible to `follow_up` later; `follow_up`: an improvement item anchored to a post-mortem, requiring the incident to be linked to that post-mortem at creation. [action, follow_up]\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - max_changes (integer) — Maximum state changes allowed within the window.\n    - minutes (integer) — Snooze duration in minutes.\n    - msg_id (string) — Upstream message ID returned by the delivery channel.\n    - mute_mins (integer) — Mute duration in minutes once flapping is detected.\n    - mute_reply (boolean) — Whether replies to this comment are muted.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - owner_id (integer) — Member ID that performed the merge.\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - persons (array<object>) — Per-person delivery records.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n      - person_id (integer) — Recipient member ID.\n      - sms_content (string) — SMS text delivered to the recipient; present on SMS deliveries.\n    - plugin_type (string) — Chat integration plugin type.\n    - post_mortem_id (string) — ID of the post-mortem the work item is bound to.\n    - progress (string) — Progress note entered at acknowledgement.\n    - reason (string) — Reason why the incident was reopened.\n    - remove_source_incidents (boolean) — True if the source incidents were removed after merging.\n    - removed_assignee_ids (array<integer>) — Member IDs removed from assignees.\n    - reporter_email (string) — Email of the reporter when the incident was created externally.\n    - rid (string) — Notification record ID.\n    - robots (array<object>) — Per-robot delivery records.\n      - alias (string) — Robot alias.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n      - token (string) — Robot token or identifier.\n    - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n    - share_link (string) — Shareable join link for the war room.\n    - snoozedBefore (integer) — Unix timestamp at which the prior snooze was scheduled to end.\n    - source_alerts (array<object>) — Source alerts merged into the target incident. Omitted when empty.\n      - alert_id (string) — Alert ID (ObjectID hex string).\n      - title (string) — Alert title, resolved at read time. Omitted when empty.\n    - source_incidents (array<object>) — Source incidents that were merged.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - source_responders (array<integer>) — Responder member IDs carried over from the source incidents.\n    - status (string) — Work item status label (e.g. `open`, `done`).\n    - target_incident (object) — Brief incident reference embedded in an alert.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - threshold (integer) — Storm threshold that was reached.\n    - title (string) — Initial incident title.\n    - to (array<integer>) — Member IDs that received the assignment.\n    - to_description (string) — Description after the update.\n    - to_priority (string) — Priority label after the update.\n    - to_status (string) — Status label after the update.\n    - to_type (string) — Work item type after the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `to_type` is always `follow_up` in this event, and a successful conversion immediately tries to bind the incident's post-mortem. [action, follow_up]\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n    - work_item_id (string) — Work item ID.\n  - ref_id (string) (required) — ObjectID of the source alert or incident this entry references.\n  - type (string) (required) — Incident timeline entry type. Each value identifies one lifecycle event; the matching `detail` payload shape is determined by this field. Incident types are prefixed with `i_`. | Type | Meaning | |---|---| | `i_new` | Incident Created: A new incident was created automatically or manually. | | `i_assign` | Assigned: Incident was assigned to responders. | | `i_a_rspd` | Responder Added: Additional responders joined the incident. | | `i_notify` | Notification dispatched through a channel at a specific escalation level. | | `i_storm` | Alert storm threshold reached on the incident. | | `i_snooze` | Notifications snoozed for a given duration. | | `i_wake` | Snooze cancelled and notifications resumed. | | `i_ack` | Acknowledged: Responder confirmed they are working on the incident. | | `i_unack` | Acknowledgement removed. | | `i_comm` | Comment: Responder logged progress or key information. | | `i_rslv` | Resolved: Incident was marked as resolved. | | `i_reopen` | Reopened: Resolved incident was reopened, possibly due to recurrence. | | `i_merge` | Merged: Multiple related incidents were merged into one. | | `i_r_title` | Title updated. | | `i_r_desc` | Description updated. | | `i_r_impact` | Impact updated. | | `i_r_rc` | Root cause updated. | | `i_r_rsltn` | Resolution updated. | | `i_r_severity` | Severity Changed: Incident severity level was adjusted. | | `i_r_field` | Custom field value updated. | | `i_m_flapping` | Incident muted by flapping detection. | | `i_m_reply` | Mute reply marker on a comment. | | `i_custom` | Action: Automated action or script was triggered. | | `i_wr_create` | War Room Created: Chat group was created for collaborative response. | | `i_wr_delete` | War room chat group deleted. | | `i_auto_refresh` | Card auto-refresh event posted back to the timeline. | | `i_wi_created` | Work Item Created: An Action or Follow-up was created. | | `i_wi_updated` | Work Item Updated: Title, description, status, or priority was changed. | | `i_wi_assignees` | Work Item Assignees Changed: Assignees were updated. | | `i_wi_completed` | Work Item Completed: An assignee marked the work item complete. | | `i_wi_converted` | Work Item Converted: An Action was converted to a Follow-up. | | `i_wi_bound` | Work Item Bound: A converted Follow-up was bound to a post-mortem. | | `i_wi_deleted` | Work Item Deleted: An Action or Follow-up was soft-deleted. | | `a_merge` | Alert Merged: An alert was merged into an existing incident. | [i_new, i_assign, i_a_rspd, i_notify, i_storm, i_snooze, i_wake, i_ack, i_unack, i_comm, i_rslv, i_reopen, i_merge, i_r_title, i_r_desc, i_r_impact, i_r_rc, i_r_rsltn, i_r_severity, i_r_field, i_m_flapping, i_m_reply, i_custom, i_wr_create, i_wr_delete, i_auto_refresh, i_wi_created, i_wi_updated, i_wi_assignees, i_wi_completed, i_wi_converted, i_wi_bound, i_wi_deleted, a_merge]\n  - updated_at (string) (required) — Last update timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.Info":                              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n        - alt (string) — Alt text.\n        - href (string) — Optional link URL when the image is clicked.\n        - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.List":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.ListByIDs":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.PastList":                          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - score (number) (required) — Similarity score from the vector search.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.PostMortemInfo":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - basics (object) (required) — Basics aggregated automatically from the linked incidents: highest severity, earliest start / latest close time, total duration, and responders.\n    - incidents_earliest_start_seconds (integer) (required) — Earliest start time among linked incidents (seconds).\n    - incidents_highest_severity (string) (required) — Highest severity among linked incidents.\n    - incidents_latest_close_seconds (integer) (required) — Latest close time among linked incidents (seconds).\n    - incidents_total_duration_seconds (integer) (required) — Cumulative duration in seconds.\n    - responders (array<object>) (required) — Responders involved in the incident(s).\n      - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - as (string) — Role label of this responder.\n      - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - email (string) — Member email, filled by the server.\n      - person_id (integer) (required) — Responder member ID.\n      - person_name (string) — Member display name, filled by the server.\n  - content (object) (required) — Post-mortem body; the object holds a single `content` field whose value is a BlockNote JSON string.\n    - content (string) (required) — Report body content (BlockNote JSON).\n  - follow_ups (string) (required) — Follow-up action items rendered as a single string.\n  - meta (object) (required) — Post-mortem metadata (lightweight shape used in lists).\n    - account_id (integer) (required) — Account ID.\n    - author_ids (array<integer>) (required) — Member IDs that contributed to the report.\n    - channel_id (integer) (required) — Owning channel ID. 0 if none.\n    - channel_name (string) (required) — Channel name, filled by the server.\n    - created_at_seconds (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - generation (integer) (required) — Collaboration document generation. Incremented by each full content reset; 0 for legacy documents.\n    - incident_ids (array<string>) (required) — Linked incident IDs.\n    - is_private (boolean) (required) — When true, only team members and admins can view.\n    - media_count (integer) (required) — Number of uploaded media files.\n    - post_mortem_id (string) (required) — Deterministic post-mortem ID derived from account and incident IDs.\n    - revision (integer) (required) — Content revision for optimistic concurrency. Monotonically increases on collaborative saves and full content resets.\n    - status (string) (required) — Post-mortem status. `drafting` means still being edited; `published` means published. [drafting, published]\n    - team_id (integer) (required) — Owning team ID. 0 if none.\n    - template_id (string) (required) — Template used to initialize the report.\n    - title (string) (required) — Report title.\n    - updated_at_seconds (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.PostMortemList":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - author_ids (array<integer>) (required) — Member IDs that contributed to the report.\n  - channel_id (integer) (required) — Owning channel ID. 0 if none.\n  - channel_name (string) (required) — Channel name, filled by the server.\n  - created_at_seconds (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - generation (integer) (required) — Collaboration document generation. Incremented by each full content reset; 0 for legacy documents.\n  - incident_ids (array<string>) (required) — Linked incident IDs.\n  - is_private (boolean) (required) — When true, only team members and admins can view.\n  - media_count (integer) (required) — Number of uploaded media files.\n  - post_mortem_id (string) (required) — Deterministic post-mortem ID derived from account and incident IDs.\n  - revision (integer) (required) — Content revision for optimistic concurrency. Monotonically increases on collaborative saves and full content resets.\n  - status (string) (required) — Post-mortem status. `drafting` means still being edited; `published` means published. [drafting, published]\n  - team_id (integer) (required) — Owning team ID. 0 if none.\n  - template_id (string) (required) — Template used to initialize the report.\n  - title (string) (required) — Report title.\n  - updated_at_seconds (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.PostMortemWriteResetContent":       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - generation (integer) (required) — New collaboration document generation after the reset.\n  - markdown_bytes (integer) (required) — UTF-8 byte length of the accepted Markdown content.\n  - markdown_sha256 (string) (required) — SHA-256 hex digest of the accepted Markdown content.\n  - post_mortem_id (string) (required) — ID of the reset post-mortem report.\n  - previous_generation (integer) (required) — Collaboration document generation before the reset.\n  - previous_revision (integer) (required) — Content revision before the reset.\n  - revision (integer) (required) — New content revision after the reset.\n",
+	"Incidents.PostmortemReadListTemplates":       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the template. 0 for built-in templates.\n  - content (string) (required) — BlockNote JSON content used to initialize the report body.\n  - content_markdown (string) (required) — Markdown version of the template content, used by AI generation.\n  - created_at_seconds (string) (required) — Unix timestamp in seconds when the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Template description.\n  - name (string) (required) — Template name shown in the console.\n  - team_id (integer) (required) — Managing team ID. Built-in templates use 0.\n  - template_id (string) (required) — Template ID. Built-in templates use a stable `post_mortem_default_tmpl_*` ID.\n  - updated_at_seconds (string) (required) — Unix timestamp in seconds when the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.PostmortemReadTemplateInfo":        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns the template. 0 for built-in templates.\n  - content (string) (required) — BlockNote JSON content used to initialize the report body.\n  - content_markdown (string) (required) — Markdown version of the template content, used by AI generation.\n  - created_at_seconds (string) (required) — Unix timestamp in seconds when the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Template description.\n  - name (string) (required) — Template name shown in the console.\n  - team_id (integer) (required) — Managing team ID. Built-in templates use 0.\n  - template_id (string) (required) — Template ID. Built-in templates use a stable `post_mortem_default_tmpl_*` ID.\n  - updated_at_seconds (string) (required) — Unix timestamp in seconds when the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.PostmortemWriteInit":               "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - basics (object) (required) — Basics aggregated automatically from the linked incidents: highest severity, earliest start / latest close time, total duration, and responders.\n    - incidents_earliest_start_seconds (integer) (required) — Earliest start time among linked incidents (seconds).\n    - incidents_highest_severity (string) (required) — Highest severity among linked incidents.\n    - incidents_latest_close_seconds (integer) (required) — Latest close time among linked incidents (seconds).\n    - incidents_total_duration_seconds (integer) (required) — Cumulative duration in seconds.\n    - responders (array<object>) (required) — Responders involved in the incident(s).\n      - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - as (string) — Role label of this responder.\n      - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - email (string) — Member email, filled by the server.\n      - person_id (integer) (required) — Responder member ID.\n      - person_name (string) — Member display name, filled by the server.\n  - content (object) (required) — Post-mortem body; the object holds a single `content` field whose value is a BlockNote JSON string.\n    - content (string) (required) — Report body content (BlockNote JSON).\n  - follow_ups (string) (required) — Follow-up action items rendered as a single string.\n  - meta (object) (required) — Post-mortem metadata (lightweight shape used in lists).\n    - account_id (integer) (required) — Account ID.\n    - author_ids (array<integer>) (required) — Member IDs that contributed to the report.\n    - channel_id (integer) (required) — Owning channel ID. 0 if none.\n    - channel_name (string) (required) — Channel name, filled by the server.\n    - created_at_seconds (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - generation (integer) (required) — Collaboration document generation. Incremented by each full content reset; 0 for legacy documents.\n    - incident_ids (array<string>) (required) — Linked incident IDs.\n    - is_private (boolean) (required) — When true, only team members and admins can view.\n    - media_count (integer) (required) — Number of uploaded media files.\n    - post_mortem_id (string) (required) — Deterministic post-mortem ID derived from account and incident IDs.\n    - revision (integer) (required) — Content revision for optimistic concurrency. Monotonically increases on collaborative saves and full content resets.\n    - status (string) (required) — Post-mortem status. `drafting` means still being edited; `published` means published. [drafting, published]\n    - team_id (integer) (required) — Owning team ID. 0 if none.\n    - template_id (string) (required) — Template used to initialize the report.\n    - title (string) (required) — Report title.\n    - updated_at_seconds (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.PostmortemWriteUpsertTemplate":     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns the template. 0 for built-in templates.\n  - content (string) (required) — BlockNote JSON content used to initialize the report body.\n  - content_markdown (string) (required) — Markdown version of the template content, used by AI generation.\n  - created_at_seconds (string) (required) — Unix timestamp in seconds when the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Template description.\n  - name (string) (required) — Template name shown in the console.\n  - team_id (integer) (required) — Managing team ID. Built-in templates use 0.\n  - template_id (string) (required) — Template ID. Built-in templates use a stable `post_mortem_default_tmpl_*` ID.\n  - updated_at_seconds (string) (required) — Unix timestamp in seconds when the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.ReadGetWarRoomDefaultObservers":    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - observers (array<object>) — Historical responders suggested as default war-room observers.\n    - account_id (integer) (required) — Account this person belongs to.\n    - as (string) — Role the person holds in the related context.\n    - avatar (string) — URL of the person's avatar image.\n    - email (string) — Email address of the person.\n    - locale (string) — Preferred language locale of the person.\n    - person_id (integer) (required) — Person ID.\n    - person_name (string) — Display name of the person.\n    - phone (string) — Phone number of the person.\n    - status (string) — Current status of the person.\n    - time_zone (string) — Time zone of the person.\n",
+	"Incidents.ServiceDeskPlusRequestReadList":    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - channel_id (integer) (required) — Channel ID for the incident.\n  - channel_name (string) (required) — Channel name for the incident.\n  - created_at (string) (required) — Mapping record creation time, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error_message (string) — Error message when synchronization failed. Usually absent on successful records.\n  - incident_id (string) (required) — Associated Flashduty incident ID.\n  - incident_title (string) (required) — Associated incident title.\n  - integration_id (integer) (required) — ServiceDeskPlus integration ID.\n  - request_id (string) (required) — ServiceDeskPlus request ID.\n  - request_link (string) (required) — ServiceDeskPlus request detail URL.\n  - status (string) (required) — Synchronization status. [success, failed]\n",
+	"Incidents.WarRoomCreate":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - chat_name (string) (required) — Chat/group display name.\n  - share_link (string) (required) — Join link for the war room, if provided by the IM.\n",
+	"Incidents.WarRoomDetail":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - chat_name (string) (required) — Chat/group display name.\n  - share_link (string) (required) — Join link for the war room, if provided by the IM.\n",
+	"Incidents.WarRoomList":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the war room.\n  - incident_id (string) (required) — Associated incident ID (MongoDB ObjectID).\n  - integration_id (integer) (required) — IM integration ID.\n  - plugin_type (string) (required) — IM plugin type (e.g. `feishu`, `dingtalk`, `wecom`, `slack`).\n  - status (string) (required) — War room record status: `enabled` active, `deleted` disbanded. [enabled, deleted]\n",
+	"Incidents.WorkItemBindPostMortem":            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n  - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n  - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID of the creator.\n  - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n  - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n  - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n  - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n  - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n  - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n  - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n  - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n  - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last updater.\n  - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n  - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n",
+	"Incidents.WorkItemComplete":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
+	"Incidents.WorkItemConvert":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
+	"Incidents.WorkItemCreate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key and no new item was created.\n  - item (object) (required) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n",
+	"Incidents.WorkItemDelete":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
+	"Incidents.WorkItemList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n  - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n  - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID of the creator.\n  - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n  - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n  - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n  - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n  - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n  - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n  - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n  - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n  - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last updater.\n  - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n  - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n",
+	"Incidents.WorkItemResetAssignees":            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
+	"Incidents.WorkItemUpdate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
+	"Integrations.DatasourceImPersonTryLink":      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - new_linked_person_ids (array<integer>) (required) — Person IDs newly linked during this call.\n",
+	"Integrations.Detail":                         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - attempt (integer) (required) — Attempt sequence number.\n  - channel_id (integer) — Channel ID when applicable.\n  - channel_name (string) — Name of the associated channel, resolved at query time.\n  - duration (integer) (required) — Total elapsed time of the attempt in milliseconds.\n  - endpoint (string) (required) — Destination URL.\n  - error_message (string) — Error message when delivery failed.\n  - event_id (string) (required) — Event ID.\n  - event_time (string) (required) — Event time formatted as `YYYY-MM-DD HH:MM:SS.ffffff`.\n  - event_type (string) (required) — Event type code. `i_*` values are incident events (for example `i_new` = incident created); `a_*` values are alert events (for example `a_new` = alert triggered).\n  - integration_id (integer) (required) — Integration ID.\n  - ref_id (string) — Source object ID.\n  - ref_title (string) — Title of the source incident or alert, resolved at query time.\n  - request_body (string) — Outbound request body payload.\n  - request_headers (string) — Serialized outbound request headers.\n  - response_body (string) — Response body.\n  - response_headers (string) — Serialized response headers.\n  - status (string) (required) — Delivery outcome. [success, failed]\n  - status_code (integer) (required) — HTTP status code.\n  - webhook_type (string) (required) — Source object kind: `incident` or `alert`. [incident, alert]\n",
+	"Integrations.List":                           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - attempt (integer) (required) — Attempt sequence number.\n  - channel_id (integer) — Channel ID associated with the event, when applicable.\n  - duration (integer) (required) — Total elapsed time of the attempt in milliseconds.\n  - endpoint (string) (required) — Destination URL.\n  - error_message (string) — Error message when delivery failed.\n  - event_id (string) (required) — Unique event identifier for the delivery attempt.\n  - event_time (string) (required) — Event time formatted as `YYYY-MM-DD HH:MM:SS.ffffff`.\n  - event_type (string) (required) — Event type code. `i_*` values are incident events (for example `i_new` = incident created); `a_*` values are alert events (for example `a_new` = alert triggered).\n  - integration_id (integer) (required) — Integration ID that triggered the webhook.\n  - ref_id (string) — Source object ID (incident ID or alert ID).\n  - request_body (string) — Outbound request body payload.\n  - request_headers (string) — Serialized outbound request headers.\n  - response_body (string) — Response body returned by the destination.\n  - response_headers (string) — Serialized response headers from the destination.\n  - status (string) (required) — Delivery outcome. [success, failed]\n  - status_code (integer) (required) — HTTP status code returned by the destination.\n  - webhook_type (string) (required) — Source object kind: `incident` or `alert`. [incident, alert]\n",
+	"IssuePresetSeverityRules.Create":             "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - priority (integer) (required) — Evaluation order assigned to the new rule (always the current lowest precedence, i.e. current max + 1).\n  - rule_id (string) (required) — ID of the newly created rule.\n  - rule_name (string) (required) — Echo of the rule's display name.\n",
+	"IssuePresetSeverityRules.HistoryList":        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - rules (array<object>) (required) — Full rule set captured immediately before the mutation that produced this snapshot. Empty for the very first snapshot.\n    - account_id (integer) (required) — Account ID the rule belongs to.\n    - application_id (string) (required) — RUM application ID the rule belongs to.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the rule was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID who originally created the rule.\n    - deleted_at (string) (required) — Unix timestamp in milliseconds the rule was soft-deleted; `0` means not deleted. Always `0` in practice, since deleted rules are excluded before a snapshot is taken. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Rule description. May be empty.\n    - filters (array<array<object>>) (required) — OR-of-ANDs filter structure: the outer array is OR'd, each inner array is AND'd. A rule matches an error when at least one inner AND-group fully matches.\n      - key (string) (required) — Filter attribute key. Only these Error-level attributes are supported for preset severity rules. | Value | Meaning | |---|---| | `error.usr_id` | User ID | | `error.usr_email` | User email | | `error.view_url` | Full URL of the page where the error occurred | | `error.view_url_path` | URL path of the page where the error occurred | | `error.error_type` | Error type | | `error.error_message` | Error message | | `error.env` | Environment (e.g. production/staging) | | `error.service` | Service name | | `error.device_type` | Device type | | `error.os_name` | Operating system name | | `error.browser_name` | Browser name | | `error.is_crash` | Whether the error is a crash (boolean) | [error.usr_id, error.usr_email, error.view_url, error.view_url_path, error.error_type, error.error_message, error.env, error.service, error.device_type, error.os_name, error.browser_name, error.is_crash]\n      - oper (string) (required) — Match semantics: `IN` matches when the field's value matches any of `vals`; `NOTIN` matches when it matches none of them (and matches when the field is absent). [IN, NOTIN]\n      - vals (array<string>) (required) — Values to match against. Each entry supports exact string match, wildcard (`*`/`?`), regex (wrap in `/.../`), CIDR (`cidr:10.0.0.0/8`) for IP-shaped values, or numeric comparison (`num:gt:100`, `num:le:50`, etc.).\n    - id (integer) (required) — Internal auto-increment row ID. Not stable across a history revert — reverting reinserts rows with new IDs.\n    - priority (integer) (required) — Evaluation order at snapshot time; `1` is highest precedence.\n    - rule_id (string) (required) — Unique rule ID.\n    - rule_name (string) (required) — Rule display name.\n    - severity (string) (required) — Severity assigned to errors matching this rule. [Critical, Warning, Info]\n    - status (string) (required) — Rule status at snapshot time. [enabled, disabled]\n    - updated_at (string) (required) — Unix timestamp in milliseconds when the rule was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID who last updated the rule as of snapshot time.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the snapshot was written. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID who triggered the mutation this snapshot precedes.\n  - updated_by_name (string) (required) — Display name of `updated_by` at the time of the change.\n  - version (integer) (required) — Monotonically increasing snapshot version number, starting at 1.\n",
+	"IssuePresetSeverityRules.List":               "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Unix timestamp in milliseconds when the rule was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Rule description. May be empty.\n  - filters (array<array<object>>) (required) — OR-of-ANDs filter structure: the outer array is OR'd, each inner array is AND'd. A rule matches an error when at least one inner AND-group fully matches.\n    - key (string) (required) — Filter attribute key. Only these Error-level attributes are supported for preset severity rules. | Value | Meaning | |---|---| | `error.usr_id` | User ID | | `error.usr_email` | User email | | `error.view_url` | Full URL of the page where the error occurred | | `error.view_url_path` | URL path of the page where the error occurred | | `error.error_type` | Error type | | `error.error_message` | Error message | | `error.env` | Environment (e.g. production/staging) | | `error.service` | Service name | | `error.device_type` | Device type | | `error.os_name` | Operating system name | | `error.browser_name` | Browser name | | `error.is_crash` | Whether the error is a crash (boolean) | [error.usr_id, error.usr_email, error.view_url, error.view_url_path, error.error_type, error.error_message, error.env, error.service, error.device_type, error.os_name, error.browser_name, error.is_crash]\n    - oper (string) (required) — Match semantics: `IN` matches when the field's value matches any of `vals`; `NOTIN` matches when it matches none of them (and matches when the field is absent). [IN, NOTIN]\n    - vals (array<string>) (required) — Values to match against. Each entry supports exact string match, wildcard (`*`/`?`), regex (wrap in `/.../`), CIDR (`cidr:10.0.0.0/8`) for IP-shaped values, or numeric comparison (`num:gt:100`, `num:le:50`, etc.).\n  - priority (integer) (required) — Evaluation order among the application's rules. `1` is evaluated first (highest precedence); the first enabled rule whose filters match wins.\n  - rule_id (string) (required) — Unique rule ID.\n  - rule_name (string) (required) — Rule display name.\n  - severity (string) (required) — Severity assigned to errors matching this rule. [Critical, Warning, Info]\n  - status (string) (required) — Only enabled rules are evaluated against incoming errors. [enabled, disabled]\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the rule was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Issues.ReadInfo":                             "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - age (integer) — Time span between the first and most recent occurrence, in seconds.\n  - application_id (string) — ID of the RUM application this issue belongs to.\n  - application_name (string) — Name of the owning application, resolved by `application_id` at query time (reflects the application's current name).\n  - created_at (string) — Issue creation time (client time of the first error event), Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error (object) — Representative error of this issue, taken from the error event that created it.\n    - message (string) — Normalized error message, truncated to at most 512 characters.\n    - type (string) — Error type, from the error event's `error_type` field as reported by the SDK.\n  - error_count (integer) — Total error occurrences.\n  - first_seen (object) — Information about the issue's first occurrence (time and application version).\n    - timestamp (string) — Client time of the first error event, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (string) — Application version at first occurrence; empty string when the event carries no version.\n  - is_crash (boolean) — Whether the error caused an app crash.\n  - issue_id (string) — Unique issue ID.\n  - last_seen (object) — Information about the issue's most recent occurrence (time and application version).\n    - timestamp (string) — Client time of the most recent error event, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (string) — Application version at the most recent occurrence; empty string when the event carries no version.\n  - regression (object) — Regression metadata. Present only when a previously resolved issue re-occurred.\n    - regressed_at (string) — Time the regression was detected, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - regressed_at_version (string) — Application version in which the regression was observed.\n    - resolved_at (string) — When the issue was resolved before this regression, as a Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - resolved_at (string) — Time the issue was marked resolved, Unix timestamp in milliseconds; 0 while unresolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - resolved_by (integer) — Person ID of the user who marked the issue resolved; 0 while unresolved.\n  - service (string) — Name of the service that produced this issue, taken from the error event's `service` field.\n  - session_count (integer) — Affected user sessions.\n  - severity (string) — Issue severity: `Critical`, `Warning`, or `Info`. Empty string on legacy issues created before severity existed. [Critical, Warning, Info]\n  - status (string) — Triage status of the issue; soft-deleted (`deleted`) issues are never returned. | Value | Meaning | |---|---| | `for_review` | Pending triage | | `reviewed` | Reviewed | | `ignored` | Ignored | | `resolved` | Resolved | [for_review, reviewed, ignored, resolved]\n  - suspected_cause (object) — Suspected root cause analysis, determined automatically (rules or AI) or set manually by a user.\n    - person_id (integer) — Person ID of the user who manually set the cause; 0 when `source` is `auto`.\n    - reason (string) — Explanation for the cause determination, generated only by AI analysis; empty string when AI is disabled or analysis has not run.\n    - source (string) — Origin of the cause: `auto` for system-determined, `user` for manually set. [auto, user]\n    - value (string) — Suspected cause category. One of: | Value | Meaning | |---|---| | `api.failed_request` | API request failure (e.g. HTTP 4xx/5xx responses) | | `network.error` | Network connectivity error (offline, aborted requests, etc.) | | `code.exception` | Code exception (Syntax/Reference/Range and similar runtime errors) | | `code.invalid_object_access` | Invalid object access (e.g. reading a property of `undefined`/`null`) | | `code.invalid_argument` | Invalid argument passed to a function | | `unknown` | Cause could not be determined | [api.failed_request, network.error, code.exception, code.invalid_object_access, code.invalid_argument, unknown]\n  - team_id (integer) — ID of the team owning this issue, copied from the owning application's `team_id` at issue creation.\n  - updated_at (string) — Time the issue was last updated, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - versions (array<string>) — Deduplicated list of application versions in which this issue has occurred; may contain an empty string for events without version info.\n",
+	"Issues.ReadList":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - age (integer) — Time span between the first and most recent occurrence, in seconds.\n  - application_id (string) — ID of the RUM application this issue belongs to.\n  - application_name (string) — Name of the owning application, resolved by `application_id` at query time (reflects the application's current name).\n  - created_at (string) — Issue creation time (client time of the first error event), Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error (object) — Representative error of this issue, taken from the error event that created it.\n    - message (string) — Normalized error message, truncated to at most 512 characters.\n    - type (string) — Error type, from the error event's `error_type` field as reported by the SDK.\n  - error_count (integer) — Total error occurrences.\n  - first_seen (object) — Information about the issue's first occurrence (time and application version).\n    - timestamp (string) — Client time of the first error event, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (string) — Application version at first occurrence; empty string when the event carries no version.\n  - is_crash (boolean) — Whether the error caused an app crash.\n  - issue_id (string) — Unique issue ID.\n  - last_seen (object) — Information about the issue's most recent occurrence (time and application version).\n    - timestamp (string) — Client time of the most recent error event, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (string) — Application version at the most recent occurrence; empty string when the event carries no version.\n  - regression (object) — Regression metadata. Present only when a previously resolved issue re-occurred.\n    - regressed_at (string) — Time the regression was detected, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - regressed_at_version (string) — Application version in which the regression was observed.\n    - resolved_at (string) — When the issue was resolved before this regression, as a Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - resolved_at (string) — Time the issue was marked resolved, Unix timestamp in milliseconds; 0 while unresolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - resolved_by (integer) — Person ID of the user who marked the issue resolved; 0 while unresolved.\n  - service (string) — Name of the service that produced this issue, taken from the error event's `service` field.\n  - session_count (integer) — Affected user sessions.\n  - severity (string) — Issue severity: `Critical`, `Warning`, or `Info`. Empty string on legacy issues created before severity existed. [Critical, Warning, Info]\n  - status (string) — Triage status of the issue; soft-deleted (`deleted`) issues are never returned. | Value | Meaning | |---|---| | `for_review` | Pending triage | | `reviewed` | Reviewed | | `ignored` | Ignored | | `resolved` | Resolved | [for_review, reviewed, ignored, resolved]\n  - suspected_cause (object) — Suspected root cause analysis, determined automatically (rules or AI) or set manually by a user.\n    - person_id (integer) — Person ID of the user who manually set the cause; 0 when `source` is `auto`.\n    - reason (string) — Explanation for the cause determination, generated only by AI analysis; empty string when AI is disabled or analysis has not run.\n    - source (string) — Origin of the cause: `auto` for system-determined, `user` for manually set. [auto, user]\n    - value (string) — Suspected cause category. One of: | Value | Meaning | |---|---| | `api.failed_request` | API request failure (e.g. HTTP 4xx/5xx responses) | | `network.error` | Network connectivity error (offline, aborted requests, etc.) | | `code.exception` | Code exception (Syntax/Reference/Range and similar runtime errors) | | `code.invalid_object_access` | Invalid object access (e.g. reading a property of `undefined`/`null`) | | `code.invalid_argument` | Invalid argument passed to a function | | `unknown` | Cause could not be determined | [api.failed_request, network.error, code.exception, code.invalid_object_access, code.invalid_argument, unknown]\n  - team_id (integer) — ID of the team owning this issue, copied from the owning application's `team_id` at issue creation.\n  - updated_at (string) — Time the issue was last updated, Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - versions (array<string>) — Deduplicated list of application versions in which this issue has occurred; may contain an empty string for events without version info.\n",
+	"Knowledge.FileReadGet":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - content_b64 (string) (required) — Base64-encoded file content; decodes to UTF-8 text.\n  - file (object) (required) — Metadata of one file inside a knowledge pack. Content is fetched separately via file/get.\n    - checksum (string) (required) — SHA-256 hex digest of the file content.\n    - content_type (string) (required) — MIME type; inferred from the file extension when not set on upload.\n    - file_id (string) (required) — File ID (`kfl_` prefix).\n    - pack_id (string) (required) — ID of the knowledge pack that contains the file.\n    - rel_path (string) (required) — Path relative to the pack root, e.g. `runbooks/restart.md`.\n    - size_bytes (integer) (required) — File size in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the file was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Person ID of the member who last modified the file.\n",
+	"Knowledge.FileReadList":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - files (array<object>) (required) — Array of files in the specified knowledge pack; empty array when the pack has no files.\n    - checksum (string) (required) — SHA-256 hex digest of the file content.\n    - content_type (string) (required) — MIME type; inferred from the file extension when not set on upload.\n    - file_id (string) (required) — File ID (`kfl_` prefix).\n    - pack_id (string) (required) — ID of the knowledge pack that contains the file.\n    - rel_path (string) (required) — Path relative to the pack root, e.g. `runbooks/restart.md`.\n    - size_bytes (integer) (required) — File size in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the file was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Person ID of the member who last modified the file.\n  - total (integer) (required) — Total number of files in the pack.\n",
+	"Knowledge.FileWriteDelete":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - warnings (array<object>) — Non-blocking warnings after deletion; `code=still_referenced_by` means the (force-)deleted file is still @ref-referenced by other files in the pack (`refs` lists the referrers). Absent when there are no warnings (omitempty).\n    - code (string) (required) — Warning code. One of: `unresolved_reference` (an @ref in the written file's content points to a file that does not exist in the pack; `ref` carries it), `still_referenced_by` (the deleted file is still @ref-referenced by other files in the pack; `refs` lists the referrers). [unresolved_reference, still_referenced_by]\n    - ref (string) — Single reference related to the warning.\n    - refs (array<string>) — Multiple references related to the warning.\n",
+	"Knowledge.FileWritePut":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - file (object) (required) — Metadata of one file inside a knowledge pack. Content is fetched separately via file/get.\n    - checksum (string) (required) — SHA-256 hex digest of the file content.\n    - content_type (string) (required) — MIME type; inferred from the file extension when not set on upload.\n    - file_id (string) (required) — File ID (`kfl_` prefix).\n    - pack_id (string) (required) — ID of the knowledge pack that contains the file.\n    - rel_path (string) (required) — Path relative to the pack root, e.g. `runbooks/restart.md`.\n    - size_bytes (integer) (required) — File size in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the file was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Person ID of the member who last modified the file.\n  - warnings (array<object>) — Non-blocking warnings after a successful write; `code=unresolved_reference` means an @ref in the file content points to a file that does not exist in the pack. Absent when there are no warnings (omitempty).\n    - code (string) (required) — Warning code. One of: `unresolved_reference` (an @ref in the written file's content points to a file that does not exist in the pack; `ref` carries it), `still_referenced_by` (the deleted file is still @ref-referenced by other files in the pack; `refs` lists the referrers). [unresolved_reference, still_referenced_by]\n    - ref (string) — Single reference related to the warning.\n    - refs (array<string>) — Multiple references related to the warning.\n",
+	"Knowledge.PackReadGet":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - files (array<object>) (required) — Array of files in this knowledge pack; empty array when the pack has no files.\n    - checksum (string) (required) — SHA-256 hex digest of the file content.\n    - content_type (string) (required) — MIME type; inferred from the file extension when not set on upload.\n    - file_id (string) (required) — File ID (`kfl_` prefix).\n    - pack_id (string) (required) — ID of the knowledge pack that contains the file.\n    - rel_path (string) (required) — Path relative to the pack root, e.g. `runbooks/restart.md`.\n    - size_bytes (integer) (required) — File size in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the file was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Person ID of the member who last modified the file.\n  - pack (object) (required) — A knowledge pack — a versioned file tree staged into every AI SRE sandbox at session start. One pack exists per (account, scope, scope_id).\n    - account_id (integer) (required) — Account that owns the pack.\n    - can_edit (boolean) (required) — Whether the caller can edit this pack.\n    - created_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Person ID of the member who created the pack.\n    - duty_version (integer) (required) — Pack version at which DUTY.md was last authored or re-affirmed. When `version` is greater, DUTY.md no longer reflects every file in the pack.\n    - file_count (integer) (required) — Number of files in the pack.\n    - pack_id (string) (required) — Knowledge pack ID (`kpk_` prefix).\n    - scope (string) (required) — Pack scope. `channel` is a legacy scope; new packs are `account` or `team`. [account, team, channel]\n    - scope_id (integer) (required) — Scope owner: the account ID for `account` scope, the team ID for `team` scope.\n    - team_name (string) — Display name of the owning team (team scope only). Omitted when empty (account scope, or the team name could not be resolved).\n    - total_bytes (integer) (required) — Total size of all files in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (integer) (required) — Pack version, incremented on every file change.\n",
+	"Knowledge.PackReadList":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - packs (array<object>) (required) — Array of visible knowledge packs after filtering (current page), used with `total` for pagination.\n    - account_id (integer) (required) — Account that owns the pack.\n    - can_edit (boolean) (required) — Whether the caller can edit this pack.\n    - created_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Person ID of the member who created the pack.\n    - duty_version (integer) (required) — Pack version at which DUTY.md was last authored or re-affirmed. When `version` is greater, DUTY.md no longer reflects every file in the pack.\n    - file_count (integer) (required) — Number of files in the pack.\n    - pack_id (string) (required) — Knowledge pack ID (`kpk_` prefix).\n    - scope (string) (required) — Pack scope. `channel` is a legacy scope; new packs are `account` or `team`. [account, team, channel]\n    - scope_id (integer) (required) — Scope owner: the account ID for `account` scope, the team ID for `team` scope.\n    - team_name (string) — Display name of the owning team (team scope only). Omitted when empty (account scope, or the team name could not be resolved).\n    - total_bytes (integer) (required) — Total size of all files in bytes.\n    - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - version (integer) (required) — Pack version, incremented on every file change.\n  - total (integer) (required) — Total number of packs after filtering, before pagination.\n",
+	"Knowledge.PackWriteDelete":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - ok (boolean) (required) — True when the pack was deleted.\n",
+	"Knowledge.PackWriteEnsure":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account that owns the pack.\n  - can_edit (boolean) (required) — Whether the caller can edit this pack.\n  - created_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Person ID of the member who created the pack.\n  - duty_version (integer) (required) — Pack version at which DUTY.md was last authored or re-affirmed. When `version` is greater, DUTY.md no longer reflects every file in the pack.\n  - file_count (integer) (required) — Number of files in the pack.\n  - pack_id (string) (required) — Knowledge pack ID (`kpk_` prefix).\n  - scope (string) (required) — Pack scope. `channel` is a legacy scope; new packs are `account` or `team`. [account, team, channel]\n  - scope_id (integer) (required) — Scope owner: the account ID for `account` scope, the team ID for `team` scope.\n  - team_name (string) — Display name of the owning team (team scope only). Omitted when empty (account scope, or the team name could not be resolved).\n  - total_bytes (integer) (required) — Total size of all files in bytes.\n  - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (integer) (required) — Pack version, incremented on every file change.\n",
+	"Knowledge.PackWriteUpdate":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account that owns the pack.\n  - can_edit (boolean) (required) — Whether the caller can edit this pack.\n  - created_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Person ID of the member who created the pack.\n  - duty_version (integer) (required) — Pack version at which DUTY.md was last authored or re-affirmed. When `version` is greater, DUTY.md no longer reflects every file in the pack.\n  - file_count (integer) (required) — Number of files in the pack.\n  - pack_id (string) (required) — Knowledge pack ID (`kpk_` prefix).\n  - scope (string) (required) — Pack scope. `channel` is a legacy scope; new packs are `account` or `team`. [account, team, channel]\n  - scope_id (integer) (required) — Scope owner: the account ID for `account` scope, the team ID for `team` scope.\n  - team_name (string) — Display name of the owning team (team scope only). Omitted when empty (account scope, or the team name could not be resolved).\n  - total_bytes (integer) (required) — Total size of all files in bytes.\n  - updated_at_ms (string) (required) — Unix timestamp in milliseconds when the pack was last modified. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (integer) (required) — Pack version, incremented on every file change.\n",
+	"Licenses.List":                               "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Unix timestamp when a fixed license was assigned. `0` for temporary licenses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - person_id (integer) (required) — ID of the licensed person.\n  - person_name (string) (required) — Display name of the licensed person.\n  - type (string) (required) — License assignment type. `fixed` is explicitly assigned; `temporary` is held from the active license window. [fixed, temporary]\n  - updated_at (string) (required) — Unix timestamp when a fixed license was last changed. `0` for temporary licenses. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Person ID that last changed a fixed license. `0` for temporary licenses.\n",
+	"McpServers.ReadServerGet":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - ai_description (string) — LLM-generated description, preferred over `description` when present. Omitted when not yet generated.\n  - allow_insecure_oauth_http (boolean) — Allow this server's OAuth token exchange over plaintext HTTP; testing use only. Omitted when false.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this server; testing use only. Omitted when false.\n  - args (array<string>) — Command arguments (stdio transport).\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - call_timeout (integer) (required) — Tool-call timeout in seconds (0 = server default, 60s).\n  - can_edit (boolean) (required) — Whether the caller may edit this server.\n  - command (string) — Executable command (stdio transport only).\n  - connect_timeout (integer) (required) — Connection timeout in seconds (0 = server default, 10s).\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the server.\n  - description (string) (required) — Server description.\n  - env (object) — Environment variables (stdio transport). Secret values are masked.\n  - environments (array<string>) (required) — Execution environments this server is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - headers (object) — HTTP headers (sse / streamable-http). Secret values are masked.\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - proxy_url (string) — Outbound proxy URL used to reach the server.\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - server_id (string) (required) — Unique MCP server ID (prefix `mcp_`).\n  - server_name (string) (required) — MCP server name, unique within its scope (account-wide or one team), case-insensitive.\n  - source_template_name (string) — Marketplace template this connector was installed from; empty for user-authored.\n  - status (string) (required) — Server status. [enabled, disabled]\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - transport (string) (required) — Transport protocol. One of: `stdio` (standard I/O to a local subprocess), `sse` (standalone SSE, the legacy MCP transport), `streamable-http` (the newer HTTP streaming transport). [stdio, sse, streamable-http]\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - url (string) — Server URL (sse / streamable-http transport).\n",
+	"McpServers.ReadServerList":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - servers (array<object>) (required) — MCP servers on this page.\n    - account_id (integer) (required) — Owning account ID.\n    - ai_description (string) — LLM-generated description, preferred over `description` when present. Omitted when not yet generated.\n    - allow_insecure_oauth_http (boolean) — Allow this server's OAuth token exchange over plaintext HTTP; testing use only. Omitted when false.\n    - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this server; testing use only. Omitted when false.\n    - args (array<string>) — Command arguments (stdio transport).\n    - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n    - call_timeout (integer) (required) — Tool-call timeout in seconds (0 = server default, 60s).\n    - can_edit (boolean) (required) — Whether the caller may edit this server.\n    - command (string) — Executable command (stdio transport only).\n    - connect_timeout (integer) (required) — Connection timeout in seconds (0 = server default, 10s).\n    - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID that created the server.\n    - description (string) (required) — Server description.\n    - env (object) — Environment variables (stdio transport). Secret values are masked.\n    - environments (array<string>) (required) — Execution environments this server is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n    - headers (object) — HTTP headers (sse / streamable-http). Secret values are masked.\n    - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n    - proxy_url (string) — Outbound proxy URL used to reach the server.\n    - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n    - server_id (string) (required) — Unique MCP server ID (prefix `mcp_`).\n    - server_name (string) (required) — MCP server name, unique within its scope (account-wide or one team), case-insensitive.\n    - source_template_name (string) — Marketplace template this connector was installed from; empty for user-authored.\n    - status (string) (required) — Server status. [enabled, disabled]\n    - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n    - transport (string) (required) — Transport protocol. One of: `stdio` (standard I/O to a local subprocess), `sse` (standalone SSE, the legacy MCP transport), `streamable-http` (the newer HTTP streaming transport). [stdio, sse, streamable-http]\n    - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - url (string) — Server URL (sse / streamable-http transport).\n  - total (integer) (required) — Total number of matching servers.\n",
+	"McpServers.WriteServerCreate":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - ai_description (string) — LLM-generated description, preferred over `description` when present. Omitted when not yet generated.\n  - allow_insecure_oauth_http (boolean) — Allow this server's OAuth token exchange over plaintext HTTP; testing use only. Omitted when false.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this server; testing use only. Omitted when false.\n  - args (array<string>) — Command arguments (stdio transport).\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - call_timeout (integer) (required) — Tool-call timeout in seconds (0 = server default, 60s).\n  - can_edit (boolean) (required) — Whether the caller may edit this server.\n  - command (string) — Executable command (stdio transport only).\n  - connect_timeout (integer) (required) — Connection timeout in seconds (0 = server default, 10s).\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the server.\n  - description (string) (required) — Server description.\n  - env (object) — Environment variables (stdio transport). Secret values are masked.\n  - environments (array<string>) (required) — Execution environments this server is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - headers (object) — HTTP headers (sse / streamable-http). Secret values are masked.\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - proxy_url (string) — Outbound proxy URL used to reach the server.\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - server_id (string) (required) — Unique MCP server ID (prefix `mcp_`).\n  - server_name (string) (required) — MCP server name, unique within its scope (account-wide or one team), case-insensitive.\n  - source_template_name (string) — Marketplace template this connector was installed from; empty for user-authored.\n  - status (string) (required) — Server status. [enabled, disabled]\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - transport (string) (required) — Transport protocol. One of: `stdio` (standard I/O to a local subprocess), `sse` (standalone SSE, the legacy MCP transport), `streamable-http` (the newer HTTP streaming transport). [stdio, sse, streamable-http]\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - url (string) — Server URL (sse / streamable-http transport).\n",
+	"McpServers.WriteServerUpdate":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - ai_description (string) — LLM-generated description, preferred over `description` when present. Omitted when not yet generated.\n  - allow_insecure_oauth_http (boolean) — Allow this server's OAuth token exchange over plaintext HTTP; testing use only. Omitted when false.\n  - allow_insecure_tls_skip_verify (boolean) — Skip TLS certificate verification when connecting to this server; testing use only. Omitted when false.\n  - args (array<string>) — Command arguments (stdio transport).\n  - auth_mode (string) — Authentication mode. One of: `shared` (a single static credential saved on the resource and shared by all callers in the account; the default — an empty value behaves the same), `per_user_secret` (each user stores their own secret per `secret_schema`, injected per user at runtime), `per_user_oauth` (each user completes their own OAuth grant; discovery and registration run lazily on first use). [shared, per_user_secret, per_user_oauth]\n  - call_timeout (integer) (required) — Tool-call timeout in seconds (0 = server default, 60s).\n  - can_edit (boolean) (required) — Whether the caller may edit this server.\n  - command (string) — Executable command (stdio transport only).\n  - connect_timeout (integer) (required) — Connection timeout in seconds (0 = server default, 10s).\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the server.\n  - description (string) (required) — Server description.\n  - env (object) — Environment variables (stdio transport). Secret values are masked.\n  - environments (array<string>) (required) — Execution environments this server is callable from (`cloud` and/or BYOC runner environment IDs). Always present; `[]` means all environments (also the value on legacy rows created before this field).\n  - headers (object) — HTTP headers (sse / streamable-http). Secret values are masked.\n  - oauth_metadata (string) — JSON-encoded OAuth metadata (per_user_oauth mode).\n  - proxy_url (string) — Outbound proxy URL used to reach the server.\n  - secret_schema (string) — JSON-encoded secret schema (per_user_secret mode).\n  - server_id (string) (required) — Unique MCP server ID (prefix `mcp_`).\n  - server_name (string) (required) — MCP server name, unique within its scope (account-wide or one team), case-insensitive.\n  - source_template_name (string) — Marketplace template this connector was installed from; empty for user-authored.\n  - status (string) (required) — Server status. [enabled, disabled]\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - transport (string) (required) — Transport protocol. One of: `stdio` (standard I/O to a local subprocess), `sse` (standalone SSE, the legacy MCP transport), `streamable-http` (the newer HTTP streaming transport). [stdio, sse, streamable-http]\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - url (string) — Server URL (sse / streamable-http transport).\n",
+	"Members.MemberInfo":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_avatar (string) (required) — Account avatar URL\n  - account_email (string) (required) — Account email\n  - account_id (integer) (required) — Account ID\n  - account_locale (string) — Account-level locale preference (e.g. zh-CN or en-US). Omitted when the account has none set.\n  - account_name (string) (required) — Account name\n  - account_role_ids (array<integer>) (required) — Assigned role IDs\n  - account_time_zone (string) — Account-level time zone (e.g. Asia/Shanghai). Omitted when the account has none set.\n  - avatar (string) (required) — Member avatar URL\n  - country_code (string) (required) — ISO 3166-1 alpha-2 region code of the member's contact phone (e.g. \"CN\", \"US\", \"HK\").\n  - created_at (string) (required) — Member creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - domain (string) (required) — Account domain\n  - email (string) (required) — Email address\n  - email_verified (boolean) (required) — Whether email is verified\n  - is_external (boolean) (required) — Whether provisioned via SSO\n  - locale (string) — Member's locale preference. Omitted when the member has none set.\n  - member_id (integer) (required) — Member ID\n  - member_name (string) (required) — Member display name\n  - mp_account_id (string) — Account identifier on the marketplace platform. Omitted together with `mp_plat`.\n  - mp_plat (string) — Cloud marketplace platform the account was provisioned from. Omitted when the account did not come from a marketplace.\n  - phone (string) (required) — Masked phone number\n  - phone_verified (boolean) (required) — Whether phone is verified\n  - time_zone (string) — Member's IANA time zone. Omitted when the member has none set.\n",
+	"Members.MemberInvite":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - member_id (integer) — Member ID\n  - member_name (string) — Member display name\n",
+	"Members.MemberList":                          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID\n  - account_role_ids (array<integer>) (required) — Role IDs\n  - avatar (string) (required) — Avatar URL\n  - country_code (string) (required) — ISO 3166-1 alpha-2 region code of the member's contact phone (e.g. \"CN\", \"US\", \"HK\").\n  - created_at (string) (required) — Creation timestamp (Unix seconds) CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - email (string) (required) — Email address\n  - email_verified (boolean) (required) — Email verified\n  - is_external (boolean) (required) — Provisioned via SSO\n  - locale (string) — Member's locale preference (e.g. `zh-CN`). Omitted when empty — the list endpoint does not populate it.\n  - member_id (integer) (required) — Member ID\n  - member_name (string) (required) — Display name\n  - phone (string) (required) — Masked phone number\n  - phone_verified (boolean) (required) — Phone verified\n  - ref_id (string) (required) — External reference ID\n  - status (string) (required) — Member status. `enabled` — active member; `pending` — invited but not yet accepted; `deleted` — removed from the organization. [enabled, pending, deleted]\n  - time_zone (string) — Member's IANA time zone (e.g. `Asia/Shanghai`). Omitted when empty — the list endpoint does not populate it.\n  - updated_at (string) (required) — Update timestamp (Unix seconds) CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Members.PersonInfos":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID\n  - as (string) — Principal kind: `account` — the account owner principal; `member` — an organization member. [account, member]\n  - avatar (string) — Avatar URL. Omitted when empty.\n  - email (string) — Email address. Omitted when empty.\n  - email_verified (boolean) (required) — Email verified\n  - locale (string) — Locale. Omitted when empty.\n  - person_id (integer) (required) — Person ID\n  - person_name (string) — Display name. Omitted when empty.\n  - phone (string) — Phone number. Omitted when empty — this endpoint never populates it.\n  - phone_verified (boolean) (required) — Whether the phone is verified. Always false in this endpoint's response.\n  - status (string) — Person status. `enabled` — active; `pending` — invited but not yet accepted; `deleted` — removed. Omitted when empty. [enabled, pending, deleted]\n  - time_zone (string) — Time zone. Omitted when empty.\n",
+	"NotificationTemplates.ReadInfo":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — ID of the owning account.\n  - created_at (string) (required) — Unix epoch seconds the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - deleted_at (string) — Unix epoch seconds the template was soft-deleted. Absent (omitempty) when the template is live. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Free-form description.\n  - dingtalk (string) (required) — DingTalk robot message template source.\n  - dingtalk_app (string) (required) — DingTalk app message template source.\n  - email (string) (required) — Email body template source (Go `html/template` syntax).\n  - feishu (string) (required) — Feishu robot message template source.\n  - feishu_app (string) (required) — Feishu app message template source.\n  - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.\n  - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.\n  - slack (string) (required) — Slack robot message template source.\n  - slack_app (string) (required) — Slack app message template source.\n  - sms (string) (required) — SMS template source (Go `text/template` syntax).\n  - status (string) (required) — Template lifecycle status. `enabled` templates can be referenced by escalation policies for notifications; `disabled` templates are no longer used for new notifications; `deleted` templates are never returned by list endpoints. [enabled, disabled, deleted]\n  - team_id (integer) (required) — ID of the team this template is scoped to, or 0 for account-wide.\n  - teams_app (string) (required) — Microsoft Teams app message template source.\n  - telegram (string) (required) — Telegram bot message template source.\n  - template_id (string) (required) — Template ID.\n  - template_name (string) (required) — Unique template name within the account.\n  - updated_at (string) (required) — Unix epoch seconds the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - voice (string) (required) — Voice call script template source.\n  - wecom (string) (required) — WeCom robot message template source.\n  - wecom_app (string) (required) — WeCom app message template source.\n  - zoom (string) (required) — Zoom bot message template source.\n",
+	"NotificationTemplates.ReadList":              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the owning account.\n  - created_at (string) (required) — Unix epoch seconds the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - deleted_at (string) — Unix epoch seconds the template was soft-deleted. Absent (omitempty) when the template is live. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Free-form description.\n  - dingtalk (string) (required) — DingTalk robot message template source.\n  - dingtalk_app (string) (required) — DingTalk app message template source.\n  - email (string) (required) — Email body template source (Go `html/template` syntax).\n  - feishu (string) (required) — Feishu robot message template source.\n  - feishu_app (string) (required) — Feishu app message template source.\n  - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.\n  - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.\n  - slack (string) (required) — Slack robot message template source.\n  - slack_app (string) (required) — Slack app message template source.\n  - sms (string) (required) — SMS template source (Go `text/template` syntax).\n  - status (string) (required) — Template lifecycle status. `enabled` templates can be referenced by escalation policies for notifications; `disabled` templates are no longer used for new notifications; `deleted` templates are never returned by list endpoints. [enabled, disabled, deleted]\n  - team_id (integer) (required) — ID of the team this template is scoped to, or 0 for account-wide.\n  - teams_app (string) (required) — Microsoft Teams app message template source.\n  - telegram (string) (required) — Telegram bot message template source.\n  - template_id (string) (required) — Template ID.\n  - template_name (string) (required) — Unique template name within the account.\n  - updated_at (string) (required) — Unix epoch seconds the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - voice (string) (required) — Voice call script template source.\n  - wecom (string) (required) — WeCom robot message template source.\n  - wecom_app (string) (required) — WeCom app message template source.\n  - zoom (string) (required) — Zoom bot message template source.\n",
+	"NotificationTemplates.ReadPreview":           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - content (string) (required) — Rendered template output, present when success is true.\n  - fixed_fields (array<object>) — Fixed incident-card fields returned for supported IM previews after the requested hiding rules are applied.\n    - field (string) (required) — Incident-card field name. | Value | Meaning | |---|---| | `channel` | Name of the alert channel that produced the incident; returned only when non-empty. | | `snoozed_before` | Snooze-until timestamp formatted as `YYYY-MM-DD HH:MM:SS`; returned only while the incident is snoozed. | | `severity` | Incident severity label; returned only when non-empty. | | `responders` | Names of the current responders, separated by spaces; returned only when the incident has responders. | | `aggregate_alert_count` | Number of alerts aggregated into the incident; returned only when greater than 1. | [channel, snoozed_before, severity, responders, aggregate_alert_count]\n    - value (string) (required) — Rendered display value for the fixed field.\n  - message (string) (required) — Error message describing why rendering failed, present when success is false.\n  - success (boolean) (required) — Whether the template rendered without errors.\n",
+	"NotificationTemplates.WriteCreate":           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - template_id (string) (required) — Newly created template ID.\n  - template_name (string) (required) — Template name echoed from the request.\n",
+	"Resources.Info":                              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns this resource.\n  - action.days (integer) (required) — Retention period in days for action (user interaction) data.\n  - created_at (string) (required) — Unix timestamp in seconds when the resource was created. Also anchors the start of the first billing window. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error.days (integer) (required) — Retention period in days for error data.\n  - expired_at (string) — Unix timestamp in seconds when the on-premises license expires. Only present on on-premises deployments; omitted entirely for SaaS accounts. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - long_task.days (integer) (required) — Retention period in days for long-task data.\n  - offering_id (integer) (required) — ID of the offering (SKU) this resource was provisioned from.\n  - order_id (string) (required) — ID of the order that provisioned this resource. Empty for resources provisioned outside the order flow (e.g. on-premises).\n  - product (string) (required) — Product code for this resource. Always `rum` for this endpoint. [rum]\n  - resource.days (integer) (required) — Retention period in days for resource (network request) data.\n  - resource_id (string) (required) — Unique resource identifier for the account's RUM resource.\n  - resource_name (string) (required) — Display name of the resource.\n  - session.days (integer) (required) — Retention period in days for session data.\n  - session_investigate.free_cnt (integer) (required) — Free quota for investigate sessions per application, per billing window.\n  - session_investigate.used_cnt (integer) (required) — Number of investigate (error tracking) sessions used in the current billing window.\n  - session_limit_reached (boolean) (required) — `true` when a `version=free` account has exceeded its combined free session quota across all applications. Always `false` for non-free plans.\n  - session_measure.free_cnt (integer) (required) — Free quota for measure sessions per application, per billing window.\n  - session_measure.used_cnt (integer) (required) — Number of measure (performance) sessions used in the current billing window.\n  - session_replay.free_cnt (integer) (required) — Free quota for session-replay sessions per application, per billing window.\n  - session_replay.used_cnt (integer) (required) — Number of session-replay sessions used in the current billing window.\n  - status (string) (required) — Status of the resource. A resource with status `deleted` or `destroyed` never reaches this field — the operation returns `ResourceNotFound` for those instead. [enabled, disabled]\n  - updated_at (string) (required) — Unix timestamp in seconds when the resource was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (string) (required) — Plan version of this resource. One of `free` (free plan) or `professional` (professional plan). [free, professional]\n  - view.days (integer) (required) — Retention period in days for view (page/screen) data.\n  - window_end_time (string) (required) — Unix timestamp in seconds for the end of the current 30-day billing window. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - window_start_time (string) (required) — Unix timestamp in seconds for the start of the current 30-day billing window. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"RolesPermissions.ReadInfo":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Unix epoch seconds the role was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Role description.\n  - editable (boolean) (required) — False for built-in roles which cannot be modified.\n  - permission_ids (array<integer>) (required) — IDs of permissions granted by this role.\n  - role_id (integer) (required) — Unique role ID.\n  - role_name (string) (required) — Role display name.\n  - status (string) (required) — Role status. [enabled, disabled]\n  - updated_at (string) (required) — Unix epoch seconds the role was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"RolesPermissions.ReadList":                   "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) (required) — Unix epoch seconds the role was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Role description.\n  - editable (boolean) (required) — False for built-in roles which cannot be modified.\n  - permission_ids (array<integer>) (required) — IDs of permissions granted by this role.\n  - role_id (integer) (required) — Unique role ID.\n  - role_name (string) (required) — Role display name.\n  - status (string) (required) — Role status. [enabled, disabled]\n  - updated_at (string) (required) — Unix epoch seconds the role was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"RolesPermissions.ReadListPermission":         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Owning account ID. Omitted when 0, i.e. for system-level permissions.\n  - class (string) (required) — Permission class (e.g., 'On-call', 'Organization').\n  - description (string) (required) — Human-readable permission description.\n  - id (integer) (required) — Unique permission ID.\n  - is_granted (boolean) (required) — Whether this permission is granted to the roles given in `role_ids`. Always present in this endpoint's response; `false` entries only appear when `with_all` is true.\n  - permission_name (string) (required) — Permission display name.\n  - permission_type (string) (required) — Whether this is a read or manage permission. `read`: view-only permission (read/list/query); `manage`: administrative permission covering mutations (create, update, delete, configure). [read, manage]\n  - scope (string) (required) — Functional scope the permission applies to. | value | meaning | | --- | --- | | `account` | Account settings and API keys | | `organization` | Members, teams, roles, audit | | `on-call` | On-call incident management | | `monit` | Monitoring | | `rum` | Real user monitoring | | `ai-sre` | AI SRE features | | `custom_menu` | Account-defined custom menu pages (on-premises only) | [account, organization, on-call, monit, rum, ai-sre, custom_menu]\n  - source (string) (required) — Origin of the permission. `system` — seeded built-in permission; `account` — dynamic permission created for this account (e.g. custom menus). [system, account]\n  - source_ref (string) — Primary key of the source object (e.g. the custom menu ID) for account-scoped permissions. Omitted when empty.\n  - status (string) (required) — Permission status. `enabled` — active; `deleted` — removed (deleted permissions are filtered out and never returned). [enabled, deleted]\n",
+	"RolesPermissions.ReadListPermissionFactor":   "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - factor_name (string) (required) — Factor identifier (e.g., 'template:read:info').\n  - factor_type (string) (required) — Factor type. `api`: backend API factor — `factor_name` is the API name (e.g. `skill:write:upload`), enforced at the gateway; `button`: UI action factor, used by the role-config page to render action toggles; `visit`: page-visit factor (custom menu pages use this type); `menu`: menu-visibility factor (legacy, no current seed data); `url`: page route-path factor (legacy, no current seed data). [api, button, visit, menu, url]\n  - source (string) — Origin of the factor. `system` — seeded built-in factor; `account` — dynamic factor created for this account (e.g. custom menus). [system, account]\n  - source_ref (string) — Primary key of the source object (e.g. the custom menu ID) for account-scoped factors. Omitted when empty.\n",
+	"RolesPermissions.WriteUpsert":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - role_id (integer) (required) — Created or updated role ID.\n  - role_name (string) (required) — Role name echoed from the request.\n",
+	"Schedules.ByPerson":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - current (object) — One on-call shift interval of a member.\n    - end_at (string) — Unix timestamp in seconds - when the shift ends. Absent while the shift is ongoing. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - schedule_id (integer) — Owning schedule ID.\n    - schedule_name (string) — Owning schedule name.\n    - start_at (string) — Unix timestamp in seconds - when the shift starts. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - next (object) — One on-call shift interval of a member.\n    - end_at (string) — Unix timestamp in seconds - when the shift ends. Absent while the shift is ongoing. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - schedule_id (integer) — Owning schedule ID.\n    - schedule_name (string) — Owning schedule name.\n    - start_at (string) — Unix timestamp in seconds - when the shift starts. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedules (array<object>) (required) — All enabled schedules the member participates in.\n    - schedule_id (integer) — Schedule ID.\n    - schedule_name (string) — Schedule name.\n",
+	"Schedules.Create":                            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - schedule_id (integer) (required) — ID of the newly created schedule.\n",
+	"Schedules.Info":                              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n        - alias (string) (required) — Channel alias.\n        - chat_ids (array<string>) (required) — Chat IDs.\n        - data_source_id (integer) (required) — Data source ID.\n        - sign_secret (string) (required) — Signature secret.\n        - token (string) (required) — Webhook token.\n        - verify_token (string) (required) — Verification token.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
+	"Schedules.Infos":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
+	"Schedules.List":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
+	"Schedules.Preview":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n        - person_ids (array<integer>) (required) — Person IDs in this slot.\n        - role_id (integer) (required) — Oncall role ID. (min 0)\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n        - alias (string) (required) — Channel alias.\n        - chat_ids (array<string>) (required) — Chat IDs.\n        - data_source_id (integer) (required) — Data source ID.\n        - sign_secret (string) (required) — Signature secret.\n        - token (string) (required) — Webhook token.\n        - verify_token (string) (required) — Verification token.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n        - end (integer) (required) — Group end timestamp (Unix seconds).\n        - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n        - members (array<object>) (required) — Members of this group.\n        - name (string) (required) — Legacy group name.\n        - start (integer) (required) — Group start timestamp (Unix seconds).\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
+	"Schedules.Self":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
+	"SessionReplay.Metadata":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - application (object) — Application the session belongs to.\n    - id (string) — RUM application ID the session belongs to.\n  - device (object) — Device that recorded the session.\n    - type (string) — Device type recorded for the session, e.g. `desktop`, `mobile`, `tablet`.\n  - foreground_periods (array<object>) — Foreground periods across the session (mobile sessions only; empty for web).\n    - end (string) — Unix timestamp in milliseconds when the foreground period ended. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - start (string) — Unix timestamp in milliseconds when the foreground period started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - view_id (string) — View ID active during this foreground period.\n  - session (object) — Session bounds and state.\n    - end (string) — Unix timestamp in milliseconds when the session ended (or was last updated, if still active). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - is_active (boolean) — Whether the session was still active as of the last recorded event.\n    - server_time_delta (integer) — Clock skew in milliseconds between the client and Flashduty's servers, added to client timestamps for correction.\n    - source (string) — SDK platform that recorded the session. Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n    - start (string) — Unix timestamp in milliseconds when the session started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - views (array<object>) — Every view recorded during the session, in chronological order.\n    - container_source (string) — SDK platform of the container app, when this view is embedded (e.g. a WebView inside a native app). Omitted when the view is not embedded.\n    - container_view_id (string) — View ID of the containing view, when this view is embedded. Omitted when the view is not embedded.\n    - end (string) — Unix timestamp in milliseconds when the view ended. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - is_active (boolean) — Whether the view was still active as of the last recorded event.\n    - loading_type (string) — How the view was entered, e.g. `initial_load`, `route_change`.\n    - name (string) — View name, typically the route or screen name.\n    - server_time_delta (integer) — Clock skew in milliseconds between the client and Flashduty's servers, added to client timestamps for correction.\n    - source (string) — SDK platform that recorded the view. Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n    - start (string) — Unix timestamp in milliseconds when the view started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - url (string) — URL (web) or screen identifier (mobile) associated with the view.\n    - view_id (string) — Unique ID of the view within the session.\n",
+	"SessionReplay.Segments":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - items (array<string>) — Presigned, time-limited URLs (valid 1 hour) for downloading each segment's raw compressed bytes.\n  - search_after_ctx (string) — Pagination cursor to pass as `search_after_ctx` on the next call. Empty when this page was the last one.\n",
+	"Sessions.ReadInfo":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - events (array<object>) (required) — Recent events, ascending by (created_at, event_id).\n    - actions (object) — ADK actions envelope (state deltas, transfers, escalation).\n    - author (string) — Event author (e.g. user, the agent name).\n    - branch (string) — ADK branch path for nested agents.\n    - content (object) — ADK content envelope {role, parts:[...]}.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the event was written. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - error_code (string) — Error code when the event represents a failure.\n    - error_message (string) — Human-readable error message, when present.\n    - event_id (string) (required) — Event identifier.\n    - invocation_id (string) — ADK invocation id grouping a turn.\n    - partial (boolean) (required) — True for a streaming partial chunk.\n    - session_id (string) (required) — Owning session id.\n    - status (string) — Event status. One of: `normal` (a live event included in the context fed to the model), `compressed` (folded into a compaction summary boundary event; no longer loaded for the model, kept as history only). [normal, compressed]\n    - turn_complete (boolean) (required) — True on the terminal event of a turn.\n    - usage_metadata (object) — Per-turn token usage metadata.\n  - has_more_older (boolean) (required) — True when older events remain beyond this page.\n  - search_after_ctx (string) — Opaque keyset cursor; pass back as search_after_ctx to fetch the next older page. Omitted when has_more_older is false.\n  - session (object) (required) — One agent session row.\n    - access_source (string) — How the caller received access to this session. Omitted when no access source is resolved. One of: | Value | Meaning | | --- | --- | | `owner` | Caller is the session creator (full access) | | `team_member` | Caller belongs to the session's bound team (full access) | | `manager` | Manager grant (reserved; never produced by the current version) | | `share_link` | Granted via a valid share link (view/fork only; cannot continue or manage) | | `participant` | Same-account non-member granted via a participable team session (view/continue/fork only) | [owner, team_member, manager, share_link, participant]\n    - app_name (string) (required) — Agent app that owns the session.\n    - archived_at (string) (required) — Unix timestamp in milliseconds when archived; 0 means not archived. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - bound_environment (object) — The runner or cloud sandbox the session is bound to. Null until the first message.\n      - id (string) (required) — Environment identifier: a cloud sandbox ID for `cloud` bindings, a runner/environment ID for `byoc` bindings.\n      - kind (string) (required) — Environment kind bound to the session: `cloud` (managed sandbox) or `byoc` (self-hosted runner). [cloud, byoc]\n      - name (string) — Human-readable environment name; empty for cloud bindings using the default allowlist.\n      - status (string) — Live binding health, namespaced by kind: BYOC uses online/pending/offline/deleted; cloud uses available/rebuilding/expired. [online, pending, offline, deleted, available, rebuilding, expired]\n    - can_continue (boolean) (required) — True when the caller can add a new turn to this session.\n    - can_fork (boolean) (required) — True when the caller can fork this session.\n    - can_manage (boolean) (required) — True when the caller may rename/archive/delete the session; personal sessions are creator-only, team sessions allow the creator, account admin, or team member.\n    - can_view (boolean) (required) — True when the caller can view this session.\n    - context_resolved (object) — Snapshot of the three-tier knowledge-pack resolution for this session.\n      - account_pack_id (string) — Resolved account-scoped pack id.\n      - incident_id (string) — Bound incident id, when war-room originated.\n      - resolved_at_ms (string) (required) — Unix timestamp in milliseconds when the packs were resolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - team_pack_id (string) — Resolved team-scoped pack id.\n      - versions (object) — Per-pack resolved version map.\n    - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.\n    - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.\n    - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_turn_tokens (integer) (required) — Total tokens (input+output+reasoning) for the in-flight round across the parent and its subagents; only computed by session/get while the session is running, always 0 in session/list responses and when idle.\n    - current_turn_wait_ms (integer) (required) — Accumulated ask_user human-wait duration in milliseconds for the current round; resets to 0 at the start of each new round.\n    - entry_kind (string) — Surface that created the session. One of: | Value | Meaning | | --- | --- | | `web` | Created from the web console | | `im` | Created from an IM client (IM bot / IM H5) | | `api` | Created via the public API | | `automation` | Created by an automation rule (unattended run) | | `subagent` | Child session spawned by a parent's agent_dispatch (audit label; at runtime it executes on the web tool surface) | [web, im, api, automation, subagent]\n    - has_unread (boolean) (required) — True when there is assistant output the caller has not yet viewed.\n    - incognito (boolean) (required) — True for incognito (non-persisted-memory) sessions.\n    - is_mine (boolean) (required) — True when the caller created this session.\n    - is_running (boolean) (required) — True when an agent turn is currently in flight for this session.\n    - last_event_at (string) — Unix timestamp in milliseconds of the most recent assistant-side event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - parent_session_id (string) — Parent session id for subagent (child) sessions; empty otherwise.\n    - person_id (string) (required) — Creator person id.\n    - pinned_at (string) (required) — Caller's per-user pin time as a Unix timestamp in milliseconds; 0 means not pinned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - session_id (string) (required) — Session identifier.\n    - session_name (string) (required) — Session title; may be empty for untitled sessions.\n    - share_enabled (boolean) (required) — True when the session's share link is active.\n    - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.\n    - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.\n    - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.\n    - status (string) (required) — Lifecycle status. One of: `enabled` (active), `deleted` (soft-deleted, no longer accessible). [enabled, deleted]\n    - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.\n    - team_name (string) — Resolved team name; empty for unbound rows or deleted teams.\n    - template_staging_round_id (string) — Current save→validate round id (template-assistant only); empty otherwise.\n    - token_usage (object) — Cumulative session-level token rollup across all turns. The account-billing source of truth.\n      - cached_tokens (integer) (required) — Portion of input_tokens served from the prompt cache.\n      - input_tokens (integer) (required) — Total prompt (input) tokens, including the cached portion.\n      - output_tokens (integer) (required) — Total generated (output) tokens.\n      - reasoning_tokens (integer) (required) — Total reasoning/thinking tokens.\n    - updated_at (string) (required) — Unix timestamp in milliseconds of the last session update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - suggest_init (boolean) (required) — Account-wide onboarding flag: true when the account has zero knowledge packs in any scope; not specific to this session.\n",
+	"Sessions.ReadList":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - sessions (array<object>) (required) — The page of sessions.\n    - access_source (string) — How the caller received access to this session. Omitted when no access source is resolved. One of: | Value | Meaning | | --- | --- | | `owner` | Caller is the session creator (full access) | | `team_member` | Caller belongs to the session's bound team (full access) | | `manager` | Manager grant (reserved; never produced by the current version) | | `share_link` | Granted via a valid share link (view/fork only; cannot continue or manage) | | `participant` | Same-account non-member granted via a participable team session (view/continue/fork only) | [owner, team_member, manager, share_link, participant]\n    - app_name (string) (required) — Agent app that owns the session.\n    - archived_at (string) (required) — Unix timestamp in milliseconds when archived; 0 means not archived. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - bound_environment (object) — The runner or cloud sandbox the session is bound to. Null until the first message.\n      - id (string) (required) — Environment identifier: a cloud sandbox ID for `cloud` bindings, a runner/environment ID for `byoc` bindings.\n      - kind (string) (required) — Environment kind bound to the session: `cloud` (managed sandbox) or `byoc` (self-hosted runner). [cloud, byoc]\n      - name (string) — Human-readable environment name; empty for cloud bindings using the default allowlist.\n      - status (string) — Live binding health, namespaced by kind: BYOC uses online/pending/offline/deleted; cloud uses available/rebuilding/expired. [online, pending, offline, deleted, available, rebuilding, expired]\n    - can_continue (boolean) (required) — True when the caller can add a new turn to this session.\n    - can_fork (boolean) (required) — True when the caller can fork this session.\n    - can_manage (boolean) (required) — True when the caller may rename/archive/delete the session; personal sessions are creator-only, team sessions allow the creator, account admin, or team member.\n    - can_view (boolean) (required) — True when the caller can view this session.\n    - context_resolved (object) — Snapshot of the three-tier knowledge-pack resolution for this session.\n      - account_pack_id (string) — Resolved account-scoped pack id.\n      - incident_id (string) — Bound incident id, when war-room originated.\n      - resolved_at_ms (string) (required) — Unix timestamp in milliseconds when the packs were resolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - team_pack_id (string) — Resolved team-scoped pack id.\n      - versions (object) — Per-pack resolved version map.\n    - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.\n    - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.\n    - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_turn_tokens (integer) (required) — Total tokens (input+output+reasoning) for the in-flight round across the parent and its subagents; only computed by session/get while the session is running, always 0 in session/list responses and when idle.\n    - current_turn_wait_ms (integer) (required) — Accumulated ask_user human-wait duration in milliseconds for the current round; resets to 0 at the start of each new round.\n    - entry_kind (string) — Surface that created the session. One of: | Value | Meaning | | --- | --- | | `web` | Created from the web console | | `im` | Created from an IM client (IM bot / IM H5) | | `api` | Created via the public API | | `automation` | Created by an automation rule (unattended run) | | `subagent` | Child session spawned by a parent's agent_dispatch (audit label; at runtime it executes on the web tool surface) | [web, im, api, automation, subagent]\n    - has_unread (boolean) (required) — True when there is assistant output the caller has not yet viewed.\n    - incognito (boolean) (required) — True for incognito (non-persisted-memory) sessions.\n    - is_mine (boolean) (required) — True when the caller created this session.\n    - is_running (boolean) (required) — True when an agent turn is currently in flight for this session.\n    - last_event_at (string) — Unix timestamp in milliseconds of the most recent assistant-side event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - parent_session_id (string) — Parent session id for subagent (child) sessions; empty otherwise.\n    - person_id (string) (required) — Creator person id.\n    - pinned_at (string) (required) — Caller's per-user pin time as a Unix timestamp in milliseconds; 0 means not pinned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - session_id (string) (required) — Session identifier.\n    - session_name (string) (required) — Session title; may be empty for untitled sessions.\n    - share_enabled (boolean) (required) — True when the session's share link is active.\n    - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.\n    - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.\n    - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.\n    - status (string) (required) — Lifecycle status. One of: `enabled` (active), `deleted` (soft-deleted, no longer accessible). [enabled, deleted]\n    - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.\n    - team_name (string) — Resolved team name; empty for unbound rows or deleted teams.\n    - template_staging_round_id (string) — Current save→validate round id (template-assistant only); empty otherwise.\n    - token_usage (object) — Cumulative session-level token rollup across all turns. The account-billing source of truth.\n      - cached_tokens (integer) (required) — Portion of input_tokens served from the prompt cache.\n      - input_tokens (integer) (required) — Total prompt (input) tokens, including the cached portion.\n      - output_tokens (integer) (required) — Total generated (output) tokens.\n      - reasoning_tokens (integer) (required) — Total reasoning/thinking tokens.\n    - updated_at (string) (required) — Unix timestamp in milliseconds of the last session update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - suggest_init (boolean) (required) — Account-wide onboarding flag: true when the account has zero knowledge packs in any scope; not dependent on this call's filters.\n  - total (integer) (required) — Total number of sessions matching the filter (ignoring pagination).\n",
+	"Skills.ReadGet":                              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - author (string) — Skill author.\n  - can_edit (boolean) (required) — Whether the caller may edit this skill.\n  - checksum (string) — SHA-256 checksum of the skill zip.\n  - content (string) — Full SKILL.md content. Omitted in list responses.\n  - created (boolean) — Set only on install-from-session responses: true = fresh install, false = in-place update.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the skill.\n  - description (string) (required) — Human-readable description from the SKILL.md frontmatter.\n  - description_en (string) — Optional English description. English-locale UI responses prefer this over `description`; the skill catalog also uses it as a stable selection signal when `description` is localized for display.\n  - is_modified (boolean) (required) — True when a marketplace-sourced skill was edited locally (auto-update skips it).\n  - license (string) — Skill license.\n  - s3_key (string) — Object-storage key of the skill zip.\n  - skill_id (string) (required) — Unique skill ID (prefix `skill_`).\n  - skill_name (string) (required) — Skill name, unique within its scope (account-wide or within one team).\n  - source_template_name (string) — Marketplace template this skill was installed from; empty for user-authored.\n  - source_template_version (string) — Template version at install time.\n  - status (string) (required) — Skill status. Deleted skills are excluded from every API response, so only these two values are ever returned. [enabled, disabled]\n  - tags (array<string>) — Tags parsed from the frontmatter.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - tools (array<string>) — Required tools (builtin or `mcp:server/tool`).\n  - update_available (boolean) (required) — True when the marketplace has a newer template version.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - venues (array<string>) — Execution-environment kinds (EnvironmentKind strings, e.g. `byoc`) the skill is restricted to. Omitted when empty, which means the skill is available in all venues.\n  - version (string) — Skill version from the frontmatter.\n",
+	"Skills.ReadList":                             "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - skills (array<object>) (required) — Skills on this page.\n    - account_id (integer) (required) — Owning account ID.\n    - author (string) — Skill author.\n    - can_edit (boolean) (required) — Whether the caller may edit this skill.\n    - checksum (string) — SHA-256 checksum of the skill zip.\n    - content (string) — Full SKILL.md content. Omitted in list responses.\n    - created (boolean) — Set only on install-from-session responses: true = fresh install, false = in-place update.\n    - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID that created the skill.\n    - description (string) (required) — Human-readable description from the SKILL.md frontmatter.\n    - description_en (string) — Optional English description. English-locale UI responses prefer this over `description`; the skill catalog also uses it as a stable selection signal when `description` is localized for display.\n    - is_modified (boolean) (required) — True when a marketplace-sourced skill was edited locally (auto-update skips it).\n    - license (string) — Skill license.\n    - s3_key (string) — Object-storage key of the skill zip.\n    - skill_id (string) (required) — Unique skill ID (prefix `skill_`).\n    - skill_name (string) (required) — Skill name, unique within its scope (account-wide or within one team).\n    - source_template_name (string) — Marketplace template this skill was installed from; empty for user-authored.\n    - source_template_version (string) — Template version at install time.\n    - status (string) (required) — Skill status. Deleted skills are excluded from every API response, so only these two values are ever returned. [enabled, disabled]\n    - tags (array<string>) — Tags parsed from the frontmatter.\n    - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n    - tools (array<string>) — Required tools (builtin or `mcp:server/tool`).\n    - update_available (boolean) (required) — True when the marketplace has a newer template version.\n    - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - venues (array<string>) — Execution-environment kinds (EnvironmentKind strings, e.g. `byoc`) the skill is restricted to. Omitted when empty, which means the skill is available in all venues.\n    - version (string) — Skill version from the frontmatter.\n  - total (integer) (required) — Total number of matching skills.\n",
+	"Skills.WriteUpdate":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - author (string) — Skill author.\n  - can_edit (boolean) (required) — Whether the caller may edit this skill.\n  - checksum (string) — SHA-256 checksum of the skill zip.\n  - content (string) — Full SKILL.md content. Omitted in list responses.\n  - created (boolean) — Set only on install-from-session responses: true = fresh install, false = in-place update.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the skill.\n  - description (string) (required) — Human-readable description from the SKILL.md frontmatter.\n  - description_en (string) — Optional English description. English-locale UI responses prefer this over `description`; the skill catalog also uses it as a stable selection signal when `description` is localized for display.\n  - is_modified (boolean) (required) — True when a marketplace-sourced skill was edited locally (auto-update skips it).\n  - license (string) — Skill license.\n  - s3_key (string) — Object-storage key of the skill zip.\n  - skill_id (string) (required) — Unique skill ID (prefix `skill_`).\n  - skill_name (string) (required) — Skill name, unique within its scope (account-wide or within one team).\n  - source_template_name (string) — Marketplace template this skill was installed from; empty for user-authored.\n  - source_template_version (string) — Template version at install time.\n  - status (string) (required) — Skill status. Deleted skills are excluded from every API response, so only these two values are ever returned. [enabled, disabled]\n  - tags (array<string>) — Tags parsed from the frontmatter.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - tools (array<string>) — Required tools (builtin or `mcp:server/tool`).\n  - update_available (boolean) (required) — True when the marketplace has a newer template version.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - venues (array<string>) — Execution-environment kinds (EnvironmentKind strings, e.g. `byoc`) the skill is restricted to. Omitted when empty, which means the skill is available in all venues.\n  - version (string) — Skill version from the frontmatter.\n",
+	"Sourcemaps.List":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - created_at (string) — Upload timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - git_commit_sha (string) — Git commit SHA for this build.\n  - git_repository_url (string) — Git repository URL associated with this build.\n  - key (string) — Storage key uniquely identifying this sourcemap file.\n  - metadata (object) — Platform-specific metadata: `minified_url` (browser/react-native/harmony/miniprogram); `build_id`, `variant`, `version_code` (android mappings), plus `arch`, `lib_name`, `code_id` (android/harmony/electron native symbols); `uuid` (ios); `build_id`, `platform`, `arch`, `flavor`, `code_id`, `debug_id` (flutter); `subpackage`, `minified_url` (miniprogram). Omitted when empty.\n  - minified_path (string) — Deprecated. Storage path of the minified file; present only on JavaScript records.\n  - minified_url (string) — Deprecated. URL of the minified file; present only on JavaScript and miniprogram records. New integrations should read `metadata.minified_url`.\n  - service (string) — Application or service name.\n  - size (integer) — File size in bytes.\n  - sourcemap_path (string) — Deprecated. Storage path of the sourcemap file; present only on JavaScript and miniprogram records.\n  - type (string) — Platform store this record belongs to. JavaScript rows always report `browser` (including HarmonyOS ArkTS and React Native uploads); native-symbol rows always report `android` (including HarmonyOS native and Electron uploads). | Value | Store | |---|---| | `browser` | JavaScript sourcemap store | | `android` | Android mapping store, or the shared native symbol store | | `ios` | iOS dSYM store | | `miniprogram` | WeChat mini program sourcemap store | | `flutter` | Flutter Dart AOT symbol store | [browser, android, ios, miniprogram, flutter]\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (string) — Application version string.\n",
+	"Sourcemaps.StackEnrich":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - frames (array<object>) (required) — Error stack frames after symbolication (via sourcemap, dSYM, NDK symbol tables, etc.).\n    - address (string) — iOS or native memory address.\n    - class_name (string) — Android Java/Kotlin class name.\n    - code_snippets (array<object>) — Source-code snippets around this frame. Omitted when no snippet was extracted (for example the source content was unavailable or `near` was not requested).\n      - code (string) (required) — Source code on that line.\n      - line (integer) (required) — Source line number.\n    - column (integer) — Column number for JavaScript or Flutter frames.\n    - converted (boolean) (required) — Whether the frame was successfully symbolicated or deobfuscated.\n    - file (string) — Source file, URL, or module path.\n    - function (string) — Function or method name.\n    - line (integer) — Line number.\n    - method_name (string) — Android Java/Kotlin method name without class prefix.\n    - module (string) — iOS Swift/Objective-C module name.\n    - native_address (string) — Unity IL native address.\n    - offset (integer) — Symbol offset from function start.\n    - original_frame (object) — The original minified/obfuscated frame before enrichment. Omitted when the processor did not retain one.\n      - address (string) — iOS or native memory address.\n      - class_name (string) — Android Java/Kotlin class name.\n      - column (integer) — Column number for JavaScript or Flutter frames.\n      - file (string) — Source file, URL, or module path.\n      - function (string) — Function or method name.\n      - line (integer) — Line number.\n      - method_name (string) — Android Java/Kotlin method name without class prefix.\n      - module (string) — iOS Swift/Objective-C module name.\n      - native_address (string) — Unity IL native address.\n      - offset (integer) — Symbol offset from function start.\n    - third_party (boolean) — Whether the frame is from third-party or system libraries (Android and native symbolication only). Omitted when `false`.\n",
+	"StatusPages.ChangeActiveList":                "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - affected_components (array<object>) — Components currently affected by this event, with their resulting status. Omitted when no components are affected.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n    - status (string) (required) — Current status of the component affected by the change. Severity increases: `operational` < `degraded` = `under_maintenance` < `partial_outage` < `full_outage`; incident-type changes may use the first four, maintenance-type changes only `operational` and `under_maintenance`. | Value | Meaning | |---|---| | `operational` | Operating normally. | | `degraded` | Degraded performance. | | `partial_outage` | Partial outage. | | `full_outage` | Full outage. | | `under_maintenance` | Under maintenance. | [operational, degraded, partial_outage, full_outage, under_maintenance]\n  - auto_update_by_schedule (boolean) — Maintenance only: whether the status advances automatically based on the scheduled window. Omitted when false.\n  - change_id (integer) (required) — Event ID.\n  - close_at_seconds (string) — Event close time in Unix seconds. For maintenances this is the scheduled end time; for closed events, the time the event reached its terminal status (`resolved`/`completed`). Omitted when not set. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description (Markdown). Omitted when empty.\n  - is_retrospective (boolean) — Whether this event is a retrospective (historical) one. Omitted when false.\n  - linked_change_ids (array<string>) — Linked event IDs (related incidents, deployments, etc.). Omitted when empty.\n  - notify_subscribers (boolean) — Whether subscribers were notified about this event. Omitted when false.\n  - page_id (integer) — Parent status page ID. Omitted when 0 (never for stored events).\n  - responder_ids (array<integer>) — Member IDs responsible for this event. Omitted when no responders are assigned.\n  - start_at_seconds (string) — Event start time in Unix seconds, derived from the first timeline update. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (string) — Current event status. Incident statuses: `investigating`/`identified`/`monitoring`/`resolved`. Maintenance statuses: `scheduled`/`ongoing`/`completed`. Omitted when empty (never for stored events). [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n  - title (string) (required) — Event title.\n  - type (string) (required) — Change type. `incident` is an unplanned outage; `maintenance` is a planned maintenance. The type determines which status values are valid. [incident, maintenance]\n  - updates (array<object>) — Timeline updates attached to this event, ordered by time. Omitted when the event has no timeline updates.\n    - at_seconds (string) (required) — Update timestamp in Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_changes (array<object>) — Component status transitions applied by this update. Omitted when the update changes no component statuses.\n      - component_id (string) (required) — Component ID.\n      - component_name (string) — Component display name. Populated by the backend on read; ignored on write. Omitted when empty.\n      - status (string) (required) — New component status. Incidents support `operational`/`degraded`/`partial_outage`/`full_outage`; maintenances support `operational`/`under_maintenance`. [operational, degraded, partial_outage, full_outage, under_maintenance]\n    - description (string) — Update description (Markdown). Omitted when empty.\n    - status (string) — Change status after this update. Omitted when the update does not change the overall status. The first four values apply to incident-type changes, the last three to maintenance-type changes. | Value | Meaning | |---|---| | `investigating` | Investigating (incident). | | `identified` | Root cause identified (incident). | | `monitoring` | Fix deployed, monitoring (incident). | | `resolved` | Resolved (incident). | | `scheduled` | Scheduled (maintenance). | | `ongoing` | In progress (maintenance). | | `completed` | Completed (maintenance). | [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n    - update_id (string) (required) — Update ID.\n",
+	"StatusPages.ChangeCreate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - change_id (integer) (required) — Newly created event ID.\n  - change_name (string) (required) — Event title (echoed from the request).\n",
+	"StatusPages.ChangeInfo":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - affected_components (array<object>) — Components currently affected by this event, with their resulting status. Omitted when no components are affected.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n    - status (string) (required) — Current status of the component affected by the change. Severity increases: `operational` < `degraded` = `under_maintenance` < `partial_outage` < `full_outage`; incident-type changes may use the first four, maintenance-type changes only `operational` and `under_maintenance`. | Value | Meaning | |---|---| | `operational` | Operating normally. | | `degraded` | Degraded performance. | | `partial_outage` | Partial outage. | | `full_outage` | Full outage. | | `under_maintenance` | Under maintenance. | [operational, degraded, partial_outage, full_outage, under_maintenance]\n  - auto_update_by_schedule (boolean) — Maintenance only: whether the status advances automatically based on the scheduled window. Omitted when false.\n  - change_id (integer) (required) — Event ID.\n  - close_at_seconds (string) — Event close time in Unix seconds. For maintenances this is the scheduled end time; for closed events, the time the event reached its terminal status (`resolved`/`completed`). Omitted when not set. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description (Markdown). Omitted when empty.\n  - is_retrospective (boolean) — Whether this event is a retrospective (historical) one. Omitted when false.\n  - linked_change_ids (array<string>) — Linked event IDs (related incidents, deployments, etc.). Omitted when empty.\n  - notify_subscribers (boolean) — Whether subscribers were notified about this event. Omitted when false.\n  - page_id (integer) — Parent status page ID. Omitted when 0 (never for stored events).\n  - responder_ids (array<integer>) — Member IDs responsible for this event. Omitted when no responders are assigned.\n  - start_at_seconds (string) — Event start time in Unix seconds, derived from the first timeline update. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (string) — Current event status. Incident statuses: `investigating`/`identified`/`monitoring`/`resolved`. Maintenance statuses: `scheduled`/`ongoing`/`completed`. Omitted when empty (never for stored events). [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n  - title (string) (required) — Event title.\n  - type (string) (required) — Change type. `incident` is an unplanned outage; `maintenance` is a planned maintenance. The type determines which status values are valid. [incident, maintenance]\n  - updates (array<object>) — Timeline updates attached to this event, ordered by time. Omitted when the event has no timeline updates.\n    - at_seconds (string) (required) — Update timestamp in Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_changes (array<object>) — Component status transitions applied by this update. Omitted when the update changes no component statuses.\n      - component_id (string) (required) — Component ID.\n      - component_name (string) — Component display name. Populated by the backend on read; ignored on write. Omitted when empty.\n      - status (string) (required) — New component status. Incidents support `operational`/`degraded`/`partial_outage`/`full_outage`; maintenances support `operational`/`under_maintenance`. [operational, degraded, partial_outage, full_outage, under_maintenance]\n    - description (string) — Update description (Markdown). Omitted when empty.\n    - status (string) — Change status after this update. Omitted when the update does not change the overall status. The first four values apply to incident-type changes, the last three to maintenance-type changes. | Value | Meaning | |---|---| | `investigating` | Investigating (incident). | | `identified` | Root cause identified (incident). | | `monitoring` | Fix deployed, monitoring (incident). | | `resolved` | Resolved (incident). | | `scheduled` | Scheduled (maintenance). | | `ongoing` | In progress (maintenance). | | `completed` | Completed (maintenance). | [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n    - update_id (string) (required) — Update ID.\n",
+	"StatusPages.ChangeList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - affected_components (array<object>) — Components currently affected by this event, with their resulting status. Omitted when no components are affected.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n    - status (string) (required) — Current status of the component affected by the change. Severity increases: `operational` < `degraded` = `under_maintenance` < `partial_outage` < `full_outage`; incident-type changes may use the first four, maintenance-type changes only `operational` and `under_maintenance`. | Value | Meaning | |---|---| | `operational` | Operating normally. | | `degraded` | Degraded performance. | | `partial_outage` | Partial outage. | | `full_outage` | Full outage. | | `under_maintenance` | Under maintenance. | [operational, degraded, partial_outage, full_outage, under_maintenance]\n  - auto_update_by_schedule (boolean) — Maintenance only: whether the status advances automatically based on the scheduled window. Omitted when false.\n  - change_id (integer) (required) — Event ID.\n  - close_at_seconds (string) — Event close time in Unix seconds. For maintenances this is the scheduled end time; for closed events, the time the event reached its terminal status (`resolved`/`completed`). Omitted when not set. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description (Markdown). Omitted when empty.\n  - is_retrospective (boolean) — Whether this event is a retrospective (historical) one. Omitted when false.\n  - linked_change_ids (array<string>) — Linked event IDs (related incidents, deployments, etc.). Omitted when empty.\n  - notify_subscribers (boolean) — Whether subscribers were notified about this event. Omitted when false.\n  - page_id (integer) — Parent status page ID. Omitted when 0 (never for stored events).\n  - responder_ids (array<integer>) — Member IDs responsible for this event. Omitted when no responders are assigned.\n  - start_at_seconds (string) — Event start time in Unix seconds, derived from the first timeline update. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (string) — Current event status. Incident statuses: `investigating`/`identified`/`monitoring`/`resolved`. Maintenance statuses: `scheduled`/`ongoing`/`completed`. Omitted when empty (never for stored events). [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n  - title (string) (required) — Event title.\n  - type (string) (required) — Change type. `incident` is an unplanned outage; `maintenance` is a planned maintenance. The type determines which status values are valid. [incident, maintenance]\n  - updates (array<object>) — Timeline updates attached to this event, ordered by time. Omitted when the event has no timeline updates.\n    - at_seconds (string) (required) — Update timestamp in Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_changes (array<object>) — Component status transitions applied by this update. Omitted when the update changes no component statuses.\n      - component_id (string) (required) — Component ID.\n      - component_name (string) — Component display name. Populated by the backend on read; ignored on write. Omitted when empty.\n      - status (string) (required) — New component status. Incidents support `operational`/`degraded`/`partial_outage`/`full_outage`; maintenances support `operational`/`under_maintenance`. [operational, degraded, partial_outage, full_outage, under_maintenance]\n    - description (string) — Update description (Markdown). Omitted when empty.\n    - status (string) — Change status after this update. Omitted when the update does not change the overall status. The first four values apply to incident-type changes, the last three to maintenance-type changes. | Value | Meaning | |---|---| | `investigating` | Investigating (incident). | | `identified` | Root cause identified (incident). | | `monitoring` | Fix deployed, monitoring (incident). | | `resolved` | Resolved (incident). | | `scheduled` | Scheduled (maintenance). | | `ongoing` | In progress (maintenance). | | `completed` | Completed (maintenance). | [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n    - update_id (string) (required) — Update ID.\n",
+	"StatusPages.ChangeTimelineCreate":            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - update_id (string) (required) — Newly created update ID.\n",
+	"StatusPages.ComponentUpsert":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - component_ids (array<string>) (required) — IDs of the created or updated components, in the same order as the request.\n",
+	"StatusPages.Create":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - page_id (integer) (required) — Created status page ID.\n  - page_name (string) (required) — Created status page name.\n  - page_url_name (string) (required) — Final URL-safe slug assigned to the status page.\n",
+	"StatusPages.DraftCreate":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Creation time in Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - draft_id (string) (required) — Draft ID matching `draft_[A-Za-z0-9]{22}`; the console review link carries it.\n",
+	"StatusPages.Info":                            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - components (array<object>) (required) — Components tracked on the status page.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n  - contact_info (string) — Get-in-touch contact, a mailto or website URL. Omitted when not set.\n  - custom_domain (string) — Custom domain pointing to the status page. Omitted when not set.\n  - custom_links (array<object>) — Custom navigation links shown on the status page. Omitted when not set.\n  - dark_logo (string) — Dark-mode logo image of the status page. Omitted when not set.\n  - date_view (string) — How the timeline displays change dates. `calendar` uses a calendar view; `list` uses a list view. Omitted when not set. [calendar, list]\n  - display_uptime_mode (string) — How uptime is displayed. `chart_and_percentage` shows both the uptime chart and the percentage figure; `chart` shows only the chart; `none` hides uptime entirely. Omitted when not set. [chart_and_percentage, chart, none]\n  - favicon (string) — Favicon of the status page. Omitted when not set.\n  - logo (string) — Logo image of the status page. Omitted when not set.\n  - logo_url (string) — URL opened when the logo is clicked. Omitted when not set.\n  - managed_domain_feature_enabled (boolean) (required) — Whether the managed custom-domain feature is enabled for this page. `true` for public pages, always `false` for internal pages.\n  - name (string) (required) — Display name of the status page.\n  - page_footer (string) — Footer content of the status page. Omitted when not set.\n  - page_header (string) — Header content of the status page. Omitted when not set.\n  - page_id (integer) (required) — Status page ID.\n  - sections (array<object>) (required) — Sections grouping the components.\n    - description (string) (required) — Section description.\n    - hide_all (boolean) (required) — Whether the section and its components are hidden from summary endpoints.\n    - hide_uptime (boolean) (required) — Whether uptime data is hidden from summary responses.\n    - name (string) (required) — Section name.\n    - order_id (integer) — Display order of the section. Omitted when 0.\n    - section_id (string) — Section ID. Omitted when empty.\n  - subscription (object) (required) — Subscription channel toggles.\n    - email (boolean) (required) — Whether email subscription is enabled.\n    - im (boolean) (required) — Whether IM subscription is enabled.\n  - template_preference (string) — Preferred event template type: `pre_defined` or `message`. Omitted when never set.\n  - type (string) (required) — Page visibility type. `public` pages are accessible to anyone and use email subscriptions; `internal` pages are restricted to account members and use IM subscriptions. [public, internal]\n  - url_name (string) (required) — URL-safe slug, unique per account.\n",
+	"StatusPages.MigrateEmailSubscribers":         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - job_id (string) (required) — Migration job ID. Use this to poll status or request cancellation.\n",
+	"StatusPages.MigrateStructure":                "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - job_id (string) (required) — Migration job ID. Use this to poll status or request cancellation.\n",
+	"StatusPages.MigrationStatus":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owner account ID.\n  - created_at (string) (required) — Job creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error (string) — Terminal error message when `status` is `failed`. Omitted when the job has not failed.\n  - job_id (string) (required) — Migration job ID.\n  - phase (string) (required) — Current migration phase. `structure` imports the page structure (sections and components); `history` imports historical incidents, maintenances, and incident templates; `subscribers` imports email subscribers. [structure, history, subscribers]\n  - progress (object) (required) — Per-entity progress counters.\n    - completed_steps (integer) (required) — Steps completed so far.\n    - components_imported (integer) (required) — Number of components imported from the source status page.\n    - incidents_imported (integer) (required) — Number of historical incidents imported.\n    - maintenances_imported (integer) (required) — Number of scheduled maintenances imported.\n    - sections_imported (integer) (required) — Number of sections (Atlassian component groups) imported from the source status page.\n    - subscribers_imported (integer) (required) — Number of email subscribers successfully imported.\n    - subscribers_skipped (integer) (required) — Number of subscribers skipped (e.g. because they would create duplicates).\n    - templates_imported (integer) (required) — Number of incident templates successfully imported; templates that fail are skipped and recorded in `warnings`.\n    - total_steps (integer) (required) — Total steps this job will perform.\n    - warnings (array<string>) — Non-fatal warnings recorded during the job. Omitted when empty.\n  - source_page_id (string) (required) — Atlassian Statuspage source page ID.\n  - status (string) (required) — Current job status. | Value | Meaning | |---|---| | `running` | In progress. | | `completed` | Finished successfully. | | `failed` | Failed; the `error` field holds the reason. | | `cancelled` | Canceled by request. | [running, completed, failed, cancelled]\n  - target_page_id (integer) (required) — Flashduty target status page ID. Set once the job produces one, or supplied up front for subscriber migration.\n  - updated_at (string) (required) — Last status update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"StatusPages.ReadPageList":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - components (array<object>) (required) — Components tracked on the status page.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n  - contact_info (string) — Get-in-touch contact, a mailto or website URL. Omitted when not set.\n  - custom_domain (string) — Custom domain pointing to the status page. Omitted when not set.\n  - custom_links (array<object>) — Custom navigation links shown on the status page. Omitted when not set.\n  - dark_logo (string) — Dark-mode logo image of the status page. Omitted when not set.\n  - date_view (string) — How the timeline displays change dates. `calendar` uses a calendar view; `list` uses a list view. Omitted when not set. [calendar, list]\n  - display_uptime_mode (string) — How uptime is displayed. `chart_and_percentage` shows both the uptime chart and the percentage figure; `chart` shows only the chart; `none` hides uptime entirely. Omitted when not set. [chart_and_percentage, chart, none]\n  - favicon (string) — Favicon of the status page. Omitted when not set.\n  - logo (string) — Logo image of the status page. Omitted when not set.\n  - logo_url (string) — URL opened when the logo is clicked. Omitted when not set.\n  - name (string) (required) — Display name of the status page.\n  - page_footer (string) — Footer content of the status page. Omitted when not set.\n  - page_header (string) — Header content of the status page. Omitted when not set.\n  - page_id (integer) (required) — Status page ID.\n  - sections (array<object>) (required) — Sections grouping the components.\n    - description (string) (required) — Section description.\n    - hide_all (boolean) (required) — Whether the section and its components are hidden from summary endpoints.\n    - hide_uptime (boolean) (required) — Whether uptime data is hidden from summary responses.\n    - name (string) (required) — Section name.\n    - order_id (integer) — Display order of the section. Omitted when 0.\n    - section_id (string) — Section ID. Omitted when empty.\n  - subscription (object) (required) — Subscription channel toggles.\n    - email (boolean) (required) — Whether email subscription is enabled.\n    - im (boolean) (required) — Whether IM subscription is enabled.\n  - template_preference (string) — Preferred event template type: `pre_defined` or `message`. Omitted when never set.\n  - type (string) (required) — Page visibility type. `public` pages are accessible to anyone and use email subscriptions; `internal` pages are restricted to account members and use IM subscriptions. [public, internal]\n  - url_name (string) (required) — URL-safe slug, unique per account.\n",
+	"StatusPages.SectionUpsert":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - section_ids (array<string>) (required) — IDs of the created or updated sections, in the same order as the request.\n",
+	"StatusPages.SubscriberList":                  "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - all (boolean) (required) — Whether the subscriber is subscribed to all components.\n  - components (array<object>) (required) — Components this subscriber has subscribed to.\n    - available_since_seconds (string) — Time the component became available, as a Unix timestamp in seconds. Omitted when 0. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - component_id (string) — Component ID. Omitted when empty.\n    - description (string) — Component description. Omitted when empty.\n    - hide_all (boolean) — When true, the component is hidden entirely from summary endpoints. Omitted when false.\n    - hide_uptime (boolean) — When true, uptime data is hidden from summary responses. Omitted when false.\n    - name (string) (required) — Component display name.\n    - order_id (integer) — Display order within its section. Omitted when 0.\n    - section_id (string) — Parent section ID. Omitted when the component sits at the top level.\n  - locale (string) — Preferred locale for notifications. Omitted when empty.\n  - method (string) (required) — Subscription notification method. `email` is email subscription (public pages); `im` is IM subscription (internal pages). Determined by the page type. [email, im]\n  - recipient (string) (required) — Subscriber recipient: email address for public pages, user ID for internal pages.\n",
+	"StatusPages.TemplateList":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - description (string) — Template body text (Markdown).\n  - messages (object) — Notification text (Markdown) per event status. Keys are change statuses valid for the template's `type` (for example `investigating` or `resolved` for incidents); the value is the text used when the event reaches that status.\n  - status (string) — Change status the template maps to. Incidents use `investigating`/`identified`/`monitoring`/`resolved`; maintenances use `scheduled`/`ongoing`/`completed`. [investigating, identified, monitoring, resolved, scheduled, ongoing, completed]\n  - template_id (string) — Template ID. Omit to create a new template; supply to update an existing one.\n  - title (string) — Template title.\n  - type (string) — Change type the template applies to: `incident` unplanned incident, `maintenance` planned maintenance. [incident, maintenance]\n",
+	"StatusPages.TemplateUpsert":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - template_id (string) (required) — ID of the created or updated template.\n",
+	"Teams.ReadInfo":                              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - created_at (string) (required) — Unix epoch seconds the team was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - creator_name (string) (required) — Display name of the creator. Not populated by current endpoints — always an empty string; resolve `creator_id` via `POST /person/infos`.\n  - description (string) (required) — Free-form description.\n  - person_ids (array<integer>) (required) — Member IDs of team members.\n  - ref_id (string) (required) — External reference ID for third-party HR system integration.\n  - status (string) (required) — Team status. `enabled` — active; `deleted` — soft-deleted (only possible when fetching a deleted team by `team_id`; list and name/ref_id lookups exclude deleted teams). [enabled, deleted]\n  - team_id (integer) (required) — Unique team ID.\n  - team_name (string) (required) — Team display name. 1–39 characters, unique per account.\n  - updated_at (string) (required) — Unix epoch seconds the team was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - updated_by_name (string) (required) — Display name of the last editor.\n",
+	"Teams.ReadInfos":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - person_ids (array<integer>) (required) — Array of person IDs belonging to the team; empty array (never null) when the team has no members.\n  - team_id (integer) (required) — Team ID.\n  - team_name (string) (required) — Team name.\n",
+	"Teams.ReadList":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Owning account ID.\n  - created_at (string) (required) — Unix epoch seconds the team was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - creator_name (string) (required) — Display name of the creator. Not populated by current endpoints — always an empty string; resolve `creator_id` via `POST /person/infos`.\n  - description (string) (required) — Free-form description.\n  - person_ids (array<integer>) (required) — Member IDs of team members.\n  - ref_id (string) (required) — External reference ID for third-party HR system integration.\n  - status (string) (required) — Team status. `enabled` — active; `deleted` — soft-deleted (only possible when fetching a deleted team by `team_id`; list and name/ref_id lookups exclude deleted teams). [enabled, deleted]\n  - team_id (integer) (required) — Unique team ID.\n  - team_name (string) (required) — Team display name. 1–39 characters, unique per account.\n  - updated_at (string) (required) — Unix epoch seconds the team was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - updated_by_name (string) (required) — Display name of the last editor.\n",
+	"Teams.WriteUpsert":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - team_id (integer) (required) — Created or updated team ID.\n  - team_name (string) (required) — Team name echoed from the request.\n",
 }
diff --git a/internal/cli/zz_generated_schedules.go b/internal/cli/zz_generated_schedules.go
index a84c4f2..5371a7f 100644
--- a/internal/cli/zz_generated_schedules.go
+++ b/internal/cli/zz_generated_schedules.go
@@ -8,6 +8,69 @@ import (
 	flashduty "github.com/flashcatcloud/go-flashduty"
 )
 
+func genSchedulesByPersonCmd() *cobra.Command {
+	var dataJSON string
+	var fPersonID int64
+	cmd := &cobra.Command{
+		Use:   "by-person <person-id>",
+		Short: "Get member on-call status",
+		Long: `Get member on-call status.
+
+Get a member's current and next on-call shifts and every enabled schedule they participate in.
+
+API: POST /schedule/by-person (scheduleByPerson)
+
+Request fields:
+  --person-id int (required) — Member ID whose on-call status is returned.
+
+Response fields ('data' envelope is unwrapped — these fields are at the top level):
+  - current (object) — One on-call shift interval of a member.
+    - end_at (string) — Unix timestamp in seconds - when the shift ends. Absent while the shift is ongoing. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+    - schedule_id (integer) — Owning schedule ID.
+    - schedule_name (string) — Owning schedule name.
+    - start_at (string) — Unix timestamp in seconds - when the shift starts. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+  - next (object) — One on-call shift interval of a member.
+    - end_at (string) — Unix timestamp in seconds - when the shift ends. Absent while the shift is ongoing. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+    - schedule_id (integer) — Owning schedule ID.
+    - schedule_name (string) — Owning schedule name.
+    - start_at (string) — Unix timestamp in seconds - when the shift starts. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+  - schedules (array<object>) (required) — All enabled schedules the member participates in.
+    - schedule_id (integer) — Schedule ID.
+    - schedule_name (string) — Schedule name.
+`,
+		Args:    requireBodyFieldOrExactArg("person_id", "person-id"),
+		Example: `  flashduty schedule by-person --data '{"person_id":2476444212131}'`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runCommand(cmd, args, func(ctx *RunContext) error {
+				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
+					if err := genFoldPositional(args, body, "person_id", "int"); err != nil {
+						return err
+					}
+					if cmd.Flags().Changed("person-id") {
+						body["person_id"] = fPersonID
+					}
+					return nil
+				})
+				if err != nil {
+					return err
+				}
+				req := new(flashduty.ScheduleByPersonRequest)
+				if err := genBindBody(body, req); err != nil {
+					return err
+				}
+				out, _, err := ctx.Client.Schedules.ByPerson(cmdContext(ctx.Cmd), req)
+				if err != nil {
+					return err
+				}
+				return printGenericResult(ctx, out)
+			})
+		},
+	}
+	cmd.Flags().Int64Var(&fPersonID, "person-id", 0, "Member ID whose on-call status is returned. (required)")
+	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
+	return cmd
+}
+
 func genSchedulesCreateCmd() *cobra.Command {
 	var dataJSON string
 	var fDescription string
@@ -1441,6 +1504,7 @@ Request fields:
 
 func registerGeneratedSchedules(root *cobra.Command) {
 	gSchedule := genGroup(root, "schedule", "On-call/Schedules API")
+	genAddLeaf(gSchedule, genSchedulesByPersonCmd())
 	genAddLeaf(gSchedule, genSchedulesCreateCmd())
 	genAddLeaf(gSchedule, genSchedulesDeleteCmd())
 	genAddLeaf(gSchedule, genSchedulesInfoCmd())
diff --git a/skills/flashduty/reference/member.md b/skills/flashduty/reference/member.md
index 9abcc0f..74ef94e 100644
--- a/skills/flashduty/reference/member.md
+++ b/skills/flashduty/reference/member.md
@@ -88,6 +88,7 @@ Invite members
 List members
 - `--asc` bool — Ascending order. Default: false (descending)
 - `--limit` int64 — Page size. Defaults to 100 on the server when omitted or 0 (1-100)
+- `--member-id` int64 — Filter by member ID. Return only the member with this ID.
 - `--orderby` string — Sort field. Default: 'updated_at' · enum: created_at | updated_at
 - `--page` int64 — Page number, 1-based (min 1)
 - `--query` string — Substring match on member name or email; if the keyword parses as a phone number, an exact phone match is also applied
diff --git a/skills/flashduty/reference/monit-datasource.md b/skills/flashduty/reference/monit-datasource.md
index e7c8075..b05800f 100644
--- a/skills/flashduty/reference/monit-datasource.md
+++ b/skills/flashduty/reference/monit-datasource.md
@@ -18,7 +18,7 @@ Prereq: `SKILL.md` + `reference/monit.md` read. Datasources are what every other
 | datasource detail | `datasource-info` |
 | create / update a datasource | `datasource-create` / `datasource-update` |
 | delete a datasource | `datasource-delete` |
-| run a structured read-only datasource diagnostic | `datasource-tools-invoke` |
+| run a datasource diagnostic or query tool | `datasource-tools-invoke` |
 | SLS project/logstore discovery | `datasource-sls-projects` / `datasource-sls-logstores` |
 
 ## Gotchas
@@ -38,10 +38,22 @@ fduty monit datasource-tools-invoke --output-format json --data - <<'FDUTY'
 FDUTY
 ```
 
-One call invokes one named tool. The CLI unwraps HTTP data to `{datasource_id,tool,data,summary?,truncated?}`. The new endpoint has no tool catalog: use the datasource-specific skill reference for static names and parameters. Examples include `mysql.lock_contention`, `postgres.activity`, `redis_node.slowlog`, `kafka.consumer_lag`, `elasticsearch.cat`, `prometheus.metric_trends`, `loki.log_patterns`, and `victorialogs.log_patterns`. Do not guess tool parameters or use removed `mysql.query`/`postgres.query` tools; SQL remains under `monit-query data`.
+One call invokes one named tool. The CLI unwraps HTTP data to `{datasource_id,tool,data,summary?,truncated?}`. The endpoint has no tool catalog: use the datasource-specific skill reference for static names and parameters. Examples include `mysql.lock_contention`, `postgres.activity`, `redis_node.slowlog`, `kafka.consumer_lag`, `elasticsearch.cat`, `prometheus.metric_trends`, `loki.log_patterns`, and `victorialogs.log_patterns`. Do not guess tool parameters.
 
 Tools require all currently routable Edge sessions in the selected cluster to support the v0.71.0 baseline. Report `edge_upgrade_required`, `mixed_edge_versions`, `no_active_edge` and `tool_not_supported` as returned; do not rotate Edges or fall back to Agent/legacy diagnose. `invalid_request` requires fixing parameters, and `source_too_large`/`result_too_large` requires a narrower request. Normal datasource queries retain their existing version compatibility.
 
+## Query tools — `<type>.query`
+
+The same invoke entry also runs query tools named `<type>.query` for ten datasource types: `prometheus`, `mysql`, `postgres`, `oracle`, `clickhouse`, `elasticsearch`, `loki`, `victorialogs`, `sls`, `tencent_cls`. The tool prefix must match the datasource type. `params` is a per-datasource structure: always `expr` plus `execution` (`kind: instant|range|window`, `from_ms`/`to_ms` Unix milliseconds; `range` also needs `max_data_points`). Log types can add `limit`/`direction`; `sls` requires `project`/`logstore`; `tencent_cls` requires `region`/`topic_id`/`syntax`. SQL types take a single read-only statement with `window` execution.
+
+```bash
+fduty monit datasource-tools-invoke --output-format json --data - <<'FDUTY'
+{"datasource_id":12345,"tool":"prometheus.query","params":{"expr":"sum by (job) (rate(http_requests_total[5m]))","execution":{"kind":"instant","to_ms":1757462400000}}}
+FDUTY
+```
+
+Query `data` is the complete Explore result: `format` is `explore_result.v1` and `result.kind` is `samples`, `frames`, or `logs`; log results keep `applied_limit` and `has_more`. Query tools never synthesize `summary` or `truncated`. Query tools require Edge Explore support (protocol v0.68.0); unsupported clusters fail with `edge_upgrade_required`, `mixed_edge_versions`, or `edge_version_unknown` — report as returned, never fall back to `/monit/query/data` automatically.
+
 <!-- GENERATED:monit[datasource] START · 由 fduty __dump-commands 同步 · 勿手改 fence 内 -->
 
 ### datasource-create
@@ -90,7 +102,7 @@ List SLS projects
 Invoke datasource tool
 - `--account-id` int64 — Optional consistency check; must equal the authenticated account.
 - `<datasource-id>` (positional, required) int64 — Datasource ID from /monit/datasource/list. (min 1)
-- `--tool` string (required) — Single tool name prefixed by the datasource type, e.g. mysql.overview. Free SQL uses /monit/query/data; mysql.query and postgres.query are unsupported. (1-128 chars)
+- `--tool` string (required) — Single tool name prefixed by the datasource type. Diagnostic tools are defined by the executing Edge (e.g. 'mysql.overview'). Query tools are '<type>.query' where '<type>' is one of 'prometheus', 'mysql', 'postgres', 'oracle', 'clickhouse', 'elasticsearch', 'loki', 'victorialogs', 'sls', 'tencent_cls'; their 'params' follow 'PrometheusQueryParams', 'MySQLQueryParams', 'PostgresQueryParams', 'OracleQueryParams', 'ClickHouseQueryParams', 'ElasticsearchQueryParams', 'LokiQueryParams', 'VictoriaLogsQueryParams', 'SLSQueryParams', or 'TencentCLSQueryParams' respectively. (1-128 chars)
 - body-only (`--data`): params (object)
 - response: single object (`data` unwrapped to the top level) — fields: data (any); datasource_id (integer); summary (string); tool (string); truncated (object)
 
diff --git a/skills/flashduty/reference/monit-query.md b/skills/flashduty/reference/monit-query.md
index efe3ce7..910eb99 100644
--- a/skills/flashduty/reference/monit-query.md
+++ b/skills/flashduty/reference/monit-query.md
@@ -1,6 +1,8 @@
 # fduty monit-query — datasource queries
 
-Use `data` for PromQL, LogsQL/LogQL, SQL and SLS queries against an already configured datasource. For structured diagnostics, including metric trends and log patterns, use `monit datasource-tools-invoke` (see `reference/monit-datasource.md`). The older `diagnose` command remains for existing callers; new workflows use named tools.
+Use `data` for PromQL, LogsQL/LogQL, SQL and SLS queries against an already configured datasource. For structured diagnostics, including metric trends and log patterns, use `monit datasource-tools-invoke` (see `reference/monit-datasource.md`).
+
+Routing: for the ten datasource types that support `<type>.query` (prometheus, mysql, postgres, oracle, clickhouse, elasticsearch, loki, victorialogs, sls, tencent_cls), prefer `monit datasource-tools-invoke --tool '<type>.query'` — structured `params` with per-datasource validation and complete Explore results. `monit-query data` (`/monit/query/data`) is unchanged and remains available for everything else.
 
 Discover the exact datasource name and type with `monit datasource-list`. Preserve the selected datasource ID for diagnostic tools; multiple configurations may share an address.
 
diff --git a/skills/flashduty/reference/monit-rule.md b/skills/flashduty/reference/monit-rule.md
index 69644d0..2e95346 100644
--- a/skills/flashduty/reference/monit-rule.md
+++ b/skills/flashduty/reference/monit-rule.md
@@ -6,34 +6,32 @@ Prereq: `SKILL.md` + `reference/monit.md` read. This is the largest Flashmonit s
 
 "监控规则 / 告警规则 / 规则文件夹 / 规则导出" or "alert rule / rule folder / rule export / rule audit" → this card.
 
-**Mutating:** `rule-create`, `rule-update`, `rule-update-fields`, `rule-move`, `rule-delete`, `rule-delete-batch`, `rule-import` — confirm before running. **`rule-delete-batch` is irreversible**; confirm IDs with `rule-list-basic` first.
+**Mutating:** `rule-v2-create`, `rule-v2-update`, `rule-update-fields`, `rule-move`, `rule-delete`, `rule-delete-batch`, `rule-import` — confirm before running. **`rule-delete-batch` is irreversible**; confirm IDs with `rule-list-basic` first.
 
 ## Intent → verb
 
 | want | verb |
 |---|---|
-| list rules directly in ONE folder (needs a real folder-id) | `rule-list-basic` |
-| count rules per top-level folder (subtree totals) | `rule-counter-node` |
-| full rule config | `rule-info` |
-| create / update a rule | `rule-create` / `rule-update` |
+| list rules in ONE folder (needs a real folder-id; `--include-descendants` adds subtree id/name rows) | `rule-list-basic` |
+| full rule config | `rule-v2-info` |
+| create / update a rule | `rule-v2-create` / `rule-v2-update` |
 | delete one or many rules | `rule-delete` / `rule-delete-batch` |
 | move rules to another folder | `rule-move` |
 | toggle enabled/channels in bulk | `rule-update-fields` |
 | rule change history | `rule-audits` → detail via `rule-audit-detail` |
 | export / import rules (backup/migrate) | `rule-export` / `rule-import` |
-| what datasource types support rules | `rule-dstypes` |
-| per-channel / per-node / total counters | `rule-counter-channel` / `rule-counter-node` / `rule-counter-total` |
+| per-channel counts / total counter time series | `rule-counter-channel` / `rule-counter-total` |
 
 ## Hot flow — inspect configured rules
 
-`rule-counter-node` returns a map of top-level folder names to subtree rule counts. It does not return folder IDs or triggered counts. Use `rule-list-basic --folder-id <id>` only when a real folder ID is available from the user or trusted context; it lists direct rules, not descendants. Omitting the ID or passing `0` returns "Folder not found".
+Use `rule-list-basic --folder-id <id>` only when a real folder ID is available from the user or trusted context; it lists direct rules, not descendants. Add `--include-descendants` (optionally `--query` / `--limit`, capped at 100) to enumerate subtree rules as id/folder_id/name rows. Omitting the ID or passing `0` returns "Folder not found".
 
 ```bash
-fduty monit rule-counter-node --output-format toon
 fduty monit rule-list-basic --folder-id <known-folder-id> --output-format toon
+fduty monit rule-list-basic --folder-id <known-folder-id> --include-descendants --limit 100 --output-format toon
 ```
 
-The public CLI cannot discover the folder tree from this counter. If folder IDs are unavailable, report that limit rather than guessing IDs or treating a partial rule list as complete.
+The public CLI cannot discover the folder tree itself. If folder IDs are unavailable, report that limit rather than guessing IDs or treating a partial rule list as complete.
 
 **CONFIGURED ≠ FIRED.** Never infer rule coverage from *fired* alerts (`insight top-alerts`, alert feeds): "not fired in 90d" does **not** mean "not configured", and reporting a rule as missing on that basis is confidently wrong. Fired-alert queries answer "what is noisy", not "what is monitored".
 
@@ -50,26 +48,23 @@ The public CLI cannot discover the folder tree from this counter. If folder IDs
 
 ## Gotchas
 
-- **`rule_configs` and nested arrays require `--data`.** The queries, thresholds, enabled_times, and labels objects cannot be expressed as flat flags — pass them as inline JSON via `--data '{"rule_configs":{...}}'`. Typed scalar flags (`--name`, `--enabled`, `--cron-pattern`, `--ds-type`) override matching `--data` keys.
-- **`folder-id 0` is not a universal "all rules" sentinel.** If the API says "Folder not found", believe it. Use `rule-counter-node` for top-level totals, then run `rule-list-basic` only against real folder IDs you actually know.
+- **`rule_configs` and nested arrays require `--data`.** The queries, thresholds, enabled_times, and labels objects cannot be expressed as flat flags — pass them as inline JSON via `--data '{"rule_configs":{...}}'` on `rule-v2-create` / `rule-v2-update`. Typed scalar flags (`--name`, `--enabled`, `--cron-pattern`, `--ds-type`) override matching `--data` keys.
+- **`folder-id 0` is not a universal "all rules" sentinel.** If the API says "Folder not found", believe it. Run `rule-list-basic` only against real folder IDs you actually know, adding `--include-descendants` when subtree id/name rows are enough.
 - **"全量规则 / full rules" means exported monitor alert-rule definitions.** The concrete verb is `rule-export --ids ...`, usually after `rule-list-basic` selected the IDs. It does not mean dumping incidents or alerts.
-- **For rule counts, prefer the counter verbs over list pagination.** `rule-counter-node`, and `rule-counter-total` are the authoritative aggregation surfaces; do not infer counts by walking `rule-list-basic` pages.
 - **`rule-delete-batch` and `datasource-delete` are irreversible.** Confirm IDs with `rule-list-basic` / `datasource-info` first.
 - **`rule-audit-detail --id` takes the audit record ID**, not the rule ID. Get audit record IDs from `rule-audits --id <rule-id>` first; passing the rule ID returns HTTP 400.
-- **`rule-list-basic` needs a REAL `--folder-id`; it does not accept `0`.** Its generated help text saying "0 to list all accessible rules" is a known SDK/OpenAPI bug; ignore it. The command returns only that folder's *direct* rules. Without known child folder IDs the CLI cannot recursively enumerate the subtree; never substitute fired alerts as configured-rule inventory.
+- **`rule-list-basic` needs a REAL `--folder-id`; it does not accept `0`.** The command returns only that folder's *direct* rules unless `--include-descendants` is set; never substitute fired alerts as configured-rule inventory.
 
 ## Worked example — inspect a firing rule then batch-disable it
 
 ```bash
-# 1. inspect rule counts by top-level folder name (no IDs or trigger counts)
-fduty monit rule-counter-node --output-format toon
-# 2. list direct rules in a folder whose ID is separately known
+# 1. list direct rules in a folder whose ID is separately known
 fduty monit rule-list-basic --folder-id <folder-id> --output-format toon
-# if this is empty while the subtree count is non-zero, rules may live in child folders;
-# the public CLI cannot descend without their IDs
+# 2. enumerate subtree rules (id/folder_id/name only, capped at 100)
+fduty monit rule-list-basic --folder-id <folder-id> --include-descendants --limit 100 --output-format toon
 
 # 3. get full config of one rule
-fduty monit rule-info --id <rule-id> --output-format toon
+fduty monit rule-v2-info --id <rule-id> --output-format toon
 
 # 4. disable several rules at once without touching other fields
 fduty monit rule-update-fields --ids <id1>,<id2> --fields enabled --enabled false
@@ -90,41 +85,10 @@ List rule change history
 ### rule-counter-channel
 Get rule counts by channel
 
-### rule-counter-node
-Get rule counts by folder node
-
 ### rule-counter-total
 Get rule counter time series
 - response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); clock (string); id (integer); num (integer)
 
-### rule-create <folder-id>
-Create alert rule
-- `--account-id` int64 — Account ID. Filled by the server from the authenticated identity; do not provide.
-- `--channel-ids` intSlice — Channel IDs to send alerts to.
-- `--created-at` string — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
-- `--creator-id` int64 — Creator user ID. Filled by the server from the current user; do not provide.
-- `--creator-name` string — Creator name. Filled by the server; do not provide.
-- `--cron-pattern` string (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval descriptor. Must not start with 'CRON_TZ=' or 'TZ='; use the 'timezone' field instead.
-- `--debug-log-enabled` bool — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.
-- `--delay-seconds` int64 — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.
-- `--description` string — Rule description, in Markdown.
-- `--description-type` string — Format for the description. Defaults to 'text' when omitted or empty. 'text' = plain text; 'markdown' = Markdown, rendered as Markdown in alert details. · enum: text | markdown
-- `--ds-ids` intSlice — Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. At least one of 'ds_list' and 'ds_ids' must be provided.
-- `--ds-list` stringSlice — Data source name patterns (supports wildcards). At least one of 'ds_list' / 'ds_ids' must be non-empty; the two are merged to decide which datasources the rule monitors.
-- `--ds-type` string (required) — Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes' (e.g. 'prometheus', 'elasticsearch').
-- `--enabled` bool — Whether the rule is enabled. Updating to 'false' makes the server clean up the rule's active alerts.
-- `<folder-id>` (positional, required) int64 — ID of the folder the rule belongs to. Obtainable via 'POST /monit/folder/list'.
-- `--id` int64 — Rule ID. Required for update; omit for create (assigned by the server).
-- `--name` string (required) — Rule name. Must be unique within the same folder.
-- `--repeat-interval` int64 — Notification repeat interval in seconds.
-- `--repeat-total` int64 — Max number of repeat notifications.
-- `--timezone` string — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); shortcuts and offsets such as 'Local', 'UTC+8', or 'CST' are rejected. Treated as 'Asia/Shanghai' if empty.
-- `--updated-at` string — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
-- `--updater-id` int64 — Last updater user ID. Filled by the server; do not provide.
-- `--updater-name` string — Last updater name. Filled by the server; do not provide.
-- body-only (`--data`): annotations (object); enabled_times (array<object>); labels (object); rule_configs (object) (required)
-- response: single object (`data` unwrapped to the top level) — fields: account_id (integer); annotations (object); channel_ids (array<integer>); created_at (integer); creator_id (integer); creator_name (string); cron_pattern (string); debug_log_enabled (boolean); delay_seconds (integer); description (string); description_type (string); ds_ids (array<integer>); ds_list (array<string>); ds_type (string); enabled (boolean); enabled_times (array<object>); folder_id (integer); id (integer); labels (object); name (string); repeat_interval (integer); repeat_total (integer); rule_configs (object); timezone (string); updated_at (integer); updater_id (integer); updater_name (string)
-
 ### rule-delete
 Delete alert rule
 - `--id` int64 (required) — Alert rule ID. Obtainable per folder via 'POST /monit/rule/list/basic'.
@@ -133,10 +97,6 @@ Delete alert rule
 Batch delete alert rules
 - `--ids` intSlice (required) — Rule IDs.
 
-### rule-dstypes
-List available datasource types
-- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); id (integer); ident (string); name (string); weight (integer)
-
 ### rule-export
 Export alert rules
 - `--ids` intSlice (required) — Rule IDs.
@@ -146,11 +106,6 @@ Export alert rules
 Import alert rules
 - response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: message (string); name (string)
 
-### rule-info
-Get alert rule detail
-- `--id` int64 (required) — Alert rule ID. Obtainable per folder via 'POST /monit/rule/list/basic'.
-- response: single object (`data` unwrapped to the top level) — fields: account_id (integer); annotations (object); channel_ids (array<integer>); created_at (string); creator_id (integer); creator_name (string); cron_pattern (string); debug_log_enabled (boolean); delay_seconds (integer); description (string); description_type (string); ds_ids (array<integer>); ds_list (array<string>); ds_type (string); enabled (boolean); enabled_times (array<object>); folder_id (integer); id (integer); labels (object); name (string); repeat_interval (integer); repeat_total (integer); rule_configs (object); timezone (string); updated_at (string); updater_id (integer); updater_name (string)
-
 ### rule-list-basic
 List alert rules
 - `--folder-id` int64 — Folder ID. Must be an existing folder; '0' is rejected with a 'folder_not_found' error.
@@ -165,34 +120,6 @@ Move alert rules to folder
 - `--ids` intSlice (required) — Rule IDs to move.
 - response: same shape as `rule-import` above
 
-### rule-update <folder-id>
-Update alert rule
-- `--account-id` int64 — Account ID. Filled by the server from the authenticated identity; do not provide.
-- `--channel-ids` intSlice — Channel IDs to send alerts to.
-- `--created-at` string — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
-- `--creator-id` int64 — Creator user ID. Filled by the server from the current user; do not provide.
-- `--creator-name` string — Creator name. Filled by the server; do not provide.
-- `--cron-pattern` string (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval descriptor. Must not start with 'CRON_TZ=' or 'TZ='; use the 'timezone' field instead.
-- `--debug-log-enabled` bool — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.
-- `--delay-seconds` int64 — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.
-- `--description` string — Rule description, in Markdown.
-- `--description-type` string — Format for the description. Defaults to 'text' when omitted or empty. 'text' = plain text; 'markdown' = Markdown, rendered as Markdown in alert details. · enum: text | markdown
-- `--ds-ids` intSlice — Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. At least one of 'ds_list' and 'ds_ids' must be provided.
-- `--ds-list` stringSlice — Data source name patterns (supports wildcards). At least one of 'ds_list' / 'ds_ids' must be non-empty; the two are merged to decide which datasources the rule monitors.
-- `--ds-type` string (required) — Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes' (e.g. 'prometheus', 'elasticsearch').
-- `--enabled` bool — Whether the rule is enabled. Updating to 'false' makes the server clean up the rule's active alerts.
-- `<folder-id>` (positional, required) int64 — ID of the folder the rule belongs to. Obtainable via 'POST /monit/folder/list'.
-- `--id` int64 — Rule ID. Required for update; omit for create (assigned by the server).
-- `--name` string (required) — Rule name. Must be unique within the same folder.
-- `--repeat-interval` int64 — Notification repeat interval in seconds.
-- `--repeat-total` int64 — Max number of repeat notifications.
-- `--timezone` string — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); shortcuts and offsets such as 'Local', 'UTC+8', or 'CST' are rejected. Treated as 'Asia/Shanghai' if empty.
-- `--updated-at` string — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
-- `--updater-id` int64 — Last updater user ID. Filled by the server; do not provide.
-- `--updater-name` string — Last updater name. Filled by the server; do not provide.
-- body-only (`--data`): annotations (object); enabled_times (array<object>); labels (object); rule_configs (object) (required)
-- response: same shape as `rule-create <folder-id>` above
-
 ### rule-update-fields
 Batch update rule fields
 - `--channel-ids` intSlice — IDs of the collaboration spaces alerts are sent to; may be empty. Effective only when 'fields' includes 'channel_ids'.
@@ -202,7 +129,7 @@ Batch update rule fields
 - `--description` string — Rule description (Markdown). Effective only when 'fields' includes 'description'.
 - `--ds-ids` intSlice — Datasource IDs, merged with 'ds_list' to decide which datasources the rule monitors; IDs survive datasource renames. Effective only when 'fields' includes 'ds_ids'.
 - `--ds-list` stringSlice — Datasource name match patterns; wildcards supported. Effective only when 'fields' includes 'ds_list'.
-- `--ds-type` string — Datasource type identifier; allowed values are listed by 'POST /monit/rule/dstypes'. Effective only when 'fields' includes 'ds_type'.
+- `--ds-type` string — Datasource type identifier. Effective only when 'fields' includes 'ds_type'.
 - `--enabled` bool — Whether the rule is enabled. Setting it to 'false' makes the server clean up the rule's active alerts. Effective only when 'fields' includes 'enabled'.
 - `--fields` stringSlice (required) — Field names to update. Only listed fields are updated, taking new values from the same-named request fields; values for unlisted fields are silently ignored. · enum: labels | ds_type | ds_list | ds_ids | enabled | debug_log_enabled | cron_pattern | timezone | delay_seconds | enabled_times | annotations | description | channel_ids | repeat_interval | repeat_total
 - `--ids` intSlice (required) — Rule IDs to update.
@@ -212,4 +139,65 @@ Batch update rule fields
 - body-only (`--data`): annotations (object); annotations_patch (object); enabled_times (array<object>); labels (object); labels_patch (object)
 - response: same shape as `rule-import` above
 
+### rule-v2-create <folder-id>
+Create alert rule (V2)
+- `--account-id` int64 — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.
+- `--channel-ids` intSlice — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.
+- `--created-at` string — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+- `--creator-id` int64 — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.
+- `--creator-name` string — Creator name, filled by the server; any client-supplied value is ignored.
+- `--cron-pattern` string (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval. Must not start with 'CRON_TZ=' or 'TZ='; set the timezone in the 'timezone' field instead.
+- `--debug-log-enabled` bool — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.
+- `--delay-seconds` int64 — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.
+- `--description` string — Rule description, Markdown format.
+- `--description-type` string — Format of the description content. Empty or omitted defaults to 'text'. 'text' = plain text; 'markdown' = Markdown, rendered as such in alert details. · enum: text | markdown
+- `--ds-ids` intSlice — Datasource ID list, merged with 'ds_list' to decide the monitored datasources; IDs survive datasource renames. At least one of 'ds_list' / 'ds_ids' must be provided.
+- `--ds-list` stringSlice — Datasource name match patterns (wildcards supported). At least one of 'ds_list' / 'ds_ids' must be non-empty; both are merged to decide which datasources the rule monitors.
+- `--ds-type` string (required) — Datasource type identifier (e.g. 'prometheus', 'elasticsearch').
+- `--enabled` bool (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including 'false') while decoding. Setting it to 'false' on update clears the rule's active alerts.
+- `<folder-id>` (positional, required) int64 — ID of the folder the rule belongs to; list folders via 'POST /monit/folder/list'. Cannot be changed through the update API — use '/monit/rule/move' instead.
+- `--id` int64 — Rule ID. Required on update; omit on create (assigned by the server).
+- `--name` string (required) — Rule name. Must be unique within the folder and at most 128 characters.
+- `--repeat-interval` int64 — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
+- `--repeat-total` int64 — Maximum number of repeat notifications. Values below 1 fall back to the default 3.
+- `--timezone` string — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); abbreviations or offsets like 'Local', 'UTC+8', 'CST' are rejected. Empty falls back to 'Asia/Shanghai'.
+- `--updated-at` string — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+- `--updater-id` int64 — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+- `--updater-name` string — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+- body-only (`--data`): annotations (object); enabled_times (array<object>); investigation_targets (array<object>); labels (object); rule_configs (object) (required)
+- response: single object (`data` unwrapped to the top level) — fields: account_id (integer); annotations (object); channel_ids (array<integer>); created_at (integer); creator_id (integer); creator_name (string); cron_pattern (string); debug_log_enabled (boolean); delay_seconds (integer); description (string); description_type (string); ds_ids (array<integer>); ds_list (array<string>); ds_type (string); enabled (boolean); enabled_times (array<object>); folder_id (integer); id (integer); investigation_targets (array<object>); labels (object); name (string); repeat_interval (integer); repeat_total (integer); rule_configs (object); timezone (string); updated_at (integer); updater_id (integer); updater_name (string)
+
+### rule-v2-info
+Get alert rule detail (V2)
+- `--id` int64 (required) — Alert rule ID. Obtainable per folder via 'POST /monit/rule/list/basic'.
+- response: same shape as `rule-v2-create <folder-id>` above
+
+### rule-v2-update <folder-id>
+Update alert rule (V2)
+- `--account-id` int64 — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.
+- `--channel-ids` intSlice — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.
+- `--created-at` string — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+- `--creator-id` int64 — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.
+- `--creator-name` string — Creator name, filled by the server; any client-supplied value is ignored.
+- `--cron-pattern` string (required) — Schedule expression: a 6-field cron (with seconds) or an '@every 30s' interval. Must not start with 'CRON_TZ=' or 'TZ='; set the timezone in the 'timezone' field instead.
+- `--debug-log-enabled` bool — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.
+- `--delay-seconds` int64 — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.
+- `--description` string — Rule description, Markdown format.
+- `--description-type` string — Format of the description content. Empty or omitted defaults to 'text'. 'text' = plain text; 'markdown' = Markdown, rendered as such in alert details. · enum: text | markdown
+- `--ds-ids` intSlice — Datasource ID list, merged with 'ds_list' to decide the monitored datasources; IDs survive datasource renames. At least one of 'ds_list' / 'ds_ids' must be provided.
+- `--ds-list` stringSlice — Datasource name match patterns (wildcards supported). At least one of 'ds_list' / 'ds_ids' must be non-empty; both are merged to decide which datasources the rule monitors.
+- `--ds-type` string (required) — Datasource type identifier (e.g. 'prometheus', 'elasticsearch').
+- `--enabled` bool (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including 'false') while decoding. Setting it to 'false' on update clears the rule's active alerts.
+- `<folder-id>` (positional, required) int64 — ID of the folder the rule belongs to; list folders via 'POST /monit/folder/list'. Cannot be changed through the update API — use '/monit/rule/move' instead.
+- `--id` int64 — Rule ID. Required on update; omit on create (assigned by the server).
+- `--name` string (required) — Rule name. Must be unique within the folder and at most 128 characters.
+- `--repeat-interval` int64 — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
+- `--repeat-total` int64 — Maximum number of repeat notifications. Values below 1 fall back to the default 3.
+- `--timezone` string — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. 'Asia/Shanghai', 'UTC', 'Europe/London'); abbreviations or offsets like 'Local', 'UTC+8', 'CST' are rejected. Empty falls back to 'Asia/Shanghai'.
+- `--updated-at` string — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+- `--updater-id` int64 — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+- `--updater-name` string — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.
+- body-only (`--data`): annotations (object); enabled_times (array<object>); investigation_targets (array<object>); labels (object); rule_configs (object) (required)
+- response: same shape as `rule-v2-create <folder-id>` above
+
 <!-- GENERATED:monit[rule] END -->
diff --git a/skills/flashduty/reference/rum.md b/skills/flashduty/reference/rum.md
index baebaf5..bf43a5b 100644
--- a/skills/flashduty/reference/rum.md
+++ b/skills/flashduty/reference/rum.md
@@ -98,6 +98,44 @@ List applications
 - `--team-id` int64 — Filter by team ID. Get team IDs via 'POST /team/list'.
 - response: `{items: [...], has_next_page, total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); alerting (object); application_id (string); application_name (string); client_token (string); created_at (string); created_by (integer); is_private (boolean); links (object); no_geo (boolean); no_ip (boolean); status (string); team_id (integer); tracing (object); type (string); updated_at (string); updated_by (integer)
 
+### application-remote-config-get <application-id>
+Get remote config detail
+- `<application-id>` (positional, required) string — RUM application ID.
+- response: single object (`data` unwrapped to the top level) — fields: config (object); updated_at (string); version (integer)
+
+### application-remote-config-history-list <application-id>
+List remote config history
+- `<application-id>` (positional, required) string — RUM application ID.
+- `--asc` bool — Ascending order. Default: false (descending).
+- `--limit` int64 — Page size. Default 20, max 100. (max 100)
+- `--orderby` string — Sort field. Default: 'updated_at'. · enum: updated_at | version
+- `--page` int64 — Zero-based page index; offset is p multiplied by limit. (0-100000)
+- `--search-after-ctx` string
+- response: `{items: [...], has_next_page, total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: config (object); content_hash (string); equivalent_to (integer); reason (string); updated_at (string); updated_by (integer); updated_by_name (string); version (integer)
+
+### application-remote-config-history-revert <application-id>
+Revert remote config
+- `<application-id>` (positional, required) string — RUM application ID.
+- `--reason` string — Operator's note. The console fills in 'rolled back to vN' when left empty. (≤255 chars)
+- `--version` int64 (required) — History version to republish. (min 1)
+- response: single object (`data` unwrapped to the top level) — fields: version (integer)
+
+### application-remote-config-preview <application-id>
+Preview remote config
+- `--app-version` string — App version the simulated client reports.
+- `<application-id>` (positional, required) string — RUM application ID.
+- `--env` string — Environment the simulated client reports.
+- `--sdk` string — SDK name and version the simulated client reports, e.g. 'web@2.4.1'.
+- body-only (`--data`): config (object)
+- response: single object (`data` unwrapped to the top level) — fields: hit_rule_index (integer); values (object)
+
+### application-remote-config-update <application-id>
+Update remote config
+- `<application-id>` (positional, required) string — RUM application ID.
+- `--reason` string — Operator's note on why this version was published. Stored verbatim. (≤255 chars)
+- body-only (`--data`): config (object) (required)
+- response: same shape as `application-remote-config-history-revert <application-id>` above
+
 ### application-update <application-id>
 Update application
 - `<application-id>` (positional, required) string — Application ID to update. Get application IDs via 'POST /rum/application/list'.
diff --git a/skills/flashduty/reference/schedule.md b/skills/flashduty/reference/schedule.md
index 281acd1..1bbef4f 100644
--- a/skills/flashduty/reference/schedule.md
+++ b/skills/flashduty/reference/schedule.md
@@ -98,6 +98,11 @@ fduty schedule create --schedule-name "SRE Weekly" --team-id <team-id> \
 
 <!-- GENERATED:schedule START · 由 fduty __dump-commands 同步 · 勿手改 fence 内 -->
 
+### by-person <person-id>
+Get member on-call status
+- `<person-id>` (positional, required) int64 — Member ID whose on-call status is returned.
+- response: single object (`data` unwrapped to the top level) — fields: current (object); next (object); schedules (array<object>)
+
 ### create
 Create schedule
 - `--description` string — Schedule description. Max 500 characters. (≤500 chars)

From 8bca8e4908ed6e7bbb00b45a30a9f1c8022d67e3 Mon Sep 17 00:00:00 2001
From: flashduty-bot <bot@flashcat.cloud>
Date: Thu, 10 Sep 2026 11:22:54 +0800
Subject: [PATCH 2/4] refactor(monit): rework monit-query onto datasource tools
 invoke

---
 internal/cli/helpers.go                       |  24 --
 internal/cli/helpers_test.go                  |  38 --
 internal/cli/monit_query.go                   | 125 +++---
 internal/cli/monit_query_test.go              | 381 +++++++-----------
 .../flashduty/reference/monit-datasource.md   |  16 +-
 skills/flashduty/reference/monit-probe.md     |   4 +-
 skills/flashduty/reference/monit-query.md     |  46 ++-
 7 files changed, 256 insertions(+), 378 deletions(-)
 delete mode 100644 internal/cli/helpers.go

diff --git a/internal/cli/helpers.go b/internal/cli/helpers.go
deleted file mode 100644
index d5a3f9d..0000000
--- a/internal/cli/helpers.go
+++ /dev/null
@@ -1,24 +0,0 @@
-package cli
-
-import (
-	"fmt"
-	"strings"
-)
-
-// parseKVSlice converts a slice of "KEY=VALUE" entries into a map.
-// Returns nil (not an error) for an empty input so callers can pass nil
-// maps through to the SDK without triggering omitempty issues.
-func parseKVSlice(entries []string) (map[string]string, error) {
-	if len(entries) == 0 {
-		return nil, nil
-	}
-	out := make(map[string]string, len(entries))
-	for _, e := range entries {
-		i := strings.IndexByte(e, '=')
-		if i < 0 {
-			return nil, fmt.Errorf("missing '=': %q", e)
-		}
-		out[e[:i]] = e[i+1:]
-	}
-	return out, nil
-}
diff --git a/internal/cli/helpers_test.go b/internal/cli/helpers_test.go
index 146a62b..1602949 100644
--- a/internal/cli/helpers_test.go
+++ b/internal/cli/helpers_test.go
@@ -1,7 +1,6 @@
 package cli
 
 import (
-	"reflect"
 	"strings"
 	"testing"
 )
@@ -126,40 +125,3 @@ func TestOrDash(t *testing.T) {
 func TestMemberPersonInfosDisplay(t *testing.T) {
 	t.Skip("requires injection seam for fake client (Phase 3)")
 }
-
-func TestParseKVSlice(t *testing.T) {
-	cases := []struct {
-		name    string
-		input   []string
-		want    map[string]string
-		wantErr bool
-	}{
-		{"nil input", nil, nil, false},
-		{"empty input", []string{}, nil, false},
-		{"single pair", []string{"K=V"}, map[string]string{"K": "V"}, false},
-		{"multiple pairs", []string{"A=1", "B=2"}, map[string]string{"A": "1", "B": "2"}, false},
-		// Value contains additional '=' signs — only the first splits key from value.
-		{"value contains equals", []string{"K=a=b=c"}, map[string]string{"K": "a=b=c"}, false},
-		{"empty value", []string{"K="}, map[string]string{"K": ""}, false},
-		// Empty-key is the current behaviour when the entry starts with '='; documented here.
-		{"empty key", []string{"=V"}, map[string]string{"": "V"}, false},
-		{"missing equals", []string{"NOEQ"}, nil, true},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := parseKVSlice(tc.input)
-			if tc.wantErr {
-				if err == nil {
-					t.Fatal("expected error, got nil")
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if !reflect.DeepEqual(got, tc.want) {
-				t.Errorf("got %v, want %v", got, tc.want)
-			}
-		})
-	}
-}
diff --git a/internal/cli/monit_query.go b/internal/cli/monit_query.go
index 7280e26..4b240ba 100644
--- a/internal/cli/monit_query.go
+++ b/internal/cli/monit_query.go
@@ -1,95 +1,102 @@
 package cli
 
 import (
+	"encoding/json"
 	"fmt"
+	"io"
 	"strconv"
+	"strings"
 
 	"github.com/flashcatcloud/go-flashduty"
 	"github.com/spf13/cobra"
-
-	"github.com/flashcatcloud/flashduty-cli/internal/timeutil"
 )
 
+// newMonitQueryCmd builds the curated leaf for the unified datasource tool
+// entry POST /monit/datasource/tools/invoke: query tools ('<type>.query') and
+// Edge-defined diagnostic tools share this one invocation surface. The
+// generated `monit datasource-tools-invoke` is the spec-mirror equivalent.
+// The CLI only assembles the request and renders the result — tool-name and
+// per-datasource params validation are the server's job.
 func newMonitQueryCmd() *cobra.Command {
-	cmd := newGroupCmd("monit-query", "Query configured datasources; structured diagnostics use monit datasource-tools-invoke")
-	cmd.AddCommand(newMonitQueryDataCmd())
-	return cmd
-}
-
-func newMonitQueryDataCmd() *cobra.Command {
 	var (
-		dsType, dsName, expr string
-		delaySeconds         int64
-		argsKV               []string
+		tool       string
+		paramsFlag string
+		accountID  int64
 	)
 
 	cmd := &cobra.Command{
-		Use:   "data",
-		Short: "Structured datasource query (returns a stable query_result.v1: frames/records/samples)",
-		Long:  curatedLong("Structured datasource query returning the stable query_result.v1 result — frames, records, or samples — instead of the legacy flattened rows.", "Diagnostics", "QueryData"),
+		Use:   "monit-query <datasource-id>",
+		Short: "Invoke a datasource query or diagnostic tool",
+		Long: curatedLong(`Invoke one query or diagnostic tool against a configured datasource.
+
+Query tools are '<type>.query' where '<type>' is one of 'prometheus', 'mysql', 'postgres', 'oracle', 'clickhouse', 'elasticsearch', 'loki', 'victorialogs', 'sls', 'tencent_cls'; their params are the per-datasource query schemas (expr + execution, plus log/sls/tencent_cls extensions). Diagnostic tools are defined by the executing Edge (e.g. 'mysql.overview'). The tool prefix must match the datasource type; the server validates the tool name and params.`, "DataSources", "ToolsInvoke"),
+		Example: `  flashduty monit-query 12345 --tool prometheus.query --params '{"expr":"up","execution":{"kind":"instant","to_ms":1757462400000}}'
+  flashduty monit-query 12345 --tool redis_node.overview`,
+		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			if dsType == "" || dsName == "" || expr == "" {
-				return fmt.Errorf("--ds-type, --ds-name, --expr are required")
+			datasourceID, err := strconv.ParseInt(args[0], 10, 64)
+			if err != nil || datasourceID < 1 {
+				return fmt.Errorf("invalid datasource-id %q: must be a positive integer", args[0])
 			}
-			argsMap, err := parseKVSlice(argsKV)
+			params, err := resolveToolParams(paramsFlag)
 			if err != nil {
-				return fmt.Errorf("invalid --args: %w", err)
-			}
-			if err := normalizeRawTimeArgs(dsType, argsMap); err != nil {
 				return err
 			}
-
 			return runCommand(cmd, args, func(ctx *RunContext) error {
-				input := &flashduty.QueryDataRequest{
-					DsType:       dsType,
-					DsName:       dsName,
-					Expr:         expr,
-					DelaySeconds: delaySeconds,
-					Args:         argsMap,
+				req := &flashduty.DatasourceToolInvokeRequest{
+					DatasourceID: uint64(datasourceID),
+					Tool:         tool,
+					Params:       params,
+				}
+				if cmd.Flags().Changed("account-id") {
+					req.AccountID = uint64(accountID)
 				}
-				result, _, err := ctx.Client.Diagnostics.QueryData(cmdContext(ctx.Cmd), input)
+				out, _, err := ctx.Client.DataSources.ToolsInvoke(cmdContext(ctx.Cmd), req)
 				if err != nil {
 					return err
 				}
-				return ctx.Printer.Print(result, nil)
+				return printGenericResult(ctx, out)
 			})
 		},
 	}
 
-	cmd.Flags().StringVar(&dsType, "ds-type", "", "Datasource type (required)")
-	cmd.Flags().StringVar(&dsName, "ds-name", "", "Datasource name as configured (required)")
-	registerEnumFlag(cmd, "ds-type", "prometheus", "victorialogs", "loki", "mysql", "sls", "elasticsearch", "postgres", "oracle", "clickhouse")
-	cmd.Flags().StringVar(&expr, "expr", "", "Query expression (required)")
-	cmd.Flags().Int64Var(&delaySeconds, "delay-seconds", 0, "Look-back offset in seconds for point-in-time queries (default 0)")
-	cmd.Flags().StringSliceVar(&argsKV, "args", nil, "Arg entries KEY=VALUE (repeatable; values must be strings per monit-query contract). "+
-		"For loki/victorialogs raw mode, <ds-type>.start/<ds-type>.end accept a relative duration ('15m'), 'now', a date/RFC3339 timestamp, "+
-		"or a unix epoch in seconds or milliseconds — normalized to the form the datasource requires before sending")
-
+	cmd.Flags().StringVar(&tool, "tool", "", "Single tool name prefixed by the datasource type: a query tool '<type>.query' or an Edge-defined diagnostic tool (e.g. 'mysql.overview'). (required)")
+	_ = cmd.MarkFlagRequired("tool")
+	cmd.Flags().StringVar(&paramsFlag, "params", "", "Tool-specific JSON parameters as inline JSON, or - to read stdin. Omitted means the params field is not sent (the server treats it as {}); explicit null is invalid. Numbers are sent byte-exact, so epoch-millisecond values above 2^53 keep their digits.")
+	cmd.Flags().Int64Var(&accountID, "account-id", 0, "Optional consistency check; must equal the authenticated account.")
 	return cmd
 }
 
-// normalizeRawTimeArgs rewrites the raw-mode time-window args of a
-// monit-query data call (<ds-type>.start / <ds-type>.end) into the unix-
-// seconds form the server requires, accepting any format timeutil.Parse
-// understands (RFC3339, date/datetime, relative duration, unix seconds or
-// milliseconds). Loki and VictoriaLogs are the only ds-types whose raw mode
-// consumes these keys; other ds-types ignore args entirely, so nothing is
-// touched for them.
-func normalizeRawTimeArgs(dsType string, args map[string]string) error {
-	if dsType != "loki" && dsType != "victorialogs" {
-		return nil
-	}
-	for _, suffix := range []string{"start", "end"} {
-		key := dsType + "." + suffix
-		v, ok := args[key]
-		if !ok || v == "" {
-			continue
-		}
-		ts, err := timeutil.Parse(v)
+// resolveToolParams validates the --params value as a single JSON object and
+// returns it byte-exact for the request's raw params field. An empty flag
+// returns nil so the field is omitted (the server treats omitted as {};
+// explicit null is invalid). Validation decodes with UseNumber only to reject
+// malformed input — the wire payload is the original text, so large integers
+// (epoch-millisecond execution windows) cannot be rounded through float64.
+func resolveToolParams(flag string) (json.RawMessage, error) {
+	raw := flag
+	if flag == "-" {
+		b, err := readStdin("--params")
 		if err != nil {
-			return fmt.Errorf("invalid --args %s=%s: %w", key, v, err)
+			return nil, fmt.Errorf("failed to read --params from stdin: %w", err)
 		}
-		args[key] = strconv.FormatInt(ts, 10)
+		raw = string(b)
+	}
+	if raw == "" {
+		return nil, nil
+	}
+	decoder := json.NewDecoder(strings.NewReader(raw))
+	decoder.UseNumber()
+	var obj map[string]any
+	if err := decoder.Decode(&obj); err != nil {
+		return nil, fmt.Errorf("invalid --params JSON: %w", err)
+	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		return nil, fmt.Errorf("invalid --params JSON: expected one JSON object")
+	}
+	if obj == nil {
+		return nil, fmt.Errorf("invalid --params JSON: expected an object")
 	}
-	return nil
+	return json.RawMessage(raw), nil
 }
diff --git a/internal/cli/monit_query_test.go b/internal/cli/monit_query_test.go
index 0c43826..d76c8e5 100644
--- a/internal/cli/monit_query_test.go
+++ b/internal/cli/monit_query_test.go
@@ -2,275 +2,202 @@ package cli
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
-	"strconv"
+	"io"
+	"net/http"
+	"net/http/httptest"
 	"strings"
+	"sync/atomic"
 	"testing"
-	"time"
+
+	"github.com/flashcatcloud/go-flashduty"
 )
 
-func TestMonitQueryDataFlags(t *testing.T) {
-	cmd := newMonitQueryDataCmd()
-	for _, name := range []string{"ds-type", "ds-name", "expr", "args", "delay-seconds"} {
-		if cmd.Flags().Lookup(name) == nil {
-			t.Errorf("flag --%s missing", name)
+// invokeRawStub captures the raw request body sent to the unified tool
+// entry and replies with a canned tool envelope. Byte-level assertions need
+// the raw body: decoding to map[string]any first would hide float64 rounding.
+func invokeRawStub(t *testing.T) chan string {
+	t.Helper()
+	requests := make(chan string, 1)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/monit/datasource/tools/invoke" {
+			t.Errorf("unexpected endpoint: %s %s", r.Method, r.URL.Path)
 		}
-	}
+		raw, _ := io.ReadAll(r.Body)
+		requests <- string(raw)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"request_id":"monit-query-test","data":{"datasource_id":42,"tool":"prometheus.query","data":{"format":"explore_result.v1","result":{"kind":"samples","samples":[{"labels":{"job":"api"},"value":1.25}]}}}}`)
+	}))
+	t.Cleanup(server.Close)
+	newClientFn = func() (*flashduty.Client, error) {
+		return flashduty.NewClient("test", flashduty.WithBaseURL(server.URL))
+	}
+	return requests
 }
 
-func TestRetiredMonitCommandsRejectBeforeRequest(t *testing.T) {
-	for _, args := range [][]string{
-		{"monit-query", "diagnose"}, {"monit", "query-diagnose"},
-		{"monit", "rule-counter-status"},
-		{"monit", "store-ruleset-create"}, {"monit", "store-ruleset-update"},
-		{"monit", "store-ruleset-list"}, {"monit", "store-ruleset-info"}, {"monit", "store-ruleset-delete"},
-	} {
-		t.Run(strings.Join(args, " "), func(t *testing.T) {
-			saveAndResetGlobals(t)
-			stub := newGFStub(t)
-			_, err := execCommand(args...)
-			if err == nil || !strings.Contains(err.Error(), "unknown command") {
-				t.Fatalf("retired command error=%v", err)
-			}
-			if stub.requests != 0 {
-				t.Fatalf("retired command sent %d requests", stub.requests)
-			}
-		})
+func TestMonitQueryToolInvokePreservesParams(t *testing.T) {
+	saveAndResetGlobals(t)
+	requests := invokeRawStub(t)
+	out, err := execCommand("monit-query", "42", "--tool", "prometheus.query",
+		"--params", `{"expr":"sum by (job) (rate(http_requests_total[5m]))","execution":{"kind":"instant","to_ms":9007199254740993}}`,
+		"--output-format", "json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw := <-requests
+	var sent struct {
+		DatasourceID uint64          `json:"datasource_id"`
+		Tool         string          `json:"tool"`
+		Params       json.RawMessage `json:"params"`
+	}
+	if err := json.Unmarshal([]byte(raw), &sent); err != nil {
+		t.Fatal(err)
+	}
+	if sent.DatasourceID != 42 || sent.Tool != "prometheus.query" {
+		t.Fatalf("request lost identity: %s", raw)
+	}
+	if !strings.Contains(string(sent.Params), `"to_ms":9007199254740993`) || strings.Contains(string(sent.Params), "9007199254740992") {
+		t.Fatalf("params lost numeric precision: %s", sent.Params)
+	}
+	if !strings.Contains(out, "explore_result.v1") {
+		t.Fatalf("response lost query evidence: %s", out)
 	}
 }
 
-// --- monit-query data -----------------------------------------------------
-
-func TestMonitQueryDataHappyPath(t *testing.T) {
+func TestMonitQueryToolInvokeParamsFromStdin(t *testing.T) {
 	saveAndResetGlobals(t)
-	stub := newGFStub(t)
-	// data returns the stable query_result.v1 envelope: data.{format,result}.
-	stub.data = map[string]any{
-		"format": "query_result.v1",
-		"result": map[string]any{
-			"kind": "samples",
-			"samples": []any{
-				map[string]any{"labels": map[string]any{"job": "api"}, "value": 1.25},
-			},
-		},
-	}
-
-	out, err := execCommand(
-		"monit-query", "data",
-		"--ds-type", "prometheus",
-		"--ds-name", "prom-prod",
-		"--expr", "up",
-		"--delay-seconds", "30",
-		"--args", "step=15s",
-		"--output-format", "json",
-	)
+	requests := invokeRawStub(t)
+	stdinReader = strings.NewReader(`{"expr":"up","execution":{"kind":"range","from_ms":9007199254740993,"to_ms":9007199254740995,"max_data_points":100}}`)
+	_, err := execCommand("monit-query", "42", "--tool", "prometheus.query", "--params", "-", "--json")
 	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
+		t.Fatal(err)
+	}
+	raw := <-requests
+	if !strings.Contains(raw, `"from_ms":9007199254740993`) || strings.Contains(raw, "9007199254740992") {
+		t.Fatalf("stdin params lost numeric precision: %s", raw)
 	}
-	if stub.lastPath != "/monit/query/data" {
-		t.Fatalf("expected /monit/query/data, got %q", stub.lastPath)
+}
+
+func TestMonitQueryToolInvokeOmitsParams(t *testing.T) {
+	saveAndResetGlobals(t)
+	stub := newGFStub(t)
+	if _, err := execCommand("monit-query", "42", "--tool", "redis_node.overview"); err != nil {
+		t.Fatal(err)
 	}
-	body := stub.lastBody
-	if body["ds_type"] != "prometheus" || body["ds_name"] != "prom-prod" || body["expr"] != "up" {
-		t.Errorf("unexpected data input: %#v", body)
+	if stub.lastPath != "/monit/datasource/tools/invoke" {
+		t.Fatalf("unexpected path: %s", stub.lastPath)
 	}
-	if fmt.Sprint(body["delay_seconds"]) != "30" {
-		t.Errorf("expected delay_seconds 30, got %v", body["delay_seconds"])
+	if _, present := stub.lastBody["params"]; present {
+		t.Fatalf("params should be omitted, got %v", stub.lastBody["params"])
 	}
-	args, _ := body["args"].(map[string]any)
-	if args["step"] != "15s" {
-		t.Errorf("expected args step=15s, got %#v", args)
+	if stub.lastBody["tool"] != "redis_node.overview" {
+		t.Fatalf("unexpected tool: %v", stub.lastBody["tool"])
 	}
-	var rendered map[string]any
-	if err := json.Unmarshal([]byte(out), &rendered); err != nil {
-		t.Fatalf("decode CLI JSON: %v\n%s", err, out)
+}
+
+func TestMonitQueryToolInvokeAccountID(t *testing.T) {
+	saveAndResetGlobals(t)
+	stub := newGFStub(t)
+	if _, err := execCommand("monit-query", "42", "--tool", "redis_node.overview", "--account-id", "7"); err != nil {
+		t.Fatal(err)
 	}
-	if rendered["format"] != "query_result.v1" {
-		t.Errorf("expected format query_result.v1, got %v", rendered["format"])
+	if fmt.Sprint(stub.lastBody["account_id"]) != "7" {
+		t.Fatalf("account_id not stamped: %v", stub.lastBody)
 	}
 }
 
-func TestMonitQueryDataRequiredFlags(t *testing.T) {
-	cases := []struct {
+func TestMonitQueryToolInvokeRejectsBadInputBeforeRequest(t *testing.T) {
+	for _, tc := range []struct {
 		name string
 		args []string
+		want string
 	}{
-		{
-			name: "missing ds-type",
-			args: []string{
-				"monit-query", "data",
-				"--ds-name", "prom-prod",
-				"--expr", "up",
-			},
-		},
-		{
-			name: "missing ds-name",
-			args: []string{
-				"monit-query", "data",
-				"--ds-type", "prometheus",
-				"--expr", "up",
-			},
-		},
-		{
-			name: "missing expr",
-			args: []string{
-				"monit-query", "data",
-				"--ds-type", "prometheus",
-				"--ds-name", "prom-prod",
-			},
-		},
-	}
-	for _, tc := range cases {
+		{"missing tool", []string{"monit-query", "42"}, "required"},
+		{"bad datasource id", []string{"monit-query", "abc", "--tool", "prometheus.query"}, "datasource-id"},
+		{"zero datasource id", []string{"monit-query", "0", "--tool", "prometheus.query"}, "datasource-id"},
+		{"malformed params", []string{"monit-query", "42", "--tool", "prometheus.query", "--params", "{oops"}, "--params"},
+		{"null params", []string{"monit-query", "42", "--tool", "prometheus.query", "--params", "null"}, "--params"},
+		{"array params", []string{"monit-query", "42", "--tool", "prometheus.query", "--params", "[1,2]"}, "--params"},
+		{"trailing params value", []string{"monit-query", "42", "--tool", "prometheus.query", "--params", "{} {}"}, "--params"},
+	} {
 		t.Run(tc.name, func(t *testing.T) {
 			saveAndResetGlobals(t)
 			stub := newGFStub(t)
-
 			_, err := execCommand(tc.args...)
-			if err == nil {
-				t.Fatal("expected required-flag error, got nil")
-			}
-			if !strings.Contains(err.Error(), "required") {
-				t.Errorf("expected error to mention 'required', got %q", err.Error())
+			if err == nil || !strings.Contains(err.Error(), tc.want) {
+				t.Fatalf("error=%v, want substring %q", err, tc.want)
 			}
 			if stub.requests != 0 {
-				t.Errorf("data should not have been called: %d request(s)", stub.requests)
+				t.Fatalf("request sent despite invalid input: %d", stub.requests)
 			}
 		})
 	}
 }
 
-// --- normalizeRawTimeArgs --------------------------------------------------
-
-func TestNormalizeRawTimeArgsAcceptedFormats(t *testing.T) {
-	cases := []struct {
-		name  string
-		input string
-	}{
-		{"rfc3339 utc", "2026-08-11T09:40:00Z"},
-		{"rfc3339 offset", "2026-08-11T09:40:00+08:00"},
-		{"unix seconds", "1786497600"},
-		{"unix milliseconds", "1786497600000"},
+func TestMonitQueryToolErrorsPassThrough(t *testing.T) {
+	saveAndResetGlobals(t)
+	var calls atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		calls.Add(1)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusBadRequest)
+		_, _ = io.WriteString(w, `{"request_id":"trace-query","error":{"code":"BadRequest","reason":"edge_upgrade_required","message":"query tools require Explore-capable Edge"}}`)
+	}))
+	t.Cleanup(server.Close)
+	newClientFn = func() (*flashduty.Client, error) {
+		return flashduty.NewClient("test", flashduty.WithBaseURL(server.URL))
+	}
+	_, err := execCommand("monit-query", "42", "--tool", "prometheus.query",
+		"--params", `{"expr":"up","execution":{"kind":"instant","to_ms":1757462400000}}`)
+	var apiErr *flashduty.ErrorResponse
+	if !errors.As(err, &apiErr) || apiErr.Reason != "edge_upgrade_required" || calls.Load() != 1 {
+		t.Fatalf("error lost or replayed: %v, calls=%d", err, calls.Load())
+	}
+	if !strings.Contains(err.Error(), "edge_upgrade_required") || !strings.Contains(err.Error(), "trace-query") {
+		t.Fatalf("CLI error omitted reason/request ID: %v", err)
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			args := map[string]string{"victorialogs.start": tc.input, "victorialogs.end": tc.input}
-			if err := normalizeRawTimeArgs("victorialogs", args); err != nil {
-				t.Fatalf("normalizeRawTimeArgs(%q): unexpected error: %v", tc.input, err)
+}
+
+// The retired `monit-query data` subcommand (and the long-gone `diagnose`)
+// must fail before any request: monit-query is now a leaf tool-invoke command.
+func TestRetiredMonitQuerySubcommandsRejectBeforeRequest(t *testing.T) {
+	for _, args := range [][]string{
+		{"monit-query", "data", "--ds-type", "prometheus", "--ds-name", "prom-prod", "--expr", "up"},
+		{"monit-query", "data"},
+		{"monit-query", "diagnose"},
+	} {
+		t.Run(strings.Join(args, " "), func(t *testing.T) {
+			saveAndResetGlobals(t)
+			stub := newGFStub(t)
+			_, err := execCommand(args...)
+			if err == nil {
+				t.Fatal("retired command form succeeded")
 			}
-			for _, key := range []string{"victorialogs.start", "victorialogs.end"} {
-				if _, err := strconv.ParseInt(args[key], 10, 64); err != nil {
-					t.Errorf("%s: expected normalized unix-seconds string, got %q", key, args[key])
-				}
+			if stub.requests != 0 {
+				t.Fatalf("retired command form sent %d requests", stub.requests)
 			}
 		})
 	}
 }
 
-func TestNormalizeRawTimeArgsLokiPrefix(t *testing.T) {
-	args := map[string]string{"loki.start": "2026-08-11T09:40:00Z", "loki.end": "2026-08-11T10:05:00Z"}
-	if err := normalizeRawTimeArgs("loki", args); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	wantStart := strconv.FormatInt(time.Date(2026, 8, 11, 9, 40, 0, 0, time.UTC).Unix(), 10)
-	wantEnd := strconv.FormatInt(time.Date(2026, 8, 11, 10, 5, 0, 0, time.UTC).Unix(), 10)
-	if args["loki.start"] != wantStart || args["loki.end"] != wantEnd {
-		t.Errorf("unexpected normalized loki args: %#v, want start=%s end=%s", args, wantStart, wantEnd)
-	}
-}
-
-func TestNormalizeRawTimeArgsIgnoresOtherDsTypes(t *testing.T) {
-	args := map[string]string{"prometheus.start": "not-a-time"}
-	if err := normalizeRawTimeArgs("prometheus", args); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if args["prometheus.start"] != "not-a-time" {
-		t.Errorf("expected prometheus args untouched, got %#v", args)
-	}
-}
-
-func TestNormalizeRawTimeArgsIgnoresUnrelatedKeys(t *testing.T) {
-	args := map[string]string{"victorialogs.type": "raw", "victorialogs.timespan.value": "15"}
-	if err := normalizeRawTimeArgs("victorialogs", args); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if args["victorialogs.type"] != "raw" || args["victorialogs.timespan.value"] != "15" {
-		t.Errorf("expected unrelated args untouched, got %#v", args)
-	}
-}
-
-func TestNormalizeRawTimeArgsInvalidValue(t *testing.T) {
-	args := map[string]string{"victorialogs.start": "not-a-time"}
-	err := normalizeRawTimeArgs("victorialogs", args)
-	if err == nil {
-		t.Fatal("expected error for invalid victorialogs.start, got nil")
-	}
-	if !strings.Contains(err.Error(), "victorialogs.start") {
-		t.Errorf("expected error to mention victorialogs.start, got %q", err.Error())
-	}
-}
-
-// TestMonitQueryDataRawModeNormalizesRFC3339 is the regression test for the
-// raw-vs-stats time format inconsistency: a raw-mode VictoriaLogs query given
-// RFC3339 --args timestamps must reach the server as the unix-seconds form
-// the raw query path requires.
-func TestMonitQueryDataRawModeNormalizesRFC3339(t *testing.T) {
-	saveAndResetGlobals(t)
-	stub := newGFStub(t)
-	stub.data = map[string]any{"format": "query_result.v1", "result": map[string]any{"kind": "records", "records": []any{}}}
-
-	_, err := execCommand(
-		"monit-query", "data",
-		"--ds-type", "victorialogs",
-		"--ds-name", "vl-prod",
-		"--expr", `{app="api"} |= "error"`,
-		"--args", "victorialogs.type=raw",
-		"--args", "victorialogs.start=2026-08-11T09:40:00Z",
-		"--args", "victorialogs.end=2026-08-11T10:05:00Z",
-	)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	body := stub.lastBody
-	argsSent, _ := body["args"].(map[string]any)
-	start, ok := argsSent["victorialogs.start"].(string)
-	if !ok {
-		t.Fatalf("expected victorialogs.start in request args, got %#v", argsSent)
-	}
-	if _, err := strconv.ParseInt(start, 10, 64); err != nil {
-		t.Errorf("expected victorialogs.start to be unix-seconds, got %q", start)
-	}
-	end, ok := argsSent["victorialogs.end"].(string)
-	if !ok {
-		t.Fatalf("expected victorialogs.end in request args, got %#v", argsSent)
-	}
-	if _, err := strconv.ParseInt(end, 10, 64); err != nil {
-		t.Errorf("expected victorialogs.end to be unix-seconds, got %q", end)
-	}
-	wantStart := time.Date(2026, 8, 11, 9, 40, 0, 0, time.UTC).Unix()
-	wantEnd := time.Date(2026, 8, 11, 10, 5, 0, 0, time.UTC).Unix()
-	if start != strconv.FormatInt(wantStart, 10) || end != strconv.FormatInt(wantEnd, 10) {
-		t.Errorf("expected start=%d end=%d, got start=%s end=%s", wantStart, wantEnd, start, end)
-	}
-}
-
-func TestMonitQueryDataInvalidArgs(t *testing.T) {
-	saveAndResetGlobals(t)
-	stub := newGFStub(t)
-
-	_, err := execCommand(
-		"monit-query", "data",
-		"--ds-type", "prometheus",
-		"--ds-name", "prom-prod",
-		"--expr", "up",
-		"--args", "no-equals-sign",
-	)
-	if err == nil {
-		t.Fatal("expected error for malformed --args, got nil")
-	}
-	if !strings.Contains(err.Error(), "--args") {
-		t.Errorf("expected error to mention --args, got %q", err.Error())
-	}
-	if stub.requests != 0 {
-		t.Errorf("data should not have been called: %d request(s)", stub.requests)
+func TestRetiredMonitCommandsRejectBeforeRequest(t *testing.T) {
+	for _, args := range [][]string{
+		{"monit", "query-diagnose"},
+		{"monit", "rule-counter-status"},
+		{"monit", "store-ruleset-create"}, {"monit", "store-ruleset-update"},
+		{"monit", "store-ruleset-list"}, {"monit", "store-ruleset-info"}, {"monit", "store-ruleset-delete"},
+	} {
+		t.Run(strings.Join(args, " "), func(t *testing.T) {
+			saveAndResetGlobals(t)
+			stub := newGFStub(t)
+			_, err := execCommand(args...)
+			if err == nil || !strings.Contains(err.Error(), "unknown command") {
+				t.Fatalf("retired command error=%v", err)
+			}
+			if stub.requests != 0 {
+				t.Fatalf("retired command sent %d requests", stub.requests)
+			}
+		})
 	}
 }
diff --git a/skills/flashduty/reference/monit-datasource.md b/skills/flashduty/reference/monit-datasource.md
index b05800f..1334dd3 100644
--- a/skills/flashduty/reference/monit-datasource.md
+++ b/skills/flashduty/reference/monit-datasource.md
@@ -18,7 +18,7 @@ Prereq: `SKILL.md` + `reference/monit.md` read. Datasources are what every other
 | datasource detail | `datasource-info` |
 | create / update a datasource | `datasource-create` / `datasource-update` |
 | delete a datasource | `datasource-delete` |
-| run a datasource diagnostic or query tool | `datasource-tools-invoke` |
+| run a datasource query or diagnostic tool | `monit-query` (recommended; `datasource-tools-invoke` is the spec-mirror equivalent) |
 | SLS project/logstore discovery | `datasource-sls-projects` / `datasource-sls-logstores` |
 
 ## Gotchas
@@ -30,29 +30,29 @@ Prereq: `SKILL.md` + `reference/monit.md` read. Datasources are what every other
 
 Use the selected `id`, never an Agent locator. `enabled=true` is required; `alerting_enabled=false` still permits diagnostics. Same address with different IDs means different credentials/configurations and must remain separate.
 
+Invoke tools through `monit-query` (see `reference/monit-query.md`); the generated `monit datasource-tools-invoke` below is the spec-mirror equivalent entry for the same endpoint.
+
 ```bash
 fduty monit datasource-list --type redis_node --output-format json \
   | jq '[.[] | {id,name,type_ident,address,edge_cluster_name,enabled,alerting_enabled}]'
-fduty monit datasource-tools-invoke --output-format json --data - <<'FDUTY'
-{"datasource_id":12345,"tool":"redis_node.overview","params":{}}
-FDUTY
+fduty monit-query 12345 --tool redis_node.overview --output-format json
 ```
 
 One call invokes one named tool. The CLI unwraps HTTP data to `{datasource_id,tool,data,summary?,truncated?}`. The endpoint has no tool catalog: use the datasource-specific skill reference for static names and parameters. Examples include `mysql.lock_contention`, `postgres.activity`, `redis_node.slowlog`, `kafka.consumer_lag`, `elasticsearch.cat`, `prometheus.metric_trends`, `loki.log_patterns`, and `victorialogs.log_patterns`. Do not guess tool parameters.
 
-Tools require all currently routable Edge sessions in the selected cluster to support the v0.71.0 baseline. Report `edge_upgrade_required`, `mixed_edge_versions`, `no_active_edge` and `tool_not_supported` as returned; do not rotate Edges or fall back to Agent/legacy diagnose. `invalid_request` requires fixing parameters, and `source_too_large`/`result_too_large` requires a narrower request. Normal datasource queries retain their existing version compatibility.
+Tools require all currently routable Edge sessions in the selected cluster to support the v0.71.0 baseline. Report `edge_upgrade_required`, `mixed_edge_versions`, `no_active_edge` and `tool_not_supported` as returned; do not rotate Edges or fall back to Agent/legacy diagnose. `invalid_request` requires fixing parameters, and `source_too_large`/`result_too_large` requires a narrower request.
 
 ## Query tools — `<type>.query`
 
 The same invoke entry also runs query tools named `<type>.query` for ten datasource types: `prometheus`, `mysql`, `postgres`, `oracle`, `clickhouse`, `elasticsearch`, `loki`, `victorialogs`, `sls`, `tencent_cls`. The tool prefix must match the datasource type. `params` is a per-datasource structure: always `expr` plus `execution` (`kind: instant|range|window`, `from_ms`/`to_ms` Unix milliseconds; `range` also needs `max_data_points`). Log types can add `limit`/`direction`; `sls` requires `project`/`logstore`; `tencent_cls` requires `region`/`topic_id`/`syntax`. SQL types take a single read-only statement with `window` execution.
 
 ```bash
-fduty monit datasource-tools-invoke --output-format json --data - <<'FDUTY'
-{"datasource_id":12345,"tool":"prometheus.query","params":{"expr":"sum by (job) (rate(http_requests_total[5m]))","execution":{"kind":"instant","to_ms":1757462400000}}}
+fduty monit-query 12345 --tool prometheus.query --output-format json --params - <<'FDUTY'
+{"expr":"sum by (job) (rate(http_requests_total[5m]))","execution":{"kind":"instant","to_ms":1757462400000}}
 FDUTY
 ```
 
-Query `data` is the complete Explore result: `format` is `explore_result.v1` and `result.kind` is `samples`, `frames`, or `logs`; log results keep `applied_limit` and `has_more`. Query tools never synthesize `summary` or `truncated`. Query tools require Edge Explore support (protocol v0.68.0); unsupported clusters fail with `edge_upgrade_required`, `mixed_edge_versions`, or `edge_version_unknown` — report as returned, never fall back to `/monit/query/data` automatically.
+Query `data` is the complete Explore result: `format` is `explore_result.v1` and `result.kind` is `samples`, `frames`, or `logs`; log results keep `applied_limit` and `has_more`. Query tools never synthesize `summary` or `truncated`. Query tools require Edge Explore support (protocol v0.68.0); unsupported clusters fail with `edge_upgrade_required`, `mixed_edge_versions`, or `edge_version_unknown` — report as returned, never fall back to another endpoint automatically.
 
 <!-- GENERATED:monit[datasource] START · 由 fduty __dump-commands 同步 · 勿手改 fence 内 -->
 
diff --git a/skills/flashduty/reference/monit-probe.md b/skills/flashduty/reference/monit-probe.md
index 171587e..51cbaba 100644
--- a/skills/flashduty/reference/monit-probe.md
+++ b/skills/flashduty/reference/monit-probe.md
@@ -4,8 +4,8 @@ Read only the card for the selected task. Use a configured datasource for metric
 
 | Need | Command / reference |
 |---|---|
-| PromQL, SQL, LogQL, LogsQL or SLS query | `monit-query data`; `reference/monit-query.md` |
-| Metric trends, log patterns, database locks, Redis/Kafka/ES diagnostics | `monit datasource-tools-invoke`; `reference/monit-datasource.md` |
+| PromQL, SQL, LogQL, LogsQL or SLS query | `monit-query --tool '<type>.query'`; `reference/monit-query.md` |
+| Metric trends, log patterns, database locks, Redis/Kafka/ES diagnostics | `monit-query --tool '<name>'`; `reference/monit-datasource.md` |
 
 Datasource tools use `datasource_id`, one tool per call and static tool guidance.
 
diff --git a/skills/flashduty/reference/monit-query.md b/skills/flashduty/reference/monit-query.md
index 910eb99..845b4ef 100644
--- a/skills/flashduty/reference/monit-query.md
+++ b/skills/flashduty/reference/monit-query.md
@@ -1,36 +1,42 @@
-# fduty monit-query — datasource queries
+# fduty monit-query — datasource tool invocation
 
-Use `data` for PromQL, LogsQL/LogQL, SQL and SLS queries against an already configured datasource. For structured diagnostics, including metric trends and log patterns, use `monit datasource-tools-invoke` (see `reference/monit-datasource.md`).
+`monit-query` is the unified tool-invocation command for a configured datasource (`POST /monit/datasource/tools/invoke`). One call runs one named tool — there is no separate query vs. diagnostic split. The generated `monit datasource-tools-invoke` is the spec-mirror equivalent entry (see `reference/monit-datasource.md`).
 
-Routing: for the ten datasource types that support `<type>.query` (prometheus, mysql, postgres, oracle, clickhouse, elasticsearch, loki, victorialogs, sls, tencent_cls), prefer `monit datasource-tools-invoke --tool '<type>.query'` — structured `params` with per-datasource validation and complete Explore results. `monit-query data` (`/monit/query/data`) is unchanged and remains available for everything else.
+```bash
+fduty monit-query <datasource-id> --tool '<name>' [--account-id <id>] [--params '<json>']
+```
 
-Discover the exact datasource name and type with `monit datasource-list`. Preserve the selected datasource ID for diagnostic tools; multiple configurations may share an address.
+- `<datasource-id>` — numeric ID from `monit datasource-list` (use the ID, never a name; several configurations may share an address).
+- `--tool` (required) — the tool prefix must match the datasource type. Query tools are `<type>.query` for the ten types `prometheus`, `mysql`, `postgres`, `oracle`, `clickhouse`, `elasticsearch`, `loki`, `victorialogs`, `sls`, `tencent_cls`; diagnostic tools are Edge-defined names like `redis_node.overview`, `mysql.lock_contention`, `prometheus.metric_trends`, `loki.log_patterns`.
+- `--params` — tool-specific JSON object, inline or `-` for stdin. Omitted means the field is not sent (the server treats it as {}); explicit null is invalid. Numbers pass through byte-exact, so epoch-millisecond values above 2^53 keep their digits. The CLI does not validate tool names or params — the server is the authority.
+
+Query-tool `params` always carry `expr` plus `execution` (`kind: instant|range|window`, `from_ms`/`to_ms` Unix milliseconds; `range` also needs `max_data_points`). Log types can add `limit`/`direction` (raw-log retrieval only); `sls` requires `project`/`logstore`; `tencent_cls` requires `region`/`topic_id`/`syntax`. SQL types take a single read-only statement with `window` execution.
 
 ```bash
-query=$(cat <<'FDUTY_QUERY'
-sum by (job) (rate(http_requests_total[5m]))
-FDUTY_QUERY
-)
-fduty monit-query data --ds-type prometheus --ds-name prod-prom --expr "$query" --output-format json
+# query tool: PromQL instant evaluation
+fduty monit-query 12345 --tool prometheus.query --output-format json --params - <<'FDUTY'
+{"expr":"sum by (job) (rate(http_requests_total[5m]))","execution":{"kind":"instant","to_ms":1757462400000}}
+FDUTY
+
+# diagnostic tool: no params needed
+fduty monit-query 12345 --tool redis_node.overview --output-format json
 ```
 
 <!-- GENERATED:monit-query START · 由 fduty __dump-commands 同步 · 勿手改 fence 内 -->
 
-### data
-Structured datasource query (returns a stable query_result.v1: frames/records/samples)
-- `--args` stringSlice
-- `--delay-seconds` int64
-- `--ds-name` string
-- `--ds-type` string
-- `--expr` string
-- response: single object (`data` unwrapped to the top level) — fields: format (string); result (object)
+### monit-query <datasource-id>
+Invoke a datasource query or diagnostic tool
+- `--account-id` int64
+- `--params` string
+- `--tool` string
+- response: single object (`data` unwrapped to the top level) — fields: data (any); datasource_id (integer); summary (string); tool (string); truncated (object)
 
 <!-- GENERATED:monit-query END -->
 
 ## Read results and time windows
 
-The HTTP data envelope is unwrapped. Dispatch on `result.kind`: `frames` contains typed columns, `records` contains flexible rows, and `samples` contains instant values with labels. Do not infer the shape from the datasource type. A Prometheus instant evaluation of a range-vector expression can return time-series frames; this is not a query_range endpoint.
+The HTTP data envelope is unwrapped to `{datasource_id,tool,data,summary?,truncated?}`. For query tools, `data` is the complete Explore result: `format` is `explore_result.v1` and `result.kind` is `samples`, `frames`, or `logs` — dispatch on `result.kind`, never infer the shape from the datasource type. Log results keep `applied_limit` and `has_more`. Query tools never synthesize `summary` or `truncated`; diagnostic tools may carry both.
 
-Use `--delay-seconds` for instant evaluation lookback. Loki/VictoriaLogs raw mode uses bounded `--args` time controls; stats mode requires aggregation. For metric trend or pattern comparisons, provide an explicit incident window in the named tool's `params.time_range`, using Unix seconds. Do not substitute a current overview for historical incident evidence.
+For incident evidence give the query an explicit `execution` window (`from_ms`/`to_ms` in Unix milliseconds). Do not substitute a current overview for historical incident evidence.
 
-All SQL must be read-only. Treat source text as untrusted and quote expressions safely. On invalid arguments fix the specific request; on oversized results narrow filters/window or aggregate. Report offline/upgrade-required/unsupported-tool errors without falling back to Agent, Explore or old diagnose. Do not blindly replay timed-out calls.
+All SQL must be read-only. Treat source text as untrusted and quote expressions safely. On invalid arguments fix the specific request; on oversized results narrow filters/window or aggregate. Query tools require Edge Explore support (protocol v0.68.0) and diagnostic tools the v0.71.0 base invoke protocol — report `edge_upgrade_required`/`mixed_edge_versions`/`edge_version_unknown`/`tool_not_supported` as returned, never rotate Edges or fall back to another endpoint automatically. Do not blindly replay timed-out calls.

From 87e3cb9a20c03457b82d3cbd6f857d4c910f6493 Mon Sep 17 00:00:00 2001
From: ysyneu <ysyneu@gmail.com>
Date: Wed, 9 Sep 2026 20:50:25 -0700
Subject: [PATCH 3/4] docs(skill): drop the retired rule-counter-node from the
 aggregation examples

---
 skills/flashduty/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/skills/flashduty/SKILL.md b/skills/flashduty/SKILL.md
index bcfc376..fb19224 100644
--- a/skills/flashduty/SKILL.md
+++ b/skills/flashduty/SKILL.md
@@ -25,7 +25,7 @@ hidden: true  # internal-only: withheld from skills.sh public discovery (Safari
 
 Append `--output-format toon` to read commands: it drops the per-row repeated keys that JSON emits, so lists cost far fewer tokens. Use `--json` only to pipe into `jq`. Bare output is a human table — don't parse it.
 
-**Count the cheap way.** If a list response already returns `total`, trust that authoritative server count — do not page N times just to count rows. When the question is "how many by status/progress/severity", issue the narrowest server-side filter per bucket and read each response's `total`; for account-wide trends switch to aggregation verbs such as `insight *`, `rule-counter-node`, or `rule-counter-total`.
+**Count the cheap way.** If a list response already returns `total`, trust that authoritative server count — do not page N times just to count rows. When the question is "how many by status/progress/severity", issue the narrowest server-side filter per bucket and read each response's `total`; for account-wide trends switch to aggregation verbs such as `insight *`, `rule-counter-total`, or `rule-counter-channel`.
 
 **Shape the payload before you fetch it.** For ID scans, counts, or "find the matching row" tasks, prefer `--fields` projections and compact list verbs over full detail dumps. Huge raw JSON dumps are a last resort, not a default.
 

From 7fa53c15fc7a1c625a62aecd317433f6e47124fd Mon Sep 17 00:00:00 2001
From: ysyneu <ysyneu@gmail.com>
Date: Wed, 9 Sep 2026 20:52:15 -0700
Subject: [PATCH 4/4] chore(deps): pin go-flashduty at the released v0.15.2

The branch pinned a pseudo-version of the SDK PR head; the SDK change is
now released, and generation produces byte-identical output from the tag.
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 9861816..b0061c3 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/flashcatcloud/flashduty-cli
 go 1.25.1
 
 require (
-	github.com/flashcatcloud/go-flashduty v0.15.2-0.20260910014922-dce7c882be68
+	github.com/flashcatcloud/go-flashduty v0.15.2
 	github.com/mattn/go-runewidth v0.0.28
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
diff --git a/go.sum b/go.sum
index c20d3d6..77c87a7 100644
--- a/go.sum
+++ b/go.sum
@@ -1,8 +1,8 @@
 github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY=
 github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/flashcatcloud/go-flashduty v0.15.2-0.20260910014922-dce7c882be68 h1:jPJA1NB+HcL2FcBZ+PbVZ0xejVvqELOMHEBDJYGUbQ0=
-github.com/flashcatcloud/go-flashduty v0.15.2-0.20260910014922-dce7c882be68/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
+github.com/flashcatcloud/go-flashduty v0.15.2 h1:dDUcoaMB48cLoRVJU8AcfXWaSEEHtI0Z6XCX81KHNpQ=
+github.com/flashcatcloud/go-flashduty v0.15.2/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU=