From c09be9bf8b0997f20aaed96b1e6da976b6cf3ab9 Mon Sep 17 00:00:00 2001
From: ysyneu <ysyneu@gmail.com>
Date: Sun, 20 Sep 2026 19:58:33 -0700
Subject: [PATCH] chore: bump go-flashduty to v0.15.4 and regenerate

- member notify: --dry-run is gone. The server now rejects a body the
  sanitizer would rewrite with a 400, so there is nothing left to
  preview; the response carries agent_instructions instead of html.
  Drops the test that pinned a dry run printing the whole email, and
  the card's dry_run advice.
- monit rule-export / rule-import are gone with their endpoints. The
  monit-rule card now points full-definition requests at
  rule-list-basic + rule-v2-info.
- Generated fences and help pick up the other spec changes
  (investigation_targets time_range / variables / query kind, and the
  schema text updates).
---
 go.mod                                        |   2 +-
 go.sum                                        |   4 +-
 internal/cli/gen_support_test.go              |  38 ---
 internal/cli/zz_generated_alert_rules.go      | 220 +++++-------------
 internal/cli/zz_generated_alerts.go           |   2 +
 internal/cli/zz_generated_applications.go     |  15 ++
 internal/cli/zz_generated_audit_logs.go       |   2 +-
 internal/cli/zz_generated_automations.go      |   4 +-
 internal/cli/zz_generated_incidents.go        |   2 +
 internal/cli/zz_generated_manifest.go         |   2 -
 internal/cli/zz_generated_members.go          |  16 +-
 .../zz_generated_notification_templates.go    |  68 ++++++
 internal/cli/zz_generated_response_help.go    |  30 ++-
 internal/cli/zz_generated_sessions.go         |  11 +
 skills/flashduty/reference/alert.md           |   4 +-
 skills/flashduty/reference/incident.md        |   4 +-
 skills/flashduty/reference/member.md          |   6 +-
 skills/flashduty/reference/monit-rule.md      |  21 +-
 skills/flashduty/reference/rum.md             |  10 +-
 skills/flashduty/reference/safari.md          |   4 +-
 skills/flashduty/reference/template.md        |  14 +-
 21 files changed, 214 insertions(+), 265 deletions(-)

diff --git a/go.mod b/go.mod
index a05b895..2d76bbf 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/flashcatcloud/flashduty-cli
 go 1.25.1
 
 require (
-	github.com/flashcatcloud/go-flashduty v0.15.3
+	github.com/flashcatcloud/go-flashduty v0.15.4
 	github.com/mattn/go-runewidth v0.0.29
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
diff --git a/go.sum b/go.sum
index bc67339..a018110 100644
--- a/go.sum
+++ b/go.sum
@@ -1,8 +1,8 @@
 github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY=
 github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/flashcatcloud/go-flashduty v0.15.3 h1:NKxAupco3bE5GuToAYt5DHtdWg/gdwcwfguyenc/umI=
-github.com/flashcatcloud/go-flashduty v0.15.3/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
+github.com/flashcatcloud/go-flashduty v0.15.4 h1:Bp7OnOd3dO0BmG2ystR7ycRRCJCwqyEEtonixWzzC3Q=
+github.com/flashcatcloud/go-flashduty v0.15.4/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/mattn/go-runewidth v0.0.29 h1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqEPDfQ=
diff --git a/internal/cli/gen_support_test.go b/internal/cli/gen_support_test.go
index 39bda16..a1a26d4 100644
--- a/internal/cli/gen_support_test.go
+++ b/internal/cli/gen_support_test.go
@@ -287,44 +287,6 @@ func TestPrintGenericResultShortenedRowStaysUTF8(t *testing.T) {
 	}
 }
 
-// TestMemberNotifyDryRunPrintsWholeEmail pins that a notify dry run is a
-// plain object, not a list page: an email past the structured-output limit
-// comes back whole, with every recipient outcome, instead of failing on the
-// list bound.
-func TestMemberNotifyDryRunPrintsWholeEmail(t *testing.T) {
-	html := "<p>" + strings.Repeat("report line ", 5000) + "</p>"
-	for _, format := range []string{"json", "toon"} {
-		t.Run(format, func(t *testing.T) {
-			saveAndResetGlobals(t)
-			stub := newGFStub(t)
-			stub.data = map[string]any{
-				"recipients": []any{
-					map[string]any{"person_id": 5068740052131, "status": "accepted"},
-					map[string]any{"person_id": 5068740052132, "status": "skipped", "reason": "no_email"},
-				},
-				"html": html,
-			}
-
-			out, stderrText, err := execCommandSplit("member", "notify",
-				"--subject", "Daily report", "--html", "<p>report</p>", "--dry-run", "--output-format", format)
-			if err != nil {
-				t.Fatalf("execCommandSplit: %v", err)
-			}
-			if len(out) < compactListOutputLimit || !strings.Contains(out, strings.Repeat("report line ", 5000)) {
-				t.Errorf("%s dry run lost part of the email: %d bytes", format, len(out))
-			}
-			for _, want := range []string{"5068740052131", "5068740052132", "no_email"} {
-				if !strings.Contains(out, want) {
-					t.Errorf("%s dry run lost recipient outcome %q", format, want)
-				}
-			}
-			if strings.Contains(out, "truncated") || strings.Contains(stderrText, "note:") {
-				t.Errorf("%s dry run must not be reduced, stderr:\n%s", format, stderrText)
-			}
-		})
-	}
-}
-
 // TestPrintGenericResultCompleteEnvelopeUnmarked guards the marker's negative
 // case: a page that fits carries no truncated/emitted_rows keys — the marker
 // means "this page was reduced", not "this command supports reduction".
diff --git a/internal/cli/zz_generated_alert_rules.go b/internal/cli/zz_generated_alert_rules.go
index ddf2dc9..f80d104 100644
--- a/internal/cli/zz_generated_alert_rules.go
+++ b/internal/cli/zz_generated_alert_rules.go
@@ -188,114 +188,6 @@ Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '
 	return cmd
 }
 
-func genAlertRulesReadExportCmd() *cobra.Command {
-	var dataJSON string
-	var fIDs []int
-	cmd := &cobra.Command{
-		Use:   "rule-export",
-		Short: "Export alert rules",
-		Long: `Export alert rules.
-
-Export the configuration of selected alert rules as a portable JSON array, compatible with 'POST /monit/rule/import'.
-
-API: POST /monit/rule/export (monit-rule-read-export)
-
-Request fields:
-  --ids []int (required) — Rule IDs.
-
-Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '.[]'', NOT '.items[]'):
-  - annotations (object) — Custom annotation key-value pairs attached to alert events; keys must not start with '$' (reserved for query field references).
-  - cron_pattern (string) (required) — Evaluation schedule as a 6-field cron expression (seconds included) or '@every <duration>' (an integral number of seconds, at least 1s); 'CRON_TZ='/'TZ=' prefixes are rejected — set the timezone in 'timezone' instead.
-  - debug_log_enabled (boolean) (required) — Whether to emit debug logs for this rule's evaluations; enable when troubleshooting.
-  - delay_seconds (integer) — Query time offset in seconds: each evaluation reads data as of 'schedule time − delay_seconds' to tolerate ingestion lag; '0' means no offset.
-  - description (string) — Rule description in the format given by 'description_type', shown with alert events.
-  - description_type (string) — Format of 'description', 'text' or 'markdown'; treated as 'text' when omitted. [text, markdown]
-  - ds_ids (array<integer>) — Datasource ID list, merged with 'ds_list'; references by ID and is therefore immune to datasource renames.
-  - ds_list (array<string>) — Datasource name list with wildcard support; merged with 'ds_ids' to decide which datasources the rule monitors — must be maintained by hand if a datasource is renamed.
-  - ds_type (string) (required) — Datasource type ident, e.g. 'prometheus'; must be a datasource type ('ident') that exists in the import target environment.
-  - enabled (boolean) (required) — Whether the rule is enabled; rules imported as disabled are not evaluated.
-  - enabled_times (array<object>) — Effective time windows; each entry has 'days' (0–6, 0 = Sunday) and 'stime'/'etime' ('HH:MM'), interpreted in the rule's 'timezone'; an empty list disables the rule.
-    - days (array<integer>) — Days of week, 0 = Sunday.
-    - etime (string) — End time, e.g. '18:00'.
-    - stime (string) — Start time, e.g. '09:00'.
-  - labels (object) — Custom label key-value pairs attached to alert events produced by this rule.
-  - name (string) (required) — Rule name, up to 128 characters when imported.
-  - repeat_interval (integer) — Interval in seconds between repeated notifications for a firing alert; values below 1 fall back to the default of 3600.
-  - repeat_total (integer) — Maximum number of repeated notifications for the same alert; values below 1 fall back to the default of 3.
-  - rule_configs (object) — Rule evaluation configuration.
-    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery condition for any-data check. If omitted or 'mode' is empty, treated as 'nodata'.
-        - args (object) — Datasource-specific options for the recovery query, same convention as 'queries[].args'; required for Elasticsearch datasources when 'mode' is 'ql'.
-        - condition (string) — Recovery expression. Required when 'mode' is 'ql'.
-        - mode (string) — 'nodata' = recover when the query returns no data; 'ql' = recover when the 'condition' expression evaluates to true. When 'mode' is 'ql', only a single query ('name=A') is permitted. [nodata, ql]
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_nodata (object) — No-data check configuration.
-      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.
-      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when 'alert_on_empty_result' is enabled. [Critical, Warning, Info]
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - resolve_timeout (integer) — Auto-resolve after N seconds.
-      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]
-    - check_threshold (object) — Threshold check configuration.
-      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.
-      - critical (string) — Critical threshold expression referencing query results via '$<query>' or '$<query>.<value_field>', e.g. '$A > 90'; at least one severity must be configured.
-      - enabled (boolean) — Whether threshold checking is enabled.
-      - info (string) — Info threshold expression, same syntax as 'critical'.
-      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.
-      - recovery (object) — Recovery evaluation configuration for threshold checks.
-        - args (object) — Datasource-specific extra parameters for the recovery query, using the same '<datasource>.<param>' key convention as query 'args'. Omitted when empty.
-        - condition (string) — Recovery condition expression; required when 'mode' is 'threshold' or 'ql', and must be empty for 'invert'.
-        - mode (string) — Recovery mode: 'invert' = resolve when the alert expression no longer holds ('condition' stays empty); 'threshold' = resolve when the 'condition' threshold expression holds; 'ql' = resolve when the 'condition' query expression evaluates true. [invert, threshold, ql]
-        - value_fields (array<string>) — Numeric result fields the recovery 'condition' references as '$A.<field>'; same semantics as the query's 'value_fields'. Omitted when empty.
-      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.
-      - warning (string) — Warning threshold expression, same syntax as 'critical'.
-    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique 'name' ('R' and '__all__' are reserved) and a non-empty, non-duplicate 'expr'.
-      - args (object) — Datasource-specific query options keyed by the '<datasource>.<option>' convention (e.g. 'es.type', 'tencent_cls.limit'); most datasources need none.
-      - expr (string) — Query expression.
-      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap 'value_fields'; applies to table-shaped results (SQL/ES-style datasources).
-      - name (string) — Query identifier (letter, e.g. 'A'). The name 'R' is reserved and must not be used.
-      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as '$A.<field>' in threshold expressions); required for threshold checks unless the datasource is 'prometheus'/'loki'/'victorialogs'; field names must not contain '.'.
-    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique 'name' (not duplicating any query name) and a non-empty 'expr'.
-      - args (object) — Datasource-specific options for the auxiliary query, same convention as 'queries[].args'.
-      - expr (string) — Query expression.
-      - name (string) — Relate-query identifier.
-  - timezone (string) — Timezone in which the rule executes. IANA timezone name; defaults to 'Asia/Shanghai'.
-`,
-		Example: `  flashduty monit rule-export --data '{"ids":[50001]}'`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return runCommand(cmd, args, func(ctx *RunContext) error {
-				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
-					if cmd.Flags().Changed("ids") {
-						body["ids"] = fIDs
-					}
-					return nil
-				})
-				if err != nil {
-					return err
-				}
-				req := new(flashduty.RuleIDsRequest)
-				if err := genBindBody(body, req); err != nil {
-					return err
-				}
-				out, _, err := ctx.Client.AlertRules.ReadExport(cmdContext(ctx.Cmd), req)
-				if err != nil {
-					return err
-				}
-				return printGenericResult(ctx, out)
-			})
-		},
-	}
-	cmd.Flags().IntSliceVar(&fIDs, "ids", nil, "Rule IDs. (required)")
-	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
-	return cmd
-}
-
 func genAlertRulesReadInfoV2Cmd() *cobra.Command {
 	var dataJSON string
 	var fID int64
@@ -337,8 +229,18 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
     - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
       - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
-      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
-    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
+      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
+    - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
+      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - query (object) (required) — Query payload.
+        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
+        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
+        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when 'mode' is 'range', and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)
+        - mode (string) (required) — Evaluation mode: 'instant' evaluates at a single timestamp, 'range' evaluates a stepped series, 'window' returns raw rows inside a time window. [instant, range, window]
+    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.
+      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)
+      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)
   - labels (object) — Custom labels.
   - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.
   - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
@@ -573,8 +475,18 @@ Request fields:
     - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
       - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
-      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
-    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
+      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
+    - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
+      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - query (object) (required) — Query payload.
+        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
+        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
+        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when 'mode' is 'range', and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)
+        - mode (string) (required) — Evaluation mode: 'instant' evaluates at a single timestamp, 'range' evaluates a stepped series, 'window' returns raw rows inside a time window. [instant, range, window]
+    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.
+      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)
+      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)
   labels (object, via --data) — Custom labels.
   rule_configs (object, via --data) (required) — Detection configuration: query list plus trigger/recovery conditions. See 'AlertRuleConfigsV2'.
     - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See 'AlertRuleAnyDataV2'.
@@ -648,8 +560,18 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
     - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
       - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
-      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
-    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
+      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
+    - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
+      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - query (object) (required) — Query payload.
+        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
+        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
+        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when 'mode' is 'range', and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)
+        - mode (string) (required) — Evaluation mode: 'instant' evaluates at a single timestamp, 'range' evaluates a stepped series, 'window' returns raw rows inside a time window. [instant, range, window]
+    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.
+      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)
+      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)
   - labels (object) — Custom labels.
   - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.
   - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
@@ -1067,46 +989,6 @@ Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '
 	return cmd
 }
 
-func genAlertRulesWriteImportCmd() *cobra.Command {
-	var dataJSON string
-	cmd := &cobra.Command{
-		Use:   "rule-import",
-		Short: "Import alert rules",
-		Long: `Import alert rules.
-
-Import one or more alert rules from a JSON array. Returns the result for each rule, indicating success or failure.
-
-API: POST /monit/rule/import (monit-rule-write-import)
-
-Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '.[]'', NOT '.items[]'):
-  - message (string) (required) — Empty on success, error message on failure.
-  - name (string) (required) — Rule name.
-`,
-		Example: `  flashduty monit rule-import --data '[{"cron_pattern":"0 * * * * *","ds_list":["prometheus*"],"ds_type":"prometheus","enabled":true,"folder_id":100,"name":"CPU High","rule_configs":{"queries":[{"expr":"avg(cpu_usage_idle) \u003c 10","name":"A"}]}}]'`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return runCommand(cmd, args, func(ctx *RunContext) error {
-				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
-					return nil
-				})
-				if err != nil {
-					return err
-				}
-				req := new(flashduty.RuleImportRequest)
-				if err := genBindBody(body, req); err != nil {
-					return err
-				}
-				out, _, err := ctx.Client.AlertRules.WriteImport(cmdContext(ctx.Cmd), req)
-				if err != nil {
-					return err
-				}
-				return printGenericResult(ctx, out)
-			})
-		},
-	}
-	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
-	return cmd
-}
-
 func genAlertRulesWriteMoveCmd() *cobra.Command {
 	var dataJSON string
 	var fDestFolderID int64
@@ -1228,8 +1110,18 @@ Request fields:
     - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
       - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
-      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
-    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
+      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
+    - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
+      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - query (object) (required) — Query payload.
+        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
+        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
+        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when 'mode' is 'range', and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)
+        - mode (string) (required) — Evaluation mode: 'instant' evaluates at a single timestamp, 'range' evaluates a stepped series, 'window' returns raw rows inside a time window. [instant, range, window]
+    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.
+      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)
+      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)
   labels (object, via --data) — Custom labels.
   rule_configs (object, via --data) (required) — Detection configuration: query list plus trigger/recovery conditions. See 'AlertRuleConfigsV2'.
     - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See 'AlertRuleAnyDataV2'.
@@ -1303,8 +1195,18 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
     - dashboard (object) — Configuration for the 'dashboard' kind; required when 'kind' is 'dashboard'.
       - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
-      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.
-    - kind (string) (required) — Entry type; currently only 'dashboard' is supported. [dashboard]
+      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
+    - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
+      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - query (object) (required) — Query payload.
+        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
+        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
+        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when 'mode' is 'range', and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)
+        - mode (string) (required) — Evaluation mode: 'instant' evaluates at a single timestamp, 'range' evaluates a stepped series, 'window' returns raw rows inside a time window. [instant, range, window]
+    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.
+      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)
+      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)
   - labels (object) — Custom labels.
   - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.
   - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.
@@ -1494,14 +1396,12 @@ func registerGeneratedAlertRules(root *cobra.Command) {
 	genAddLeaf(gMonit, genAlertRulesReadAuditsCmd())
 	genAddLeaf(gMonit, genAlertRulesReadCounterChannelCmd())
 	genAddLeaf(gMonit, genAlertRulesReadCounterTotalCmd())
-	genAddLeaf(gMonit, genAlertRulesReadExportCmd())
 	genAddLeaf(gMonit, genAlertRulesReadInfoV2Cmd())
 	genAddLeaf(gMonit, genAlertRulesReadListCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteCreateV2Cmd())
 	genAddLeaf(gMonit, genAlertRulesWriteDeleteCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteDeleteBatchCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteFieldsUpdateCmd())
-	genAddLeaf(gMonit, genAlertRulesWriteImportCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteMoveCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteUpdateV2Cmd())
 }
diff --git a/internal/cli/zz_generated_alerts.go b/internal/cli/zz_generated_alerts.go
index 7f3d411..281da42 100644
--- a/internal/cli/zz_generated_alerts.go
+++ b/internal/cli/zz_generated_alerts.go
@@ -281,6 +281,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
   - has_next_page (boolean) — Whether a next page exists.
   - items (array<object>) — Alert feed records on the current page.
     - account_id (integer) (required) — Account ID.
+    - agent_session_id (string) — AI SRE session that produced the entry. Omitted when no agent wrote it.
     - created_at (string) (required) — Creation timestamp in Unix epoch milliseconds. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
     - creator_id (integer) (required) — Member ID of the creator. 0 for system-generated entries.
     - deleted_at (string) — Soft-delete time, Unix epoch milliseconds. Omitted when not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
@@ -307,6 +308,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
     - ref_id (string) (required) — ObjectID of the alert this entry references.
     - type (string) (required) — Alert activity feed entry type. Each value identifies one alert lifecycle event; the matching 'detail' payload shape is determined by this field. | Type | Meaning | |---|---| | 'a_new' | Alert triggered by an incoming event. | | 'a_update' | Alert severity or status changed on an incoming event. | | 'a_comm' | Comment added on the alert. | | 'a_merge' | Alert merged into an incident. | | 'a_m_silence' | Alert muted by a silence rule. | | 'a_m_inhibit' | Alert muted by an inhibit rule. | | 'a_m_flapping' | Alert muted by flapping detection (historical data only; no longer produced). | | 'a_ack' | Alert acknowledged (historical data only; alert-level acknowledgement has been removed). | | 'a_unack' | Alert acknowledgement revoked (historical data only). | | 'a_close' | Alert closed (historical data only; no longer produced). | [a_new, a_update, a_comm, a_merge, a_m_silence, a_m_inhibit, a_m_flapping, a_ack, a_unack, a_close]
     - updated_at (string) (required) — Last update timestamp in Unix epoch milliseconds. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+    - via (string) — Surface that wrote the entry on a user's behalf; currently only 'ai_sre'. Omitted when a user created the entry directly.
 `,
 		Args:    requireBodyFieldOrExactArg("alert_id", "alert-id"),
 		Example: `  flashduty alert feed --data '{"alert_id":"663a1b2c3d4e5f6789abcdef","asc":false,"limit":20}'`,
diff --git a/internal/cli/zz_generated_applications.go b/internal/cli/zz_generated_applications.go
index 4ed818f..bb60b19 100644
--- a/internal/cli/zz_generated_applications.go
+++ b/internal/cli/zz_generated_applications.go
@@ -49,6 +49,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - url (string) (required) — HTTP or HTTPS URL template. '${var}' tokens are resolved from the RUM event context.
   - no_geo (boolean) — If 'true', geographic location is not inferred from IP.
   - no_ip (boolean) — If 'true', IP addresses are not collected.
+  - repositories (array<object>) — Linked source code repositories, in order; the first entry is the primary repository. Linking grants no access by itself: AI sessions can only read repositories granted to the account's GitHub App installations.
+    - repo (string) (required) — GitHub repository in 'owner/name' form.
+    - subdir (string) — Directory holding the application inside the repository, relative to the repository root. '.' is the repository root; an empty value is saved as '.'.
   - status (string) — Application status. One of 'enabled' (active, receiving data), 'disabled' (deactivated), 'deleted' (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]
   - team_id (integer) — Owning team ID.
   - tracing (object) — APM tracing integration configuration.
@@ -134,6 +137,9 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
         - url (string) (required) — HTTP or HTTPS URL template. '${var}' tokens are resolved from the RUM event context.
     - no_geo (boolean) — If 'true', geographic location is not inferred from IP.
     - no_ip (boolean) — If 'true', IP addresses are not collected.
+    - repositories (array<object>) — Linked source code repositories, in order; the first entry is the primary repository. Linking grants no access by itself: AI sessions can only read repositories granted to the account's GitHub App installations.
+      - repo (string) (required) — GitHub repository in 'owner/name' form.
+      - subdir (string) — Directory holding the application inside the repository, relative to the repository root. '.' is the repository root; an empty value is saved as '.'.
     - status (string) — Application status. One of 'enabled' (active, receiving data), 'disabled' (deactivated), 'deleted' (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]
     - team_id (integer) — Owning team ID.
     - tracing (object) — APM tracing integration configuration.
@@ -234,6 +240,9 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
         - url (string) (required) — HTTP or HTTPS URL template. '${var}' tokens are resolved from the RUM event context.
     - no_geo (boolean) — If 'true', geographic location is not inferred from IP.
     - no_ip (boolean) — If 'true', IP addresses are not collected.
+    - repositories (array<object>) — Linked source code repositories, in order; the first entry is the primary repository. Linking grants no access by itself: AI sessions can only read repositories granted to the account's GitHub App installations.
+      - repo (string) (required) — GitHub repository in 'owner/name' form.
+      - subdir (string) — Directory holding the application inside the repository, relative to the repository root. '.' is the repository root; an empty value is saved as '.'.
     - status (string) — Application status. One of 'enabled' (active, receiving data), 'disabled' (deactivated), 'deleted' (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]
     - team_id (integer) — Owning team ID.
     - tracing (object) — APM tracing integration configuration.
@@ -801,6 +810,9 @@ Request fields:
       - id (string) — Stable client-side identifier for this external system.
       - name (string) (required) — Display name of the external system.
       - url (string) (required) — HTTP or HTTPS URL template. '${var}' tokens are resolved from the RUM event context.
+  repositories (array<object>, via --data) — Source code repositories to link, in order; the first entry is the primary repository. At most 10 entries.
+    - repo (string) (required) — GitHub repository in 'owner/name' form.
+    - subdir (string) — Directory holding the application inside the repository, relative to the repository root. '.' is the repository root; an empty value is saved as '.'.
   tracing (object, via --data) — Optional APM tracing integration configuration.
     - enabled (boolean) (required) — Whether tracing integration is enabled.
     - endpoint (string) (required) — Trace endpoint URL (http or https).
@@ -958,6 +970,9 @@ Request fields:
       - id (string) — Stable client-side identifier for this external system.
       - name (string) (required) — Display name of the external system.
       - url (string) (required) — HTTP or HTTPS URL template. '${var}' tokens are resolved from the RUM event context.
+  repositories (array<object>, via --data) — Replaces the linked source code repositories when present; an empty array removes all links, and omitting the field leaves them unchanged. At most 10 entries.
+    - repo (string) (required) — GitHub repository in 'owner/name' form.
+    - subdir (string) — Directory holding the application inside the repository, relative to the repository root. '.' is the repository root; an empty value is saved as '.'.
   tracing (object, via --data) — APM tracing integration configuration. Omit to leave unchanged.
     - enabled (boolean) (required) — Whether tracing integration is enabled.
     - endpoint (string) (required) — Trace endpoint URL (http or https).
diff --git a/internal/cli/zz_generated_audit_logs.go b/internal/cli/zz_generated_audit_logs.go
index 8d4305a..675d21a 100644
--- a/internal/cli/zz_generated_audit_logs.go
+++ b/internal/cli/zz_generated_audit_logs.go
@@ -85,7 +85,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
     - body (string) (required) — JSON-encoded request body. Bodies containing sensitive fields are base64url-encoded instead; bodies over 10 KB are replaced by a truncation placeholder.
     - created_at (string) (required) — Timestamp of the operation in Unix epoch milliseconds. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
     - credential_id (integer) (required) — ID of the credential (the app key ID) when 'credential_type' is 'app_key'; 0 otherwise.
-    - credential_type (string) (required) — Credential type used for the call. 'app_key' when authenticated with an app key; empty string for member sessions.
+    - credential_type (string) (required) — Credential type used for the call. 'app_key' for a long-lived console app key, 'ephemeral_app_key' for a short-lived key issued to AI SRE, and an empty string for member sessions.
     - ip (string) (required) — Client IP address of the caller.
     - is_dangerous (boolean) (required) — True if this is flagged as a high-risk operation.
     - is_write (boolean) (required) — True for mutating operations; false for read-only ones.
diff --git a/internal/cli/zz_generated_automations.go b/internal/cli/zz_generated_automations.go
index f733203..f8b9de1 100644
--- a/internal/cli/zz_generated_automations.go
+++ b/internal/cli/zz_generated_automations.go
@@ -105,7 +105,7 @@ API: POST /safari/automation/rule/list (automation-rule-read-list)
 
 Request fields:
   --page int — Page number, 1-based.
-  --limit int — Page size.
+  --limit int — Page size. Values below 1 fall back to 20; values above 200 are capped at 200. (max 200)
   --search-after-ctx string
   --enabled bool — Filter by enabled state: 'true' returns only enabled rules, 'false' only disabled; omit or pass null for no filter.
   --include-person bool — Compatibility field; when scope is empty and this is false, behaves like team scope.
@@ -189,7 +189,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 		},
 	}
 	cmd.Flags().Int64Var(&fP, "page", 0, "Page number, 1-based.")
-	cmd.Flags().Int64Var(&fLimit, "limit", 0, "Page size.")
+	cmd.Flags().Int64Var(&fLimit, "limit", 0, "Page size. Values below 1 fall back to 20; values above 200 are capped at 200. (max 200)")
 	cmd.Flags().StringVar(&fSearchAfterCtx, "search-after-ctx", "", "Request field ")
 	cmd.Flags().BoolVar(&fEnabled, "enabled", false, "Filter by enabled state: 'true' returns only enabled rules, 'false' only disabled; omit or pass null for no filter.")
 	cmd.Flags().BoolVar(&fIncludePerson, "include-person", false, "Compatibility field; when scope is empty and this is false, behaves like team scope.")
diff --git a/internal/cli/zz_generated_incidents.go b/internal/cli/zz_generated_incidents.go
index a45f8c3..da51970 100644
--- a/internal/cli/zz_generated_incidents.go
+++ b/internal/cli/zz_generated_incidents.go
@@ -3406,10 +3406,12 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
   - items (array<object>) (required) — War room records.
     - account_id (integer) (required) — Account ID.
     - chat_id (string) (required) — Chat/group ID on the IM side.
+    - chat_name (string) (required) — Display name of the group chat on the IM side.
     - created_at (string) (required) — Creation timestamp (seconds). CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
     - created_by (integer) (required) — Member ID that created the war room.
     - incident_id (string) (required) — Associated incident ID (MongoDB ObjectID).
     - integration_id (integer) (required) — IM integration ID.
+    - integration_unavailable (boolean) — True when the IM integration behind this war room is disabled or no longer exists.
     - plugin_type (string) (required) — IM plugin type (e.g. 'feishu', 'dingtalk', 'wecom', 'slack').
     - status (string) (required) — War room record status: 'enabled' active, 'deleted' disbanded. [enabled, deleted]
 `,
diff --git a/internal/cli/zz_generated_manifest.go b/internal/cli/zz_generated_manifest.go
index a4d53e9..92784e8 100644
--- a/internal/cli/zz_generated_manifest.go
+++ b/internal/cli/zz_generated_manifest.go
@@ -199,14 +199,12 @@ var generatedOpIDs = []string{
 	"monit-rule-read-audits",
 	"monit-rule-read-counter-channel",
 	"monit-rule-read-counter-total",
-	"monit-rule-read-export",
 	"monit-rule-read-info-v2",
 	"monit-rule-read-list",
 	"monit-rule-write-create-v2",
 	"monit-rule-write-delete",
 	"monit-rule-write-delete-batch",
 	"monit-rule-write-fields-update",
-	"monit-rule-write-import",
 	"monit-rule-write-move",
 	"monit-rule-write-update-v2",
 	"oncall-license-read-license-list",
diff --git a/internal/cli/zz_generated_members.go b/internal/cli/zz_generated_members.go
index a601e1d..3dc3185 100644
--- a/internal/cli/zz_generated_members.go
+++ b/internal/cli/zz_generated_members.go
@@ -376,7 +376,6 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
 
 func genMembersMemberNotifyCmd() *cobra.Command {
 	var dataJSON string
-	var fDryRun bool
 	var fHTML string
 	var fPersonIDs []int
 	var fSubject string
@@ -385,19 +384,18 @@ func genMembersMemberNotifyCmd() *cobra.Command {
 		Short: "Notify members",
 		Long: `Notify members.
 
-Send an email to account members on behalf of the caller, with content the caller supplies. Only callable with a credential minted for an AI SRE session; any other credential is rejected with 'AccessDenied'. Delivery is asynchronous — 'accepted' means the email was queued, not that it was delivered. Call it with 'dry_run' set to 'true' before sending: 'html' in the response is the email exactly as recipients will get it, so you can confirm the sanitizer kept everything the message depends on.
+Send an email to account members on behalf of the caller, with content the caller supplies. Only callable with a credential minted for an AI SRE session; any other credential is rejected with 'AccessDenied'. Delivery is asynchronous — 'accepted' means the email was queued, not that it was delivered.
 
 API: POST /member/notify (memberNotify)
 
 Request fields:
-  --dry-run bool — Check without sending. When 'true', every check runs and the response returns the exact email in 'html', but nothing is queued and neither the hourly limit nor the per-turn duplicate check is consumed. Defaults to 'false'.
-  --html string (required) — Email body as an HTML fragment (no '<html>'/'<head>'/'<body>' wrapper needed); recipients receive it as the whole email body. Required, up to 102,400 bytes of raw UTF-8 input (larger messages are clipped by common email clients), and must be non-empty after sanitization. Sanitized server-side: '<script>', '<style>', '<iframe>', '<object>', '<embed>', '<form>', '<input>', '<button>', '<svg>', '<meta>', '<link>', and '<base>' tags and all 'on*' event handlers are removed; images are kept only when their 'src' is 'https' — images with any other or no 'src', including 'data:', are removed; links are restricted to 'http', 'https', and 'mailto'. Inline 'style' attributes are kept as written. (≤102400 chars)
+  --html string (required) — Email body as an HTML fragment (no '<html>'/'<head>'/'<body>' wrapper needed); recipients receive it as the whole email body. Required, up to 102,400 bytes of raw UTF-8 input (larger messages are clipped by common email clients), and must be non-empty after sanitization. '<script>', '<meta>', '<link>', and '<base>' tags and all 'on*' event handlers are silently removed before sending, since email clients never execute them; inline 'style' attributes are kept as written. '<style>', '<svg>', '<iframe>', '<object>', '<embed>', '<form>', '<input>', and '<button>' tags, an '<img>' with a missing or non-'https' 'src' (including 'data:'), or an '<a>' whose href scheme is not 'http', 'https', or 'mailto' are rejected instead of stripped: the request fails with '400' rather than silently changing what recipients see. (≤102400 chars)
   --person-ids []int — Recipient member IDs. Optional, up to 20, no duplicates. Omitted or empty sends to the caller only.
   --subject string (required) — Email subject, used as written. Required, 1–200 characters. Line breaks are replaced with a space; leading/trailing whitespace is trimmed. (1-200 chars)
 
 Response fields ('data' envelope is unwrapped — these fields are at the top level):
-  - html (string) — Only present when 'dry_run' is 'true': the complete email HTML exactly as recipients would receive it, after sanitization.
-  - recipients (array<object>) — One result per resolved recipient, in the same order as the resolved recipient list. With 'dry_run', each result is what a real send would return.
+  - agent_instructions (string) — Present when the submitted HTML body does not follow the default email layout (no 'max-width:600px' wrapper table): guidance telling the calling AI SRE agent how to conform. Advisory only — a format the caller deliberately chose needs no change.
+  - recipients (array<object>) — One result per resolved recipient, in the same order as the resolved recipient list.
     - person_id (integer) (required) — Recipient member ID.
     - reason (string) — Why the recipient was skipped. Only present when 'status' is 'skipped'. 'not_member' — not an active member of the caller's account; 'no_email' — the member has no email address on file; 'email_disabled' — the member's notification preferences for this kind of message exclude email; 'duplicate' — this recipient already received a message from the same AI SRE session turn; 'rate_limited' — this recipient has already been sent 20 emails through this endpoint within the last hour; 'send_failed' — enqueueing the email failed. [not_member, no_email, email_disabled, duplicate, rate_limited, send_failed]
     - status (string) (required) — Delivery status. 'accepted' — the email was queued for asynchronous delivery; 'skipped' — no email was queued, see 'reason'. [accepted, skipped]
@@ -406,9 +404,6 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
 				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
-					if cmd.Flags().Changed("dry-run") {
-						body["dry_run"] = fDryRun
-					}
 					if cmd.Flags().Changed("html") {
 						body["html"] = fHTML
 					}
@@ -435,8 +430,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 			})
 		},
 	}
-	cmd.Flags().BoolVar(&fDryRun, "dry-run", false, "Check without sending. When 'true', every check runs and the response returns the exact email in 'html', but nothing is queued and neither the hourly limit nor the per-turn duplicate check is consumed. Defaults to 'false'.")
-	cmd.Flags().StringVar(&fHTML, "html", "", "Email body as an HTML fragment (no '<html>'/'<head>'/'<body>' wrapper needed); recipients receive it as the whole email body. Required, up to 102,400 bytes of raw UTF-8 input (larger messages are clipped by common email clients), and must be non-empty after sanitization. Sanitized server-side: '<script>', '<style>', '<iframe>', '<object>', '<embed>', '<form>', '<input>', '<button>', '<svg>', '<meta>', '<link>', and '<base>' tags and all 'on*' event handlers are removed; images are kept only when their 'src' is 'https' — images with any other or no 'src', including 'data:', are removed; links are restricted to 'http', 'https', and 'mailto'. Inline 'style' attributes are kept as written. (required) (≤102400 chars)")
+	cmd.Flags().StringVar(&fHTML, "html", "", "Email body as an HTML fragment (no '<html>'/'<head>'/'<body>' wrapper needed); recipients receive it as the whole email body. Required, up to 102,400 bytes of raw UTF-8 input (larger messages are clipped by common email clients), and must be non-empty after sanitization. '<script>', '<meta>', '<link>', and '<base>' tags and all 'on*' event handlers are silently removed before sending, since email clients never execute them; inline 'style' attributes are kept as written. '<style>', '<svg>', '<iframe>', '<object>', '<embed>', '<form>', '<input>', and '<button>' tags, an '<img>' with a missing or non-'https' 'src' (including 'data:'), or an '<a>' whose href scheme is not 'http', 'https', or 'mailto' are rejected instead of stripped: the request fails with '400' rather than silently changing what recipients see. (required) (≤102400 chars)")
 	cmd.Flags().IntSliceVar(&fPersonIDs, "person-ids", nil, "Recipient member IDs. Optional, up to 20, no duplicates. Omitted or empty sends to the caller only.")
 	cmd.Flags().StringVar(&fSubject, "subject", "", "Email subject, used as written. Required, 1–200 characters. Line breaks are replaced with a space; leading/trailing whitespace is trimmed. (required) (1-200 chars)")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
diff --git a/internal/cli/zz_generated_notification_templates.go b/internal/cli/zz_generated_notification_templates.go
index 15e882f..b4934db 100644
--- a/internal/cli/zz_generated_notification_templates.go
+++ b/internal/cli/zz_generated_notification_templates.go
@@ -34,7 +34,10 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
   - email (string) (required) — Email body template source (Go 'html/template' syntax).
   - feishu (string) (required) — Feishu robot message template source.
   - feishu_app (string) (required) — Feishu app message template source.
+  - feishu_app_card_v2_preserve_blank_lines (boolean) (required) — Whether Feishu app card v2 messages keep blank lines in the body.
   - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.
+  - feishu_app_war_room_enabled (boolean) (required) — Whether Feishu app cards show the Create War Room button. Hidden when the incident has no responders.
+  - incident_card_closed_action_apps (array<string>) (required) — IM apps whose closed-incident cards keep the custom action buttons. Supported values: 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app'. An empty list hides the buttons on every app. [feishu_app, dingtalk_app, wecom_app, slack_app, teams_app]
   - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.
   - slack (string) (required) — Slack robot message template source.
   - slack_app (string) (required) — Slack app message template source.
@@ -50,6 +53,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
   - voice (string) (required) — Voice call script template source.
   - wecom (string) (required) — WeCom robot message template source.
   - wecom_app (string) (required) — WeCom app message template source.
+  - wecom_markdown_v2_enabled (boolean) (required) — Whether WeCom robot notifications use the 'markdown_v2' message format.
   - zoom (string) (required) — Zoom bot message template source.
 `,
 		Args:    requireBodyFieldOrExactArg("template_id", "template-id"),
@@ -129,7 +133,10 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
     - email (string) (required) — Email body template source (Go 'html/template' syntax).
     - feishu (string) (required) — Feishu robot message template source.
     - feishu_app (string) (required) — Feishu app message template source.
+    - feishu_app_card_v2_preserve_blank_lines (boolean) (required) — Whether Feishu app card v2 messages keep blank lines in the body.
     - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.
+    - feishu_app_war_room_enabled (boolean) (required) — Whether Feishu app cards show the Create War Room button. Hidden when the incident has no responders.
+    - incident_card_closed_action_apps (array<string>) (required) — IM apps whose closed-incident cards keep the custom action buttons. Supported values: 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app'. An empty list hides the buttons on every app. [feishu_app, dingtalk_app, wecom_app, slack_app, teams_app]
     - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.
     - slack (string) (required) — Slack robot message template source.
     - slack_app (string) (required) — Slack app message template source.
@@ -145,6 +152,7 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
     - voice (string) (required) — Voice call script template source.
     - wecom (string) (required) — WeCom robot message template source.
     - wecom_app (string) (required) — WeCom app message template source.
+    - wecom_markdown_v2_enabled (boolean) (required) — Whether WeCom robot notifications use the 'markdown_v2' message format.
     - zoom (string) (required) — Zoom bot message template source.
   - total (integer) (required) — Total number of templates matching the filter, across all pages (including the built-in preset template).
 `,
@@ -212,6 +220,8 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
 func genNotificationTemplatesReadPreviewCmd() *cobra.Command {
 	var dataJSON string
 	var fContent string
+	var fFeishuAppCardV2Enabled bool
+	var fFeishuAppCardV2PreserveBlankLines bool
 	var fIncidentID string
 	var fType string
 	cmd := &cobra.Command{
@@ -225,6 +235,8 @@ API: POST /template/preview (template-read-preview)
 
 Request fields:
   --content string (required) — Template content to render.
+  --feishu-app-card-v2-enabled bool — Render the preview as a Feishu app card v2 message.
+  --feishu-app-card-v2-preserve-blank-lines bool — Keep blank lines in the body of the Feishu app card v2 preview.
   --incident-id string — Incident ID whose data is used to render the template; mock data is used when omitted. A MongoDB ObjectID hex string.
   --type string (required) — Template channel type that selects the rendering engine. 'email' renders as Go html/template; other channels render as text/template. Values match the template channel fields, for example 'email', 'sms', 'voice', 'dingtalk', 'wecom', 'feishu', 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app', 'telegram', 'slack', 'zoom'.
   incident_card_hidden_fields (object, via --data) — Incident card fields to hide per IM app when previewing.
@@ -244,6 +256,12 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 					if cmd.Flags().Changed("content") {
 						body["content"] = fContent
 					}
+					if cmd.Flags().Changed("feishu-app-card-v2-enabled") {
+						body["feishu_app_card_v2_enabled"] = fFeishuAppCardV2Enabled
+					}
+					if cmd.Flags().Changed("feishu-app-card-v2-preserve-blank-lines") {
+						body["feishu_app_card_v2_preserve_blank_lines"] = fFeishuAppCardV2PreserveBlankLines
+					}
 					if cmd.Flags().Changed("incident-id") {
 						body["incident_id"] = fIncidentID
 					}
@@ -268,6 +286,8 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 		},
 	}
 	cmd.Flags().StringVar(&fContent, "content", "", "Template content to render. (required)")
+	cmd.Flags().BoolVar(&fFeishuAppCardV2Enabled, "feishu-app-card-v2-enabled", false, "Render the preview as a Feishu app card v2 message.")
+	cmd.Flags().BoolVar(&fFeishuAppCardV2PreserveBlankLines, "feishu-app-card-v2-preserve-blank-lines", false, "Keep blank lines in the body of the Feishu app card v2 preview.")
 	cmd.Flags().StringVar(&fIncidentID, "incident-id", "", "Incident ID whose data is used to render the template; mock data is used when omitted. A MongoDB ObjectID hex string.")
 	cmd.Flags().StringVar(&fType, "type", "", "Template channel type that selects the rendering engine. 'email' renders as Go html/template; other channels render as text/template. Values match the template channel fields, for example 'email', 'sms', 'voice', 'dingtalk', 'wecom', 'feishu', 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app', 'telegram', 'slack', 'zoom'. (required)")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
@@ -282,7 +302,10 @@ func genNotificationTemplatesWriteCreateCmd() *cobra.Command {
 	var fEmail string
 	var fFeishu string
 	var fFeishuApp string
+	var fFeishuAppCardV2PreserveBlankLines bool
 	var fFeishuAppCardV2TableEnabled bool
+	var fFeishuAppWarRoomEnabled bool
+	var fIncidentCardClosedActionApps []string
 	var fSlack string
 	var fSlackApp string
 	var fSMS string
@@ -293,6 +316,7 @@ func genNotificationTemplatesWriteCreateCmd() *cobra.Command {
 	var fVoice string
 	var fWecom string
 	var fWecomApp string
+	var fWecomMarkdownV2Enabled bool
 	var fZoom string
 	cmd := &cobra.Command{
 		Use:   "create",
@@ -310,7 +334,10 @@ Request fields:
   --email string — Email body template source (Go 'html/template' syntax).
   --feishu string — Feishu robot message template source.
   --feishu-app string — Feishu app message template source.
+  --feishu-app-card-v2-preserve-blank-lines bool — Keep blank lines in the body of Feishu app card v2 messages.
   --feishu-app-card-v2-table-enabled bool — Render alert labels as a table in Feishu app cards.
+  --feishu-app-war-room-enabled bool — Show the Create War Room button on Feishu app cards.
+  --incident-card-closed-action-apps []string — IM apps whose closed-incident cards keep the custom action buttons. Supported values: 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app'. An empty list hides the buttons on every app. [feishu_app, dingtalk_app, wecom_app, slack_app, teams_app]
   --slack string — Slack robot message template source.
   --slack-app string — Slack app message template source.
   --sms string — SMS template source (Go 'text/template' syntax).
@@ -321,6 +348,7 @@ Request fields:
   --voice string — Voice call script template source.
   --wecom string — WeCom robot message template source.
   --wecom-app string — WeCom app message template source.
+  --wecom-markdown-v2-enabled bool — Send WeCom robot notifications as 'markdown_v2' messages instead of plain markdown.
   --zoom string — Zoom bot message template source.
   incident_card_hidden_fields (object, via --data) — Incident card fields hidden per IM app type.
 
@@ -350,9 +378,18 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 					if cmd.Flags().Changed("feishu-app") {
 						body["feishu_app"] = fFeishuApp
 					}
+					if cmd.Flags().Changed("feishu-app-card-v2-preserve-blank-lines") {
+						body["feishu_app_card_v2_preserve_blank_lines"] = fFeishuAppCardV2PreserveBlankLines
+					}
 					if cmd.Flags().Changed("feishu-app-card-v2-table-enabled") {
 						body["feishu_app_card_v2_table_enabled"] = fFeishuAppCardV2TableEnabled
 					}
+					if cmd.Flags().Changed("feishu-app-war-room-enabled") {
+						body["feishu_app_war_room_enabled"] = fFeishuAppWarRoomEnabled
+					}
+					if cmd.Flags().Changed("incident-card-closed-action-apps") {
+						body["incident_card_closed_action_apps"] = fIncidentCardClosedActionApps
+					}
 					if cmd.Flags().Changed("slack") {
 						body["slack"] = fSlack
 					}
@@ -383,6 +420,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 					if cmd.Flags().Changed("wecom-app") {
 						body["wecom_app"] = fWecomApp
 					}
+					if cmd.Flags().Changed("wecom-markdown-v2-enabled") {
+						body["wecom_markdown_v2_enabled"] = fWecomMarkdownV2Enabled
+					}
 					if cmd.Flags().Changed("zoom") {
 						body["zoom"] = fZoom
 					}
@@ -409,7 +449,10 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 	cmd.Flags().StringVar(&fEmail, "email", "", "Email body template source (Go 'html/template' syntax).")
 	cmd.Flags().StringVar(&fFeishu, "feishu", "", "Feishu robot message template source.")
 	cmd.Flags().StringVar(&fFeishuApp, "feishu-app", "", "Feishu app message template source.")
+	cmd.Flags().BoolVar(&fFeishuAppCardV2PreserveBlankLines, "feishu-app-card-v2-preserve-blank-lines", false, "Keep blank lines in the body of Feishu app card v2 messages.")
 	cmd.Flags().BoolVar(&fFeishuAppCardV2TableEnabled, "feishu-app-card-v2-table-enabled", false, "Render alert labels as a table in Feishu app cards.")
+	cmd.Flags().BoolVar(&fFeishuAppWarRoomEnabled, "feishu-app-war-room-enabled", false, "Show the Create War Room button on Feishu app cards.")
+	cmd.Flags().StringSliceVar(&fIncidentCardClosedActionApps, "incident-card-closed-action-apps", nil, "IM apps whose closed-incident cards keep the custom action buttons. Supported values: 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app'. An empty list hides the buttons on every app. [feishu_app, dingtalk_app, wecom_app, slack_app, teams_app]")
 	cmd.Flags().StringVar(&fSlack, "slack", "", "Slack robot message template source.")
 	cmd.Flags().StringVar(&fSlackApp, "slack-app", "", "Slack app message template source.")
 	cmd.Flags().StringVar(&fSMS, "sms", "", "SMS template source (Go 'text/template' syntax).")
@@ -420,6 +463,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 	cmd.Flags().StringVar(&fVoice, "voice", "", "Voice call script template source.")
 	cmd.Flags().StringVar(&fWecom, "wecom", "", "WeCom robot message template source.")
 	cmd.Flags().StringVar(&fWecomApp, "wecom-app", "", "WeCom app message template source.")
+	cmd.Flags().BoolVar(&fWecomMarkdownV2Enabled, "wecom-markdown-v2-enabled", false, "Send WeCom robot notifications as 'markdown_v2' messages instead of plain markdown.")
 	cmd.Flags().StringVar(&fZoom, "zoom", "", "Zoom bot message template source.")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
 	return cmd
@@ -485,7 +529,10 @@ func genNotificationTemplatesWriteUpdateCmd() *cobra.Command {
 	var fEmail string
 	var fFeishu string
 	var fFeishuApp string
+	var fFeishuAppCardV2PreserveBlankLines bool
 	var fFeishuAppCardV2TableEnabled bool
+	var fFeishuAppWarRoomEnabled bool
+	var fIncidentCardClosedActionApps []string
 	var fSlack string
 	var fSlackApp string
 	var fSMS string
@@ -497,6 +544,7 @@ func genNotificationTemplatesWriteUpdateCmd() *cobra.Command {
 	var fVoice string
 	var fWecom string
 	var fWecomApp string
+	var fWecomMarkdownV2Enabled bool
 	var fZoom string
 	cmd := &cobra.Command{
 		Use:   "update <template-id>",
@@ -514,7 +562,10 @@ Request fields:
   --email string — Email body template source (Go 'html/template' syntax). Omit to keep the current content; send an empty string to clear it.
   --feishu string — Feishu robot message template source. Omit to keep the current content; send an empty string to clear it.
   --feishu-app string — Feishu app message template source. Omit to keep the current content; send an empty string to clear it.
+  --feishu-app-card-v2-preserve-blank-lines bool — When set, keep or drop blank lines in the body of Feishu app card v2 messages. Omit to keep the existing setting.
   --feishu-app-card-v2-table-enabled bool — When set, enable or disable table rendering for alert labels in Feishu app cards. Omit to keep the existing setting.
+  --feishu-app-war-room-enabled bool — When set, show or hide the Create War Room button on Feishu app cards. Omit to keep the existing setting.
+  --incident-card-closed-action-apps []string — Replaces the retained-app list when sent. Supported values: 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app'. Omit the field to leave it unchanged. [feishu_app, dingtalk_app, wecom_app, slack_app, teams_app]
   --slack string — Slack robot message template source. Omit to keep the current content; send an empty string to clear it.
   --slack-app string — Slack app message template source. Omit to keep the current content; send an empty string to clear it.
   --sms string — SMS template source (Go 'text/template' syntax). Omit to keep the current content; send an empty string to clear it.
@@ -526,6 +577,7 @@ Request fields:
   --voice string — Voice call script template source. Omit to keep the current content; send an empty string to clear it.
   --wecom string — WeCom robot message template source. Omit to keep the current content; send an empty string to clear it.
   --wecom-app string — WeCom app message template source. Omit to keep the current content; send an empty string to clear it.
+  --wecom-markdown-v2-enabled bool — When set, switch WeCom robot notifications between 'markdown_v2' and plain markdown. Omit to keep the existing setting.
   --zoom string — Zoom bot message template source. Omit to keep the current content; send an empty string to clear it.
   incident_card_hidden_fields (object, via --data) — Incident card fields hidden per IM app type.
 `,
@@ -555,9 +607,18 @@ Request fields:
 					if cmd.Flags().Changed("feishu-app") {
 						body["feishu_app"] = fFeishuApp
 					}
+					if cmd.Flags().Changed("feishu-app-card-v2-preserve-blank-lines") {
+						body["feishu_app_card_v2_preserve_blank_lines"] = fFeishuAppCardV2PreserveBlankLines
+					}
 					if cmd.Flags().Changed("feishu-app-card-v2-table-enabled") {
 						body["feishu_app_card_v2_table_enabled"] = fFeishuAppCardV2TableEnabled
 					}
+					if cmd.Flags().Changed("feishu-app-war-room-enabled") {
+						body["feishu_app_war_room_enabled"] = fFeishuAppWarRoomEnabled
+					}
+					if cmd.Flags().Changed("incident-card-closed-action-apps") {
+						body["incident_card_closed_action_apps"] = fIncidentCardClosedActionApps
+					}
 					if cmd.Flags().Changed("slack") {
 						body["slack"] = fSlack
 					}
@@ -591,6 +652,9 @@ Request fields:
 					if cmd.Flags().Changed("wecom-app") {
 						body["wecom_app"] = fWecomApp
 					}
+					if cmd.Flags().Changed("wecom-markdown-v2-enabled") {
+						body["wecom_markdown_v2_enabled"] = fWecomMarkdownV2Enabled
+					}
 					if cmd.Flags().Changed("zoom") {
 						body["zoom"] = fZoom
 					}
@@ -621,7 +685,10 @@ Request fields:
 	cmd.Flags().StringVar(&fEmail, "email", "", "Email body template source (Go 'html/template' syntax). Omit to keep the current content; send an empty string to clear it.")
 	cmd.Flags().StringVar(&fFeishu, "feishu", "", "Feishu robot message template source. Omit to keep the current content; send an empty string to clear it.")
 	cmd.Flags().StringVar(&fFeishuApp, "feishu-app", "", "Feishu app message template source. Omit to keep the current content; send an empty string to clear it.")
+	cmd.Flags().BoolVar(&fFeishuAppCardV2PreserveBlankLines, "feishu-app-card-v2-preserve-blank-lines", false, "When set, keep or drop blank lines in the body of Feishu app card v2 messages. Omit to keep the existing setting.")
 	cmd.Flags().BoolVar(&fFeishuAppCardV2TableEnabled, "feishu-app-card-v2-table-enabled", false, "When set, enable or disable table rendering for alert labels in Feishu app cards. Omit to keep the existing setting.")
+	cmd.Flags().BoolVar(&fFeishuAppWarRoomEnabled, "feishu-app-war-room-enabled", false, "When set, show or hide the Create War Room button on Feishu app cards. Omit to keep the existing setting.")
+	cmd.Flags().StringSliceVar(&fIncidentCardClosedActionApps, "incident-card-closed-action-apps", nil, "Replaces the retained-app list when sent. Supported values: 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app'. Omit the field to leave it unchanged. [feishu_app, dingtalk_app, wecom_app, slack_app, teams_app]")
 	cmd.Flags().StringVar(&fSlack, "slack", "", "Slack robot message template source. Omit to keep the current content; send an empty string to clear it.")
 	cmd.Flags().StringVar(&fSlackApp, "slack-app", "", "Slack app message template source. Omit to keep the current content; send an empty string to clear it.")
 	cmd.Flags().StringVar(&fSMS, "sms", "", "SMS template source (Go 'text/template' syntax). Omit to keep the current content; send an empty string to clear it.")
@@ -633,6 +700,7 @@ Request fields:
 	cmd.Flags().StringVar(&fVoice, "voice", "", "Voice call script template source. Omit to keep the current content; send an empty string to clear it.")
 	cmd.Flags().StringVar(&fWecom, "wecom", "", "WeCom robot message template source. Omit to keep the current content; send an empty string to clear it.")
 	cmd.Flags().StringVar(&fWecomApp, "wecom-app", "", "WeCom app message template source. Omit to keep the current content; send an empty string to clear it.")
+	cmd.Flags().BoolVar(&fWecomMarkdownV2Enabled, "wecom-markdown-v2-enabled", false, "When set, switch WeCom robot notifications between 'markdown_v2' and plain markdown. Omit to keep the existing setting.")
 	cmd.Flags().StringVar(&fZoom, "zoom", "", "Zoom bot message template source. Omit to keep the current content; send an empty string to clear it.")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
 	return cmd
diff --git a/internal/cli/zz_generated_response_help.go b/internal/cli/zz_generated_response_help.go
index d6d9d02..33e3dcd 100644
--- a/internal/cli/zz_generated_response_help.go
+++ b/internal/cli/zz_generated_response_help.go
@@ -26,17 +26,15 @@ var responseHelpBySDKMethod = map[string]string{
 	"AlertRules.ReadAuditDetail":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — ID of the account that owns the rule.\n  - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n  - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n  - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n  - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n  - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n  - id (integer) (required) — Audit record ID.\n",
 	"AlertRules.ReadAudits":                       "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account that owns the rule.\n  - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n  - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n  - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n  - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n  - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n  - id (integer) (required) — Audit record ID.\n",
 	"AlertRules.ReadCounterTotal":                 "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account this snapshot belongs to.\n  - clock (string) (required) — Sample timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - id (integer) (required) — ID of this snapshot record.\n  - num (integer) (required) — Rule count at the sample time.\n",
-	"AlertRules.ReadExport":                       "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - annotations (object) — Custom annotation key-value pairs attached to alert events; keys must not start with `$` (reserved for query field references).\n  - cron_pattern (string) (required) — Evaluation schedule as a 6-field cron expression (seconds included) or `@every <duration>` (an integral number of seconds, at least 1s); `CRON_TZ=`/`TZ=` prefixes are rejected — set the timezone in `timezone` instead.\n  - debug_log_enabled (boolean) (required) — Whether to emit debug logs for this rule's evaluations; enable when troubleshooting.\n  - delay_seconds (integer) — Query time offset in seconds: each evaluation reads data as of `schedule time − delay_seconds` to tolerate ingestion lag; `0` means no offset.\n  - description (string) — Rule description in the format given by `description_type`, shown with alert events.\n  - description_type (string) — Format of `description`, `text` or `markdown`; treated as `text` when omitted. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list`; references by ID and is therefore immune to datasource renames.\n  - ds_list (array<string>) — Datasource name list with wildcard support; merged with `ds_ids` to decide which datasources the rule monitors — must be maintained by hand if a datasource is renamed.\n  - ds_type (string) (required) — Datasource type ident, e.g. `prometheus`; must be a datasource type (`ident`) that exists in the import target environment.\n  - enabled (boolean) (required) — Whether the rule is enabled; rules imported as disabled are not evaluated.\n  - enabled_times (array<object>) — Effective time windows; each entry has `days` (0–6, 0 = Sunday) and `stime`/`etime` (`HH:MM`), interpreted in the rule's `timezone`; an empty list disables the rule.\n    - days (array<integer>) — Days of week, 0 = Sunday.\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - labels (object) — Custom label key-value pairs attached to alert events produced by this rule.\n  - name (string) (required) — Rule name, up to 128 characters when imported.\n  - repeat_interval (integer) — Interval in seconds between repeated notifications for a firing alert; values below 1 fall back to the default of 3600.\n  - repeat_total (integer) — Maximum number of repeated notifications for the same alert; values below 1 fall back to the default of 3.\n  - rule_configs (object) — Rule evaluation configuration.\n    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery condition for any-data check. If omitted or `mode` is empty, treated as `nodata`.\n        - args (object) — Datasource-specific options for the recovery query, same convention as `queries[].args`; required for Elasticsearch datasources when `mode` is `ql`.\n        - condition (string) — Recovery expression. Required when `mode` is `ql`.\n        - mode (string) — `nodata` = recover when the query returns no data; `ql` = recover when the `condition` expression evaluates to true. When `mode` is `ql`, only a single query (`name=A`) is permitted. [nodata, ql]\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration.\n      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when `alert_on_empty_result` is enabled. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - resolve_timeout (integer) — Auto-resolve after N seconds.\n      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - critical (string) — Critical threshold expression referencing query results via `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; at least one severity must be configured.\n      - enabled (boolean) — Whether threshold checking is enabled.\n      - info (string) — Info threshold expression, same syntax as `critical`.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery evaluation configuration for threshold checks.\n        - args (object) — Datasource-specific extra parameters for the recovery query, using the same `<datasource>.<param>` key convention as query `args`. Omitted when empty.\n        - condition (string) — Recovery condition expression; required when `mode` is `threshold` or `ql`, and must be empty for `invert`.\n        - mode (string) — Recovery mode: `invert` = resolve when the alert expression no longer holds (`condition` stays empty); `threshold` = resolve when the `condition` threshold expression holds; `ql` = resolve when the `condition` query expression evaluates true. [invert, threshold, ql]\n        - value_fields (array<string>) — Numeric result fields the recovery `condition` references as `$A.<field>`; same semantics as the query's `value_fields`. Omitted when empty.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - warning (string) — Warning threshold expression, same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicate `expr`.\n      - args (object) — Datasource-specific query options keyed by the `<datasource>.<option>` convention (e.g. `es.type`, `tencent_cls.limit`); most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap `value_fields`; applies to table-shaped results (SQL/ES-style datasources).\n      - name (string) — Query identifier (letter, e.g. `A`). The name `R` is reserved and must not be used.\n      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as `$A.<field>` in threshold expressions); required for threshold checks unless the datasource is `prometheus`/`loki`/`victorialogs`; field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique `name` (not duplicating any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific options for the auxiliary query, same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Relate-query identifier.\n  - timezone (string) — Timezone in which the rule executes. IANA timezone name; defaults to `Asia/Shanghai`.\n",
-	"AlertRules.ReadInfoV2":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.\n    - kind (string) (required) — Entry type; currently only `dashboard` is supported. [dashboard]\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
+	"AlertRules.ReadInfoV2":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n    - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n    - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)\n      - query (object) (required) — Query payload.\n        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n        - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
 	"AlertRules.ReadList":                         "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - active_alert_count (integer) (required) — Number of currently active (unrecovered) alerts fired by this rule. `triggered` equals `active_alert_count > 0`.\n  - created_at (string) (required) — Creation time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who created the rule.\n  - creator_name (string) (required) — Name of the user who created the rule.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron with seconds, e.g. `0 * * * * *`, or an `@every 30s` interval descriptor. Must not start with `CRON_TZ=` or `TZ=`; use the `timezone` field instead.\n  - debug_log_enabled (boolean) (required) — Whether debug logging is enabled.\n  - delay_seconds (integer) (required) — Evaluation delay in seconds.\n  - ds_type (string) (required) — Data source type, e.g. `prometheus`.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - folder_id (integer) (required) — Folder ID.\n  - id (integer) (required) — Unique rule ID.\n  - labels (object) (required) — Custom labels.\n  - name (string) (required) — Rule name.\n  - runtime_state (string) — Runtime evaluation state, derived from edge heartbeats and the edge-reported rule status. Omitted when the state is unavailable. | Value | Meaning | |---|---| | `disabled` | The rule is disabled. | | `offline` | The edge instance or cluster owning this rule is offline. | | `abnormal` | The edge reports evaluation errors. | | `stale` | The edge's runtime status report is outdated. | | `no_datasource` | No datasource currently matches the rule's `ds_list` / `ds_ids`. | | `config_pending` | The latest rule config has not been delivered to the edge yet. | | `waiting` | Enabled, but the edge has not reported runtime status yet. | | `normal` | Evaluating normally. | [disabled, offline, abnormal, stale, no_datasource, config_pending, waiting, normal]\n  - timezone (string) (required) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); shortcuts and offsets such as `Local`, `UTC+8`, or `CST` are rejected. Treated as `Asia/Shanghai` if empty.\n  - triggered (boolean) (required) — True if the rule currently has active alerts.\n  - updated_at (string) (required) — Last modification time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updater_id (integer) (required) — ID of the user who last modified the rule.\n  - updater_name (string) (required) — Name of the user who last modified the rule.\n",
-	"AlertRules.WriteCreateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.\n    - kind (string) (required) — Entry type; currently only `dashboard` is supported. [dashboard]\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
+	"AlertRules.WriteCreateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n    - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n    - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)\n      - query (object) (required) — Query payload.\n        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n        - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
 	"AlertRules.WriteFieldsUpdate":                "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
-	"AlertRules.WriteImport":                      "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
 	"AlertRules.WriteMove":                        "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
-	"AlertRules.WriteUpdateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variable_bindings (object) — Dashboard variable bindings, keyed by dashboard variable name.\n    - kind (string) (required) — Entry type; currently only `dashboard` is supported. [dashboard]\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
+	"AlertRules.WriteUpdateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n    - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n    - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)\n      - query (object) (required) — Query payload.\n        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n        - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
 	"Alerts.EventReadList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n  - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Alerts.ReadEventList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n  - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Alerts.ReadFeed":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - created_at (string) (required) — Creation timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator. 0 for system-generated entries.\n  - deleted_at (string) — Soft-delete time, Unix epoch milliseconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - detail (object) (required) — Type-specific payload; the concrete shape is determined by `type`. May be `null` for entries stored without detail.\n    - comment (string) — Comment body.\n    - in_secs (integer) — Window in seconds over which the state changes were counted. Omitted when zero.\n    - max_changes (integer) — State-change count threshold that triggered flapping detection. Omitted when zero.\n    - mute_secs (integer) — Mute duration in seconds. Omitted when zero.\n    - owner_id (integer) — New owner member ID set on the target incident. Omitted when unchanged.\n    - rule_id (string) — Silence rule ID that muted the alert. Omitted when empty.\n    - rule_name (string) — Silence rule name, resolved at read time. Omitted when empty.\n    - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n    - source_alert_id (string) — ID of the source alert that triggered the inhibition. Omitted when empty.\n    - source_alert_title (string) — Title of the source alert, resolved at read time. Omitted when empty.\n    - source_alerts (array<object>) — Source alerts merged into the target incident. Omitted when empty.\n      - alert_id (string) — Alert ID (ObjectID hex string).\n      - title (string) — Alert title, resolved at read time. Omitted when empty.\n    - status (string) — Severity level. [Ok, Critical, Warning, Info]\n    - target_incident (object) — Incident the alerts were merged into. Omitted when not recorded.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - title (string) — New title set on the target incident. Omitted when unchanged.\n  - ref_id (string) (required) — ObjectID of the alert this entry references.\n  - type (string) (required) — Alert activity feed entry type. Each value identifies one alert lifecycle event; the matching `detail` payload shape is determined by this field. | Type | Meaning | |---|---| | `a_new` | Alert triggered by an incoming event. | | `a_update` | Alert severity or status changed on an incoming event. | | `a_comm` | Comment added on the alert. | | `a_merge` | Alert merged into an incident. | | `a_m_silence` | Alert muted by a silence rule. | | `a_m_inhibit` | Alert muted by an inhibit rule. | | `a_m_flapping` | Alert muted by flapping detection (historical data only; no longer produced). | | `a_ack` | Alert acknowledged (historical data only; alert-level acknowledgement has been removed). | | `a_unack` | Alert acknowledgement revoked (historical data only). | | `a_close` | Alert closed (historical data only; no longer produced). | [a_new, a_update, a_comm, a_merge, a_m_silence, a_m_inhibit, a_m_flapping, a_ack, a_unack, a_close]\n  - updated_at (string) (required) — Last update timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Alerts.ReadFeed":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - agent_session_id (string) — AI SRE session that produced the entry. Omitted when no agent wrote it.\n  - created_at (string) (required) — Creation timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator. 0 for system-generated entries.\n  - deleted_at (string) — Soft-delete time, Unix epoch milliseconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - detail (object) (required) — Type-specific payload; the concrete shape is determined by `type`. May be `null` for entries stored without detail.\n    - comment (string) — Comment body.\n    - in_secs (integer) — Window in seconds over which the state changes were counted. Omitted when zero.\n    - max_changes (integer) — State-change count threshold that triggered flapping detection. Omitted when zero.\n    - mute_secs (integer) — Mute duration in seconds. Omitted when zero.\n    - owner_id (integer) — New owner member ID set on the target incident. Omitted when unchanged.\n    - rule_id (string) — Silence rule ID that muted the alert. Omitted when empty.\n    - rule_name (string) — Silence rule name, resolved at read time. Omitted when empty.\n    - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n    - source_alert_id (string) — ID of the source alert that triggered the inhibition. Omitted when empty.\n    - source_alert_title (string) — Title of the source alert, resolved at read time. Omitted when empty.\n    - source_alerts (array<object>) — Source alerts merged into the target incident. Omitted when empty.\n      - alert_id (string) — Alert ID (ObjectID hex string).\n      - title (string) — Alert title, resolved at read time. Omitted when empty.\n    - status (string) — Severity level. [Ok, Critical, Warning, Info]\n    - target_incident (object) — Incident the alerts were merged into. Omitted when not recorded.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - title (string) — New title set on the target incident. Omitted when unchanged.\n  - ref_id (string) (required) — ObjectID of the alert this entry references.\n  - type (string) (required) — Alert activity feed entry type. Each value identifies one alert lifecycle event; the matching `detail` payload shape is determined by this field. | Type | Meaning | |---|---| | `a_new` | Alert triggered by an incoming event. | | `a_update` | Alert severity or status changed on an incoming event. | | `a_comm` | Comment added on the alert. | | `a_merge` | Alert merged into an incident. | | `a_m_silence` | Alert muted by a silence rule. | | `a_m_inhibit` | Alert muted by an inhibit rule. | | `a_m_flapping` | Alert muted by flapping detection (historical data only; no longer produced). | | `a_ack` | Alert acknowledged (historical data only; alert-level acknowledgement has been removed). | | `a_unack` | Alert acknowledgement revoked (historical data only). | | `a_close` | Alert closed (historical data only; no longer produced). | [a_new, a_update, a_comm, a_merge, a_m_silence, a_m_inhibit, a_m_flapping, a_ack, a_unack, a_close]\n  - updated_at (string) (required) — Last update timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - via (string) — Surface that wrote the entry on a user's behalf; currently only `ai_sre`. Omitted when a user created the entry directly.\n",
 	"Alerts.ReadInfo":                             "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Unique alert ID (ObjectID hex string).\n  - alert_key (string) — Deduplication key.\n  - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n  - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n  - channel_id (integer) — ID of the channel the alert belongs to.\n  - channel_name (string) — Display name of the channel.\n  - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated: use `integration_id` instead.\n  - data_source_name (string) — Deprecated: use `integration_name` instead.\n  - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n  - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Alert description.\n  - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) — Total number of raw events received by this alert.\n  - events (array<object>) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) — True if this alert has ever been silenced.\n  - images (array<object>) — Images attached to the alert.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - incident (object) — Associated incident, if any.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) — ID of the integration that produced this alert.\n  - integration_name (string) — Display name of the integration.\n  - integration_ref_id (string) — External reference ID of the integration.\n  - integration_type (string) — Type/plugin key of the integration.\n  - labels (object) — Label key-value pairs.\n  - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n  - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n  - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Alert title.\n  - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Alerts.ReadList":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Unique alert ID (ObjectID hex string).\n  - alert_key (string) — Deduplication key.\n  - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n  - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n  - channel_id (integer) — ID of the channel the alert belongs to.\n  - channel_name (string) — Display name of the channel.\n  - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated: use `integration_id` instead.\n  - data_source_name (string) — Deprecated: use `integration_name` instead.\n  - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n  - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Alert description.\n  - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) — Total number of raw events received by this alert.\n  - events (array<object>) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) — True if this alert has ever been silenced.\n  - images (array<object>) — Images attached to the alert.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - incident (object) — Associated incident, if any.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) — ID of the integration that produced this alert.\n  - integration_name (string) — Display name of the integration.\n  - integration_ref_id (string) — External reference ID of the integration.\n  - integration_type (string) — Type/plugin key of the integration.\n  - labels (object) — Label key-value pairs.\n  - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n  - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n  - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Alert title.\n  - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Alerts.ReadListByIDs":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Unique alert ID (ObjectID hex string).\n  - alert_key (string) — Deduplication key.\n  - alert_severity (string) — Current severity — the highest severity ever seen on this alert: `Critical`, `Warning`, or `Info`. [Critical, Warning, Info]\n  - alert_status (string) — Current status: `Critical`/`Warning`/`Info` while firing, `Ok` once recovered. [Critical, Warning, Info, Ok]\n  - channel_id (integer) — ID of the channel the alert belongs to.\n  - channel_name (string) — Display name of the channel.\n  - channel_status (string) — Status of the channel: `enabled` or `disabled`. [enabled, disabled]\n  - created_at (string) — Creation timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated: use `integration_id` instead.\n  - data_source_name (string) — Deprecated: use `integration_name` instead.\n  - data_source_ref_id (string) — Deprecated: use `integration_ref_id` instead.\n  - data_source_type (string) — Deprecated: use `integration_type` instead. Omitted when empty.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the alert is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Alert description.\n  - end_time (string) — Resolution time, Unix epoch seconds. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - event_cnt (integer) — Total number of raw events received by this alert.\n  - events (array<object>) — Raw events of this alert. Omitted here; populated only by `POST /incident/alert/list`.\n    - account_id (integer) — Account ID.\n    - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n    - alert_key (string) — Deduplication key used to merge events into an alert.\n    - channel_id (integer) — Channel ID the event is routed to.\n    - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n    - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) — Event description.\n    - event_id (string) — Event ID (MongoDB ObjectID).\n    - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n    - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n    - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - images (array<object>) — Images attached to the event.\n      - alt (string) — Alt text.\n      - href (string) — Optional link URL when the image is clicked.\n      - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n    - integration_id (integer) — Integration that produced this event.\n    - integration_type (string) — Type/plugin key of the integration that produced this event.\n    - labels (object) — Label key-value pairs.\n    - title (string) — Event title.\n    - title_rule (string) — Title template used to derive `title` from labels.\n    - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - ever_muted (boolean) — True if this alert has ever been silenced.\n  - images (array<object>) — Images attached to the alert.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - incident (object) — Associated incident, if any.\n    - incident_id (string) — Incident ID (ObjectID hex string).\n    - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n    - title (string) — Incident title.\n  - integration_id (integer) — ID of the integration that produced this alert.\n  - integration_name (string) — Display name of the integration.\n  - integration_ref_id (string) — External reference ID of the integration.\n  - integration_type (string) — Type/plugin key of the integration.\n  - labels (object) — Label key-value pairs.\n  - last_time (string) — Last-event time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - responder_email (string) — Responder email. Always empty in this response — responder tracking lives on the associated incident.\n  - responder_name (string) — Responder display name. Always empty in this response — responder tracking lives on the associated incident.\n  - start_time (string) — First-seen time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - title (string) — Alert title.\n  - title_rule (string) — Title template used to derive `title` from the event labels (e.g. `$service::$cluster`).\n  - updated_at (string) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
@@ -48,9 +46,9 @@ var responseHelpBySDKMethod = map[string]string{
 	"Analytics.ByTeam":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgement_pct (number) — Acknowledgement rate (%): acknowledged incidents ÷ total incidents × 100, rounded to two decimals and capped at 100; 0 when the bucket has no incidents.\n  - channel_id (integer) — Channel ID, returned only when aggregating by channel (`/insight/channel`).\n  - channel_name (string) — Channel name, returned when aggregating by channel; omitted when the name cannot be resolved.\n  - hours (string) — Hour bucket when `split_hours` is enabled. `work` is Mon–Fri 08:00–19:00, `sleep` is daily 23:00–08:00, and `off` is everything else, all evaluated in the account timezone (`sleep` takes precedence over `work`). Omitted when `split_hours` is false. [work, sleep, off]\n  - mean_seconds_to_ack (number) — Mean time to first acknowledgement in seconds; 0 when no incident in the bucket was acknowledged.\n  - mean_seconds_to_close (number) — Mean time to close in seconds; 0 when no incident in the bucket was closed.\n  - noise_reduction_pct (number) — Noise reduction ratio (%): 100 − incidents ÷ alert events × 100, rounded to two decimals; 0 when there is no alert-event data or alert events do not exceed incidents.\n  - responder_id (integer) — Responder (person) ID, returned only when aggregating by responder (`/insight/responder`).\n  - responder_name (string) — Responder name, returned when aggregating by responder; omitted when the name cannot be resolved.\n  - team_id (integer) — Team ID, returned only when aggregating by team (`/insight/team`).\n  - team_name (string) — Team name, returned when aggregating by team; omitted when the name cannot be resolved (e.g. team deleted).\n  - total_alert_cnt (integer) — Total number of alerts.\n  - total_alert_event_cnt (integer) — Total number of alert events.\n  - total_engaged_seconds (integer) — Total engaged time in seconds: each incident contributes the sum of close time minus acknowledgement time across its acknowledged responders.\n  - total_incident_cnt (integer) — Total number of incidents.\n  - total_incidents_acknowledged (integer) — Incidents that were acknowledged at least once.\n  - total_incidents_auto_closed (integer) — Incidents closed automatically because all alerts recovered.\n  - total_incidents_closed (integer) — Incidents that are closed.\n  - total_incidents_escalated (integer) — Incidents that were escalated at least once.\n  - total_incidents_manually_closed (integer) — Incidents closed manually.\n  - total_incidents_manually_escalated (integer) — Incidents escalated manually at least once.\n  - total_incidents_reassigned (integer) — Incidents that were reassigned at least once.\n  - total_incidents_timeout_closed (integer) — Incidents closed automatically on timeout.\n  - total_incidents_timeout_escalated (integer) — Incidents escalated on timeout at least once.\n  - total_interruptions (integer) — Total interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - total_notifications (integer) — Total number of notifications sent.\n  - total_seconds_to_ack (integer) — Total time to first acknowledgement in seconds.\n  - total_seconds_to_close (integer) — Total time to close in seconds.\n  - ts (string) — Start of the aggregation bucket, Unix epoch seconds. Equals `start_time` when no `aggregate_unit` is given. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Analytics.IncidentList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - acknowledgements (integer) — Number of acknowledgements.\n  - active_alert_cnt (integer) — Number of alerts still active (not recovered).\n  - alert_cnt (integer) — Total number of alerts aggregated into the incident.\n  - alert_event_cnt (integer) — Total number of alert events associated with the incident; each report of an alert counts as one event.\n  - assigned_to (object) — Current assignment target for the incident; `null` when the incident has no assignment record.\n    - assigned_at (string) — Unix timestamp (seconds) when this assignment was made. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) driving the assignment.\n    - escalate_rule_name (string) — Display name of the escalation rule.\n    - id (string) — Internal assignment record ID.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - person_ids (array<integer>) — Member IDs assigned directly to this incident.\n    - type (string) — Assignment type. | Value | Meaning | |---|---| | `assign` | Initial assignment when the incident is created manually. | | `reassign` | Re-assignment of an existing incident. | | `escalate` | Assignment triggered by escalation policy advancement. | | `reopen` | Assignment restarted from the first layer after the incident is reopened. | [assign, reassign, escalate, reopen]\n  - assignments (integer) — Number of assignments.\n  - channel_id (integer) — ID of the channel the incident belongs to.\n  - channel_name (string) — Name of the channel the incident belongs to.\n  - closed_by (string) — How the incident was closed: `auto`, `timeout`, or `manually`. Empty string while the incident is still open. [auto, timeout, manually]\n  - closer_id (integer) — Member ID of the person who closed the incident. Omitted when 0 (not closed manually).\n  - closer_name (string) — Display name of the person who closed the incident. Omitted when empty.\n  - created_at (string) — Incident creation time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) — Person ID of the incident creator.\n  - creator_name (string) — Display name of the incident creator.\n  - description (string) — Incident description. Omitted when empty.\n  - engaged_seconds (integer) — Total engaged time in seconds across acknowledged responders, each contributing close time minus their acknowledgement time; 0 if not closed.\n  - escalations (integer) — Total escalations, the sum of `timeout_escalations` and `manual_escalations`.\n  - ever_muted (boolean) — Whether the incident was ever muted by noise reduction. Omitted when false.\n  - fields (object) — Custom fields of the incident. Always omitted in this response (reserved for export).\n  - frequency (string) — Frequency classification: `frequent` or `rare`. Omitted when not classified. [frequent, rare]\n  - hours (string) — Time-of-day bucket of the creation time in the account timezone: `work` = Mon–Fri 08:00–19:00, `sleep` = 23:00–08:00 daily, `off` = all other times. [work, off, sleep]\n  - incident_id (string) — Incident ID, unique within the account.\n  - interruptions (integer) — Number of interruptions: notifications sent via app push, SMS, or voice call; consecutive notifications to the same responder within 60 seconds count as one.\n  - labels (object) — Incident labels as key-value pairs. Always omitted in this response (reserved for export).\n  - manual_escalations (integer) — Manually triggered escalations.\n  - notifications (integer) — Total number of notifications sent.\n  - owner_id (integer) — Member ID of the incident owner. Omitted when 0 (no owner).\n  - owner_name (string) — Display name of the incident owner. Omitted when empty.\n  - progress (string) — Incident progress state — one of `Triggered`, `Processing`, `Closed`. [Triggered, Processing, Closed]\n  - reassignments (integer) — Number of reassignments.\n  - responders (array<object>) — Responders with per-person assignment and acknowledgement times.\n    - acknowledged_at (string) — Acknowledgement time, as a Unix timestamp in seconds; 0 if not acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Responder's identity in an external chat tool (e.g. Slack); only present when backfilled by an external system.\n    - assigned_at (string) — Assignment time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Responder email. Omitted when empty.\n    - person_id (integer) — Person ID of the responder.\n    - person_name (string) — Responder display name. Omitted when empty.\n  - seconds_to_ack (integer) — Seconds from incident creation to the first acknowledgement; 0 if never acknowledged.\n  - seconds_to_close (integer) — Seconds from incident creation to close; 0 if not closed.\n  - severity (string) — Incident severity. [Critical, Warning, Info]\n  - snoozed_before (string) — Unix timestamp in seconds until which the incident is snoozed. Omitted when the incident is not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) — ID of the team that owns the incident.\n  - team_name (string) — Name of the team that owns the incident.\n  - timeout_escalations (integer) — Escalations triggered by timeout.\n  - title (string) — Incident title.\n",
 	"Analytics.TopkAlertsByLabel":                 "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - hours (string) — Hour bucket when `split_hours` is enabled: `work`, `sleep`, or `off`. Omitted when `split_hours` is false. [work, sleep, off]\n  - label (string) — Aggregation key value (check name or resource identifier).\n  - total_alert_cnt (integer) — Total number of alerts in this label-value bucket.\n  - total_alert_event_cnt (integer) — Total number of raw alert events in this label-value bucket.\n",
-	"Applications.ReadInfo":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
-	"Applications.ReadInfos":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
-	"Applications.ReadList":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
+	"Applications.ReadInfo":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - repositories (array<object>) — Linked source code repositories, in order; the first entry is the primary repository. Linking grants no access by itself: AI sessions can only read repositories granted to the account's GitHub App installations.\n    - repo (string) (required) — GitHub repository in `owner/name` form.\n    - subdir (string) — Directory holding the application inside the repository, relative to the repository root. `.` is the repository root; an empty value is saved as `.`.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
+	"Applications.ReadInfos":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - repositories (array<object>) — Linked source code repositories, in order; the first entry is the primary repository. Linking grants no access by itself: AI sessions can only read repositories granted to the account's GitHub App installations.\n    - repo (string) (required) — GitHub repository in `owner/name` form.\n    - subdir (string) — Directory holding the application inside the repository, relative to the repository root. `.` is the repository root; an empty value is saved as `.`.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
+	"Applications.ReadList":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alerting (object) — Alerting configuration of the application.\n    - channel_ids (array<integer>) — Channel IDs to send alerts to. Used only when `delivery_mode` is `oncall`.\n    - delivery_mode (string) — Alert delivery channel: `oncall` routes alert events through Flashduty On-call, `webhook` POSTs them directly to `webhook_url`. An empty value is treated as `oncall`, and on create/update it is persisted as the deployment default (`webhook` on RUM-only on-premises deployments, `oncall` otherwise). Omitted when empty (legacy rows). [oncall, webhook]\n    - enabled (boolean) (required) — Whether alerting is enabled.\n    - integration_id (integer) — Associated on-call integration ID (read-only, auto-assigned on save when `delivery_mode` is `oncall`).\n    - webhook_url (string) — URL that receives alert events when `delivery_mode` is `webhook`; required in that mode, ignored otherwise. Omitted when empty.\n  - application_id (string) — Unique application ID.\n  - application_name (string) — Application display name.\n  - client_token (string) — Token used to initialize the RUM SDK.\n  - created_at (string) — Creation timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) — Creator member ID.\n  - is_private (boolean) — If `true`, the application is only accessible to team members.\n  - links (object) — External-link integration configuration.\n    - enabled (boolean) (required) — Whether external link integration is enabled.\n    - systems (array<object>) — External systems whose URL templates can be opened from matching RUM events.\n      - enabled (boolean) (required) — Whether this external system link is enabled.\n      - event_types (array<string>) (required) — RUM event types where this external system link is shown; at least one is required. | Value | Meaning | |---|---| | `crash` | Crash events (errors flagged `is_crash`) | | `error` | Error events | | `view` | Page/screen view events | | `action` | User action events | | `resource` | Resource load events | | `session` | Session events | | `all` | All event types | [crash, error, view, action, resource, session, all]\n      - icon_color (string) — Display color for the link icon.\n      - icon_text (string) — Short text shown in the link icon.\n      - id (string) — Stable client-side identifier for this external system.\n      - name (string) (required) — Display name of the external system.\n      - url (string) (required) — HTTP or HTTPS URL template. `${var}` tokens are resolved from the RUM event context.\n  - no_geo (boolean) — If `true`, geographic location is not inferred from IP.\n  - no_ip (boolean) — If `true`, IP addresses are not collected.\n  - repositories (array<object>) — Linked source code repositories, in order; the first entry is the primary repository. Linking grants no access by itself: AI sessions can only read repositories granted to the account's GitHub App installations.\n    - repo (string) (required) — GitHub repository in `owner/name` form.\n    - subdir (string) — Directory holding the application inside the repository, relative to the repository root. `.` is the repository root; an empty value is saved as `.`.\n  - status (string) — Application status. One of `enabled` (active, receiving data), `disabled` (deactivated), `deleted` (soft-delete marker; every query filters it out, so it never actually appears in responses). [enabled, disabled, deleted]\n  - team_id (integer) — Owning team ID.\n  - tracing (object) — APM tracing integration configuration.\n    - enabled (boolean) (required) — Whether tracing integration is enabled.\n    - endpoint (string) (required) — Trace endpoint URL (http or https).\n    - open_type (string) (required) — How to open the trace link. One of `popup` (open trace details in a popup) or `tab` (open in a new browser tab). [popup, tab]\n  - type (string) — Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n  - updated_at (string) — Last update timestamp, Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — Last updater member ID.\n",
 	"Applications.RemoteConfigReadGet":            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - config (object) — The whole per-application remote configuration. A change reaches an SDK asynchronously and is applied when that SDK creates its next session, so a running session never flips a decision mid-flight.\n    - activation (string) — How a change lands on a client that is already running: `next_session` (the default, and what an empty value means) leaves running sessions untouched and applies the change to new sessions; `immediate` ends the running session as soon as the change arrives so a new session starts under the new configuration. [next_session, immediate]\n    - custom (object) — Application-defined pass-through values handed to the host app verbatim. At most 5 keys, each key up to 64 bytes, each value up to 4 KB of JSON nested at most 3 levels, 16 KB in total. Anyone holding the public client token can read it.\n    - default (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n      - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]\n      - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)\n      - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)\n      - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)\n    - enabled (boolean) — Kill switch. When false the engine reports no values at all and SDKs fall back to their init values.\n    - refresh_on_foreground (boolean) — Let clients re-check the configuration when they return to the foreground instead of waiting for the next poll.\n    - rules (array<object>) — Targeting rules, evaluated in order; at most 20 per application.\n      - match (object) (required) — Key/value conditions the SDK's config request must equal. Keys are limited to `env`, `app_version` and `sdk`; values are at most 256 bytes.\n      - set (object) (required) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n        - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]\n        - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)\n        - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)\n        - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)\n  - updated_at (string) — Unix timestamp in milliseconds - when the current version was published. 0 when never configured. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (integer) — Version the live configuration is stored under. 0 means the application has never been configured.\n",
 	"Applications.RemoteConfigReadHistoryList":    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - config (object) — The whole per-application remote configuration. A change reaches an SDK asynchronously and is applied when that SDK creates its next session, so a running session never flips a decision mid-flight.\n    - activation (string) — How a change lands on a client that is already running: `next_session` (the default, and what an empty value means) leaves running sessions untouched and applies the change to new sessions; `immediate` ends the running session as soon as the change arrives so a new session starts under the new configuration. [next_session, immediate]\n    - custom (object) — Application-defined pass-through values handed to the host app verbatim. At most 5 keys, each key up to 64 bytes, each value up to 4 KB of JSON nested at most 3 levels, 16 KB in total. Anyone holding the public client token can read it.\n    - default (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n      - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]\n      - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)\n      - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)\n      - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)\n    - enabled (boolean) — Kill switch. When false the engine reports no values at all and SDKs fall back to their init values.\n    - refresh_on_foreground (boolean) — Let clients re-check the configuration when they return to the foreground instead of waiting for the next poll.\n    - rules (array<object>) — Targeting rules, evaluated in order; at most 20 per application.\n      - match (object) (required) — Key/value conditions the SDK's config request must equal. Keys are limited to `env`, `app_version` and `sdk`; values are at most 256 bytes.\n      - set (object) (required) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n  - content_hash (string) — Hash of the configuration content; lets the console identify versions with identical content.\n  - equivalent_to (integer) — Earliest version carrying the same content, when that is not this version itself.\n  - reason (string) — Operator's note left when the version was published. Empty when none was given.\n  - updated_at (string) — Unix timestamp in milliseconds - when the version was published. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) — ID of the member who published the version.\n  - updated_by_name (string) — Name of the member who published the version.\n  - version (integer) — Version number, unique within the application.\n",
 	"Applications.RemoteConfigReadPreview":        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - hit_rule_index (integer) — 0-based index of the rule that decided the result, or -1 when only the default applied.\n  - values (object) — The SDK knobs a configuration can set. Every field is optional: a value absent from both rule and default is omitted from the SDK response, which tells the SDK to keep its init value.\n    - defaultPrivacyLevel (string) — How Session Replay masks a page by default. [mask, mask-user-input, allow]\n    - sessionReplaySampleRate (integer) — Session Replay sampling rate (0-100). (0-100)\n    - sessionSampleRate (integer) — Session sampling rate (0-100). (0-100)\n    - traceSampleRate (integer) — Trace sampling rate (0-100): which sessions inject trace headers into their requests. (0-100)\n",
@@ -67,7 +65,7 @@ var responseHelpBySDKMethod = map[string]string{
 	"Artifacts.WriteShareSync":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - public_url (string) (required) — Anonymous public link served entirely from CDN. Anyone with the link can view the content, no login required.\n  - share_enabled (boolean) (required) — Always `true` in this response.\n  - shared_at (string) (required) — Unix timestamp in milliseconds of the last share enable or snapshot sync. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) (required) — Person ID of the member who enabled sharing.\n",
 	"Artifacts.WriteUpdate":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - artifact_id (string) (required) — Artifact ID (`art_` prefix). Also the key of the public-share link.\n  - can_edit (boolean) (required) — Whether the caller may manage this artifact (rename, transfer, delete, share): the creator, any member of the owning team, or a manager of the source session.\n  - content_type (string) (required) — MIME type of the file.\n  - created_at (string) (required) — Unix timestamp in milliseconds when the artifact was published. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_name (string) (required) — Creator's display name.\n  - file_id (string) (required) — Presented-file ID (`pf_` prefix) currently holding the artifact's bytes. Changes on every republish.\n  - is_mine (boolean) (required) — Whether the caller is the creator.\n  - name (string) (required) — Underlying file name including extension.\n  - person_id (integer) (required) — Person (member) ID of the creator.\n  - public_url (string) — Anonymous public link — a console `/share/artifact/<artifact_id>` page served entirely from CDN. Present only while shared; anyone with the link can view it, no login required.\n  - session_id (string) (required) — Source session ID (`sess_` prefix) that produced the file.\n  - session_title (string) — Source session's title. Omitted when the session has been deleted.\n  - share_enabled (boolean) — Whether anonymous public sharing is on. Omitted when false.\n  - share_file_id (string) — Presented-file ID the public snapshot was materialized from. When `share_enabled` is true and `file_id` differs from `share_file_id`, the public snapshot is stale — call `/safari/artifact/gallery/share/sync` to refresh it.\n  - shared_at (string) — Unix timestamp in milliseconds of the last share enable or snapshot sync. Present only while shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - shared_by (integer) — Person ID of the member who enabled sharing. Present only while shared.\n  - size (integer) (required) — File size in bytes.\n  - team_id (integer) (required) — Owning team ID. `0` means a personal artifact (creator-only management); a positive value means team-owned.\n  - team_name (string) — Owning team's display name. Omitted for personal artifacts.\n  - title (string) (required) — Display title in the gallery.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the artifact was last updated (rename, transfer, or republish). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"AuditLogs.OperationList":                     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - name (string) (required) — Stable machine-readable operation name for use as a filter.\n  - name_cn (string) (required) — Human-readable Chinese label shown in the console.\n",
-	"AuditLogs.Search":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account.\n  - body (string) (required) — JSON-encoded request body. Bodies containing sensitive fields are base64url-encoded instead; bodies over 10 KB are replaced by a truncation placeholder.\n  - created_at (string) (required) — Timestamp of the operation in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - credential_id (integer) (required) — ID of the credential (the app key ID) when `credential_type` is `app_key`; 0 otherwise.\n  - credential_type (string) (required) — Credential type used for the call. `app_key` when authenticated with an app key; empty string for member sessions.\n  - ip (string) (required) — Client IP address of the caller.\n  - is_dangerous (boolean) (required) — True if this is flagged as a high-risk operation.\n  - is_write (boolean) (required) — True for mutating operations; false for read-only ones.\n  - member_id (integer) (required) — ID of the member who performed the action. 0 when the action was performed by the account principal itself.\n  - member_name (string) (required) — Display name of the member. Empty when `member_id` is 0.\n  - operation (string) (required) — Stable machine-readable operation name, e.g. `template:write:create`.\n  - operation_name (string) (required) — Human-readable Chinese label of the operation (e.g. `创建模板`).\n  - params (array<object>) (required) — URL path parameters as an array of key-value pairs, or an empty array when none.\n    - Key (string) — Name of a URL path parameter (the `:xxx` placeholder in the route).\n    - Value (string) — The actual value of that path parameter in this request.\n  - principal_kind (string) (required) — Kind of the caller. `member` — an interactive member session; `service` — an app key credential. [member, service]\n  - request_id (string) (required) — Unique request ID for correlation.\n",
+	"AuditLogs.Search":                            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account.\n  - body (string) (required) — JSON-encoded request body. Bodies containing sensitive fields are base64url-encoded instead; bodies over 10 KB are replaced by a truncation placeholder.\n  - created_at (string) (required) — Timestamp of the operation in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - credential_id (integer) (required) — ID of the credential (the app key ID) when `credential_type` is `app_key`; 0 otherwise.\n  - credential_type (string) (required) — Credential type used for the call. `app_key` for a long-lived console app key, `ephemeral_app_key` for a short-lived key issued to AI SRE, and an empty string for member sessions.\n  - ip (string) (required) — Client IP address of the caller.\n  - is_dangerous (boolean) (required) — True if this is flagged as a high-risk operation.\n  - is_write (boolean) (required) — True for mutating operations; false for read-only ones.\n  - member_id (integer) (required) — ID of the member who performed the action. 0 when the action was performed by the account principal itself.\n  - member_name (string) (required) — Display name of the member. Empty when `member_id` is 0.\n  - operation (string) (required) — Stable machine-readable operation name, e.g. `template:write:create`.\n  - operation_name (string) (required) — Human-readable Chinese label of the operation (e.g. `创建模板`).\n  - params (array<object>) (required) — URL path parameters as an array of key-value pairs, or an empty array when none.\n    - Key (string) — Name of a URL path parameter (the `:xxx` placeholder in the route).\n    - Value (string) — The actual value of that path parameter in this request.\n  - principal_kind (string) (required) — Kind of the caller. `member` — an interactive member session; `service` — an app key credential. [member, service]\n  - request_id (string) (required) — Unique request ID for correlation.\n",
 	"Automations.RuleReadGet":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n  - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - cron_expr (string) (required) — Normalized 5-field cron expression.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - environment_id (string) (required) — BYOC Runner ID.\n  - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n  - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n  - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n  - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n  - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n  - name (string) (required) — Rule name.\n  - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n  - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n  - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n  - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n  - owner_id (integer) (required) — Creator person ID.\n  - prompt (string) (required) — Task prompt.\n  - rule_id (string) (required) — Rule ID.\n  - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n  - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n  - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n  - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n  - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n  - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Automations.RuleReadList":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - rules (array<object>) (required) — Array of automation rules for the current page, used with `total` for pagination.\n    - account_id (integer) (required) — Account ID.\n    - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n    - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - cron_expr (string) (required) — Normalized 5-field cron expression.\n    - enabled (boolean) (required) — Whether the rule is enabled.\n    - environment_id (string) (required) — BYOC Runner ID.\n    - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n    - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n    - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n    - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n    - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n    - name (string) (required) — Rule name.\n    - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n    - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n    - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n    - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n    - owner_id (integer) (required) — Creator person ID.\n    - prompt (string) (required) — Task prompt.\n    - rule_id (string) (required) — Rule ID.\n    - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n    - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n    - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n    - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n    - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n    - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - total (integer) (required) — Total count.\n",
 	"Automations.RuleWriteCreate":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - can_edit (boolean) (required) — True when the caller can manage this rule: the personal rule owner; for team rules, an account admin or a member of the rule's team.\n  - created_at (string) (required) — Creation time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - cron_expr (string) (required) — Normalized 5-field cron expression.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - environment_id (string) (required) — BYOC Runner ID.\n  - environment_kind (string) (required) — Runtime environment kind. Omit or send an empty value for automatic selection. One of: `cloud` (platform-hosted cloud sandbox), `byoc` (self-hosted BYOC runner in the account); an empty value means automatic selection (prefers an online BYOC runner, falls back to the cloud sandbox). [cloud, byoc]\n  - http_post_token (string) — HTTP POST trigger token. Returned only on create or token rotation; save it immediately.\n  - http_post_trigger_enabled (boolean) (required) — Whether the HTTP POST trigger is enabled.\n  - http_post_trigger_id (string) — HTTP POST trigger ID. Omitted when the rule has no HTTP POST trigger.\n  - http_post_trigger_url (string) — HTTP POST trigger path. Omitted when the rule has no HTTP POST trigger.\n  - name (string) (required) — Rule name.\n  - oncall_incident_channel_ids (array<integer>) — On-call integration IDs to watch. Creating or enabling this trigger requires at least one valid ID. Omitted when no On-call incident trigger is configured.\n  - oncall_incident_severities (array<string>) — Incident severities to watch. Supported values are Critical, Warning, and Info; creating or enabling this trigger requires at least one value. Omitted when no On-call incident trigger is configured. [Critical, Warning, Info]\n  - oncall_incident_trigger_enabled (boolean) (required) — Whether the On-call incident trigger is enabled.\n  - oncall_incident_trigger_id (string) — On-call incident trigger ID. Omitted when the rule has no On-call incident trigger.\n  - owner_id (integer) (required) — Creator person ID.\n  - prompt (string) (required) — Task prompt.\n  - rule_id (string) (required) — Rule ID.\n  - run_scope (string) (required) — Hidden session run scope. One of: `person` (personal rule, team_id=0, runs as the creator; disabled when the creator leaves the account), `team` (team rule, team_id>0, owned by the team and shared with its members; survives the creator leaving). Derived from the rule's team_id. [person, team]\n  - schedule_next_fire_at_ms (string) (required) — Next scheduled fire time, Unix milliseconds. 0 means no future scheduled fire is available. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_trigger_enabled (boolean) (required) — Whether the schedule trigger is enabled.\n  - schedule_trigger_id (string) — Schedule trigger ID. Omitted if the rule has no schedule trigger.\n  - team_id (integer) (required) — Scope team ID; 0 means personal rule.\n  - timezone (string) (required) — IANA timezone `cron_expr` is evaluated in. Always populated for rules created after this field shipped; empty on legacy rows created before it, which still resolve to UTC when scheduled.\n  - updated_at (string) (required) — Last update time, Unix milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
@@ -132,7 +130,7 @@ var responseHelpBySDKMethod = map[string]string{
 	"Incidents.ServiceDeskPlusRequestReadList":    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - channel_id (integer) (required) — Channel ID for the incident.\n  - channel_name (string) (required) — Channel name for the incident.\n  - created_at (string) (required) — Mapping record creation time, Unix seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error_message (string) — Error message when synchronization failed. Usually absent on successful records.\n  - incident_id (string) (required) — Associated Flashduty incident ID.\n  - incident_title (string) (required) — Associated incident title.\n  - integration_id (integer) (required) — ServiceDeskPlus integration ID.\n  - request_id (string) (required) — ServiceDeskPlus request ID.\n  - request_link (string) (required) — ServiceDeskPlus request detail URL.\n  - status (string) (required) — Synchronization status. [success, failed]\n",
 	"Incidents.WarRoomCreate":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - chat_name (string) (required) — Chat/group display name.\n  - share_link (string) (required) — Join link for the war room, if provided by the IM.\n",
 	"Incidents.WarRoomDetail":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - chat_name (string) (required) — Chat/group display name.\n  - share_link (string) (required) — Join link for the war room, if provided by the IM.\n",
-	"Incidents.WarRoomList":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the war room.\n  - incident_id (string) (required) — Associated incident ID (MongoDB ObjectID).\n  - integration_id (integer) (required) — IM integration ID.\n  - plugin_type (string) (required) — IM plugin type (e.g. `feishu`, `dingtalk`, `wecom`, `slack`).\n  - status (string) (required) — War room record status: `enabled` active, `deleted` disbanded. [enabled, deleted]\n",
+	"Incidents.WarRoomList":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - chat_id (string) (required) — Chat/group ID on the IM side.\n  - chat_name (string) (required) — Display name of the group chat on the IM side.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the war room.\n  - incident_id (string) (required) — Associated incident ID (MongoDB ObjectID).\n  - integration_id (integer) (required) — IM integration ID.\n  - integration_unavailable (boolean) — True when the IM integration behind this war room is disabled or no longer exists.\n  - plugin_type (string) (required) — IM plugin type (e.g. `feishu`, `dingtalk`, `wecom`, `slack`).\n  - status (string) (required) — War room record status: `enabled` active, `deleted` disbanded. [enabled, deleted]\n",
 	"Incidents.WorkItemBindPostMortem":            "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n  - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n  - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID of the creator.\n  - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n  - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n  - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n  - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n  - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n  - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n  - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n  - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n  - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last updater.\n  - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n  - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n",
 	"Incidents.WorkItemComplete":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
 	"Incidents.WorkItemConvert":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - assignee_ids (array<integer>) (required) — Member IDs of the current assignees. Never null; an empty array means unassigned.\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
@@ -166,10 +164,10 @@ var responseHelpBySDKMethod = map[string]string{
 	"Members.MemberInfo":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_avatar (string) (required) — Account avatar URL\n  - account_email (string) (required) — Account email\n  - account_id (integer) (required) — Account ID\n  - account_locale (string) — Account-level locale preference (e.g. zh-CN or en-US). Omitted when the account has none set.\n  - account_name (string) (required) — Account name\n  - account_role_ids (array<integer>) (required) — Assigned role IDs\n  - account_time_zone (string) — Account-level time zone (e.g. Asia/Shanghai). Omitted when the account has none set.\n  - avatar (string) (required) — Member avatar URL\n  - country_code (string) (required) — ISO 3166-1 alpha-2 region code of the member's contact phone (e.g. \"CN\", \"US\", \"HK\").\n  - created_at (string) (required) — Member creation time, Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - domain (string) (required) — Account domain\n  - email (string) (required) — Email address\n  - email_verified (boolean) (required) — Whether email is verified\n  - is_external (boolean) (required) — Whether provisioned via SSO\n  - locale (string) — Member's locale preference. Omitted when the member has none set.\n  - member_id (integer) (required) — Member ID\n  - member_name (string) (required) — Member display name\n  - mp_account_id (string) — Account identifier on the marketplace platform. Omitted together with `mp_plat`.\n  - mp_plat (string) — Cloud marketplace platform the account was provisioned from. Omitted when the account did not come from a marketplace.\n  - phone (string) (required) — Masked phone number\n  - phone_verified (boolean) (required) — Whether phone is verified\n  - time_zone (string) — Member's IANA time zone. Omitted when the member has none set.\n",
 	"Members.MemberInvite":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - member_id (integer) — Member ID\n  - member_name (string) — Member display name\n",
 	"Members.MemberList":                          "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID\n  - account_role_ids (array<integer>) (required) — Role IDs\n  - avatar (string) (required) — Avatar URL\n  - country_code (string) (required) — ISO 3166-1 alpha-2 region code of the member's contact phone (e.g. \"CN\", \"US\", \"HK\").\n  - created_at (string) (required) — Creation timestamp (Unix seconds) CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - email (string) (required) — Email address\n  - email_verified (boolean) (required) — Email verified\n  - is_external (boolean) (required) — Provisioned via SSO\n  - locale (string) — Member's locale preference (e.g. `zh-CN`). Omitted when empty — the list endpoint does not populate it.\n  - member_id (integer) (required) — Member ID\n  - member_name (string) (required) — Display name\n  - phone (string) (required) — Masked phone number\n  - phone_verified (boolean) (required) — Phone verified\n  - ref_id (string) (required) — External reference ID\n  - status (string) (required) — Member status. `enabled` — active member; `pending` — invited but not yet accepted; `deleted` — removed from the organization. [enabled, pending, deleted]\n  - time_zone (string) — Member's IANA time zone (e.g. `Asia/Shanghai`). Omitted when empty — the list endpoint does not populate it.\n  - updated_at (string) (required) — Update timestamp (Unix seconds) CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
-	"Members.MemberNotify":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - html (string) — Only present when `dry_run` is `true`: the complete email HTML exactly as recipients would receive it, after sanitization.\n  - recipients (array<object>) — One result per resolved recipient, in the same order as the resolved recipient list. With `dry_run`, each result is what a real send would return.\n    - person_id (integer) (required) — Recipient member ID.\n    - reason (string) — Why the recipient was skipped. Only present when `status` is `skipped`. `not_member` — not an active member of the caller's account; `no_email` — the member has no email address on file; `email_disabled` — the member's notification preferences for this kind of message exclude email; `duplicate` — this recipient already received a message from the same AI SRE session turn; `rate_limited` — this recipient has already been sent 20 emails through this endpoint within the last hour; `send_failed` — enqueueing the email failed. [not_member, no_email, email_disabled, duplicate, rate_limited, send_failed]\n    - status (string) (required) — Delivery status. `accepted` — the email was queued for asynchronous delivery; `skipped` — no email was queued, see `reason`. [accepted, skipped]\n",
+	"Members.MemberNotify":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - agent_instructions (string) — Present when the submitted HTML body does not follow the default email layout (no `max-width:600px` wrapper table): guidance telling the calling AI SRE agent how to conform. Advisory only — a format the caller deliberately chose needs no change.\n  - recipients (array<object>) — One result per resolved recipient, in the same order as the resolved recipient list.\n    - person_id (integer) (required) — Recipient member ID.\n    - reason (string) — Why the recipient was skipped. Only present when `status` is `skipped`. `not_member` — not an active member of the caller's account; `no_email` — the member has no email address on file; `email_disabled` — the member's notification preferences for this kind of message exclude email; `duplicate` — this recipient already received a message from the same AI SRE session turn; `rate_limited` — this recipient has already been sent 20 emails through this endpoint within the last hour; `send_failed` — enqueueing the email failed. [not_member, no_email, email_disabled, duplicate, rate_limited, send_failed]\n    - status (string) (required) — Delivery status. `accepted` — the email was queued for asynchronous delivery; `skipped` — no email was queued, see `reason`. [accepted, skipped]\n",
 	"Members.PersonInfos":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID\n  - as (string) — Principal kind: `account` — the account owner principal; `member` — an organization member. [account, member]\n  - avatar (string) — Avatar URL. Omitted when empty.\n  - email (string) — Email address. Omitted when empty.\n  - email_verified (boolean) (required) — Email verified\n  - locale (string) — Locale. Omitted when empty.\n  - person_id (integer) (required) — Person ID\n  - person_name (string) — Display name. Omitted when empty.\n  - phone (string) — Phone number. Omitted when empty — this endpoint never populates it.\n  - phone_verified (boolean) (required) — Whether the phone is verified. Always false in this endpoint's response.\n  - status (string) — Person status. `enabled` — active; `pending` — invited but not yet accepted; `deleted` — removed. Omitted when empty. [enabled, pending, deleted]\n  - time_zone (string) — Time zone. Omitted when empty.\n",
-	"NotificationTemplates.ReadInfo":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — ID of the owning account.\n  - created_at (string) (required) — Unix epoch seconds the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - deleted_at (string) — Unix epoch seconds the template was soft-deleted. Absent (omitempty) when the template is live. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Free-form description.\n  - dingtalk (string) (required) — DingTalk robot message template source.\n  - dingtalk_app (string) (required) — DingTalk app message template source.\n  - email (string) (required) — Email body template source (Go `html/template` syntax).\n  - feishu (string) (required) — Feishu robot message template source.\n  - feishu_app (string) (required) — Feishu app message template source.\n  - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.\n  - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.\n  - slack (string) (required) — Slack robot message template source.\n  - slack_app (string) (required) — Slack app message template source.\n  - sms (string) (required) — SMS template source (Go `text/template` syntax).\n  - status (string) (required) — Template lifecycle status. `enabled` templates can be referenced by escalation policies for notifications; `disabled` templates are no longer used for new notifications; `deleted` templates are never returned by list endpoints. [enabled, disabled, deleted]\n  - team_id (integer) (required) — ID of the team this template is scoped to, or 0 for account-wide.\n  - teams_app (string) (required) — Microsoft Teams app message template source.\n  - telegram (string) (required) — Telegram bot message template source.\n  - template_id (string) (required) — Template ID.\n  - template_name (string) (required) — Unique template name within the account.\n  - updated_at (string) (required) — Unix epoch seconds the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - voice (string) (required) — Voice call script template source.\n  - wecom (string) (required) — WeCom robot message template source.\n  - wecom_app (string) (required) — WeCom app message template source.\n  - zoom (string) (required) — Zoom bot message template source.\n",
-	"NotificationTemplates.ReadList":              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the owning account.\n  - created_at (string) (required) — Unix epoch seconds the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - deleted_at (string) — Unix epoch seconds the template was soft-deleted. Absent (omitempty) when the template is live. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Free-form description.\n  - dingtalk (string) (required) — DingTalk robot message template source.\n  - dingtalk_app (string) (required) — DingTalk app message template source.\n  - email (string) (required) — Email body template source (Go `html/template` syntax).\n  - feishu (string) (required) — Feishu robot message template source.\n  - feishu_app (string) (required) — Feishu app message template source.\n  - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.\n  - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.\n  - slack (string) (required) — Slack robot message template source.\n  - slack_app (string) (required) — Slack app message template source.\n  - sms (string) (required) — SMS template source (Go `text/template` syntax).\n  - status (string) (required) — Template lifecycle status. `enabled` templates can be referenced by escalation policies for notifications; `disabled` templates are no longer used for new notifications; `deleted` templates are never returned by list endpoints. [enabled, disabled, deleted]\n  - team_id (integer) (required) — ID of the team this template is scoped to, or 0 for account-wide.\n  - teams_app (string) (required) — Microsoft Teams app message template source.\n  - telegram (string) (required) — Telegram bot message template source.\n  - template_id (string) (required) — Template ID.\n  - template_name (string) (required) — Unique template name within the account.\n  - updated_at (string) (required) — Unix epoch seconds the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - voice (string) (required) — Voice call script template source.\n  - wecom (string) (required) — WeCom robot message template source.\n  - wecom_app (string) (required) — WeCom app message template source.\n  - zoom (string) (required) — Zoom bot message template source.\n",
+	"NotificationTemplates.ReadInfo":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — ID of the owning account.\n  - created_at (string) (required) — Unix epoch seconds the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - deleted_at (string) — Unix epoch seconds the template was soft-deleted. Absent (omitempty) when the template is live. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Free-form description.\n  - dingtalk (string) (required) — DingTalk robot message template source.\n  - dingtalk_app (string) (required) — DingTalk app message template source.\n  - email (string) (required) — Email body template source (Go `html/template` syntax).\n  - feishu (string) (required) — Feishu robot message template source.\n  - feishu_app (string) (required) — Feishu app message template source.\n  - feishu_app_card_v2_preserve_blank_lines (boolean) (required) — Whether Feishu app card v2 messages keep blank lines in the body.\n  - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.\n  - feishu_app_war_room_enabled (boolean) (required) — Whether Feishu app cards show the Create War Room button. Hidden when the incident has no responders.\n  - incident_card_closed_action_apps (array<string>) (required) — IM apps whose closed-incident cards keep the custom action buttons. Supported values: `feishu_app`, `dingtalk_app`, `wecom_app`, `slack_app`, `teams_app`. An empty list hides the buttons on every app. [feishu_app, dingtalk_app, wecom_app, slack_app, teams_app]\n  - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.\n  - slack (string) (required) — Slack robot message template source.\n  - slack_app (string) (required) — Slack app message template source.\n  - sms (string) (required) — SMS template source (Go `text/template` syntax).\n  - status (string) (required) — Template lifecycle status. `enabled` templates can be referenced by escalation policies for notifications; `disabled` templates are no longer used for new notifications; `deleted` templates are never returned by list endpoints. [enabled, disabled, deleted]\n  - team_id (integer) (required) — ID of the team this template is scoped to, or 0 for account-wide.\n  - teams_app (string) (required) — Microsoft Teams app message template source.\n  - telegram (string) (required) — Telegram bot message template source.\n  - template_id (string) (required) — Template ID.\n  - template_name (string) (required) — Unique template name within the account.\n  - updated_at (string) (required) — Unix epoch seconds the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - voice (string) (required) — Voice call script template source.\n  - wecom (string) (required) — WeCom robot message template source.\n  - wecom_app (string) (required) — WeCom app message template source.\n  - wecom_markdown_v2_enabled (boolean) (required) — Whether WeCom robot notifications use the `markdown_v2` message format.\n  - zoom (string) (required) — Zoom bot message template source.\n",
+	"NotificationTemplates.ReadList":              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the owning account.\n  - created_at (string) (required) — Unix epoch seconds the template was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator.\n  - deleted_at (string) — Unix epoch seconds the template was soft-deleted. Absent (omitempty) when the template is live. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Free-form description.\n  - dingtalk (string) (required) — DingTalk robot message template source.\n  - dingtalk_app (string) (required) — DingTalk app message template source.\n  - email (string) (required) — Email body template source (Go `html/template` syntax).\n  - feishu (string) (required) — Feishu robot message template source.\n  - feishu_app (string) (required) — Feishu app message template source.\n  - feishu_app_card_v2_preserve_blank_lines (boolean) (required) — Whether Feishu app card v2 messages keep blank lines in the body.\n  - feishu_app_card_v2_table_enabled (boolean) (required) — Whether alert labels use table rendering in Feishu app cards.\n  - feishu_app_war_room_enabled (boolean) (required) — Whether Feishu app cards show the Create War Room button. Hidden when the incident has no responders.\n  - incident_card_closed_action_apps (array<string>) (required) — IM apps whose closed-incident cards keep the custom action buttons. Supported values: `feishu_app`, `dingtalk_app`, `wecom_app`, `slack_app`, `teams_app`. An empty list hides the buttons on every app. [feishu_app, dingtalk_app, wecom_app, slack_app, teams_app]\n  - incident_card_hidden_fields (object) (required) — Incident card fields hidden per IM app type; an empty object when none are configured.\n  - slack (string) (required) — Slack robot message template source.\n  - slack_app (string) (required) — Slack app message template source.\n  - sms (string) (required) — SMS template source (Go `text/template` syntax).\n  - status (string) (required) — Template lifecycle status. `enabled` templates can be referenced by escalation policies for notifications; `disabled` templates are no longer used for new notifications; `deleted` templates are never returned by list endpoints. [enabled, disabled, deleted]\n  - team_id (integer) (required) — ID of the team this template is scoped to, or 0 for account-wide.\n  - teams_app (string) (required) — Microsoft Teams app message template source.\n  - telegram (string) (required) — Telegram bot message template source.\n  - template_id (string) (required) — Template ID.\n  - template_name (string) (required) — Unique template name within the account.\n  - updated_at (string) (required) — Unix epoch seconds the template was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID of the last editor.\n  - voice (string) (required) — Voice call script template source.\n  - wecom (string) (required) — WeCom robot message template source.\n  - wecom_app (string) (required) — WeCom app message template source.\n  - wecom_markdown_v2_enabled (boolean) (required) — Whether WeCom robot notifications use the `markdown_v2` message format.\n  - zoom (string) (required) — Zoom bot message template source.\n",
 	"NotificationTemplates.ReadPreview":           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - content (string) (required) — Rendered template output, present when success is true.\n  - fixed_fields (array<object>) — Fixed incident-card fields returned for supported IM previews after the requested hiding rules are applied.\n    - field (string) (required) — Incident-card field name. | Value | Meaning | |---|---| | `channel` | Name of the alert channel that produced the incident; returned only when non-empty. | | `snoozed_before` | Snooze-until timestamp formatted as `YYYY-MM-DD HH:MM:SS`; returned only while the incident is snoozed. | | `severity` | Incident severity label; returned only when non-empty. | | `responders` | Names of the current responders, separated by spaces; returned only when the incident has responders. | | `aggregate_alert_count` | Number of alerts aggregated into the incident; returned only when greater than 1. | [channel, snoozed_before, severity, responders, aggregate_alert_count]\n    - value (string) (required) — Rendered display value for the fixed field.\n  - message (string) (required) — Error message describing why rendering failed, present when success is false.\n  - success (boolean) (required) — Whether the template rendered without errors.\n",
 	"NotificationTemplates.WriteCreate":           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - template_id (string) (required) — Newly created template ID.\n  - template_name (string) (required) — Template name echoed from the request.\n",
 	"Resources.Info":                              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns this resource.\n  - action.days (integer) (required) — Retention period in days for action (user interaction) data.\n  - created_at (string) (required) — Unix timestamp in seconds when the resource was created. Also anchors the start of the first billing window. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - error.days (integer) (required) — Retention period in days for error data.\n  - expired_at (string) — Unix timestamp in seconds when the on-premises license expires. Only present on on-premises deployments; omitted entirely for SaaS accounts. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - long_task.days (integer) (required) — Retention period in days for long-task data.\n  - offering_id (integer) (required) — ID of the offering (SKU) this resource was provisioned from.\n  - order_id (string) (required) — ID of the order that provisioned this resource. Empty for resources provisioned outside the order flow (e.g. on-premises).\n  - product (string) (required) — Product code for this resource. Always `rum` for this endpoint. [rum]\n  - resource.days (integer) (required) — Retention period in days for resource (network request) data.\n  - resource_id (string) (required) — Unique resource identifier for the account's RUM resource.\n  - resource_name (string) (required) — Display name of the resource.\n  - session.days (integer) (required) — Retention period in days for session data.\n  - session_investigate.free_cnt (integer) (required) — Free quota for investigate sessions per application, per billing window.\n  - session_investigate.used_cnt (integer) (required) — Number of investigate (error tracking) sessions used in the current billing window.\n  - session_limit_reached (boolean) (required) — `true` when a `version=free` account has exceeded its combined free session quota across all applications. Always `false` for non-free plans.\n  - session_measure.free_cnt (integer) (required) — Free quota for measure sessions per application, per billing window.\n  - session_measure.used_cnt (integer) (required) — Number of measure (performance) sessions used in the current billing window.\n  - session_replay.free_cnt (integer) (required) — Free quota for session-replay sessions per application, per billing window.\n  - session_replay.used_cnt (integer) (required) — Number of session-replay sessions used in the current billing window.\n  - status (string) (required) — Status of the resource. A resource with status `deleted` or `destroyed` never reaches this field — the operation returns `ResourceNotFound` for those instead. [enabled, disabled]\n  - updated_at (string) (required) — Unix timestamp in seconds when the resource was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - version (string) (required) — Plan version of this resource. One of `free` (free plan) or `professional` (professional plan). [free, professional]\n  - view.days (integer) (required) — Retention period in days for view (page/screen) data.\n  - window_end_time (string) (required) — Unix timestamp in seconds for the end of the current 30-day billing window. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - window_start_time (string) (required) — Unix timestamp in seconds for the start of the current 30-day billing window. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
@@ -187,8 +185,8 @@ var responseHelpBySDKMethod = map[string]string{
 	"Schedules.Self":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - create_at (string) (required) — Creation timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - create_by (integer) (required) — Creator person ID.\n  - cur_oncall (object) (required) — Current on-call group, or null when nobody is on-call.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - description (string) (required) — Schedule description. null when returned from /schedule/preview.\n  - disabled (integer) (required) — Disabled flag (0 = enabled, 1 = disabled). Deprecated. null when returned from /schedule/preview.\n  - end (string) — Window end (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - field (string) — Field name used by the legacy update-field endpoint.\n  - final_schedule (object) (required) — Collapsed final schedule across all layers.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - group_id (integer) (required) — Legacy team/group ID. null when returned from /schedule/preview.\n  - id (integer) (required) — Schedule ID. null when returned from /schedule/preview.\n  - layer_schedules (array<object>) (required) — Alias of schedule_layers returned for compatibility. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - layers (array<object>) (required) — Rotation layers defined on the schedule. Null when layers were not loaded (for example by `/schedule/infos`, or by `/schedule/list` without start/end).\n    - account_id (integer) (required) — Account ID.\n    - create_at (integer) (required) — Creation timestamp (Unix seconds).\n    - create_by (integer) (required) — Creator person ID.\n    - day_mask (object) (required) — Day-of-week mask.\n      - repeat (array<integer>) — Weekday numbers (0 = Sunday) included in the rotation. Conflicts with restrict_mode = 2 (week).\n    - enable_time (integer) (required) — When the layer becomes effective (Unix seconds).\n    - expire_time (integer) (required) — When the layer expires (Unix seconds, 0 means never).\n    - fair_rotation (boolean) (required) — Whether fair rotation is enabled.\n    - groups (array<object>) (required) — Oncall groups participating in the rotation. Null when not set.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - handoff_time (integer) (required) — Rotation handoff time as a weekly offset in seconds (weekday x 86400 + seconds since midnight), not an absolute Unix timestamp.\n    - hidden (integer) (required) — Whether the layer is hidden in the UI (0 = no, 1 = yes).\n    - layer_end (integer) — Layer end timestamp (Unix seconds). null means open-ended.\n    - layer_name (string) — User-facing layer name. Null when not set.\n    - layer_start (integer) — Layer effective start (Unix seconds). Null when not set.\n    - mask_continuous_enabled (boolean) (required) — Whether continuous masking is enabled.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - restrict_end (integer) (required) — Legacy end offset inside the restriction window (seconds).\n    - restrict_mode (integer) (required) — Restriction mode: 0 = none, 1 = day, 2 = week.\n    - restrict_periods (array<object>) (required) — Restriction windows inside each rotation cycle. Null when not set.\n      - restrict_end (integer) (required) — End offset inside the rotation cycle.\n      - restrict_start (integer) (required) — Start offset inside the rotation cycle.\n    - restrict_start (integer) (required) — Legacy start offset inside the restriction window (seconds).\n    - rotation_duration (integer) (required) — Rotation duration in seconds.\n    - rotation_unit (string) (required) — Rotation unit. On-call assignees rotate in turn by this unit. | Value | Meaning | |---|---| | `hour` | Rotates hourly. | | `day` | Rotates daily. | | `week` | Rotates weekly. | | `month` | Rotates monthly. | [hour, day, week, month]\n    - rotation_value (integer) (required) — Rotation quantity (number of rotation_unit per cycle). (min 0)\n    - schedule_id (integer) (required) — Parent schedule ID.\n    - update_at (integer) (required) — Last update timestamp (Unix seconds).\n    - update_by (integer) (required) — Last updater person ID.\n    - weight (integer) (required) — Layer weight for ordering.\n  - name (string) (required) — Schedule name (legacy field; mirrors schedule_name). null when returned from /schedule/preview.\n  - next_oncall (object) (required) — Next on-call group, or null when unknown.\n    - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - group (object) (required) — Oncall group on duty for the shift.\n      - end (integer) (required) — Group end timestamp (Unix seconds).\n      - group_name (string) (required) — Group display name. Null when only the legacy name is set.\n      - members (array<object>) (required) — Members of this group.\n      - name (string) (required) — Legacy group name.\n      - start (integer) (required) — Group start timestamp (Unix seconds).\n    - index (integer) (required) — Index inside the rotation.\n    - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - update_at (string) (required) — Update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - weight (integer) (required) — Layer weight the shift comes from.\n  - notify (object) (required) — Notification configuration. Null when the schedule has none.\n    - advance_in_time (integer) — Advance notification lead time in seconds. `0` notifies exactly at shift start; omitting disables advance notification.\n    - by (object) (required) — Recipient notification preference; null when not configured.\n      - follow_preference (boolean) (required) — Whether to follow each responder's personal notification preference.\n      - personal_channels (array<string>) (required) — Personal notification channel keys.\n    - fixed_time (object) (required) — Fixed-time notification config; null when not configured.\n      - cycle (string) (required) — Notification cycle; only `day` is supported. [day]\n      - start (string) (required) — Time of day to send, format `HH:MM` (24-hour).\n    - im (object) — Legacy IM-type to token map.\n    - webhooks (array<object>) (required) — IM webhook notification channels; null when not configured.\n      - settings (object) (required) — Webhook channel settings.\n      - type (string) (required) — IM provider type (for example feishu_app, dingtalk_app, wecom_app, teams_app, slack_app).\n  - schedule_id (integer) (required) — Schedule ID. Null when returned from `/schedule/preview`.\n  - schedule_layers (array<object>) (required) — Computed per-layer schedules for the requested window. Null when not computed.\n    - layer_name (string) (required) — Layer display name.\n    - mode (integer) (required) — Layer mode: 0 = common rotation, 1 = override.\n    - name (string) (required) — Layer internal name.\n    - schedules (array<object>) (required) — Computed shifts; null when the layer produces none.\n      - end (string) (required) — Shift end timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - group (object) (required) — Oncall group covering the shift; null marks a coverage gap.\n      - index (integer) (required) — Index inside the rotation.\n      - start (string) (required) — Shift start timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - schedule_name (string) (required) — Schedule display name. null when returned from /schedule/preview.\n  - start (string) — Window start (Unix seconds). Omitted when 0 (no window requested). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - status (integer) (required) — Legacy status flag. Deprecated. null when returned from /schedule/preview.\n  - team_id (integer) (required) — Owning team ID. null when returned from /schedule/preview.\n  - update_at (string) (required) — Last update timestamp (Unix seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - update_by (integer) (required) — Last updater person ID.\n",
 	"SessionReplay.Metadata":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - application (object) — Application the session belongs to.\n    - id (string) — RUM application ID the session belongs to.\n  - device (object) — Device that recorded the session.\n    - type (string) — Device type recorded for the session, e.g. `desktop`, `mobile`, `tablet`.\n  - foreground_periods (array<object>) — Foreground periods across the session (mobile sessions only; empty for web).\n    - end (string) — Unix timestamp in milliseconds when the foreground period ended. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - start (string) — Unix timestamp in milliseconds when the foreground period started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - view_id (string) — View ID active during this foreground period.\n  - session (object) — Session bounds and state.\n    - end (string) — Unix timestamp in milliseconds when the session ended (or was last updated, if still active). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - is_active (boolean) — Whether the session was still active as of the last recorded event.\n    - server_time_delta (integer) — Clock skew in milliseconds between the client and Flashduty's servers, added to client timestamps for correction.\n    - source (string) — SDK platform that recorded the session. Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n    - start (string) — Unix timestamp in milliseconds when the session started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - views (array<object>) — Every view recorded during the session, in chronological order.\n    - container_source (string) — SDK platform of the container app, when this view is embedded (e.g. a WebView inside a native app). Omitted when the view is not embedded.\n    - container_view_id (string) — View ID of the containing view, when this view is embedded. Omitted when the view is not embedded.\n    - end (string) — Unix timestamp in milliseconds when the view ended. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - is_active (boolean) — Whether the view was still active as of the last recorded event.\n    - loading_type (string) — How the view was entered, e.g. `initial_load`, `route_change`.\n    - name (string) — View name, typically the route or screen name.\n    - server_time_delta (integer) — Clock skew in milliseconds between the client and Flashduty's servers, added to client timestamps for correction.\n    - source (string) — SDK platform that recorded the view. Platform identifier: | Value | Meaning | |---|---| | `browser` | Web browser application (JavaScript SDK) | | `ios` | Apple iOS application | | `android` | Android application | | `react-native` | React Native application | | `flutter` | Flutter application | | `kotlin-multiplatform` | Kotlin Multiplatform application | | `roku` | Roku channel application | | `unity` | Unity application | | `miniprogram` | WeChat mini program | | `harmony` | HarmonyOS application | | `electron` | Electron desktop application | [browser, ios, android, react-native, flutter, kotlin-multiplatform, roku, unity, miniprogram, harmony, electron]\n    - start (string) — Unix timestamp in milliseconds when the view started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - url (string) — URL (web) or screen identifier (mobile) associated with the view.\n    - view_id (string) — Unique ID of the view within the session.\n",
 	"SessionReplay.Segments":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - items (array<string>) — Presigned, time-limited URLs (valid 1 hour) for downloading each segment's raw compressed bytes.\n  - search_after_ctx (string) — Pagination cursor to pass as `search_after_ctx` on the next call. Empty when this page was the last one.\n",
-	"Sessions.ReadInfo":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - events (array<object>) (required) — Recent events, ascending by (created_at, event_id).\n    - actions (object) — ADK actions envelope (state deltas, transfers, escalation).\n    - author (string) — Event author (e.g. user, the agent name).\n    - branch (string) — ADK branch path for nested agents.\n    - content (object) — ADK content envelope {role, parts:[...]}.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the event was written. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - error_code (string) — Error code when the event represents a failure.\n    - error_message (string) — Human-readable error message, when present.\n    - event_id (string) (required) — Event identifier.\n    - invocation_id (string) — ADK invocation id grouping a turn.\n    - partial (boolean) (required) — True for a streaming partial chunk.\n    - session_id (string) (required) — Owning session id.\n    - status (string) — Event status. One of: `normal` (a live event included in the context fed to the model), `compressed` (folded into a compaction summary boundary event; no longer loaded for the model, kept as history only). [normal, compressed]\n    - turn_complete (boolean) (required) — True on the terminal event of a turn.\n    - usage_metadata (object) — Per-turn token usage metadata.\n  - has_more_older (boolean) (required) — True when older events remain beyond this page.\n  - search_after_ctx (string) — Opaque keyset cursor; pass back as search_after_ctx to fetch the next older page. Omitted when has_more_older is false.\n  - session (object) (required) — One agent session row.\n    - access_source (string) — How the caller received access to this session. Omitted when no access source is resolved. One of: | Value | Meaning | | --- | --- | | `owner` | Caller is the session creator (full access) | | `team_member` | Caller belongs to the session's bound team (full access) | | `manager` | Manager grant (reserved; never produced by the current version) | | `share_link` | Granted via a valid share link (view/fork only; cannot continue or manage) | | `participant` | Same-account non-member granted via a participable team session (view/continue/fork only) | [owner, team_member, manager, share_link, participant]\n    - app_name (string) (required) — Agent app that owns the session.\n    - archived_at (string) (required) — Unix timestamp in milliseconds when archived; 0 means not archived. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - bound_environment (object) — The runner or cloud sandbox the session is bound to. Null until the first message.\n      - id (string) (required) — Environment identifier: a cloud sandbox ID for `cloud` bindings, a runner/environment ID for `byoc` bindings.\n      - kind (string) (required) — Environment kind bound to the session: `cloud` (managed sandbox) or `byoc` (self-hosted runner). [cloud, byoc]\n      - name (string) — Human-readable environment name; empty for cloud bindings using the default allowlist.\n      - status (string) — Live binding health, namespaced by kind: BYOC uses online/pending/offline/deleted; cloud uses available/rebuilding/expired. [online, pending, offline, deleted, available, rebuilding, expired]\n    - can_continue (boolean) (required) — True when the caller can add a new turn to this session.\n    - can_fork (boolean) (required) — True when the caller can fork this session.\n    - can_manage (boolean) (required) — True when the caller may rename/archive/delete the session; personal sessions are creator-only, team sessions allow the creator, account admin, or team member.\n    - can_view (boolean) (required) — True when the caller can view this session.\n    - context_resolved (object) — Snapshot of the three-tier knowledge-pack resolution for this session.\n      - account_pack_id (string) — Resolved account-scoped pack id.\n      - incident_id (string) — Bound incident id, when war-room originated.\n      - resolved_at_ms (string) (required) — Unix timestamp in milliseconds when the packs were resolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - team_pack_id (string) — Resolved team-scoped pack id.\n      - versions (object) — Per-pack resolved version map.\n    - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.\n    - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.\n    - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_turn_tokens (integer) (required) — Total tokens (input+output+reasoning) for the in-flight round across the parent and its subagents; only computed by session/get while the session is running, always 0 in session/list responses and when idle.\n    - current_turn_wait_ms (integer) (required) — Accumulated ask_user human-wait duration in milliseconds for the current round; resets to 0 at the start of each new round.\n    - entry_kind (string) — Surface that created the session. One of: | Value | Meaning | | --- | --- | | `web` | Created from the web console | | `im` | Created from an IM client (IM bot / IM H5) | | `api` | Created via the public API | | `automation` | Created by an automation rule (unattended run) | | `subagent` | Child session spawned by a parent's agent_dispatch (audit label; at runtime it executes on the web tool surface) | [web, im, api, automation, subagent]\n    - has_unread (boolean) (required) — True when there is assistant output the caller has not yet viewed.\n    - incognito (boolean) (required) — True for incognito (non-persisted-memory) sessions.\n    - is_mine (boolean) (required) — True when the caller created this session.\n    - is_running (boolean) (required) — True when an agent turn is currently in flight for this session.\n    - last_event_at (string) — Unix timestamp in milliseconds of the most recent assistant-side event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - parent_session_id (string) — Parent session id for subagent (child) sessions; empty otherwise.\n    - person_id (string) (required) — Creator person id.\n    - pinned_at (string) (required) — Caller's per-user pin time as a Unix timestamp in milliseconds; 0 means not pinned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - session_id (string) (required) — Session identifier.\n    - session_name (string) (required) — Session title; may be empty for untitled sessions.\n    - share_enabled (boolean) (required) — True when the session's share link is active.\n    - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.\n    - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.\n    - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.\n    - status (string) (required) — Lifecycle status. One of: `enabled` (active), `deleted` (soft-deleted, no longer accessible). [enabled, deleted]\n    - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.\n    - team_name (string) — Resolved team name; empty for unbound rows or deleted teams.\n    - template_staging_round_id (string) — Current save→validate round id (template-assistant only); empty otherwise.\n    - token_usage (object) — Cumulative session-level token rollup across all turns. The account-billing source of truth.\n      - cached_tokens (integer) (required) — Portion of input_tokens served from the prompt cache.\n      - input_tokens (integer) (required) — Total prompt (input) tokens, including the cached portion.\n      - output_tokens (integer) (required) — Total generated (output) tokens.\n      - reasoning_tokens (integer) (required) — Total reasoning/thinking tokens.\n    - updated_at (string) (required) — Unix timestamp in milliseconds of the last session update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - suggest_init (boolean) (required) — Account-wide onboarding flag: true when the account has zero knowledge packs in any scope; not specific to this session.\n",
-	"Sessions.ReadList":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - sessions (array<object>) (required) — The page of sessions.\n    - access_source (string) — How the caller received access to this session. Omitted when no access source is resolved. One of: | Value | Meaning | | --- | --- | | `owner` | Caller is the session creator (full access) | | `team_member` | Caller belongs to the session's bound team (full access) | | `manager` | Manager grant (reserved; never produced by the current version) | | `share_link` | Granted via a valid share link (view/fork only; cannot continue or manage) | | `participant` | Same-account non-member granted via a participable team session (view/continue/fork only) | [owner, team_member, manager, share_link, participant]\n    - app_name (string) (required) — Agent app that owns the session.\n    - archived_at (string) (required) — Unix timestamp in milliseconds when archived; 0 means not archived. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - bound_environment (object) — The runner or cloud sandbox the session is bound to. Null until the first message.\n      - id (string) (required) — Environment identifier: a cloud sandbox ID for `cloud` bindings, a runner/environment ID for `byoc` bindings.\n      - kind (string) (required) — Environment kind bound to the session: `cloud` (managed sandbox) or `byoc` (self-hosted runner). [cloud, byoc]\n      - name (string) — Human-readable environment name; empty for cloud bindings using the default allowlist.\n      - status (string) — Live binding health, namespaced by kind: BYOC uses online/pending/offline/deleted; cloud uses available/rebuilding/expired. [online, pending, offline, deleted, available, rebuilding, expired]\n    - can_continue (boolean) (required) — True when the caller can add a new turn to this session.\n    - can_fork (boolean) (required) — True when the caller can fork this session.\n    - can_manage (boolean) (required) — True when the caller may rename/archive/delete the session; personal sessions are creator-only, team sessions allow the creator, account admin, or team member.\n    - can_view (boolean) (required) — True when the caller can view this session.\n    - context_resolved (object) — Snapshot of the three-tier knowledge-pack resolution for this session.\n      - account_pack_id (string) — Resolved account-scoped pack id.\n      - incident_id (string) — Bound incident id, when war-room originated.\n      - resolved_at_ms (string) (required) — Unix timestamp in milliseconds when the packs were resolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - team_pack_id (string) — Resolved team-scoped pack id.\n      - versions (object) — Per-pack resolved version map.\n    - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.\n    - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.\n    - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_turn_tokens (integer) (required) — Total tokens (input+output+reasoning) for the in-flight round across the parent and its subagents; only computed by session/get while the session is running, always 0 in session/list responses and when idle.\n    - current_turn_wait_ms (integer) (required) — Accumulated ask_user human-wait duration in milliseconds for the current round; resets to 0 at the start of each new round.\n    - entry_kind (string) — Surface that created the session. One of: | Value | Meaning | | --- | --- | | `web` | Created from the web console | | `im` | Created from an IM client (IM bot / IM H5) | | `api` | Created via the public API | | `automation` | Created by an automation rule (unattended run) | | `subagent` | Child session spawned by a parent's agent_dispatch (audit label; at runtime it executes on the web tool surface) | [web, im, api, automation, subagent]\n    - has_unread (boolean) (required) — True when there is assistant output the caller has not yet viewed.\n    - incognito (boolean) (required) — True for incognito (non-persisted-memory) sessions.\n    - is_mine (boolean) (required) — True when the caller created this session.\n    - is_running (boolean) (required) — True when an agent turn is currently in flight for this session.\n    - last_event_at (string) — Unix timestamp in milliseconds of the most recent assistant-side event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - parent_session_id (string) — Parent session id for subagent (child) sessions; empty otherwise.\n    - person_id (string) (required) — Creator person id.\n    - pinned_at (string) (required) — Caller's per-user pin time as a Unix timestamp in milliseconds; 0 means not pinned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - session_id (string) (required) — Session identifier.\n    - session_name (string) (required) — Session title; may be empty for untitled sessions.\n    - share_enabled (boolean) (required) — True when the session's share link is active.\n    - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.\n    - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.\n    - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.\n    - status (string) (required) — Lifecycle status. One of: `enabled` (active), `deleted` (soft-deleted, no longer accessible). [enabled, deleted]\n    - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.\n    - team_name (string) — Resolved team name; empty for unbound rows or deleted teams.\n    - template_staging_round_id (string) — Current save→validate round id (template-assistant only); empty otherwise.\n    - token_usage (object) — Cumulative session-level token rollup across all turns. The account-billing source of truth.\n      - cached_tokens (integer) (required) — Portion of input_tokens served from the prompt cache.\n      - input_tokens (integer) (required) — Total prompt (input) tokens, including the cached portion.\n      - output_tokens (integer) (required) — Total generated (output) tokens.\n      - reasoning_tokens (integer) (required) — Total reasoning/thinking tokens.\n    - updated_at (string) (required) — Unix timestamp in milliseconds of the last session update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - suggest_init (boolean) (required) — Account-wide onboarding flag: true when the account has zero knowledge packs in any scope; not dependent on this call's filters.\n  - total (integer) (required) — Total number of sessions matching the filter (ignoring pagination).\n",
+	"Sessions.ReadInfo":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - events (array<object>) (required) — Recent events, ascending by (created_at, event_id).\n    - actions (object) — ADK actions envelope (state deltas, transfers, escalation).\n    - author (string) — Event author (e.g. user, the agent name).\n    - branch (string) — ADK branch path for nested agents.\n    - content (object) — ADK content envelope {role, parts:[...]}.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the event was written. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - error_code (string) — Error code when the event represents a failure.\n    - error_message (string) — Human-readable error message, when present.\n    - event_id (string) (required) — Event identifier.\n    - invocation_id (string) — ADK invocation id grouping a turn.\n    - partial (boolean) (required) — True for a streaming partial chunk.\n    - session_id (string) (required) — Owning session id.\n    - status (string) — Event status. One of: `normal` (a live event included in the context fed to the model), `compressed` (folded into a compaction summary boundary event; no longer loaded for the model, kept as history only). [normal, compressed]\n    - turn_complete (boolean) (required) — True on the terminal event of a turn.\n    - usage_metadata (object) — Per-turn token usage metadata.\n  - has_more_older (boolean) (required) — True when older events remain beyond this page.\n  - pending_messages (array<object>) (required) — Human messages queued but not yet picked up by the agent, in execution order. Always an array — empty when nothing is queued.\n    - client_msg_id (string) — Client-supplied message ID, echoed back for de-duplication. Omitted when absent.\n    - invocation_id (string) (required) — Invocation ID of the queued message.\n    - parts (array<object>) — Request parts passed through verbatim (text, file, ref, or skill entries). Omitted when the original message carried none.\n    - person_id (integer) (required) — Person ID of the sender.\n    - query (string) (required) — Message text.\n    - steering (boolean) — True when the message was sent as a mid-turn steering instruction. Omitted when false.\n  - search_after_ctx (string) — Opaque keyset cursor; pass back as search_after_ctx to fetch the next older page. Omitted when has_more_older is false.\n  - session (object) (required) — One agent session row.\n    - access_source (string) — How the caller received access to this session. Omitted when no access source is resolved. One of: | Value | Meaning | | --- | --- | | `owner` | Caller is the session creator (full access) | | `team_member` | Caller belongs to the session's bound team (full access) | | `manager` | Manager grant (reserved; never produced by the current version) | | `share_link` | Granted via a valid share link (view/fork only; cannot continue or manage) | | `participant` | Same-account non-member granted via a participable team session (view/continue/fork only) | [owner, team_member, manager, share_link, participant]\n    - app_name (string) (required) — Agent app that owns the session.\n    - archived_at (string) (required) — Unix timestamp in milliseconds when archived; 0 means not archived. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - bound_environment (object) — The runner or cloud sandbox the session is bound to. Null until the first message.\n      - id (string) (required) — Environment identifier: a cloud sandbox ID for `cloud` bindings, a runner/environment ID for `byoc` bindings.\n      - kind (string) (required) — Environment kind bound to the session: `cloud` (managed sandbox) or `byoc` (self-hosted runner). [cloud, byoc]\n      - name (string) — Human-readable environment name; empty for cloud bindings using the default allowlist.\n      - status (string) — Live binding health, namespaced by kind: BYOC uses online/pending/offline/deleted; cloud uses available/rebuilding/expired. [online, pending, offline, deleted, available, rebuilding, expired]\n    - can_continue (boolean) (required) — True when the caller can add a new turn to this session.\n    - can_fork (boolean) (required) — True when the caller can fork this session.\n    - can_manage (boolean) (required) — True when the caller may rename/archive/delete the session; personal sessions are creator-only, team sessions allow the creator, account admin, or team member.\n    - can_view (boolean) (required) — True when the caller can view this session.\n    - context_resolved (object) — Snapshot of the three-tier knowledge-pack resolution for this session.\n      - account_pack_id (string) — Resolved account-scoped pack id.\n      - incident_id (string) — Bound incident id, when war-room originated.\n      - resolved_at_ms (string) (required) — Unix timestamp in milliseconds when the packs were resolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - team_pack_id (string) — Resolved team-scoped pack id.\n      - versions (object) — Per-pack resolved version map.\n    - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - creator_name (string) — Display name of the session creator, resolved when the response is rendered. Omitted when the member lookup fails.\n    - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.\n    - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.\n    - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_turn_tokens (integer) (required) — Total tokens (input+output+reasoning) for the in-flight round across the parent and its subagents; only computed by session/get while the session is running, always 0 in session/list responses and when idle.\n    - current_turn_wait_ms (integer) (required) — Accumulated ask_user human-wait duration in milliseconds for the current round; resets to 0 at the start of each new round.\n    - entry_kind (string) — Surface that created the session. One of: | Value | Meaning | | --- | --- | | `web` | Created from the web console | | `im` | Created from an IM client (IM bot / IM H5) | | `api` | Created via the public API | | `automation` | Created by an automation rule (unattended run) | | `subagent` | Child session spawned by a parent's agent_dispatch (audit label; at runtime it executes on the web tool surface) | [web, im, api, automation, subagent]\n    - has_unread (boolean) (required) — True when there is assistant output the caller has not yet viewed.\n    - incognito (boolean) (required) — True for incognito (non-persisted-memory) sessions.\n    - is_mine (boolean) (required) — True when the caller created this session.\n    - is_running (boolean) (required) — True when an agent turn is currently in flight for this session.\n    - last_event_at (string) — Unix timestamp in milliseconds of the most recent assistant-side event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - parent_session_id (string) — Parent session id for subagent (child) sessions; empty otherwise.\n    - person_id (string) (required) — Creator person id.\n    - pinned_at (string) (required) — Caller's per-user pin time as a Unix timestamp in milliseconds; 0 means not pinned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - session_id (string) (required) — Session identifier.\n    - session_name (string) (required) — Session title; may be empty for untitled sessions.\n    - share_enabled (boolean) (required) — True when the session's share link is active.\n    - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.\n    - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.\n    - standing_tasks (integer) (required) — Number of process-type tasks (background shell or monitor) still alive when the response was rendered.\n    - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.\n    - status (string) (required) — Lifecycle status. One of: `enabled` (active), `deleted` (soft-deleted, no longer accessible). [enabled, deleted]\n    - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.\n    - team_name (string) — Resolved team name; empty for unbound rows or deleted teams.\n    - template_staging_round_id (string) — Current save→validate round id (template-assistant only); empty otherwise.\n    - token_usage (object) — Cumulative session-level token rollup across all turns. The account-billing source of truth.\n      - cached_tokens (integer) (required) — Portion of input_tokens served from the prompt cache.\n      - input_tokens (integer) (required) — Total prompt (input) tokens, including the cached portion.\n      - output_tokens (integer) (required) — Total generated (output) tokens.\n      - reasoning_tokens (integer) (required) — Total reasoning/thinking tokens.\n    - updated_at (string) (required) — Unix timestamp in milliseconds of the last session update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - suggest_init (boolean) (required) — Account-wide onboarding flag: true when the account has zero knowledge packs in any scope; not specific to this session.\n",
+	"Sessions.ReadList":                           "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - sessions (array<object>) (required) — The page of sessions.\n    - access_source (string) — How the caller received access to this session. Omitted when no access source is resolved. One of: | Value | Meaning | | --- | --- | | `owner` | Caller is the session creator (full access) | | `team_member` | Caller belongs to the session's bound team (full access) | | `manager` | Manager grant (reserved; never produced by the current version) | | `share_link` | Granted via a valid share link (view/fork only; cannot continue or manage) | | `participant` | Same-account non-member granted via a participable team session (view/continue/fork only) | [owner, team_member, manager, share_link, participant]\n    - app_name (string) (required) — Agent app that owns the session.\n    - archived_at (string) (required) — Unix timestamp in milliseconds when archived; 0 means not archived. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - bound_environment (object) — The runner or cloud sandbox the session is bound to. Null until the first message.\n      - id (string) (required) — Environment identifier: a cloud sandbox ID for `cloud` bindings, a runner/environment ID for `byoc` bindings.\n      - kind (string) (required) — Environment kind bound to the session: `cloud` (managed sandbox) or `byoc` (self-hosted runner). [cloud, byoc]\n      - name (string) — Human-readable environment name; empty for cloud bindings using the default allowlist.\n      - status (string) — Live binding health, namespaced by kind: BYOC uses online/pending/offline/deleted; cloud uses available/rebuilding/expired. [online, pending, offline, deleted, available, rebuilding, expired]\n    - can_continue (boolean) (required) — True when the caller can add a new turn to this session.\n    - can_fork (boolean) (required) — True when the caller can fork this session.\n    - can_manage (boolean) (required) — True when the caller may rename/archive/delete the session; personal sessions are creator-only, team sessions allow the creator, account admin, or team member.\n    - can_view (boolean) (required) — True when the caller can view this session.\n    - context_resolved (object) — Snapshot of the three-tier knowledge-pack resolution for this session.\n      - account_pack_id (string) — Resolved account-scoped pack id.\n      - incident_id (string) — Bound incident id, when war-room originated.\n      - resolved_at_ms (string) (required) — Unix timestamp in milliseconds when the packs were resolved. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - team_pack_id (string) — Resolved team-scoped pack id.\n      - versions (object) — Per-pack resolved version map.\n    - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - creator_name (string) — Display name of the session creator, resolved when the response is rendered. Omitted when the member lookup fails.\n    - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.\n    - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.\n    - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - current_turn_tokens (integer) (required) — Total tokens (input+output+reasoning) for the in-flight round across the parent and its subagents; only computed by session/get while the session is running, always 0 in session/list responses and when idle.\n    - current_turn_wait_ms (integer) (required) — Accumulated ask_user human-wait duration in milliseconds for the current round; resets to 0 at the start of each new round.\n    - entry_kind (string) — Surface that created the session. One of: | Value | Meaning | | --- | --- | | `web` | Created from the web console | | `im` | Created from an IM client (IM bot / IM H5) | | `api` | Created via the public API | | `automation` | Created by an automation rule (unattended run) | | `subagent` | Child session spawned by a parent's agent_dispatch (audit label; at runtime it executes on the web tool surface) | [web, im, api, automation, subagent]\n    - has_unread (boolean) (required) — True when there is assistant output the caller has not yet viewed.\n    - incognito (boolean) (required) — True for incognito (non-persisted-memory) sessions.\n    - is_mine (boolean) (required) — True when the caller created this session.\n    - is_running (boolean) (required) — True when an agent turn is currently in flight for this session.\n    - last_event_at (string) — Unix timestamp in milliseconds of the most recent assistant-side event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - parent_session_id (string) — Parent session id for subagent (child) sessions; empty otherwise.\n    - person_id (string) (required) — Creator person id.\n    - pinned_at (string) (required) — Caller's per-user pin time as a Unix timestamp in milliseconds; 0 means not pinned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - session_id (string) (required) — Session identifier.\n    - session_name (string) (required) — Session title; may be empty for untitled sessions.\n    - share_enabled (boolean) (required) — True when the session's share link is active.\n    - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.\n    - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.\n    - standing_tasks (integer) (required) — Number of process-type tasks (background shell or monitor) still alive when the response was rendered.\n    - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.\n    - status (string) (required) — Lifecycle status. One of: `enabled` (active), `deleted` (soft-deleted, no longer accessible). [enabled, deleted]\n    - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.\n    - team_name (string) — Resolved team name; empty for unbound rows or deleted teams.\n    - template_staging_round_id (string) — Current save→validate round id (template-assistant only); empty otherwise.\n    - token_usage (object) — Cumulative session-level token rollup across all turns. The account-billing source of truth.\n      - cached_tokens (integer) (required) — Portion of input_tokens served from the prompt cache.\n      - input_tokens (integer) (required) — Total prompt (input) tokens, including the cached portion.\n      - output_tokens (integer) (required) — Total generated (output) tokens.\n      - reasoning_tokens (integer) (required) — Total reasoning/thinking tokens.\n    - updated_at (string) (required) — Unix timestamp in milliseconds of the last session update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - suggest_init (boolean) (required) — Account-wide onboarding flag: true when the account has zero knowledge packs in any scope; not dependent on this call's filters.\n  - total (integer) (required) — Total number of sessions matching the filter (ignoring pagination).\n",
 	"Skills.ReadGet":                              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - author (string) — Skill author.\n  - can_edit (boolean) (required) — Whether the caller may edit this skill.\n  - checksum (string) — SHA-256 checksum of the skill zip.\n  - content (string) — Full SKILL.md content. Omitted in list responses.\n  - created (boolean) — Set only on install-from-session responses: true = fresh install, false = in-place update.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the skill.\n  - description (string) (required) — Human-readable description from the SKILL.md frontmatter.\n  - description_en (string) — Optional English description. English-locale UI responses prefer this over `description`; the skill catalog also uses it as a stable selection signal when `description` is localized for display.\n  - is_modified (boolean) (required) — True when a marketplace-sourced skill was edited locally (auto-update skips it).\n  - license (string) — Skill license.\n  - s3_key (string) — Object-storage key of the skill zip.\n  - skill_id (string) (required) — Unique skill ID (prefix `skill_`).\n  - skill_name (string) (required) — Skill name, unique within its scope (account-wide or within one team).\n  - source_template_name (string) — Marketplace template this skill was installed from; empty for user-authored.\n  - source_template_version (string) — Template version at install time.\n  - status (string) (required) — Skill status. Deleted skills are excluded from every API response, so only these two values are ever returned. [enabled, disabled]\n  - tags (array<string>) — Tags parsed from the frontmatter.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - tools (array<string>) — Required tools (builtin or `mcp:server/tool`).\n  - update_available (boolean) (required) — True when the marketplace has a newer template version.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - venues (array<string>) — Execution-environment kinds (EnvironmentKind strings, e.g. `byoc`) the skill is restricted to. Omitted when empty, which means the skill is available in all venues.\n  - version (string) — Skill version from the frontmatter.\n",
 	"Skills.ReadList":                             "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - skills (array<object>) (required) — Skills on this page.\n    - account_id (integer) (required) — Owning account ID.\n    - author (string) — Skill author.\n    - can_edit (boolean) (required) — Whether the caller may edit this skill.\n    - checksum (string) — SHA-256 checksum of the skill zip.\n    - content (string) — Full SKILL.md content. Omitted in list responses.\n    - created (boolean) — Set only on install-from-session responses: true = fresh install, false = in-place update.\n    - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID that created the skill.\n    - description (string) (required) — Human-readable description from the SKILL.md frontmatter.\n    - description_en (string) — Optional English description. English-locale UI responses prefer this over `description`; the skill catalog also uses it as a stable selection signal when `description` is localized for display.\n    - is_modified (boolean) (required) — True when a marketplace-sourced skill was edited locally (auto-update skips it).\n    - license (string) — Skill license.\n    - s3_key (string) — Object-storage key of the skill zip.\n    - skill_id (string) (required) — Unique skill ID (prefix `skill_`).\n    - skill_name (string) (required) — Skill name, unique within its scope (account-wide or within one team).\n    - source_template_name (string) — Marketplace template this skill was installed from; empty for user-authored.\n    - source_template_version (string) — Template version at install time.\n    - status (string) (required) — Skill status. Deleted skills are excluded from every API response, so only these two values are ever returned. [enabled, disabled]\n    - tags (array<string>) — Tags parsed from the frontmatter.\n    - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n    - tools (array<string>) — Required tools (builtin or `mcp:server/tool`).\n    - update_available (boolean) (required) — True when the marketplace has a newer template version.\n    - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - venues (array<string>) — Execution-environment kinds (EnvironmentKind strings, e.g. `byoc`) the skill is restricted to. Omitted when empty, which means the skill is available in all venues.\n    - version (string) — Skill version from the frontmatter.\n  - total (integer) (required) — Total number of matching skills.\n",
 	"Skills.WriteUpdate":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Owning account ID.\n  - author (string) — Skill author.\n  - can_edit (boolean) (required) — Whether the caller may edit this skill.\n  - checksum (string) — SHA-256 checksum of the skill zip.\n  - content (string) — Full SKILL.md content. Omitted in list responses.\n  - created (boolean) — Set only on install-from-session responses: true = fresh install, false = in-place update.\n  - created_at (string) (required) — Creation time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (integer) (required) — Member ID that created the skill.\n  - description (string) (required) — Human-readable description from the SKILL.md frontmatter.\n  - description_en (string) — Optional English description. English-locale UI responses prefer this over `description`; the skill catalog also uses it as a stable selection signal when `description` is localized for display.\n  - is_modified (boolean) (required) — True when a marketplace-sourced skill was edited locally (auto-update skips it).\n  - license (string) — Skill license.\n  - s3_key (string) — Object-storage key of the skill zip.\n  - skill_id (string) (required) — Unique skill ID (prefix `skill_`).\n  - skill_name (string) (required) — Skill name, unique within its scope (account-wide or within one team).\n  - source_template_name (string) — Marketplace template this skill was installed from; empty for user-authored.\n  - source_template_version (string) — Template version at install time.\n  - status (string) (required) — Skill status. Deleted skills are excluded from every API response, so only these two values are ever returned. [enabled, disabled]\n  - tags (array<string>) — Tags parsed from the frontmatter.\n  - team_id (integer) (required) — Team scope: 0 = account-wide; >0 = the owning team.\n  - tools (array<string>) — Required tools (builtin or `mcp:server/tool`).\n  - update_available (boolean) (required) — True when the marketplace has a newer template version.\n  - updated_at (string) (required) — Last update time. Unix timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - venues (array<string>) — Execution-environment kinds (EnvironmentKind strings, e.g. `byoc`) the skill is restricted to. Omitted when empty, which means the skill is available in all venues.\n  - version (string) — Skill version from the frontmatter.\n",
diff --git a/internal/cli/zz_generated_sessions.go b/internal/cli/zz_generated_sessions.go
index 5d470f1..d7d2085 100644
--- a/internal/cli/zz_generated_sessions.go
+++ b/internal/cli/zz_generated_sessions.go
@@ -48,6 +48,13 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
     - turn_complete (boolean) (required) — True on the terminal event of a turn.
     - usage_metadata (object) — Per-turn token usage metadata.
   - has_more_older (boolean) (required) — True when older events remain beyond this page.
+  - pending_messages (array<object>) (required) — Human messages queued but not yet picked up by the agent, in execution order. Always an array — empty when nothing is queued.
+    - client_msg_id (string) — Client-supplied message ID, echoed back for de-duplication. Omitted when absent.
+    - invocation_id (string) (required) — Invocation ID of the queued message.
+    - parts (array<object>) — Request parts passed through verbatim (text, file, ref, or skill entries). Omitted when the original message carried none.
+    - person_id (integer) (required) — Person ID of the sender.
+    - query (string) (required) — Message text.
+    - steering (boolean) — True when the message was sent as a mid-turn steering instruction. Omitted when false.
   - search_after_ctx (string) — Opaque keyset cursor; pass back as search_after_ctx to fetch the next older page. Omitted when has_more_older is false.
   - session (object) (required) — One agent session row.
     - access_source (string) — How the caller received access to this session. Omitted when no access source is resolved. One of: | Value | Meaning | | --- | --- | | 'owner' | Caller is the session creator (full access) | | 'team_member' | Caller belongs to the session's bound team (full access) | | 'manager' | Manager grant (reserved; never produced by the current version) | | 'share_link' | Granted via a valid share link (view/fork only; cannot continue or manage) | | 'participant' | Same-account non-member granted via a participable team session (view/continue/fork only) | [owner, team_member, manager, share_link, participant]
@@ -70,6 +77,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - versions (object) — Per-pack resolved version map.
     - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.
     - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+    - creator_name (string) — Display name of the session creator, resolved when the response is rendered. Omitted when the member lookup fails.
     - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.
     - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.
     - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
@@ -90,6 +98,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
     - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.
     - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
     - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.
+    - standing_tasks (integer) (required) — Number of process-type tasks (background shell or monitor) still alive when the response was rendered.
     - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.
     - status (string) (required) — Lifecycle status. One of: 'enabled' (active), 'deleted' (soft-deleted, no longer accessible). [enabled, deleted]
     - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.
@@ -211,6 +220,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - versions (object) — Per-pack resolved version map.
     - context_window (integer) (required) — The bound model's max context size in tokens. 0 means unknown.
     - created_at (string) (required) — Unix timestamp in milliseconds when the session was created. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+    - creator_name (string) — Display name of the session creator, resolved when the response is rendered. Omitted when the member lookup fails.
     - current_context_tokens (integer) (required) — Size in tokens of the LLM context window as of the most recent turn. 0 means no turn has completed.
     - current_turn_active_ms (integer) (required) — Active working duration in milliseconds for the current or most recent round, excluding time spent waiting on ask_user; resets to 0 at the start of each new round.
     - current_turn_started_at (string) (required) — Unix timestamp in milliseconds when the current or most recent round started; 0 if no round has started yet. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
@@ -231,6 +241,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
     - share_version (integer) (required) — Revision of the share link; it increases when sharing is revoked.
     - shared_at (string) (required) — Unix timestamp in milliseconds when sharing was last enabled; 0 if never shared. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
     - shared_by (integer) (required) — Person ID that most recently enabled sharing; 0 if never shared.
+    - standing_tasks (integer) (required) — Number of process-type tasks (background shell or monitor) still alive when the response was rendered.
     - state (object) — Raw session-state bag (session-scoped keys). Omitted when empty.
     - status (string) (required) — Lifecycle status. One of: 'enabled' (active), 'deleted' (soft-deleted, no longer accessible). [enabled, deleted]
     - team_id (integer) (required) — Owning team id; 0 means no team is bound. Immutable after create.
diff --git a/skills/flashduty/reference/alert.md b/skills/flashduty/reference/alert.md
index f617951..7d2a81e 100644
--- a/skills/flashduty/reference/alert.md
+++ b/skills/flashduty/reference/alert.md
@@ -74,7 +74,7 @@ List alert activity feed
 - `--page` int64 — Page number, starting at 1. (min 1)
 - `--search-after-ctx` string
 - `--types` stringSlice — Filter by feed type codes — see the 'type' field of the response items for the full list (e.g. 'a_new', 'a_comm', 'a_merge').
-- response: `{items: [...], has_next_page}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); created_at (string); creator_id (integer); deleted_at (string); detail (object); ref_id (string); type (string); updated_at (string)
+- response: `{items: [...], has_next_page}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); agent_session_id (string); created_at (string); creator_id (integer); deleted_at (string); detail (object); ref_id (string); type (string); updated_at (string); via (string)
 
 ### get <alert_id>
 Get alert detail
@@ -132,7 +132,7 @@ Create or update alert pipeline
 View alert timeline
 - `--limit` int
 - `--page` int
-- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); created_at (string); creator_id (integer); deleted_at (string); detail (object); ref_id (string); type (string); updated_at (string)
+- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); agent_session_id (string); created_at (string); creator_id (integer); deleted_at (string); detail (object); ref_id (string); type (string); updated_at (string); via (string)
 
 <!-- GENERATED:alert END -->
 
diff --git a/skills/flashduty/reference/incident.md b/skills/flashduty/reference/incident.md
index e454ec4..8528e6f 100644
--- a/skills/flashduty/reference/incident.md
+++ b/skills/flashduty/reference/incident.md
@@ -375,7 +375,7 @@ Get incident war room details
 ### list <incident_id>
 List incident war rooms
 - `--integration` int64
-- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); chat_id (string); created_at (string); created_by (integer); incident_id (string); integration_id (integer); plugin_type (string); status (string)
+- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: account_id (integer); chat_id (string); chat_name (string); created_at (string); created_by (integer); incident_id (string); integration_id (integer); integration_unavailable (boolean); plugin_type (string); status (string)
 
 ### war-room-add-member <chat-id>
 Add war-room member
@@ -411,7 +411,7 @@ Get war room detail
 List war rooms
 - `<incident-id>` (positional, required) string — Incident ID (MongoDB ObjectID).
 - `--integration-id` int64 — Optional filter: only return war rooms for this IM integration.
-- response: `{items: [...]}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); chat_id (string); created_at (string); created_by (integer); incident_id (string); integration_id (integer); plugin_type (string); status (string)
+- response: `{items: [...]}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); chat_id (string); chat_name (string); created_at (string); created_by (integer); incident_id (string); integration_id (integer); integration_unavailable (boolean); plugin_type (string); status (string)
 
 ### work-item-assignees-reset <work-item-id>
 Reset work item assignees
diff --git a/skills/flashduty/reference/member.md b/skills/flashduty/reference/member.md
index 6dabbed..1d60a1c 100644
--- a/skills/flashduty/reference/member.md
+++ b/skills/flashduty/reference/member.md
@@ -99,11 +99,10 @@ List members
 
 ### notify
 Notify members
-- `--dry-run` bool — Check without sending. When 'true', every check runs and the response returns the exact email in 'html', but nothing is queued and neither the hourly limit nor the per-turn duplicate check is consumed. Defaults to 'false'.
-- `--html` string (required) — Email body as an HTML fragment (no '<html>'/'<head>'/'<body>' wrapper needed); recipients receive it as the whole email body. Required, up to 102,400 bytes of raw UTF-8 input (larger messages are clipped by common email clients), and must be non-empty after sanitization. Sanitized server-side: '<script>', '<style>', '<iframe>', '<object>', '<embed>', '<form>', '<input>', '<button>', '<svg>', '<meta>', '<link>', and '<base>' tags and all 'on*' event handlers are removed; images are kept only when their 'src' is 'https' — images with any other or no 'src', including 'data:', are removed; links are restricted to 'http', 'https', and 'mailto'. Inline 'style' attributes are kept as written. (≤102400 chars)
+- `--html` string (required) — Email body as an HTML fragment (no '<html>'/'<head>'/'<body>' wrapper needed); recipients receive it as the whole email body. Required, up to 102,400 bytes of raw UTF-8 input (larger messages are clipped by common email clients), and must be non-empty after sanitization. '<script>', '<meta>', '<link>', and '<base>' tags and all 'on*' event handlers are silently removed before sending, since email clients never execute them; inline 'style' attributes are kept as written. '<style>', '<svg>', '<iframe>', '<object>', '<embed>', '<form>', '<input>', and '<button>' tags, an '<img>' with a missing or non-'https' 'src' (including 'data:'), or an '<a>' whose href scheme is not 'http', 'https', or 'mailto' are rejected instead of stripped: the request fails with '400' rather than silently changing what recipients see. (≤102400 chars)
 - `--person-ids` intSlice — Recipient member IDs. Optional, up to 20, no duplicates. Omitted or empty sends to the caller only.
 - `--subject` string (required) — Email subject, used as written. Required, 1–200 characters. Line breaks are replaced with a space; leading/trailing whitespace is trimmed. (1-200 chars)
-- response: single object (`data` unwrapped to the top level) — fields: html (string); recipients (array<object>)
+- response: single object (`data` unwrapped to the top level) — fields: agent_instructions (string); recipients (array<object>)
 
 ### role-grant <role-id> [<id2>...]
 Grant role to member
@@ -138,7 +137,6 @@ Update member roles
     '{html: $h, subject: "<subject>", person_ids: $pids}' \
     | fduty member notify --data -
   ```
-  Add `dry_run: true` to that body to get the finished email back in `.html` without sending anything, and check it before the real send.
 - **Resolving a `person_id` → name: use `fduty person infos <person_id> …`, NOT `member list`.** `schedule`/`oncall`/`incident`/`alert` output returns `person_id`s, a **different namespace from `member_id`**. `fduty person infos` (the sibling `person` group) batch-resolves any number of `person_id`s to `person_name` in one call (rows under `.items[]`). Matching `member list` rows on `member_id == <person_id>` is wrong, and paginating the full roster to find them silently misses people on later pages.
 - **`invite` members array is body-only — use `--data`.** Individual members cannot be passed as flat flags; the `members` array (with nested `role_ids`, `email`, `phone`, etc.) lives only in the JSON body. Up to 20 members per call.
 - **`info-reset <member-id>` can be passed positionally or via `--member-id`** — both work: `fduty member info-reset <member_id> --member-name "New Name"` or `fduty member info-reset --member-id <member_id> --member-name "New Name"`. If both are given, the flag wins.
diff --git a/skills/flashduty/reference/monit-rule.md b/skills/flashduty/reference/monit-rule.md
index 2e95346..b50556d 100644
--- a/skills/flashduty/reference/monit-rule.md
+++ b/skills/flashduty/reference/monit-rule.md
@@ -1,12 +1,12 @@
 # fduty monit — alert rules
 
-Prereq: `SKILL.md` + `reference/monit.md` read. This is the largest Flashmonit surface: rule CRUD, the folder tree, counters, change history, and export/import.
+Prereq: `SKILL.md` + `reference/monit.md` read. This is the largest Flashmonit surface: rule CRUD, the folder tree, counters, and change history.
 
 ## Route here when
 
 "监控规则 / 告警规则 / 规则文件夹 / 规则导出" or "alert rule / rule folder / rule export / rule audit" → this card.
 
-**Mutating:** `rule-v2-create`, `rule-v2-update`, `rule-update-fields`, `rule-move`, `rule-delete`, `rule-delete-batch`, `rule-import` — confirm before running. **`rule-delete-batch` is irreversible**; confirm IDs with `rule-list-basic` first.
+**Mutating:** `rule-v2-create`, `rule-v2-update`, `rule-update-fields`, `rule-move`, `rule-delete`, `rule-delete-batch` — confirm before running. **`rule-delete-batch` is irreversible**; confirm IDs with `rule-list-basic` first.
 
 ## Intent → verb
 
@@ -19,7 +19,7 @@ Prereq: `SKILL.md` + `reference/monit.md` read. This is the largest Flashmonit s
 | move rules to another folder | `rule-move` |
 | toggle enabled/channels in bulk | `rule-update-fields` |
 | rule change history | `rule-audits` → detail via `rule-audit-detail` |
-| export / import rules (backup/migrate) | `rule-export` / `rule-import` |
+| full definitions of several rules (backup) | `rule-list-basic` for the IDs, then `rule-v2-info` per ID |
 | per-channel counts / total counter time series | `rule-counter-channel` / `rule-counter-total` |
 
 ## Hot flow — inspect configured rules
@@ -50,7 +50,7 @@ The public CLI cannot discover the folder tree itself. If folder IDs are unavail
 
 - **`rule_configs` and nested arrays require `--data`.** The queries, thresholds, enabled_times, and labels objects cannot be expressed as flat flags — pass them as inline JSON via `--data '{"rule_configs":{...}}'` on `rule-v2-create` / `rule-v2-update`. Typed scalar flags (`--name`, `--enabled`, `--cron-pattern`, `--ds-type`) override matching `--data` keys.
 - **`folder-id 0` is not a universal "all rules" sentinel.** If the API says "Folder not found", believe it. Run `rule-list-basic` only against real folder IDs you actually know, adding `--include-descendants` when subtree id/name rows are enough.
-- **"全量规则 / full rules" means exported monitor alert-rule definitions.** The concrete verb is `rule-export --ids ...`, usually after `rule-list-basic` selected the IDs. It does not mean dumping incidents or alerts.
+- **"全量规则 / full rules" means complete monitor alert-rule definitions.** Select the IDs with `rule-list-basic`, then read each with `rule-v2-info`. It does not mean dumping incidents or alerts.
 - **`rule-delete-batch` and `datasource-delete` are irreversible.** Confirm IDs with `rule-list-basic` / `datasource-info` first.
 - **`rule-audit-detail --id` takes the audit record ID**, not the rule ID. Get audit record IDs from `rule-audits --id <rule-id>` first; passing the rule ID returns HTTP 400.
 - **`rule-list-basic` needs a REAL `--folder-id`; it does not accept `0`.** The command returns only that folder's *direct* rules unless `--include-descendants` is set; never substitute fired alerts as configured-rule inventory.
@@ -97,15 +97,6 @@ Delete alert rule
 Batch delete alert rules
 - `--ids` intSlice (required) — Rule IDs.
 
-### rule-export
-Export alert rules
-- `--ids` intSlice (required) — Rule IDs.
-- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: annotations (object); cron_pattern (string); debug_log_enabled (boolean); delay_seconds (integer); description (string); description_type (string); ds_ids (array<integer>); ds_list (array<string>); ds_type (string); enabled (boolean); enabled_times (array<object>); labels (object); name (string); repeat_interval (integer); repeat_total (integer); rule_configs (object); timezone (string)
-
-### rule-import
-Import alert rules
-- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: message (string); name (string)
-
 ### rule-list-basic
 List alert rules
 - `--folder-id` int64 — Folder ID. Must be an existing folder; '0' is rejected with a 'folder_not_found' error.
@@ -118,7 +109,7 @@ List alert rules
 Move alert rules to folder
 - `--dest-folder-id` int64 (required) — Destination folder ID. Obtainable via 'POST /monit/folder/list'.
 - `--ids` intSlice (required) — Rule IDs to move.
-- response: same shape as `rule-import` above
+- response: TOP-LEVEL array — pipe `--json | jq '.[]'` (NOT `.items[]`) — fields: message (string); name (string)
 
 ### rule-update-fields
 Batch update rule fields
@@ -137,7 +128,7 @@ Batch update rule fields
 - `--repeat-total` int64 — Maximum number of repeated notifications. Effective only when 'fields' includes 'repeat_total'.
 - `--timezone` string — Timezone in which the rule executes. IANA timezone name; defaults to 'Asia/Shanghai'.
 - body-only (`--data`): annotations (object); annotations_patch (object); enabled_times (array<object>); labels (object); labels_patch (object)
-- response: same shape as `rule-import` above
+- response: same shape as `rule-move` above
 
 ### rule-v2-create <folder-id>
 Create alert rule (V2)
diff --git a/skills/flashduty/reference/rum.md b/skills/flashduty/reference/rum.md
index bf43a5b..e872ead 100644
--- a/skills/flashduty/reference/rum.md
+++ b/skills/flashduty/reference/rum.md
@@ -69,7 +69,7 @@ Create application
 - `--no-ip` bool — Do not collect IP addresses.
 - `<team-id>` (positional, required) int64 — Owning team ID. Get team IDs via 'POST /team/list'.
 - `--type` string (required) — Platform identifier: | Value | Meaning | |---|---| | 'browser' | Web browser application (JavaScript SDK) | | 'ios' | Apple iOS application | | 'android' | Android application | | 'react-native' | React Native application | | 'flutter' | Flutter application | | 'kotlin-multiplatform' | Kotlin Multiplatform application | | 'roku' | Roku channel application | | 'unity' | Unity application | | 'miniprogram' | WeChat mini program | | 'harmony' | HarmonyOS application | | 'electron' | Electron desktop application | · enum: browser | ios | android | react-native | flutter | kotlin-multiplatform | roku | unity | miniprogram | harmony | electron
-- body-only (`--data`): alerting (object); links (object); tracing (object)
+- body-only (`--data`): alerting (object); links (object); repositories (array<object>); tracing (object)
 - response: single object (`data` unwrapped to the top level) — fields: application_id (string); application_name (string); client_token (string)
 
 ### application-delete <application-id>
@@ -79,12 +79,12 @@ Delete application
 ### application-info <application-id>
 Get application detail
 - `<application-id>` (positional, required) string — RUM application ID. Get application IDs via 'POST /rum/application/list'.
-- response: single object (`data` unwrapped to the top level) — fields: account_id (integer); alerting (object); application_id (string); application_name (string); client_token (string); created_at (string); created_by (integer); is_private (boolean); links (object); no_geo (boolean); no_ip (boolean); status (string); team_id (integer); tracing (object); type (string); updated_at (string); updated_by (integer)
+- response: single object (`data` unwrapped to the top level) — fields: account_id (integer); alerting (object); application_id (string); application_name (string); client_token (string); created_at (string); created_by (integer); is_private (boolean); links (object); no_geo (boolean); no_ip (boolean); repositories (array<object>); status (string); team_id (integer); tracing (object); type (string); updated_at (string); updated_by (integer)
 
 ### application-infos <application-id> [<id2>...]
 Batch get applications
 - `<application-ids>` (positional, required) stringSlice — Up to 200 application IDs. Get IDs via 'POST /rum/application/list'.
-- response: `{items: [...]}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); alerting (object); application_id (string); application_name (string); client_token (string); created_at (string); created_by (integer); is_private (boolean); links (object); no_geo (boolean); no_ip (boolean); status (string); team_id (integer); tracing (object); type (string); updated_at (string); updated_by (integer)
+- response: `{items: [...]}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); alerting (object); application_id (string); application_name (string); client_token (string); created_at (string); created_by (integer); is_private (boolean); links (object); no_geo (boolean); no_ip (boolean); repositories (array<object>); status (string); team_id (integer); tracing (object); type (string); updated_at (string); updated_by (integer)
 
 ### application-list
 List applications
@@ -96,7 +96,7 @@ List applications
 - `--query` string — Substring match on the application name.
 - `--search-after-ctx` string
 - `--team-id` int64 — Filter by team ID. Get team IDs via 'POST /team/list'.
-- response: `{items: [...], has_next_page, total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); alerting (object); application_id (string); application_name (string); client_token (string); created_at (string); created_by (integer); is_private (boolean); links (object); no_geo (boolean); no_ip (boolean); status (string); team_id (integer); tracing (object); type (string); updated_at (string); updated_by (integer)
+- response: `{items: [...], has_next_page, total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); alerting (object); application_id (string); application_name (string); client_token (string); created_at (string); created_by (integer); is_private (boolean); links (object); no_geo (boolean); no_ip (boolean); repositories (array<object>); status (string); team_id (integer); tracing (object); type (string); updated_at (string); updated_by (integer)
 
 ### application-remote-config-get <application-id>
 Get remote config detail
@@ -145,7 +145,7 @@ Update application
 - `--no-ip` bool — When 'true', stop collecting user IP addresses; when 'false', resume collecting them. Omit to leave unchanged.
 - `--team-id` int64 — Owning team ID. Get team IDs via 'POST /team/list'. Omit to leave unchanged.
 - `--type` string — Application type. Omit to leave unchanged. Platform identifier: | Value | Meaning | |---|---| | 'browser' | Web browser application (JavaScript SDK) | | 'ios' | Apple iOS application | | 'android' | Android application | | 'react-native' | React Native application | | 'flutter' | Flutter application | | 'kotlin-multiplatform' | Kotlin Multiplatform application | | 'roku' | Roku channel application | | 'unity' | Unity application | | 'miniprogram' | WeChat mini program | | 'harmony' | HarmonyOS application | | 'electron' | Electron desktop application | · enum: browser | ios | android | react-native | flutter | kotlin-multiplatform | roku | unity | miniprogram | harmony | electron
-- body-only (`--data`): alerting (object); links (object); tracing (object)
+- body-only (`--data`): alerting (object); links (object); repositories (array<object>); tracing (object)
 
 ### application-webhook-test <application-id>
 Test application webhook
diff --git a/skills/flashduty/reference/safari.md b/skills/flashduty/reference/safari.md
index 5af816b..a3db641 100644
--- a/skills/flashduty/reference/safari.md
+++ b/skills/flashduty/reference/safari.md
@@ -199,7 +199,7 @@ List Automation rules
 - `--enabled` bool — Filter by enabled state: 'true' returns only enabled rules, 'false' only disabled; omit or pass null for no filter.
 - `--include-person` bool — Compatibility field; when scope is empty and this is false, behaves like team scope.
 - `--keyword` string — Filter by name keyword. (≤64 chars)
-- `--limit` int64 — Page size.
+- `--limit` int64 — Page size. Values below 1 fall back to 20; values above 200 are capped at 200. (max 200)
 - `--page` int64 — Page number, 1-based.
 - `--scope` string — Scope filter: 'all' (own personal + accessible team rules), 'personal', or 'team'; default 'all'. · enum: all | personal | team
 - `--search-after-ctx` string
@@ -399,7 +399,7 @@ Get session detail
 - `--search-after-ctx` string — Opaque keyset cursor from a previous response; pass it back to fetch the next older page. (≤4096 chars)
 - `<session-id>` (positional, required) string — Target session ID, from the list returned by 'POST /safari/session/list'. (≥1 chars)
 - `--share-token` string — Share token for accessing a session through its share link. Omit it for normal account-authorized access. (≤512 chars)
-- response: single object (`data` unwrapped to the top level) — fields: events (array<object>); has_more_older (boolean); search_after_ctx (string); session (object); suggest_init (boolean)
+- response: single object (`data` unwrapped to the top level) — fields: events (array<object>); has_more_older (boolean); pending_messages (array<object>); search_after_ctx (string); session (object); suggest_init (boolean)
 
 ### session-list
 List sessions
diff --git a/skills/flashduty/reference/template.md b/skills/flashduty/reference/template.md
index 7c77b44..56eefd8 100644
--- a/skills/flashduty/reference/template.md
+++ b/skills/flashduty/reference/template.md
@@ -95,7 +95,10 @@ Create a template
 - `--email` string — Email body template source (Go 'html/template' syntax).
 - `--feishu` string — Feishu robot message template source.
 - `--feishu-app` string — Feishu app message template source.
+- `--feishu-app-card-v2-preserve-blank-lines` bool — Keep blank lines in the body of Feishu app card v2 messages.
 - `--feishu-app-card-v2-table-enabled` bool — Render alert labels as a table in Feishu app cards.
+- `--feishu-app-war-room-enabled` bool — Show the Create War Room button on Feishu app cards.
+- `--incident-card-closed-action-apps` stringSlice — IM apps whose closed-incident cards keep the custom action buttons. Supported values: 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app'. An empty list hides the buttons on every app. · enum: feishu_app | dingtalk_app | wecom_app | slack_app | teams_app
 - `--slack` string — Slack robot message template source.
 - `--slack-app` string — Slack app message template source.
 - `--sms` string — SMS template source (Go 'text/template' syntax).
@@ -106,6 +109,7 @@ Create a template
 - `--voice` string — Voice call script template source.
 - `--wecom` string — WeCom robot message template source.
 - `--wecom-app` string — WeCom app message template source.
+- `--wecom-markdown-v2-enabled` bool — Send WeCom robot notifications as 'markdown_v2' messages instead of plain markdown.
 - `--zoom` string — Zoom bot message template source.
 - body-only (`--data`): incident_card_hidden_fields (object)
 - response: single object (`data` unwrapped to the top level) — fields: template_id (string); template_name (string)
@@ -121,7 +125,7 @@ List available template functions
 ### get-preset
 Get the preset template for a channel
 - `--channel` string
-- response: single object (`data` unwrapped to the top level) — fields: account_id (integer); created_at (string); creator_id (integer); deleted_at (string); description (string); dingtalk (string); dingtalk_app (string); email (string); feishu (string); feishu_app (string); feishu_app_card_v2_table_enabled (boolean); incident_card_hidden_fields (object); slack (string); slack_app (string); sms (string); status (string); team_id (integer); teams_app (string); telegram (string); template_id (string); template_name (string); updated_at (string); updated_by (integer); voice (string); wecom (string); wecom_app (string); zoom (string)
+- response: single object (`data` unwrapped to the top level) — fields: account_id (integer); created_at (string); creator_id (integer); deleted_at (string); description (string); dingtalk (string); dingtalk_app (string); email (string); feishu (string); feishu_app (string); feishu_app_card_v2_preserve_blank_lines (boolean); feishu_app_card_v2_table_enabled (boolean); feishu_app_war_room_enabled (boolean); incident_card_closed_action_apps (array<string>); incident_card_hidden_fields (object); slack (string); slack_app (string); sms (string); status (string); team_id (integer); teams_app (string); telegram (string); template_id (string); template_name (string); updated_at (string); updated_by (integer); voice (string); wecom (string); wecom_app (string); wecom_markdown_v2_enabled (boolean); zoom (string)
 
 ### info <template-id>
 Get template detail
@@ -139,11 +143,13 @@ List templates
 - `--query` string — Regex or substring match on template_name.
 - `--search-after-ctx` string
 - `--team-ids` intSlice — Filter by specific team IDs.
-- response: `{items: [...], has_next_page, total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); created_at (string); creator_id (integer); deleted_at (string); description (string); dingtalk (string); dingtalk_app (string); email (string); feishu (string); feishu_app (string); feishu_app_card_v2_table_enabled (boolean); incident_card_hidden_fields (object); slack (string); slack_app (string); sms (string); status (string); team_id (integer); teams_app (string); telegram (string); template_id (string); template_name (string); updated_at (string); updated_by (integer); voice (string); wecom (string); wecom_app (string); zoom (string)
+- response: `{items: [...], has_next_page, total}` page wrapper — pipe `--json | jq '.items[]'` (NOT top-level `.[]`) — items fields: account_id (integer); created_at (string); creator_id (integer); deleted_at (string); description (string); dingtalk (string); dingtalk_app (string); email (string); feishu (string); feishu_app (string); feishu_app_card_v2_preserve_blank_lines (boolean); feishu_app_card_v2_table_enabled (boolean); feishu_app_war_room_enabled (boolean); incident_card_closed_action_apps (array<string>); incident_card_hidden_fields (object); slack (string); slack_app (string); sms (string); status (string); team_id (integer); teams_app (string); telegram (string); template_id (string); template_name (string); updated_at (string); updated_by (integer); voice (string); wecom (string); wecom_app (string); wecom_markdown_v2_enabled (boolean); zoom (string)
 
 ### preview
 Preview template
 - `--content` string (required) — Template content to render.
+- `--feishu-app-card-v2-enabled` bool — Render the preview as a Feishu app card v2 message.
+- `--feishu-app-card-v2-preserve-blank-lines` bool — Keep blank lines in the body of the Feishu app card v2 preview.
 - `--incident-id` string — Incident ID whose data is used to render the template; mock data is used when omitted. A MongoDB ObjectID hex string.
 - `--type` string (required) — Template channel type that selects the rendering engine. 'email' renders as Go html/template; other channels render as text/template. Values match the template channel fields, for example 'email', 'sms', 'voice', 'dingtalk', 'wecom', 'feishu', 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app', 'telegram', 'slack', 'zoom'.
 - body-only (`--data`): incident_card_hidden_fields (object)
@@ -157,7 +163,10 @@ Update a template
 - `--email` string — Email body template source (Go 'html/template' syntax). Omit to keep the current content; send an empty string to clear it.
 - `--feishu` string — Feishu robot message template source. Omit to keep the current content; send an empty string to clear it.
 - `--feishu-app` string — Feishu app message template source. Omit to keep the current content; send an empty string to clear it.
+- `--feishu-app-card-v2-preserve-blank-lines` bool — When set, keep or drop blank lines in the body of Feishu app card v2 messages. Omit to keep the existing setting.
 - `--feishu-app-card-v2-table-enabled` bool — When set, enable or disable table rendering for alert labels in Feishu app cards. Omit to keep the existing setting.
+- `--feishu-app-war-room-enabled` bool — When set, show or hide the Create War Room button on Feishu app cards. Omit to keep the existing setting.
+- `--incident-card-closed-action-apps` stringSlice — Replaces the retained-app list when sent. Supported values: 'feishu_app', 'dingtalk_app', 'wecom_app', 'slack_app', 'teams_app'. Omit the field to leave it unchanged. · enum: feishu_app | dingtalk_app | wecom_app | slack_app | teams_app
 - `--slack` string — Slack robot message template source. Omit to keep the current content; send an empty string to clear it.
 - `--slack-app` string — Slack app message template source. Omit to keep the current content; send an empty string to clear it.
 - `--sms` string — SMS template source (Go 'text/template' syntax). Omit to keep the current content; send an empty string to clear it.
@@ -169,6 +178,7 @@ Update a template
 - `--voice` string — Voice call script template source. Omit to keep the current content; send an empty string to clear it.
 - `--wecom` string — WeCom robot message template source. Omit to keep the current content; send an empty string to clear it.
 - `--wecom-app` string — WeCom app message template source. Omit to keep the current content; send an empty string to clear it.
+- `--wecom-markdown-v2-enabled` bool — When set, switch WeCom robot notifications between 'markdown_v2' and plain markdown. Omit to keep the existing setting.
 - `--zoom` string — Zoom bot message template source. Omit to keep the current content; send an empty string to clear it.
 - body-only (`--data`): incident_card_hidden_fields (object)