@secondlayer/shared 13.3.0 → 13.5.0

package/dist/src/insights/index.js

@@ -0,0 +1,2284 @@
+// src/schemas/insights.ts
+import { z } from "zod";
+var INSIGHT_SEVERITIES = [
+  "losing",
+  "will_fail",
+  "costs",
+  "recovered"
+];
+var InsightSeveritySchema = z.enum(INSIGHT_SEVERITIES);
+var InsightResourceKindSchema = z.enum(["webhook", "subgraph", "account"]);
+var InsightEvidenceSchema = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("series"),
+    title: z.string(),
+    series: z.array(z.object({
+      name: z.string(),
+      role: z.enum(["a", "context", "mark"]),
+      points: z.array(z.number())
+    })),
+    labels: z.array(z.tuple([z.number(), z.string()])),
+    unit: z.string().optional()
+  }),
+  z.object({
+    kind: z.literal("table"),
+    title: z.string(),
+    columns: z.array(z.string()),
+    rows: z.array(z.array(z.union([z.string(), z.number()]))),
+    markRow: z.number().optional()
+  }),
+  z.object({
+    kind: z.literal("shapes"),
+    title: z.string(),
+    shapes: z.array(z.object({
+      code: z.string(),
+      body: z.string(),
+      count: z.number(),
+      isNew: z.boolean()
+    }))
+  }),
+  z.object({
+    kind: z.literal("timeline"),
+    title: z.string(),
+    steps: z.array(z.object({
+      what: z.string(),
+      at: z.string(),
+      note: z.string().optional(),
+      failed: z.boolean()
+    }))
+  })
+]);
+var InsightSchema = z.object({
+  id: z.string(),
+  rule: z.string(),
+  severity: InsightSeveritySchema,
+  impact: z.number(),
+  resource: z.object({
+    kind: InsightResourceKindSchema,
+    id: z.string(),
+    name: z.string()
+  }),
+  line: z.string(),
+  meta: z.string().optional(),
+  lead: z.string(),
+  body: z.string(),
+  evidence: z.array(InsightEvidenceSchema),
+  handoff: z.object({
+    prompt: z.string(),
+    commands: z.array(z.string())
+  }),
+  how: z.object({
+    detector: z.string(),
+    facts: z.array(z.tuple([z.string(), z.string()])),
+    label: z.object({ cause: z.string(), confidence: z.number() }).optional()
+  }),
+  createdAt: z.string(),
+  resolvedAt: z.string().nullable().optional()
+});
+var InsightListResponseSchema = z.object({
+  data: z.array(InsightSchema)
+});
+var SEVERITY_ORDER = {
+  losing: 0,
+  will_fail: 1,
+  costs: 2,
+  recovered: 3
+};
+
+// src/insights/rank.ts
+function rankInsights(insights) {
+  return [...insights].sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] || b.impact - a.impact || Date.parse(b.createdAt) - Date.parse(a.createdAt));
+}
+// src/insights/thresholds.ts
+var RATE_LIMITED_MIN_ATTEMPTS = 10;
+var RATE_LIMITED_MIN_RATIO = 0.5;
+var DOWN_MIN_CONSECUTIVE = 5;
+var REJECTS_MIN_CONSECUTIVE = 5;
+var SLOW_WINDOW = 20;
+var SLOW_MIN_SAMPLES = 5;
+var SLOW_TIMEOUT_RATIO = 0.5;
+var LAG_WINDOW = 20;
+var LAG_MIN_SAMPLES = 5;
+var LAG_THRESHOLD_MS = 60000;
+var LOGIN_WALL_MIN_CONSECUTIVE = 20;
+var LOGIN_WALL_PRIOR_JSON_RATIO = 0.8;
+var LOGIN_WALL_MIN_PRIOR = 10;
+var SLOWING_DAYS = 14;
+var SLOWING_MIN_RISING_DAYS = 10;
+var SLOWING_MIN_R2 = 0.8;
+var TLS_WARN_DAYS = 14;
+var DEAD_LETTER_WARN_AGE_DAYS = 83;
+var DEAD_LETTER_DELETE_AGE_DAYS = 90;
+var TEST_ENDPOINT_MIN_AGE_DAYS = 7;
+var HANDLER_ERRORS_MIN_24H = 10;
+var SUBGRAPH_LAG_BLOCKS = 20;
+var SUBGRAPH_LAG_SNAPSHOTS = 3;
+var SUBGRAPH_LAG_LOSING_BLOCKS = 500;
+var PAGE_CAP_ROWS = 1000;
+var DUPLICATE_READS_MIN_PAGES = 3;
+var DUPLICATE_READS_WINDOW_MS = 3600000;
+var DUPLICATE_READS_LOOKBACK_MS = 24 * 3600000;
+var POLLING_MIN_DURATION_MS = 3600000;
+var POLLING_MIN_REQUESTS = 5;
+var POLLING_LOOKBACK_MS = 6 * 3600000;
+var POLLING_MAX_STDDEV_RATIO = 0.2;
+var POLLING_MIN_EMPTY_RATIO = 0.8;
+var SERVER_ERRORS_MIN_5XX = 3;
+var BACKFILL_DAY_SHARE = 0.25;
+var BACKFILL_FULL_PAGE_RATIO = 0.9;
+var BACKFILL_MIN_DAY_ROWS = 1e5;
+var CREDITS_RUNWAY_WARN_DAYS = 7;
+var RECOVERED_VISIBLE_MS = 24 * 3600000;
+var CLEAR_STREAK_TO_RESOLVE = 2;
+// src/insights/prompt.ts
+function handoffPrompt(parts) {
+  const sentence = (text) => {
+    const trimmed = text.trim().replace(/[.\s]+$/, "");
+    return trimmed.length > 0 ? `${trimmed}.` : "";
+  };
+  const [first = "", ...rest] = parts.observed;
+  const sentences = [
+    sentence(`${parts.subject} ${first}`),
+    ...rest.map(sentence),
+    sentence(parts.lookAt),
+    parts.followUp ? sentence(parts.followUp) : ""
+  ];
+  return sentences.filter((s) => s.length > 0).join(" ");
+}
+function plainSnippet(text, max = 80) {
+  if (!text)
+    return "";
+  const flat = text.replace(/<[^>]*>/g, " ").replace(/=>/g, "->").replace(/[`{}$\\]/g, "").replace(/\s+/g, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max - 1).trimEnd()}...` : flat;
+}
+function utcTime(date) {
+  return `${date.toISOString().slice(11, 16)} UTC`;
+}
+function utcDateTime(date) {
+  const month = date.toLocaleString("en-US", {
+    month: "short",
+    timeZone: "UTC"
+  });
+  return `${month} ${date.getUTCDate()} ${utcTime(date)}`;
+}
+function utcDay(date) {
+  const month = date.toLocaleString("en-US", {
+    month: "short",
+    timeZone: "UTC"
+  });
+  return `${month} ${date.getUTCDate()}`;
+}
+function plural(n, one, many = `${one}s`) {
+  return `${n.toLocaleString("en-US")} ${n === 1 ? one : many}`;
+}
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+// src/insights/store.ts
+import { sql as sql2 } from "kysely";
+
+// src/db/jsonb.ts
+import { sql } from "kysely";
+function jsonb(value) {
+  const escaped = JSON.stringify(value, (_k, v) => typeof v === "bigint" ? v.toString() : v).replace(/'/g, "''");
+  return sql`${sql.raw(`'${escaped}'::jsonb`)}`;
+}
+function parseJsonb(value) {
+  if (typeof value === "string") {
+    try {
+      return JSON.parse(value);
+    } catch {
+      return value;
+    }
+  }
+  return value ?? {};
+}
+
+// src/insights/store.ts
+var NIL_UUID = "00000000-0000-0000-0000-000000000000";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function scopeWhere(scope, column = sql2.ref("account_id")) {
+  return scope.accountId === null ? sql2`${column} IS NULL` : sql2`${column} = ${scope.accountId}`;
+}
+function toPayload(insight) {
+  return {
+    resource: insight.resource,
+    line: insight.line,
+    ...insight.meta !== undefined ? { meta: insight.meta } : {},
+    lead: insight.lead,
+    body: insight.body,
+    evidence: insight.evidence,
+    handoff: insight.handoff,
+    how: insight.how
+  };
+}
+async function recordEvaluation(db, scope, fired, evaluatedKeys, now = new Date) {
+  await db.transaction().execute(async (trx) => {
+    for (const insight of fired) {
+      await sql2`
+				INSERT INTO insights
+					(account_id, resource_kind, resource_id, rule, severity, impact,
+					 payload, first_seen_at, last_seen_at)
+				VALUES
+					(${scope.accountId}, ${insight.resource.kind}, ${insight.resource.id},
+					 ${insight.rule}, ${insight.severity}, ${insight.impact},
+					 ${jsonb(toPayload(insight))}, ${now}, ${now})
+				ON CONFLICT
+					(coalesce(account_id, ${sql2.lit(NIL_UUID)}::uuid), resource_kind, resource_id, rule)
+					WHERE resolved_at IS NULL
+				DO UPDATE SET
+					payload = EXCLUDED.payload,
+					severity = EXCLUDED.severity,
+					impact = EXCLUDED.impact,
+					last_seen_at = EXCLUDED.last_seen_at,
+					clear_streak = 0
+			`.execute(trx);
+    }
+    const firedKeys = new Set(fired.map((i) => `${i.resource.kind}\x00${i.resource.id}\x00${i.rule}`));
+    for (const key of evaluatedKeys) {
+      if (firedKeys.has(`${key.kind}\x00${key.id}\x00${key.rule}`))
+        continue;
+      await sql2`
+				UPDATE insights
+				SET clear_streak = clear_streak + 1,
+					resolved_at = CASE
+						WHEN clear_streak + 1 >= ${CLEAR_STREAK_TO_RESOLVE}
+						THEN ${now}::timestamptz
+						ELSE NULL
+					END
+				WHERE ${scopeWhere(scope)}
+					AND resource_kind = ${key.kind}
+					AND resource_id = ${key.id}
+					AND rule = ${key.rule}
+					AND resolved_at IS NULL
+			`.execute(trx);
+    }
+  });
+}
+async function listOpenResources(db, scope) {
+  const { rows } = await sql2`
+		SELECT resource_kind, resource_id, rule FROM insights
+		WHERE ${scopeWhere(scope)} AND resolved_at IS NULL
+	`.execute(db);
+  return rows.map((r) => ({
+    kind: r.resource_kind,
+    id: r.resource_id,
+    rule: r.rule
+  }));
+}
+async function listInsights(db, scope, now = new Date, filter = {}) {
+  const since = new Date(now.getTime() - RECOVERED_VISIBLE_MS);
+  const { rows } = await sql2`
+		SELECT i.id, i.rule, i.severity, i.impact, i.payload, i.first_seen_at, i.resolved_at
+		FROM insights i
+		WHERE ${scopeWhere(scope, sql2.ref("i.account_id"))}
+			AND i.dismissed_at IS NULL
+			AND (i.resolved_at IS NULL OR i.resolved_at > ${since})
+			${filter.kind ? sql2`AND i.resource_kind = ${filter.kind}` : sql2``}
+			${filter.id ? sql2`AND i.resource_id = ${filter.id}` : sql2``}
+			AND NOT EXISTS (
+				SELECT 1 FROM insight_mutes m
+				WHERE ${scopeWhere(scope, sql2.ref("m.account_id"))}
+					AND m.resource_kind = i.resource_kind
+					AND m.resource_id = i.resource_id
+					AND m.rule = i.rule
+			)
+	`.execute(db);
+  return rankInsights(rows.map((row) => {
+    const payload = parseJsonb(row.payload);
+    return {
+      id: row.id,
+      rule: row.rule,
+      severity: row.resolved_at ? "recovered" : row.severity,
+      impact: Number(row.impact),
+      ...payload,
+      createdAt: row.first_seen_at.toISOString(),
+      resolvedAt: row.resolved_at ? row.resolved_at.toISOString() : null
+    };
+  }));
+}
+async function dismissInsight(db, scope, id, now = new Date) {
+  if (!UUID_RE.test(id))
+    return false;
+  const result = await sql2`
+		UPDATE insights SET dismissed_at = ${now}
+		WHERE id = ${id}::uuid AND ${scopeWhere(scope)}
+	`.execute(db);
+  return Number(result.numAffectedRows ?? 0) > 0;
+}
+async function muteRule(db, scope, id) {
+  if (!UUID_RE.test(id))
+    return false;
+  const result = await sql2`
+		INSERT INTO insight_mutes (account_id, resource_kind, resource_id, rule)
+		SELECT account_id, resource_kind, resource_id, rule FROM insights
+		WHERE id = ${id}::uuid AND ${scopeWhere(scope)}
+		ON CONFLICT (coalesce(account_id, ${sql2.lit(NIL_UUID)}::uuid), resource_kind, resource_id, rule)
+		DO NOTHING
+	`.execute(db);
+  if (Number(result.numAffectedRows ?? 0) > 0)
+    return true;
+  return existsInScope(db, scope, id);
+}
+async function unmuteRule(db, scope, id) {
+  if (!await existsInScope(db, scope, id))
+    return false;
+  await sql2`
+		DELETE FROM insight_mutes m
+		USING insights i
+		WHERE i.id = ${id}::uuid
+			AND ${scopeWhere(scope, sql2.ref("i.account_id"))}
+			AND ${scopeWhere(scope, sql2.ref("m.account_id"))}
+			AND m.resource_kind = i.resource_kind
+			AND m.resource_id = i.resource_id
+			AND m.rule = i.rule
+	`.execute(db);
+  return true;
+}
+async function existsInScope(db, scope, id) {
+  if (!UUID_RE.test(id))
+    return false;
+  const { rows } = await sql2`
+		SELECT id FROM insights WHERE id = ${id}::uuid AND ${scopeWhere(scope)}
+	`.execute(db);
+  return rows.length > 0;
+}
+async function purgeResolved(db, scope, olderThanDays = 30, now = new Date) {
+  const cutoff = new Date(now.getTime() - olderThanDays * 86400000);
+  await sql2`
+		DELETE FROM insights
+		WHERE ${scopeWhere(scope)} AND resolved_at IS NOT NULL AND resolved_at < ${cutoff}
+	`.execute(db);
+}
+// src/env.ts
+import { z as z2 } from "zod";
+var networksSchema = z2.string().transform((val) => {
+  const networks = val.split(",").map((n) => n.trim()).filter(Boolean);
+  const valid = ["mainnet", "testnet"];
+  for (const n of networks) {
+    if (!valid.includes(n)) {
+      throw new Error(`Invalid network: ${n}. Must be one of: ${valid.join(", ")}`);
+    }
+  }
+  return networks;
+});
+var envSchema = z2.object({
+  DATABASE_URL: z2.preprocess((val) => typeof val === "string" && val.length === 0 ? undefined : val, z2.string().url().optional()),
+  SOURCE_DATABASE_URL: z2.preprocess((val) => typeof val === "string" && val.length === 0 ? undefined : val, z2.string().url().optional()),
+  TARGET_DATABASE_URL: z2.preprocess((val) => typeof val === "string" && val.length === 0 ? undefined : val, z2.string().url().optional()),
+  NETWORK: z2.enum(["mainnet", "testnet"]).optional(),
+  NETWORKS: networksSchema.optional(),
+  LOG_LEVEL: z2.enum(["debug", "info", "warn", "error"]).default("info"),
+  NODE_ENV: z2.enum(["development", "production", "test"]).default("development")
+});
+var cachedEnv = null;
+function getEnv() {
+  if (cachedEnv) {
+    return cachedEnv;
+  }
+  const result = envSchema.safeParse(process.env);
+  if (!result.success) {
+    console.error("❌ Invalid environment configuration:");
+    console.error(z2.treeifyError(result.error));
+    throw new Error("Invalid environment configuration");
+  }
+  let enabledNetworks;
+  if (result.data.NETWORKS && result.data.NETWORKS.length > 0) {
+    enabledNetworks = result.data.NETWORKS;
+  } else if (result.data.NETWORK) {
+    enabledNetworks = [result.data.NETWORK];
+  } else {
+    enabledNetworks = ["mainnet"];
+  }
+  cachedEnv = { ...result.data, enabledNetworks };
+  return cachedEnv;
+}
+function isProductionEnv() {
+  return process.env["NODE_ENV"] === "production";
+}
+function isPox4DecoderEnabled(env = process.env) {
+  return env.POX4_DECODER_ENABLED !== "false";
+}
+function isPox5DecoderEnabled(env = process.env) {
+  return env.POX5_DECODER_ENABLED !== "false";
+}
+function isSbtcDecoderEnabled(env = process.env) {
+  return env.SBTC_DECODER_ENABLED !== "false";
+}
+function isBnsDecoderEnabled(env = process.env) {
+  return env.BNS_DECODER_ENABLED === "true";
+}
+// src/logger.ts
+var LOG_LEVELS = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+
+class Logger {
+  _level;
+  _isProduction;
+  _initialized = false;
+  init() {
+    if (this._initialized)
+      return;
+    this._initialized = true;
+    try {
+      const env = getEnv();
+      this._level = env.LOG_LEVEL;
+      this._isProduction = env.NODE_ENV === "production";
+    } catch {
+      this._level = "info";
+      this._isProduction = false;
+    }
+  }
+  get level() {
+    this.init();
+    return this._level;
+  }
+  get isProduction() {
+    this.init();
+    return this._isProduction;
+  }
+  shouldLog(level) {
+    return LOG_LEVELS[level] >= LOG_LEVELS[this.level];
+  }
+  formatMessage(level, message, meta) {
+    const timestamp = new Date().toISOString();
+    if (this.isProduction) {
+      return JSON.stringify({
+        timestamp,
+        level,
+        message,
+        ...meta
+      });
+    }
+    const metaStr = meta ? ` ${JSON.stringify(meta)}` : "";
+    return `[${timestamp}] ${level.toUpperCase()}: ${message}${metaStr}`;
+  }
+  debug(message, meta) {
+    if (this.shouldLog("debug")) {
+      console.debug(this.formatMessage("debug", message, meta));
+    }
+  }
+  info(message, meta) {
+    if (this.shouldLog("info")) {
+      console.info(this.formatMessage("info", message, meta));
+    }
+  }
+  warn(message, meta) {
+    if (this.shouldLog("warn")) {
+      console.warn(this.formatMessage("warn", message, meta));
+    }
+  }
+  error(message, meta) {
+    if (this.shouldLog("error")) {
+      console.error(this.formatMessage("error", message, meta));
+    }
+  }
+}
+var logger = new Logger;
+
+// src/classify/confidence.ts
+var clamp01 = (n) => Math.min(1, Math.max(0, n));
+function choiceConfidence(probabilities) {
+  const ps = Object.values(probabilities);
+  const k = ps.length;
+  if (k <= 1)
+    return 1;
+  const pmax = Math.max(...ps);
+  return clamp01((pmax - 1 / k) / (1 - 1 / k));
+}
+function scoreConfidence(probabilities, levels) {
+  if (levels <= 1)
+    return 1;
+  let mode = 0;
+  let best = -1;
+  for (let i = 0;i < levels; i++) {
+    const p = probabilities[String(i)] ?? 0;
+    if (p > best) {
+      best = p;
+      mode = i;
+    }
+  }
+  let e = 0;
+  let d = 0;
+  for (let i = 0;i < levels; i++) {
+    e += (probabilities[String(i)] ?? 0) * Math.abs(i - mode);
+    d += Math.abs(i - (levels - 1) / 2);
+  }
+  d /= levels;
+  return clamp01(1 - e / d);
+}
+function booleanConfidence(p) {
+  return Math.abs(2 * p - 1);
+}
+function normalizeAnswer(question, raw) {
+  if (raw.type === "refusal")
+    return { type: "refusal" };
+  if (raw.type === "boolean" && question.type === "boolean") {
+    return {
+      type: "boolean",
+      probability: raw.probability,
+      confidence: booleanConfidence(raw.probability)
+    };
+  }
+  if (raw.type === "choice" && question.type === "choice") {
+    const probabilities = raw.probabilities ?? {};
+    return {
+      type: "choice",
+      choice: raw.choice,
+      probabilities,
+      confidence: raw.probabilities ? choiceConfidence(probabilities) : 0
+    };
+  }
+  if (raw.type === "score" && question.type === "score") {
+    const probabilities = raw.probabilities ?? {};
+    return {
+      type: "score",
+      score: raw.score,
+      probabilities,
+      confidence: raw.probabilities ? scoreConfidence(probabilities, question.criteria.length) : 0
+    };
+  }
+  return { type: "refusal" };
+}
+
+// src/classify/types.ts
+class ClassifierInputError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ClassifierInputError";
+  }
+}
+
+// src/classify/limits.ts
+var MAX_QUESTIONS = 64;
+var MIN_CHOICE = 2;
+var MAX_CHOICE = 255;
+var MIN_SCORE = 2;
+var MAX_SCORE = 10;
+var QUESTION_ID = /^[A-Za-z0-9_.-]{1,100}$/;
+var MAX_STATE_CHARS = 24000;
+function validateQuestions(questions) {
+  const ids = Object.keys(questions);
+  if (ids.length === 0)
+    throw new ClassifierInputError("no questions");
+  if (ids.length > MAX_QUESTIONS) {
+    throw new ClassifierInputError(`more than ${MAX_QUESTIONS} questions`);
+  }
+  for (const id of ids) {
+    if (!QUESTION_ID.test(id)) {
+      throw new ClassifierInputError(`invalid question id: ${id}`);
+    }
+    const q = questions[id];
+    if (q.type === "choice") {
+      const n = Object.keys(q.criteria).length;
+      if (n < MIN_CHOICE || n > MAX_CHOICE) {
+        throw new ClassifierInputError(`question ${id}: choice needs ${MIN_CHOICE}-${MAX_CHOICE} options`);
+      }
+    } else if (q.type === "score") {
+      const n = q.criteria.length;
+      if (n < MIN_SCORE || n > MAX_SCORE) {
+        throw new ClassifierInputError(`question ${id}: score needs ${MIN_SCORE}-${MAX_SCORE} levels`);
+      }
+    } else if (q.type !== "boolean") {
+      throw new ClassifierInputError(`question ${id}: unknown type`);
+    }
+  }
+}
+function stateSize(state) {
+  return typeof state === "string" ? state.length : JSON.stringify(state).length;
+}
+
+// src/classify/system-one.ts
+function toWireState(state) {
+  const parts = state.map((p) => {
+    if (p.type === "text")
+      return p.text;
+    if (p.type === "json")
+      return p.value;
+    throw new Error("file state unsupported");
+  });
+  return parts.length === 1 ? parts[0] : parts;
+}
+function renormalize(p) {
+  const sum = Object.values(p).reduce((a, b) => a + b, 0);
+  if (!(sum > 0))
+    return p;
+  return Object.fromEntries(Object.entries(p).map(([k, v]) => [k, v / sum]));
+}
+function mapAnswer(a) {
+  if (a.type === "noul" && typeof a.noul === "number") {
+    return { type: "boolean", probability: a.noul };
+  }
+  if (a.type === "choice" && typeof a.choice === "string") {
+    return {
+      type: "choice",
+      choice: a.choice,
+      ...a.probabilities && { probabilities: renormalize(a.probabilities) }
+    };
+  }
+  if (a.type === "score" && typeof a.score === "number") {
+    if (!a.probabilities)
+      return { type: "score", score: a.score };
+    const probabilities = renormalize(a.probabilities);
+    const score = Object.entries(probabilities).reduce((s, [level, p]) => s + Number(level) * p, 0);
+    return { type: "score", score, probabilities };
+  }
+  return { type: "refusal" };
+}
+function systemOneModel(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  return {
+    specificationVersion: "v4",
+    provider: `secondlayer.${opts.provider}`,
+    modelId: opts.modelId,
+    supportedQuestionTypes: ["choice", "score", "boolean"],
+    async doDecide({ state, questions, abortSignal }) {
+      const wireQuestions = Object.fromEntries(Object.entries(questions).map(([id, q]) => [
+        id,
+        q.type === "boolean" ? { ...q, type: "noul" } : q
+      ]));
+      const res = await doFetch(opts.url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          ...opts.apiKey && { authorization: `Bearer ${opts.apiKey}` }
+        },
+        body: JSON.stringify({
+          model: opts.modelId,
+          state: toWireState(state),
+          questions: wireQuestions
+        }),
+        signal: abortSignal
+      });
+      if (!res.ok)
+        throw new Error(`${opts.provider} ${res.status}`);
+      const json = await res.json();
+      const body = json.result ?? json;
+      const answers = Object.fromEntries(Object.entries(body.answers ?? {}).map(([id, a]) => [id, mapAnswer(a)]));
+      return {
+        answers,
+        warnings: [],
+        usage: {
+          inputTokens: body.usage?.input_tokens,
+          outputTokens: body.usage?.output_tokens
+        },
+        response: { modelId: body.model ?? opts.modelId }
+      };
+    }
+  };
+}
+
+// src/classify/providers.ts
+var DEFAULT_MODEL = {
+  jev: "typesafe-ai/jev",
+  kev: "kev-latest",
+  clef: "clef"
+};
+var REQUIRED_ENV = {
+  jev: ["AI_GATEWAY_API_KEY"],
+  kev: ["KEV_URL"],
+  clef: ["CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_API_TOKEN"]
+};
+var envModel = (env) => env.CLASSIFIER_MODEL?.trim() || undefined;
+function resolveProvider(env = process.env) {
+  const rules = { name: "rules", modelId: "rules" };
+  const requested = env.CLASSIFIER?.trim();
+  let name;
+  if (!requested) {
+    name = env.AI_GATEWAY_API_KEY ? "jev" : "rules";
+  } else if (requested === "jev" || requested === "kev" || requested === "clef" || requested === "rules") {
+    name = requested;
+  } else {
+    logger.warn(`classifier: unknown CLASSIFIER=${requested}; using rules`);
+    return rules;
+  }
+  if (name === "rules")
+    return rules;
+  const missing = REQUIRED_ENV[name].find((v) => !env[v]);
+  if (missing) {
+    logger.warn(`classifier: CLASSIFIER=${name} missing ${missing}; using rules`);
+    return rules;
+  }
+  return { name, modelId: envModel(env) ?? DEFAULT_MODEL[name] };
+}
+function buildModel(name, modelId, env = process.env, fetchImpl) {
+  if (name === "jev")
+    return modelId;
+  if (name === "kev") {
+    return systemOneModel({
+      provider: "kev",
+      url: `${(env.KEV_URL ?? "").replace(/\/$/, "")}/v1/systemone`,
+      modelId,
+      apiKey: env.KEV_API_KEY,
+      fetchImpl
+    });
+  }
+  return systemOneModel({
+    provider: "clef",
+    url: `https://api.cloudflare.com/client/v4/accounts/${env.CLOUDFLARE_ACCOUNT_ID}/ai/run/@cf/cloudflare/${modelId}`,
+    modelId,
+    apiKey: env.CLOUDFLARE_API_TOKEN,
+    fetchImpl
+  });
+}
+
+// src/classify/rules.ts
+function answerFor(question, value) {
+  if (value === undefined)
+    return { type: "refusal" };
+  if (question.type === "choice") {
+    if (typeof value !== "string" || !(value in question.criteria)) {
+      return { type: "refusal" };
+    }
+    const probabilities = Object.fromEntries(Object.keys(question.criteria).map((k) => [k, k === value ? 1 : 0]));
+    return { type: "choice", choice: value, probabilities, confidence: 1 };
+  }
+  if (question.type === "score") {
+    const n = question.criteria.length;
+    if (typeof value !== "number" || !Number.isInteger(value)) {
+      return { type: "refusal" };
+    }
+    if (value < 0 || value >= n)
+      return { type: "refusal" };
+    const probabilities = Object.fromEntries(Array.from({ length: n }, (_, i) => [String(i), i === value ? 1 : 0]));
+    return { type: "score", score: value, probabilities, confidence: 1 };
+  }
+  if (typeof value !== "boolean")
+    return { type: "refusal" };
+  return { type: "boolean", probability: value ? 1 : 0, confidence: 1 };
+}
+function runRules(questions, fn, state) {
+  const values = fn(state) ?? {};
+  const out = {};
+  for (const id of Object.keys(questions)) {
+    out[id] = answerFor(questions[id], values[id]);
+  }
+  return out;
+}
+
+// src/classify/classify.ts
+async function classify(input) {
+  validateQuestions(input.questions);
+  const env = input.env ?? process.env;
+  const resolved = resolveProvider(env);
+  const name = input.provider ?? resolved.name;
+  if (name === "rules") {
+    if (!input.rules)
+      return null;
+    return {
+      provider: "rules",
+      modelId: "rules",
+      answers: runRules(input.questions, input.rules, input.state)
+    };
+  }
+  const modelId = input.modelId ?? (input.provider ? undefined : envModel(env)) ?? DEFAULT_MODEL[name];
+  if (stateSize(input.state) > MAX_STATE_CHARS) {
+    logger.warn(`classifier: state over ${MAX_STATE_CHARS} chars; skipped`);
+    return null;
+  }
+  try {
+    const { experimental_decide: decide } = await import("ai");
+    const r = await decide({
+      model: buildModel(name, modelId, env, input.fetchImpl),
+      state: input.state,
+      questions: input.questions,
+      maxRetries: 1,
+      abortSignal: AbortSignal.timeout(input.timeoutMs ?? 5000)
+    });
+    const answers = {};
+    for (const id of Object.keys(input.questions)) {
+      answers[id] = normalizeAnswer(input.questions[id], r.answers[id] ?? { type: "refusal" });
+    }
+    return {
+      provider: name,
+      modelId: r.response.modelId ?? modelId,
+      answers
+    };
+  } catch (err) {
+    logger.warn(`classifier: ${name} failed: ${err instanceof Error ? err.name : "error"}`);
+    return null;
+  }
+}
+// src/insights/label.ts
+var CAUSE_CONFIDENCE = 0.85;
+var LABEL_TIMEOUT_MS = 5000;
+var CACHE_TTL_MS = 6 * 3600000;
+var CAUSE_QUESTIONS = {
+  cause: {
+    type: "choice",
+    instructions: "Which cause best explains this webhook's change?",
+    criteria: {
+      receiver_down: "receiver unreachable: 5xx from a proxy, connection refused, timeouts",
+      receiver_rate_limiting: "receiver answers 429 or slows under load",
+      receiver_rejects_payload: "4xx other than 429: auth, schema, signature",
+      receiver_slow: "2xx but response time well above baseline",
+      tls_or_dns: "certificate or name resolution errors",
+      chain_quiet: "matching events dropped as much as deliveries",
+      config_change: "change began right after the webhook's settings changed",
+      our_side: "delivery service or chain source is behind (cursor lag)",
+      unknown: "none of these fit the evidence"
+    }
+  }
+};
+var defaultCache = new Map;
+function cacheKey(insight) {
+  const codes = insight.evidence.flatMap((e) => e.kind === "shapes" ? e.shapes.map((s) => s.code) : []).sort().join(",");
+  return `${insight.resource.kind}:${insight.resource.id}:${insight.rule}:${codes}`;
+}
+function renderState(insight) {
+  return [
+    `${insight.resource.kind} ${insight.resource.name}`,
+    `rule: ${insight.rule}`,
+    `detector: ${insight.how.detector}`,
+    ...insight.how.facts.map(([k, v]) => `${k}: ${v}`)
+  ].join(`
+`);
+}
+async function maybeLabel(insight, deps = {}) {
+  const env = deps.env ?? process.env;
+  if (env.INSIGHTS_MODEL_LABELS !== "on")
+    return insight;
+  if (!insight.rule.startsWith("receiver_"))
+    return insight;
+  const now = deps.now ?? Date.now();
+  const cache = deps.cache ?? defaultCache;
+  const key = cacheKey(insight);
+  const hit = cache.get(key);
+  let outcome;
+  if (hit && now - hit.at < CACHE_TTL_MS) {
+    outcome = hit.outcome;
+  } else {
+    const result = await (deps.classifyFn ?? classify)({
+      state: renderState(insight),
+      questions: CAUSE_QUESTIONS,
+      timeoutMs: LABEL_TIMEOUT_MS,
+      env
+    }).catch((err) => {
+      logger.warn("insights.label_failed", { error: String(err) });
+      return null;
+    });
+    if (!result)
+      return insight;
+    const answer = result.answers.cause;
+    outcome = answer.type === "choice" && answer.confidence >= CAUSE_CONFIDENCE && answer.choice !== "unknown" ? { cause: answer.choice, confidence: answer.confidence } : null;
+    cache.set(key, { at: now, outcome });
+  }
+  if (!outcome)
+    return insight;
+  return { ...insight, how: { ...insight.how, label: outcome } };
+}
+// src/insights/subgraph-rules.ts
+import { sql as sql3 } from "kysely";
+
+// src/subgraphs/health.ts
+var HOUR_MS = 3600000;
+function positiveDeltas(values) {
+  let total = 0;
+  let prev = null;
+  for (const value of values) {
+    if (value === null)
+      continue;
+    if (prev !== null && value > prev)
+      total += value - prev;
+    prev = value;
+  }
+  return total;
+}
+function toNumber(value) {
+  if (value === null)
+    return null;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : null;
+}
+function bucketHourly(snapshots, hours, now = Date.now()) {
+  const sorted = snapshots.map((s) => ({ ...s, at: new Date(s.captured_at).getTime() })).sort((a, b) => a.at - b.at);
+  const currentHourStart = Math.floor(now / HOUR_MS) * HOUR_MS;
+  const out = [];
+  for (let i = hours - 1;i >= 0; i--) {
+    const start = currentHourStart - i * HOUR_MS;
+    const end = start + HOUR_MS;
+    const inHour = sorted.filter((s) => s.at >= start && s.at < end);
+    if (inHour.length === 0) {
+      out.push({
+        hour: new Date(start).toISOString(),
+        lagBlocks: null,
+        rowsWritten: 0,
+        errors: 0,
+        eventsHandled: 0
+      });
+      continue;
+    }
+    const before = sorted.filter((s) => s.at < start).at(-1);
+    const series = before ? [before, ...inHour] : inHour;
+    const lags = inHour.map((s) => {
+      const tip = toNumber(s.chain_tip);
+      const cursor = toNumber(s.last_processed_block);
+      return tip === null || cursor === null ? null : Math.max(0, tip - cursor);
+    }).filter((lag) => lag !== null);
+    out.push({
+      hour: new Date(start).toISOString(),
+      lagBlocks: lags.length > 0 ? Math.max(...lags) : null,
+      rowsWritten: positiveDeltas(series.map((s) => toNumber(s.rows_written_total))),
+      errors: positiveDeltas(series.map((s) => toNumber(s.total_errors))),
+      eventsHandled: positiveDeltas(series.map((s) => toNumber(s.total_processed)))
+    });
+  }
+  return out;
+}
+
+// src/insights/subgraph-rules.ts
+var HOUR_MS2 = 3600000;
+var ERROR_GROUPS_SHOWN = 3;
+function subject(name) {
+  return `My Secondlayer subgraph "${name}"`;
+}
+function resourceOf(input) {
+  return {
+    kind: "subgraph",
+    id: input.subgraph.name,
+    name: input.subgraph.name
+  };
+}
+var handlerErrors = {
+  id: "subgraph_handler_errors",
+  skip: (input) => input.snapshots.length === 0,
+  evaluate(input) {
+    const hours = bucketHourly(input.snapshots, 24, input.now.getTime());
+    const errors = hours.reduce((sum, h) => sum + h.errors, 0);
+    if (errors < HANDLER_ERRORS_MIN_24H)
+      return null;
+    const { subgraph } = input;
+    const top = input.errorGroups.slice(0, ERROR_GROUPS_SHOWN);
+    const leader = top[0];
+    const eventTypes = [
+      ...new Set(top.map((g) => g.eventType).filter((t) => !!t))
+    ];
+    const leaderText = leader ? plainSnippet(leader.message, 120) : "";
+    return {
+      rule: "subgraph_handler_errors",
+      severity: "losing",
+      impact: errors,
+      resource: resourceOf(input),
+      line: `${subgraph.name} threw ${plural(errors, "handler error")} today`,
+      meta: "last 24 hours",
+      lead: "Your handler is failing on some events.",
+      body: [
+        `${plural(errors, "event")} failed inside your handler in the last 24 hours, and those rows were not written.`,
+        leader ? `The most common error is: ${leaderText}${eventTypes.length > 0 ? ` (event type ${eventTypes[0]})` : ""}.` : ""
+      ].filter(Boolean).join(" "),
+      evidence: top.length > 0 ? [
+        {
+          kind: "table",
+          title: "Most common errors",
+          columns: ["Error", "Event type", "Seen"],
+          rows: top.map((g) => [
+            plainSnippet(g.message, 120),
+            g.eventType ?? g.sourceName,
+            g.count
+          ])
+        }
+      ] : [],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject(subgraph.name),
+          observed: [
+            `threw ${plural(errors, "handler error")} in the last 24 hours`,
+            leader ? `The most common error is: ${leaderText}${eventTypes[0] ? ` on event type ${eventTypes[0]}` : ""}, seen ${plural(leader.count, "time")} in total` : ""
+          ],
+          lookAt: eventTypes.length > 0 ? `Check how the handler deals with ${eventTypes.join(" and ")} events` : "Check what the failing events have in common",
+          followUp: `Then run sl subgraphs gaps ${subgraph.name}`
+        }),
+        commands: [`sl subgraphs gaps ${subgraph.name}`]
+      },
+      how: {
+        detector: `${HANDLER_ERRORS_MIN_24H} or more handler errors in the last 24 hours of health history`,
+        facts: [
+          ["errors in 24 hours", String(errors)],
+          [
+            "event types in top errors",
+            eventTypes.join(", ") || "none recorded"
+          ],
+          ["group counts", "all-time per group, not limited to 24 hours"]
+        ]
+      }
+    };
+  }
+};
+var lag = {
+  id: "subgraph_lag",
+  skip: (input) => lagSamples(input).length < SUBGRAPH_LAG_SNAPSHOTS,
+  evaluate(input) {
+    if (input.subgraph.status !== "active")
+      return null;
+    const newest = lagSamples(input).slice(0, SUBGRAPH_LAG_SNAPSHOTS);
+    if (newest.length < SUBGRAPH_LAG_SNAPSHOTS)
+      return null;
+    if (!newest.every((s) => s.blocks > SUBGRAPH_LAG_BLOCKS))
+      return null;
+    const current = newest[0]?.blocks ?? 0;
+    const since = newest[newest.length - 1]?.at ?? input.now;
+    const minutes = Math.max(1, Math.round((input.now.getTime() - since.getTime()) / 60000));
+    const { subgraph } = input;
+    const hours = bucketHourly(input.snapshots, 24, input.now.getTime());
+    return {
+      rule: "subgraph_lag",
+      severity: current > SUBGRAPH_LAG_LOSING_BLOCKS ? "losing" : "will_fail",
+      impact: current,
+      resource: resourceOf(input),
+      line: `${subgraph.name} is ${plural(current, "block")} behind`,
+      meta: `for about ${plural(minutes, "minute")}`,
+      lead: "Your subgraph is falling behind the chain.",
+      body: `It has trailed the chain tip by more than ${SUBGRAPH_LAG_BLOCKS} blocks on its last ${SUBGRAPH_LAG_SNAPSHOTS} checks, and is ${plural(current, "block")} behind now. Rows are late until it catches up.`,
+      evidence: [
+        {
+          kind: "series",
+          title: "Blocks behind the chain, per hour",
+          series: [
+            {
+              name: "Blocks behind",
+              role: "a",
+              points: hours.map((h) => h.lagBlocks ?? 0)
+            }
+          ],
+          labels: [
+            [0, "24h ago"],
+            [hours.length - 1, "now"]
+          ],
+          unit: "blocks"
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject(subgraph.name),
+          observed: [
+            `has been more than ${SUBGRAPH_LAG_BLOCKS} blocks behind the chain for about ${plural(minutes, "minute")}`,
+            `It is ${plural(current, "block")} behind right now`
+          ],
+          lookAt: "Check whether the handler got slower, a recent deploy changed how much work each block needs, or the subgraph is processing a very large range",
+          followUp: `Then run sl subgraphs status ${subgraph.name}`
+        }),
+        commands: [`sl subgraphs status ${subgraph.name}`]
+      },
+      how: {
+        detector: `more than ${SUBGRAPH_LAG_BLOCKS} blocks behind the tip on ${SUBGRAPH_LAG_SNAPSHOTS} consecutive health snapshots, and not reindexing`,
+        facts: [
+          ["blocks behind now", String(current)],
+          ["snapshots over the line", String(newest.length)],
+          ["behind since about", `${since.toISOString().slice(11, 16)} UTC`]
+        ]
+      }
+    };
+  }
+};
+function lagSamples(input) {
+  return input.snapshots.map((s) => ({
+    at: new Date(s.captured_at),
+    tip: s.chain_tip === null ? null : Number(s.chain_tip),
+    cursor: s.last_processed_block === null ? null : Number(s.last_processed_block)
+  })).filter((s) => s.tip !== null && s.cursor !== null).sort((a, b) => b.at.getTime() - a.at.getTime()).map((s) => ({ at: s.at, blocks: Math.max(0, s.tip - s.cursor) }));
+}
+var SUBGRAPH_RULES = [
+  handlerErrors,
+  lag
+];
+async function loadSubgraphInputs(db, now) {
+  const subgraphs = await db.selectFrom("subgraphs").select(["id", "name", "status"]).execute();
+  if (subgraphs.length === 0)
+    return [];
+  const since = new Date(now.getTime() - 25 * HOUR_MS2);
+  const snapshots = await db.selectFrom("subgraph_health_snapshots").select([
+    "subgraph_id",
+    "captured_at",
+    "chain_tip",
+    "last_processed_block",
+    "rows_written_total",
+    "total_errors",
+    "total_processed"
+  ]).where("captured_at", ">=", since).orderBy("captured_at", "asc").execute();
+  const groups = await sql3`
+		SELECT subgraph_name, message, event_type, source_name, count, last_seen
+		FROM subgraph_error_groups
+		WHERE last_seen > ${new Date(now.getTime() - 24 * HOUR_MS2)}
+		ORDER BY count DESC
+	`.execute(db);
+  return subgraphs.map((subgraph) => ({
+    now,
+    subgraph,
+    snapshots: snapshots.filter((s) => s.subgraph_id === subgraph.id),
+    errorGroups: groups.rows.filter((g) => g.subgraph_name === subgraph.name).slice(0, ERROR_GROUPS_SHOWN).map((g) => ({
+      message: g.message,
+      eventType: g.event_type,
+      sourceName: g.source_name,
+      count: Number(g.count),
+      lastSeen: g.last_seen
+    }))
+  }));
+}
+
+// src/insights/webhook-rules.ts
+import { sql as sql4 } from "kysely";
+var MINUTE_MS = 60000;
+var DAY_MS = 86400000;
+var BUCKET_MS = 10 * MINUTE_MS;
+var BUCKETS = 36;
+var SHAPE_BODY_MAX = 80;
+var SHAPES_MAX = 4;
+var ATTEMPT_WINDOW = 300;
+var ATTEMPT_LOOKBACK_DAYS = 8;
+var PRIOR_WINDOW_MS = 7 * DAY_MS;
+function consecutiveFromStart(rows, predicate) {
+  const out = [];
+  for (const row of rows) {
+    if (!predicate(row))
+      break;
+    out.push(row);
+  }
+  return out;
+}
+var is2xx = (d) => d.statusCode !== null && d.statusCode >= 200 && d.statusCode < 300;
+var isDown = (d) => d.statusCode === null || d.statusCode >= 500;
+var isReject = (d) => d.statusCode !== null && d.statusCode >= 400 && d.statusCode < 500 && d.statusCode !== 429;
+var isHtml = (d) => (d.contentType ?? "").toLowerCase().startsWith("text/html");
+var isJson = (d) => (d.contentType ?? "").toLowerCase().startsWith("application/json");
+function codeLabel(statusCode) {
+  return statusCode === null ? "no response" : String(statusCode);
+}
+function shapeText(d) {
+  return (d.body ?? d.errorMessage ?? "").replace(/\s+/g, " ").trim().slice(0, SHAPE_BODY_MAX);
+}
+function shapeKey(d) {
+  return `${codeLabel(d.statusCode)}\x00${shapeText(d)}`;
+}
+function buildShapes(affected, earlier, now) {
+  const seenBefore = new Set(earlier.filter((d) => now.getTime() - d.dispatchedAt.getTime() <= PRIOR_WINDOW_MS).map(shapeKey));
+  const counts = new Map;
+  for (const d of affected) {
+    const key = shapeKey(d);
+    const entry = counts.get(key);
+    if (entry)
+      entry.count++;
+    else
+      counts.set(key, { sample: d, count: 1 });
+  }
+  return [...counts.entries()].sort((a, b) => b[1].count - a[1].count).slice(0, SHAPES_MAX).map(([key, { sample, count }]) => ({
+    code: codeLabel(sample.statusCode),
+    body: shapeText(sample),
+    count,
+    isNew: !seenBefore.has(key)
+  }));
+}
+function subject2(name) {
+  return `My Secondlayer webhook "${name}"`;
+}
+function mostCommonCode(rows) {
+  const counts = new Map;
+  for (const r of rows)
+    counts.set(r.statusCode, (counts.get(r.statusCode) ?? 0) + 1);
+  return [...counts.entries()].sort((a, b) => b[1] - a[1])[0]?.[0] ?? null;
+}
+function breakdown(rows) {
+  const counts = new Map;
+  for (const r of rows) {
+    const key = codeLabel(r.statusCode);
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  return [...counts.entries()].map(([k, n]) => `${n}x ${k}`).join(", ");
+}
+function attemptsLast24h(input) {
+  const since = input.now.getTime() - DAY_MS;
+  return input.attempts.filter((a) => a.dispatchedAt.getTime() >= since).length;
+}
+function resourceOf2(input) {
+  return {
+    kind: "webhook",
+    id: input.webhook.id,
+    name: input.webhook.name
+  };
+}
+function throughputEvidence(input) {
+  const { startMs, matched, delivered } = input.throughput;
+  const at = (i) => utcTime(new Date(startMs + i * BUCKET_MS)).slice(0, 5);
+  return {
+    kind: "series",
+    title: "Matched and delivered, every 10 minutes",
+    series: [
+      { name: "Matched", role: "context", points: matched },
+      { name: "Delivered", role: "a", points: delivered }
+    ],
+    labels: [
+      [0, at(0)],
+      [Math.floor(BUCKETS / 2), at(Math.floor(BUCKETS / 2))],
+      [BUCKETS - 1, "now"]
+    ],
+    unit: "events"
+  };
+}
+function matchedPerHour(input) {
+  const total = input.throughput.matched.reduce((a, b) => a + b, 0);
+  return Math.round(total / (BUCKETS / 6));
+}
+function levenshtein(a, b) {
+  const prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1;i <= a.length; i++) {
+    let diagonal = prev[0] ?? 0;
+    prev[0] = i;
+    for (let j = 1;j <= b.length; j++) {
+      const above = prev[j] ?? 0;
+      prev[j] = Math.min(above + 1, (prev[j - 1] ?? 0) + 1, diagonal + (a[i - 1] === b[j - 1] ? 0 : 1));
+      diagonal = above;
+    }
+  }
+  return prev[b.length] ?? 0;
+}
+function canonicalJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+var receiverDown = {
+  id: "receiver_down",
+  evaluate(input) {
+    const streak = consecutiveFromStart(input.attempts, isDown);
+    if (streak.length < DOWN_MIN_CONSECUTIVE)
+      return null;
+    const { webhook } = input;
+    const since = streak[streak.length - 1]?.dispatchedAt ?? input.now;
+    const host = hostOf(webhook.url);
+    const code = mostCommonCode(streak);
+    const server = streak.find((d) => d.server)?.server ?? null;
+    const answer = code === null ? "did not answer" : `returns HTTP ${code}${server ? ` from ${plainSnippet(server, 30)}` : ""}`;
+    const hourly = matchedPerHour(input);
+    const queued = input.pending;
+    const flowing = hourly > 0 ? `Chain matches are normal (about ${hourly} an hour), so the problem is the receiver.` : "";
+    const shapes = buildShapes(streak, input.attempts.slice(streak.length), input.now);
+    return {
+      rule: "receiver_down",
+      severity: "losing",
+      impact: queued > 0 ? queued : streak.length,
+      resource: resourceOf2(input),
+      line: `${webhook.name} has failed ${streak.length} deliveries in a row`,
+      meta: `since ${utcTime(since)}`,
+      lead: "Your receiver is down, not us.",
+      body: [
+        `${host} ${answer} on every delivery since ${utcTime(since)}.`,
+        queued > 0 ? `${plural(queued, "delivery")} queued to retry.` : "",
+        flowing
+      ].filter(Boolean).join(" "),
+      evidence: [
+        throughputEvidence(input),
+        { kind: "shapes", title: "What the receiver sent back", shapes }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            `has been failing since ${utcTime(since)}`,
+            `The receiver ${host} ${answer} on every delivery`,
+            queued > 0 ? `${plural(queued, "delivery")} queued to retry` : "",
+            flowing.replace(/\.$/, "")
+          ],
+          lookAt: `Check the service behind ${host}`,
+          followUp: `Then run sl webhooks doctor ${webhook.name}`
+        }),
+        commands: [
+          `sl webhooks doctor ${webhook.name}`,
+          `sl webhooks dead ${webhook.name}`
+        ]
+      },
+      how: {
+        detector: `the newest ${DOWN_MIN_CONSECUTIVE} or more delivery attempts are 5xx or got no response`,
+        facts: [
+          ["consecutive failures", String(streak.length)],
+          ["breakdown", breakdown(streak)],
+          ["first failure", utcDateTime(since)],
+          [
+            "last success",
+            webhook.lastSuccessAt ? utcDateTime(webhook.lastSuccessAt) : "never"
+          ],
+          ["queued retries", String(queued)]
+        ]
+      }
+    };
+  }
+};
+var receiverRejects = {
+  id: "receiver_rejects",
+  evaluate(input) {
+    const streak = consecutiveFromStart(input.attempts, isReject);
+    if (streak.length < REJECTS_MIN_CONSECUTIVE)
+      return null;
+    const { webhook } = input;
+    const host = hostOf(webhook.url);
+    const code = mostCommonCode(streak);
+    const since = streak[streak.length - 1]?.dispatchedAt ?? input.now;
+    const text = plainSnippet(streak.find((d) => d.body || d.errorMessage)?.body ?? streak.find((d) => d.errorMessage)?.errorMessage, 100);
+    return {
+      rule: "receiver_rejects",
+      severity: "losing",
+      impact: input.pending > 0 ? input.pending : streak.length,
+      resource: resourceOf2(input),
+      line: `${webhook.name} is being rejected by ${host}`,
+      meta: `${streak.length} in a row, HTTP ${code}`,
+      lead: "Your receiver is refusing our requests.",
+      body: [
+        `${host} answered HTTP ${code} to the last ${streak.length} deliveries, since ${utcTime(since)}.`,
+        text ? `It said: ${text}.` : "",
+        "It is reachable, so this is usually its auth or signature check."
+      ].filter(Boolean).join(" "),
+      evidence: [
+        {
+          kind: "shapes",
+          title: "What the receiver sent back",
+          shapes: buildShapes(streak, input.attempts.slice(streak.length), input.now)
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            `has been rejected since ${utcTime(since)}`,
+            `The receiver ${host} answered HTTP ${code} to ${plural(streak.length, "delivery")} in a row`,
+            text ? `The response said: ${text}` : ""
+          ],
+          lookAt: `Check how ${host} authenticates or verifies signatures on incoming webhook requests`,
+          followUp: `Then run sl webhooks test ${webhook.name}`
+        }),
+        commands: [`sl webhooks test ${webhook.name}`]
+      },
+      how: {
+        detector: `the newest ${REJECTS_MIN_CONSECUTIVE} or more delivery attempts are 4xx other than 429`,
+        facts: [
+          ["consecutive rejects", String(streak.length)],
+          ["breakdown", breakdown(streak)],
+          ["first reject", utcDateTime(since)]
+        ]
+      }
+    };
+  }
+};
+var receiverRateLimited = {
+  id: "receiver_rate_limited",
+  evaluate(input) {
+    const window = input.attempts.slice(0, 100);
+    if (window.length < RATE_LIMITED_MIN_ATTEMPTS)
+      return null;
+    const limited = window.filter((d) => d.statusCode === 429);
+    if (limited.length / window.length < RATE_LIMITED_MIN_RATIO)
+      return null;
+    const { webhook } = input;
+    const host = hostOf(webhook.url);
+    const retryAfter = limited.find((d) => d.retryAfter && /^\d+$/.test(d.retryAfter))?.retryAfter ?? null;
+    const percent = Math.round(limited.length / window.length * 100);
+    return {
+      rule: "receiver_rate_limited",
+      severity: "will_fail",
+      impact: limited.length,
+      resource: resourceOf2(input),
+      line: `${host} is rate limiting ${webhook.name}`,
+      meta: `${limited.length} of the last ${window.length} attempts`,
+      lead: "Your receiver is telling us to slow down.",
+      body: [
+        `${percent}% of recent deliveries got HTTP 429.`,
+        retryAfter ? `It asked us to wait ${retryAfter} seconds.` : "",
+        "We retry, so nothing is lost yet, but a long streak ends in dead letters."
+      ].filter(Boolean).join(" "),
+      evidence: [
+        {
+          kind: "shapes",
+          title: "What the receiver sent back",
+          shapes: buildShapes(window, input.attempts.slice(window.length), input.now)
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            `is being rate limited by ${host}`,
+            `${limited.length} of the last ${window.length} delivery attempts got HTTP 429`,
+            retryAfter ? `The receiver asked for ${retryAfter} seconds between retries` : ""
+          ],
+          lookAt: `Check the rate limit on ${host} and whether this webhook should have its own allowance`,
+          followUp: `Then run sl webhooks deliveries ${webhook.name}`
+        }),
+        commands: [`sl webhooks deliveries ${webhook.name}`]
+      },
+      how: {
+        detector: `at least ${RATE_LIMITED_MIN_ATTEMPTS} recent attempts and ${Math.round(RATE_LIMITED_MIN_RATIO * 100)}% or more are HTTP 429`,
+        facts: [
+          ["429 responses", `${limited.length} of ${window.length}`],
+          ["latest Retry-After", retryAfter ? `${retryAfter}s` : "not sent"]
+        ]
+      }
+    };
+  }
+};
+var receiverLoginWall = {
+  id: "receiver_login_wall",
+  evaluate(input) {
+    const streak = consecutiveFromStart(input.attempts, (d) => is2xx(d) && isHtml(d));
+    if (streak.length < LOGIN_WALL_MIN_CONSECUTIVE)
+      return null;
+    const start = streak[streak.length - 1]?.dispatchedAt ?? input.now;
+    const prior = input.attempts.slice(streak.length).filter((d) => is2xx(d) && start.getTime() - d.dispatchedAt.getTime() <= PRIOR_WINDOW_MS);
+    if (prior.length < LOGIN_WALL_MIN_PRIOR)
+      return null;
+    const json = prior.filter(isJson);
+    if (json.length / prior.length < LOGIN_WALL_PRIOR_JSON_RATIO)
+      return null;
+    const { webhook } = input;
+    const host = hostOf(webhook.url);
+    const heights = streak.map((d) => d.blockHeight).filter((h) => h !== null);
+    const from = heights.length > 0 ? Math.min(...heights) : null;
+    const to = heights.length > 0 ? Math.max(...heights) : null;
+    const htmlSample = streak.find((d) => d.body);
+    const jsonSample = json.find((d) => d.body);
+    return {
+      rule: "receiver_login_wall",
+      severity: "losing",
+      impact: streak.length,
+      resource: resourceOf2(input),
+      line: `${host} now answers ${webhook.name} with a web page`,
+      meta: `${streak.length} deliveries since ${utcTime(start)}`,
+      lead: "Your receiver says OK, but sends back a web page.",
+      body: [
+        `Since ${utcTime(start)} every delivery got HTTP 200 with an HTML page instead of JSON.`,
+        "That is usually a login page or proxy screen in front of the endpoint, so the events are not reaching your handler."
+      ].join(" "),
+      evidence: [
+        {
+          kind: "shapes",
+          title: "Response before and after",
+          shapes: [
+            {
+              code: "200",
+              body: jsonSample ? shapeText(jsonSample) : "application/json",
+              count: json.length,
+              isNew: false
+            },
+            {
+              code: "200",
+              body: htmlSample ? shapeText(htmlSample) : "text/html",
+              count: streak.length,
+              isNew: true
+            }
+          ]
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            `has been answered with a web page since ${utcTime(start)}`,
+            `${host} returns HTTP 200 with text/html on ${streak.length} deliveries in a row, where it used to return JSON`,
+            `${json.length} of ${prior.length} successful deliveries in the week before were JSON`
+          ],
+          lookAt: `Check whether a login page, access policy or proxy rule was put in front of ${host}`,
+          followUp: from !== null && to !== null ? `Once it is fixed, replay the missed blocks with sl webhooks replay ${webhook.name} --from-block ${from} --to-block ${to} -y` : undefined
+        }),
+        commands: from !== null && to !== null ? [
+          `sl webhooks replay ${webhook.name} --from-block ${from} --to-block ${to} -y`
+        ] : []
+      },
+      how: {
+        detector: `the newest ${LOGIN_WALL_MIN_CONSECUTIVE} or more successful responses are text/html while ${Math.round(LOGIN_WALL_PRIOR_JSON_RATIO * 100)}% or more of the week before were JSON`,
+        facts: [
+          ["html responses in a row", String(streak.length)],
+          ["first html response", utcDateTime(start)],
+          ["json share before", `${json.length} of ${prior.length}`],
+          ...from !== null && to !== null ? [["affected blocks", `${from} to ${to}`]] : []
+        ]
+      }
+    };
+  }
+};
+function fitLine(points) {
+  const n = points.length;
+  const meanX = points.reduce((s, p) => s + p.x, 0) / n;
+  const meanY = points.reduce((s, p) => s + p.y, 0) / n;
+  let sxx = 0;
+  let sxy = 0;
+  let syy = 0;
+  for (const p of points) {
+    sxx += (p.x - meanX) ** 2;
+    sxy += (p.x - meanX) * (p.y - meanY);
+    syy += (p.y - meanY) ** 2;
+  }
+  const slope = sxx === 0 ? 0 : sxy / sxx;
+  const intercept = meanY - slope * meanX;
+  const r2 = sxx === 0 || syy === 0 ? 0 : sxy * sxy / (sxx * syy);
+  return { slope, intercept, r2 };
+}
+var receiverSlowing = {
+  id: "receiver_slowing",
+  evaluate(input) {
+    const days = input.dailyP95;
+    if (days.length < SLOWING_DAYS)
+      return null;
+    let rising = 0;
+    for (let i = 1;i < days.length; i++) {
+      const prev = days[i - 1]?.p95Ms;
+      const cur = days[i]?.p95Ms;
+      if (prev != null && cur != null && cur > prev)
+        rising++;
+    }
+    if (rising < SLOWING_MIN_RISING_DAYS)
+      return null;
+    const points = days.flatMap((d, x) => d.p95Ms === null ? [] : [{ x, y: d.p95Ms }]);
+    if (points.length < SLOWING_MIN_RISING_DAYS)
+      return null;
+    const fit = fitLine(points);
+    if (fit.slope <= 0 || fit.r2 < SLOWING_MIN_R2)
+      return null;
+    const timeout = input.webhook.timeoutMs;
+    const lastX = days.length - 1;
+    const nowFit = fit.intercept + fit.slope * lastX;
+    const laterFit = fit.intercept + fit.slope * (lastX + SLOWING_DAYS);
+    if (!(nowFit < timeout && laterFit >= timeout))
+      return null;
+    const daysLeft = Math.max(1, Math.round((timeout - nowFit) / fit.slope));
+    const { webhook } = input;
+    const host = hostOf(webhook.url);
+    const first = days.find((d) => d.p95Ms !== null)?.p95Ms ?? 0;
+    const last = [...days].reverse().find((d) => d.p95Ms !== null)?.p95Ms ?? 0;
+    return {
+      rule: "receiver_slowing",
+      severity: "will_fail",
+      impact: attemptsLast24h(input),
+      resource: resourceOf2(input),
+      line: `${host} is getting slower for ${webhook.name}`,
+      meta: `may hit the ${timeout / 1000}s timeout in about ${plural(daysLeft, "day")}`,
+      lead: "Your receiver is slowing down, and not by chance.",
+      body: `The slowest 5% of deliveries went from ${Math.round(first)} ms to ${Math.round(last)} ms over ${days.length} days, rising on ${rising} of them. At this pace they reach the ${timeout} ms timeout in about ${plural(daysLeft, "day")}, and then they start failing.`,
+      evidence: [
+        {
+          kind: "series",
+          title: "Slowest 5% of response times, per day",
+          series: [
+            {
+              name: "p95",
+              role: "a",
+              points: days.map((d) => Math.round(d.p95Ms ?? 0))
+            },
+            {
+              name: "Timeout",
+              role: "context",
+              points: days.map(() => timeout)
+            }
+          ],
+          labels: [
+            [0, days[0]?.day.slice(5) ?? ""],
+            [lastX, days[lastX]?.day.slice(5) ?? ""]
+          ],
+          unit: "ms"
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            `is getting slower: its receiver ${host} took ${Math.round(first)} ms at the slow end ${days.length} days ago and ${Math.round(last)} ms now`,
+            `The delivery timeout is ${timeout} ms, which the trend reaches in about ${plural(daysLeft, "day")}`
+          ],
+          lookAt: `Check what changed on ${host} over the last two weeks, such as data growth, a slower dependency or a heavier handler`,
+          followUp: `Then run sl webhooks deliveries ${webhook.name}`
+        }),
+        commands: [`sl webhooks deliveries ${webhook.name}`]
+      },
+      how: {
+        detector: `daily p95 response time rose on ${SLOWING_MIN_RISING_DAYS} or more of ${SLOWING_DAYS} days, a straight-line fit has r2 of ${SLOWING_MIN_R2} or more, and it reaches the timeout within ${SLOWING_DAYS} days`,
+        facts: [
+          ["rising days", `${rising} of ${days.length}`],
+          ["trend", `+${Math.round(fit.slope)} ms a day`],
+          ["fit r2", fit.r2.toFixed(2)],
+          ["timeout", `${timeout} ms`],
+          ["days until timeout", String(daysLeft)]
+        ]
+      }
+    };
+  }
+};
+var tlsExpiring = {
+  id: "tls_expiring",
+  evaluate(input) {
+    const expires = input.webhook.receiverCertExpiresAt;
+    if (!expires)
+      return null;
+    const msLeft = expires.getTime() - input.now.getTime();
+    if (msLeft >= TLS_WARN_DAYS * DAY_MS)
+      return null;
+    const { webhook } = input;
+    const host = hostOf(webhook.url);
+    const daysLeft = Math.floor(msLeft / DAY_MS);
+    const expired = msLeft <= 0;
+    return {
+      rule: "tls_expiring",
+      severity: "will_fail",
+      impact: attemptsLast24h(input),
+      resource: resourceOf2(input),
+      line: expired ? `The certificate for ${host} has expired` : `The certificate for ${host} expires soon`,
+      meta: expired ? `expired ${utcDateTime(expires)}` : `in ${plural(daysLeft, "day")}`,
+      lead: expired ? "Your receiver's certificate has expired." : "Your receiver's certificate is about to expire.",
+      body: expired ? `Deliveries to ${host} fail the TLS check until the certificate is renewed.` : `After ${utcDateTime(expires)} deliveries to ${host} fail the TLS check until the certificate is renewed.`,
+      evidence: [
+        {
+          kind: "table",
+          title: "Receiver certificate",
+          columns: ["Host", "Expires", "Days left", "Last checked"],
+          rows: [
+            [
+              host,
+              utcDateTime(expires),
+              daysLeft,
+              input.webhook.receiverCertCheckedAt ? utcDateTime(input.webhook.receiverCertCheckedAt) : "unknown"
+            ]
+          ]
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            expired ? `points at ${host}, whose TLS certificate expired on ${utcDateTime(expires)}` : `points at ${host}, whose TLS certificate expires on ${utcDateTime(expires)}`
+          ],
+          lookAt: `Check why the certificate on ${host} is not renewing automatically`
+        }),
+        commands: []
+      },
+      how: {
+        detector: `the receiver certificate expires in less than ${TLS_WARN_DAYS} days`,
+        facts: [
+          ["expires", utcDateTime(expires)],
+          ["days left", String(daysLeft)]
+        ]
+      }
+    };
+  }
+};
+function literalContractCalls(triggers) {
+  if (!Array.isArray(triggers))
+    return [];
+  const out = [];
+  for (const t of triggers) {
+    if (!t || typeof t !== "object")
+      continue;
+    const { type, contractId, functionName } = t;
+    if (type !== "contract_call")
+      continue;
+    if (typeof contractId !== "string" || typeof functionName !== "string")
+      continue;
+    if (contractId.includes("*") || functionName.includes("*"))
+      continue;
+    out.push({ contractId, functionName });
+  }
+  return out;
+}
+function contractIdsToCheck(triggers) {
+  return [...new Set(literalContractCalls(triggers).map((t) => t.contractId))];
+}
+var filterCantMatch = {
+  id: "filter_cant_match",
+  skip: (input) => contractIdsToCheck(input.webhook.triggers).length > 0 && !input.abiAvailable,
+  evaluate(input) {
+    const offending = literalContractCalls(input.webhook.triggers).filter((t) => {
+      const names = input.abi[t.contractId];
+      return names !== undefined && !names.includes(t.functionName);
+    });
+    const first = offending[0];
+    if (!first)
+      return null;
+    const names = input.abi[first.contractId] ?? [];
+    const ranked = [...names].sort((a, b) => levenshtein(a, first.functionName) - levenshtein(b, first.functionName));
+    const closest = ranked[0];
+    const { webhook } = input;
+    return {
+      rule: "filter_cant_match",
+      severity: "will_fail",
+      impact: offending.length,
+      resource: resourceOf2(input),
+      line: `${webhook.name} can never match a call`,
+      meta: `${first.contractId} has no ${first.functionName}`,
+      lead: "This filter waits for something that does not exist.",
+      body: [
+        `${first.contractId} has no public function named ${first.functionName}, so no event will ever match.`,
+        closest ? `The closest is ${closest}.` : ""
+      ].filter(Boolean).join(" "),
+      evidence: [
+        {
+          kind: "table",
+          title: "Public functions on the contract",
+          columns: ["Function", "In contract"],
+          rows: [
+            [first.functionName, "not found"],
+            ...ranked.slice(0, 6).map((n) => [n, "yes"])
+          ],
+          markRow: 0
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            `waits for calls to ${first.functionName} on ${first.contractId}`,
+            `That contract has no public method with that name${closest ? `, and the closest name is ${closest}` : ""}`,
+            "The webhook has never matched and cannot"
+          ],
+          lookAt: "Check the spelling in the trigger and whether the contract was redeployed under another name",
+          followUp: `Create the corrected webhook first, then run sl webhooks delete ${webhook.name}`
+        }),
+        commands: [`sl webhooks delete ${webhook.name}`]
+      },
+      how: {
+        detector: "a contract_call trigger names a literal contract and method, the contract exists, and its ABI has no method with that name",
+        facts: [
+          ["contract", first.contractId],
+          ["method in trigger", first.functionName],
+          ["methods on contract", String(names.length)],
+          ["triggers that cannot match", String(offending.length)]
+        ]
+      }
+    };
+  }
+};
+var deadLettersExpiring = {
+  id: "dead_letters_expiring",
+  evaluate(input) {
+    const { dead, webhook } = input;
+    if (dead.count === 0 || !dead.oldestAt)
+      return null;
+    const deleteAt = new Date(dead.oldestAt.getTime() + DEAD_LETTER_DELETE_AGE_DAYS * DAY_MS);
+    return {
+      rule: "dead_letters_expiring",
+      severity: "will_fail",
+      impact: dead.count,
+      resource: resourceOf2(input),
+      line: `${plural(dead.count, "failed event")} on ${webhook.name} will be deleted`,
+      meta: `from ${utcDateTime(deleteAt)}`,
+      lead: "Failed events are kept for 90 days, and these are almost there.",
+      body: `${plural(dead.count, "event")} that never reached your receiver are older than ${DEAD_LETTER_WARN_AGE_DAYS} days. The oldest is deleted on ${utcDateTime(deleteAt)}. Send them again before then if you still want them.`,
+      evidence: [
+        {
+          kind: "table",
+          title: "Failed events near deletion",
+          columns: ["Failed events", "Oldest failure", "Deleted from"],
+          rows: [
+            [dead.count, utcDateTime(dead.oldestAt), utcDateTime(deleteAt)]
+          ]
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            `has ${plural(dead.count, "failed event")} older than ${DEAD_LETTER_WARN_AGE_DAYS} days`,
+            `The oldest failed on ${utcDateTime(dead.oldestAt)} and is deleted from ${utcDateTime(deleteAt)}`
+          ],
+          lookAt: "Decide whether those events still matter, and confirm the receiver can handle them now",
+          followUp: `Then run sl webhooks dead ${webhook.name}${dead.oldestOutboxId ? ` and sl webhooks requeue ${webhook.name} ${dead.oldestOutboxId}` : ""}`
+        }),
+        commands: [
+          `sl webhooks dead ${webhook.name}`,
+          ...dead.oldestOutboxId ? [`sl webhooks requeue ${webhook.name} ${dead.oldestOutboxId}`] : []
+        ]
+      },
+      how: {
+        detector: `failed outbox rows older than ${DEAD_LETTER_WARN_AGE_DAYS} days exist (deleted at ${DEAD_LETTER_DELETE_AGE_DAYS})`,
+        facts: [
+          ["failed events past the line", String(dead.count)],
+          ["oldest failure", utcDateTime(dead.oldestAt)],
+          ["oldest is deleted", utcDateTime(deleteAt)]
+        ]
+      }
+    };
+  }
+};
+var duplicateWebhook = {
+  id: "duplicate_webhook",
+  evaluate(input) {
+    const { webhook, siblings } = input;
+    const mine = canonicalJson(webhook.triggers);
+    const twin = siblings.find((s) => s.url === webhook.url && canonicalJson(s.triggers) === mine);
+    if (!twin)
+      return null;
+    const newer = webhook.createdAt.getTime() !== twin.createdAt.getTime() ? webhook.createdAt.getTime() > twin.createdAt.getTime() : webhook.id > twin.id;
+    if (!newer)
+      return null;
+    return {
+      rule: "duplicate_webhook",
+      severity: "costs",
+      impact: input.deliveries30d,
+      resource: resourceOf2(input),
+      line: `${webhook.name} duplicates ${twin.name}`,
+      meta: "same URL and same filters",
+      lead: "Two webhooks do the same job.",
+      body: `${webhook.name} and ${twin.name} send the same events to ${hostOf(webhook.url)}. Your receiver gets each event twice, and each delivery counts.`,
+      evidence: [
+        {
+          kind: "table",
+          title: "Matching webhooks",
+          columns: ["Webhook", "Created"],
+          rows: [
+            [twin.name, utcDateTime(twin.createdAt)],
+            [webhook.name, utcDateTime(webhook.createdAt)]
+          ],
+          markRow: 1
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            `duplicates the webhook "${twin.name}"`,
+            `Both send the same filters to ${webhook.url}, so each event is delivered twice`
+          ],
+          lookAt: `Check that nothing relies on both, then remove the newer one, ${webhook.name}`
+        }),
+        commands: [`sl webhooks delete ${webhook.name}`]
+      },
+      how: {
+        detector: "two non-paused webhooks share a URL and identical triggers",
+        facts: [
+          ["older webhook", twin.name],
+          ["newer webhook", webhook.name],
+          ["deliveries in the last 30 days", String(input.deliveries30d)]
+        ]
+      }
+    };
+  }
+};
+var TEST_HOST_SUFFIXES = [".ngrok.io", ".ngrok-free.app", ".pipedream.net"];
+var TEST_HOSTS = new Set(["postman-echo.com", "webhook.site"]);
+function isTestHost(host) {
+  const name = host.toLowerCase().split(":")[0] ?? "";
+  return TEST_HOSTS.has(name) || name.startsWith("requestbin.") || TEST_HOST_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+var testEndpoint = {
+  id: "test_endpoint",
+  evaluate(input) {
+    const { webhook } = input;
+    const host = hostOf(webhook.url);
+    if (!isTestHost(host))
+      return null;
+    const ageMs = input.now.getTime() - webhook.createdAt.getTime();
+    if (ageMs <= TEST_ENDPOINT_MIN_AGE_DAYS * DAY_MS)
+      return null;
+    const ageDays = Math.floor(ageMs / DAY_MS);
+    return {
+      rule: "test_endpoint",
+      severity: "costs",
+      impact: input.deliveries30d,
+      resource: resourceOf2(input),
+      line: `${webhook.name} still sends to a test endpoint`,
+      meta: host,
+      lead: "This webhook points at a throwaway test URL.",
+      body: `${host} is a public testing service, and ${webhook.name} has been sending to it for ${plural(ageDays, "day")}. Real events are leaving your account, and each delivery counts.`,
+      evidence: [
+        {
+          kind: "table",
+          title: "Test endpoint",
+          columns: ["Host", "Age", "Deliveries, last 30 days"],
+          rows: [[host, `${ageDays} days`, input.deliveries30d]]
+        }
+      ],
+      handoff: {
+        prompt: handoffPrompt({
+          subject: subject2(webhook.name),
+          observed: [
+            `has sent to the test service ${host} for ${plural(ageDays, "day")}`,
+            `${plural(input.deliveries30d, "delivery")} in the last 30 days`
+          ],
+          lookAt: "Decide whether this should point at a real receiver, or be paused or removed"
+        }),
+        commands: [
+          `sl webhooks pause ${webhook.name}`,
+          `sl webhooks delete ${webhook.name}`
+        ]
+      },
+      how: {
+        detector: `the receiver host is a known test service and the webhook is older than ${TEST_ENDPOINT_MIN_AGE_DAYS} days`,
+        facts: [
+          ["host", host],
+          ["age", `${ageDays} days`],
+          ["deliveries in the last 30 days", String(input.deliveries30d)]
+        ]
+      }
+    };
+  }
+};
+var WEBHOOK_RULES = [
+  receiverDown,
+  receiverRejects,
+  receiverRateLimited,
+  receiverLoginWall,
+  receiverSlowing,
+  tlsExpiring,
+  filterCantMatch,
+  deadLettersExpiring,
+  duplicateWebhook,
+  testEndpoint
+];
+var ABI_TTL_MS = 24 * 3600000;
+function createAbiCache() {
+  const entries = new Map;
+  return {
+    get(contractId, now) {
+      const hit = entries.get(contractId);
+      return hit && now - hit.at < ABI_TTL_MS ? hit.names : undefined;
+    },
+    set(contractId, names, now) {
+      entries.set(contractId, { names, at: now });
+    }
+  };
+}
+async function fetchFunctionNames(contractId, baseUrl, apiKey, deps) {
+  try {
+    const res = await deps.fetchImpl(`${baseUrl.replace(/\/$/, "")}/v1/contracts/${encodeURIComponent(contractId)}?include=abi`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(5000)
+    });
+    if (res.status === 404)
+      return null;
+    if (!res.ok)
+      return "unavailable";
+    const body = await res.json();
+    const functions = body.contract?.abi?.functions;
+    if (!Array.isArray(functions))
+      return "unavailable";
+    return functions.map((f) => f.name).filter((n) => typeof n === "string");
+  } catch {
+    return "unavailable";
+  }
+}
+var num = (v) => v === null ? null : Number(v);
+async function loadWebhookInputs(db, now, abiDeps) {
+  const nowMs = now.getTime();
+  const webhooks = await db.selectFrom("webhooks").select([
+    "id",
+    "name",
+    "status",
+    "url",
+    "triggers",
+    "timeout_ms",
+    "created_at",
+    "last_success_at",
+    "receiver_cert_expires_at",
+    "receiver_cert_checked_at"
+  ]).execute();
+  if (webhooks.length === 0)
+    return [];
+  const lookback = new Date(nowMs - ATTEMPT_LOOKBACK_DAYS * DAY_MS);
+  const attemptRows = await sql4`
+		SELECT webhook_id, outbox_id, status_code, duration_ms, dispatched_at,
+			error_message, body, content_type, server, retry_after, block_height
+		FROM (
+			SELECT d.webhook_id, d.outbox_id, d.status_code, d.duration_ms,
+				d.dispatched_at, d.error_message,
+				left(d.response_body, 200) AS body,
+				d.response_headers ->> 'content-type' AS content_type,
+				d.response_headers ->> 'server' AS server,
+				d.response_headers ->> 'retry-after' AS retry_after,
+				o.block_height,
+				row_number() OVER (PARTITION BY d.webhook_id ORDER BY d.dispatched_at DESC) AS rn
+			FROM webhook_deliveries d
+			LEFT JOIN webhook_outbox o ON o.id = d.outbox_id
+			WHERE d.dispatched_at > ${lookback}
+		) t
+		WHERE rn <= ${ATTEMPT_WINDOW}
+		ORDER BY webhook_id, dispatched_at DESC
+	`.execute(db);
+  const startMs = Math.floor(nowMs / BUCKET_MS) * BUCKET_MS - (BUCKETS - 1) * BUCKET_MS;
+  const start = new Date(startMs);
+  const matchedRows = await sql4`
+		SELECT webhook_id,
+			floor(extract(epoch FROM (created_at - ${start}::timestamptz)) / 600)::int AS b,
+			count(*) AS n
+		FROM webhook_outbox
+		WHERE created_at >= ${start} AND is_replay = false
+		GROUP BY 1, 2
+	`.execute(db);
+  const deliveredRows = await sql4`
+		SELECT webhook_id,
+			floor(extract(epoch FROM (delivered_at - ${start}::timestamptz)) / 600)::int AS b,
+			count(*) AS n
+		FROM webhook_outbox
+		WHERE delivered_at >= ${start} AND status = 'delivered'
+		GROUP BY 1, 2
+	`.execute(db);
+  const pendingRows = await sql4`
+		SELECT webhook_id, count(*) AS n FROM webhook_outbox
+		WHERE status = 'pending' GROUP BY 1
+	`.execute(db);
+  const dayStart = Math.floor(nowMs / DAY_MS) * DAY_MS - (SLOWING_DAYS - 1) * DAY_MS;
+  const p95Rows = await sql4`
+		SELECT webhook_id,
+			to_char(dispatched_at AT TIME ZONE 'UTC', 'YYYY-MM-DD') AS day,
+			percentile_cont(0.95) WITHIN GROUP (ORDER BY duration_ms) AS p95
+		FROM webhook_deliveries
+		WHERE dispatched_at >= ${new Date(dayStart)} AND duration_ms IS NOT NULL
+		GROUP BY 1, 2
+	`.execute(db);
+  const warnBefore = new Date(nowMs - DEAD_LETTER_WARN_AGE_DAYS * DAY_MS);
+  const deadRows = await sql4`
+		SELECT webhook_id, count(*) AS n,
+			min(coalesce(failed_at, created_at)) AS oldest,
+			(array_agg(id ORDER BY coalesce(failed_at, created_at)))[1] AS oldest_id
+		FROM webhook_outbox
+		WHERE status = 'dead' AND coalesce(failed_at, created_at) < ${warnBefore}
+		GROUP BY 1
+	`.execute(db);
+  const deliveryCountRows = await sql4`
+		SELECT webhook_id, count(*) AS n FROM webhook_deliveries
+		WHERE dispatched_at > ${new Date(nowMs - 30 * DAY_MS)} GROUP BY 1
+	`.execute(db);
+  const attemptsBy = new Map;
+  for (const r of attemptRows.rows) {
+    const list = attemptsBy.get(r.webhook_id) ?? [];
+    list.push({
+      outboxId: r.outbox_id,
+      statusCode: r.status_code,
+      durationMs: r.duration_ms,
+      dispatchedAt: r.dispatched_at,
+      errorMessage: r.error_message,
+      body: r.body,
+      contentType: r.content_type,
+      server: r.server,
+      retryAfter: r.retry_after,
+      blockHeight: num(r.block_height)
+    });
+    attemptsBy.set(r.webhook_id, list);
+  }
+  const series = (rows) => {
+    const by = new Map;
+    for (const r of rows) {
+      if (r.b < 0 || r.b >= BUCKETS)
+        continue;
+      const arr = by.get(r.webhook_id) ?? new Array(BUCKETS).fill(0);
+      arr[r.b] = Number(r.n);
+      by.set(r.webhook_id, arr);
+    }
+    return by;
+  };
+  const matchedBy = series(matchedRows.rows);
+  const deliveredBy = series(deliveredRows.rows);
+  const pendingBy = new Map(pendingRows.rows.map((r) => [r.webhook_id, Number(r.n)]));
+  const countBy = new Map(deliveryCountRows.rows.map((r) => [r.webhook_id, Number(r.n)]));
+  const deadBy = new Map(deadRows.rows.map((r) => [r.webhook_id, r]));
+  const p95By = new Map;
+  for (const r of p95Rows.rows) {
+    const m = p95By.get(r.webhook_id) ?? new Map;
+    m.set(r.day, Number(r.p95));
+    p95By.set(r.webhook_id, m);
+  }
+  const days = Array.from({ length: SLOWING_DAYS }, (_, i) => new Date(dayStart + i * DAY_MS).toISOString().slice(0, 10));
+  const baseUrl = abiDeps.env.STREAMS_API_URL?.trim();
+  const apiKey = abiDeps.env.INDEX_INTERNAL_API_KEY?.trim();
+  const abiEnabled = Boolean(baseUrl && apiKey);
+  const abiBy = new Map;
+  if (abiEnabled && baseUrl && apiKey) {
+    const wanted = new Set(webhooks.filter((w) => w.status !== "paused").flatMap((w) => contractIdsToCheck(w.triggers)));
+    for (const id of wanted) {
+      const cached = abiDeps.cache.get(id, nowMs);
+      if (cached) {
+        abiBy.set(id, cached);
+        continue;
+      }
+      const names = await fetchFunctionNames(id, baseUrl, apiKey, abiDeps);
+      if (Array.isArray(names))
+        abiDeps.cache.set(id, names, nowMs);
+      abiBy.set(id, names);
+    }
+  }
+  const live = webhooks.filter((w) => w.status !== "paused");
+  return webhooks.map((w) => {
+    const dead = deadBy.get(w.id);
+    const ids = contractIdsToCheck(w.triggers);
+    const abi = {};
+    let abiAvailable = abiEnabled;
+    for (const id of ids) {
+      const found = abiBy.get(id);
+      if (Array.isArray(found))
+        abi[id] = found;
+      else if (found === "unavailable")
+        abiAvailable = false;
+    }
+    const p95 = p95By.get(w.id);
+    return {
+      now,
+      webhook: {
+        id: w.id,
+        name: w.name,
+        status: w.status,
+        url: w.url,
+        triggers: w.triggers,
+        timeoutMs: w.timeout_ms,
+        createdAt: w.created_at,
+        lastSuccessAt: w.last_success_at,
+        receiverCertExpiresAt: w.receiver_cert_expires_at,
+        receiverCertCheckedAt: w.receiver_cert_checked_at
+      },
+      attempts: attemptsBy.get(w.id) ?? [],
+      pending: pendingBy.get(w.id) ?? 0,
+      throughput: {
+        startMs,
+        matched: matchedBy.get(w.id) ?? new Array(BUCKETS).fill(0),
+        delivered: deliveredBy.get(w.id) ?? new Array(BUCKETS).fill(0)
+      },
+      dailyP95: days.map((day) => ({ day, p95Ms: p95?.get(day) ?? null })),
+      dead: {
+        count: dead ? Number(dead.n) : 0,
+        oldestAt: dead?.oldest ?? null,
+        oldestOutboxId: dead?.oldest_id ?? null
+      },
+      deliveries30d: countBy.get(w.id) ?? 0,
+      siblings: live.filter((o) => o.id !== w.id).map((o) => ({
+        id: o.id,
+        name: o.name,
+        url: o.url,
+        triggers: o.triggers,
+        createdAt: o.created_at
+      })),
+      abi,
+      abiAvailable
+    };
+  });
+}
+
+// src/insights/evaluate.ts
+function runRules2(rules, input, resource, opts = {}) {
+  const fired = [];
+  const evaluated = [];
+  for (const rule of rules) {
+    try {
+      if (rule.skip?.(input))
+        continue;
+      const key = { kind: resource.kind, id: resource.id, rule: rule.id };
+      const result = opts.active === false ? null : rule.evaluate(input);
+      evaluated.push(key);
+      if (result)
+        fired.push(result);
+    } catch (err) {
+      logger.warn("insights.rule_failed", {
+        rule: rule.id,
+        error: String(err)
+      });
+    }
+  }
+  return { fired, evaluated };
+}
+var defaultAbiCache = createAbiCache();
+async function evaluateTenantInsights(db, deps = {}) {
+  const now = deps.now ?? new Date;
+  const env = deps.env ?? process.env;
+  const scope = { accountId: null };
+  const webhookInputs = await loadWebhookInputs(db, now, {
+    env,
+    fetchImpl: deps.fetchImpl ?? fetch,
+    cache: deps.abiCache ?? defaultAbiCache
+  });
+  const subgraphInputs = await loadSubgraphInputs(db, now);
+  const fired = [];
+  const evaluated = [];
+  for (const input of webhookInputs) {
+    const result = runRules2(WEBHOOK_RULES, input, { kind: "webhook", id: input.webhook.id }, { active: input.webhook.status !== "paused" });
+    fired.push(...result.fired);
+    evaluated.push(...result.evaluated);
+  }
+  for (const input of subgraphInputs) {
+    const result = runRules2(SUBGRAPH_RULES, input, {
+      kind: "subgraph",
+      id: input.subgraph.name
+    });
+    fired.push(...result.fired);
+    evaluated.push(...result.evaluated);
+  }
+  const live = new Set([
+    ...webhookInputs.map((i) => `webhook\x00${i.webhook.id}`),
+    ...subgraphInputs.map((i) => `subgraph\x00${i.subgraph.name}`)
+  ]);
+  for (const open of await listOpenResources(db, scope)) {
+    if (!live.has(`${open.kind}\x00${open.id}`))
+      evaluated.push(open);
+  }
+  const labelled = await Promise.all(fired.map((insight) => maybeLabel(insight, {
+    classifyFn: deps.classifyFn,
+    cache: deps.cache,
+    env,
+    now: now.getTime()
+  })));
+  await recordEvaluation(db, scope, labelled, evaluated, now);
+  await purgeResolved(db, scope, 30, now);
+}
+export {
+  BACKFILL_DAY_SHARE,
+  BACKFILL_FULL_PAGE_RATIO,
+  BACKFILL_MIN_DAY_ROWS,
+  CLEAR_STREAK_TO_RESOLVE,
+  CREDITS_RUNWAY_WARN_DAYS,
+  DEAD_LETTER_DELETE_AGE_DAYS,
+  DEAD_LETTER_WARN_AGE_DAYS,
+  DOWN_MIN_CONSECUTIVE,
+  DUPLICATE_READS_LOOKBACK_MS,
+  DUPLICATE_READS_MIN_PAGES,
+  DUPLICATE_READS_WINDOW_MS,
+  HANDLER_ERRORS_MIN_24H,
+  LAG_MIN_SAMPLES,
+  LAG_THRESHOLD_MS,
+  LAG_WINDOW,
+  LOGIN_WALL_MIN_CONSECUTIVE,
+  LOGIN_WALL_MIN_PRIOR,
+  LOGIN_WALL_PRIOR_JSON_RATIO,
+  PAGE_CAP_ROWS,
+  POLLING_LOOKBACK_MS,
+  POLLING_MAX_STDDEV_RATIO,
+  POLLING_MIN_DURATION_MS,
+  POLLING_MIN_EMPTY_RATIO,
+  POLLING_MIN_REQUESTS,
+  RATE_LIMITED_MIN_ATTEMPTS,
+  RATE_LIMITED_MIN_RATIO,
+  RECOVERED_VISIBLE_MS,
+  REJECTS_MIN_CONSECUTIVE,
+  SERVER_ERRORS_MIN_5XX,
+  SLOWING_DAYS,
+  SLOWING_MIN_R2,
+  SLOWING_MIN_RISING_DAYS,
+  SLOW_MIN_SAMPLES,
+  SLOW_TIMEOUT_RATIO,
+  SLOW_WINDOW,
+  SUBGRAPH_LAG_BLOCKS,
+  SUBGRAPH_LAG_LOSING_BLOCKS,
+  SUBGRAPH_LAG_SNAPSHOTS,
+  TEST_ENDPOINT_MIN_AGE_DAYS,
+  TLS_WARN_DAYS,
+  dismissInsight,
+  evaluateTenantInsights,
+  handoffPrompt,
+  hostOf,
+  listInsights,
+  listOpenResources,
+  maybeLabel,
+  muteRule,
+  plainSnippet,
+  plural,
+  purgeResolved,
+  rankInsights,
+  recordEvaluation,
+  runRules2 as runRules,
+  unmuteRule,
+  utcDateTime,
+  utcDay,
+  utcTime
+};
+
+//# debugId=85A02E469680D94664756E2164756E21
+//# sourceMappingURL=index.js.map