brakit 0.7.4 → 0.7.6

package/dist/runtime/index.js

@@ -33,7 +33,7 @@ var init_routes = __esm({
 });
 
 // src/constants/limits.ts
-var MAX_REQUEST_ENTRIES, DEFAULT_MAX_BODY_CAPTURE, DEFAULT_API_LIMIT, MAX_TELEMETRY_ENTRIES;
+var MAX_REQUEST_ENTRIES, DEFAULT_MAX_BODY_CAPTURE, DEFAULT_API_LIMIT, MAX_TELEMETRY_ENTRIES, MAX_TAB_NAME_LENGTH;
 var init_limits = __esm({
   "src/constants/limits.ts"() {
     "use strict";
@@ -41,11 +41,12 @@ var init_limits = __esm({
     DEFAULT_MAX_BODY_CAPTURE = 10240;
     DEFAULT_API_LIMIT = 500;
     MAX_TELEMETRY_ENTRIES = 1e3;
+    MAX_TAB_NAME_LENGTH = 32;
   }
 });
 
 // src/constants/thresholds.ts
-var FLOW_GAP_MS, SLOW_REQUEST_THRESHOLD_MS, MIN_POLLING_SEQUENCE, ENDPOINT_TRUNCATE_LENGTH, N1_QUERY_THRESHOLD, ERROR_RATE_THRESHOLD_PCT, SLOW_ENDPOINT_THRESHOLD_MS, MIN_REQUESTS_FOR_INSIGHT, HIGH_QUERY_COUNT_PER_REQ, CROSS_ENDPOINT_MIN_ENDPOINTS, CROSS_ENDPOINT_PCT, CROSS_ENDPOINT_MIN_OCCURRENCES, REDUNDANT_QUERY_MIN_COUNT, LARGE_RESPONSE_BYTES, HIGH_ROW_COUNT, OVERFETCH_MIN_REQUESTS, OVERFETCH_MIN_FIELDS, OVERFETCH_MIN_INTERNAL_IDS, OVERFETCH_NULL_RATIO;
+var FLOW_GAP_MS, SLOW_REQUEST_THRESHOLD_MS, MIN_POLLING_SEQUENCE, ENDPOINT_TRUNCATE_LENGTH, N1_QUERY_THRESHOLD, ERROR_RATE_THRESHOLD_PCT, SLOW_ENDPOINT_THRESHOLD_MS, MIN_REQUESTS_FOR_INSIGHT, HIGH_QUERY_COUNT_PER_REQ, CROSS_ENDPOINT_MIN_ENDPOINTS, CROSS_ENDPOINT_PCT, CROSS_ENDPOINT_MIN_OCCURRENCES, REDUNDANT_QUERY_MIN_COUNT, LARGE_RESPONSE_BYTES, HIGH_ROW_COUNT, OVERFETCH_MIN_REQUESTS, OVERFETCH_MIN_FIELDS, OVERFETCH_MIN_INTERNAL_IDS, OVERFETCH_NULL_RATIO, REGRESSION_PCT_THRESHOLD, REGRESSION_MIN_INCREASE_MS, REGRESSION_MIN_REQUESTS, QUERY_COUNT_REGRESSION_RATIO, OVERFETCH_MANY_FIELDS, OVERFETCH_UNWRAP_MIN_SIZE, MAX_DUPLICATE_INSIGHTS;
 var init_thresholds = __esm({
   "src/constants/thresholds.ts"() {
     "use strict";
@@ -68,6 +69,13 @@ var init_thresholds = __esm({
     OVERFETCH_MIN_FIELDS = 8;
     OVERFETCH_MIN_INTERNAL_IDS = 2;
     OVERFETCH_NULL_RATIO = 0.3;
+    REGRESSION_PCT_THRESHOLD = 50;
+    REGRESSION_MIN_INCREASE_MS = 200;
+    REGRESSION_MIN_REQUESTS = 5;
+    QUERY_COUNT_REGRESSION_RATIO = 1.5;
+    OVERFETCH_MANY_FIELDS = 12;
+    OVERFETCH_UNWRAP_MIN_SIZE = 3;
+    MAX_DUPLICATE_INSIGHTS = 3;
   }
 });
 
@@ -154,20 +162,6 @@ var init_constants = __esm({
   }
 });
 
-// src/instrument/hooks/context.ts
-import { AsyncLocalStorage } from "async_hooks";
-import { randomUUID } from "crypto";
-function getRequestContext() {
-  return storage.getStore();
-}
-var storage;
-var init_context = __esm({
-  "src/instrument/hooks/context.ts"() {
-    "use strict";
-    storage = new AsyncLocalStorage();
-  }
-});
-
 // src/instrument/transport.ts
 function setEmitter(fn) {
   emitter = fn;
@@ -183,6 +177,20 @@ var init_transport2 = __esm({
   }
 });
 
+// src/instrument/hooks/context.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { randomUUID } from "crypto";
+function getRequestContext() {
+  return storage.getStore();
+}
+var storage;
+var init_context = __esm({
+  "src/instrument/hooks/context.ts"() {
+    "use strict";
+    storage = new AsyncLocalStorage();
+  }
+});
+
 // src/instrument/hooks/fetch.ts
 import { subscribe } from "diagnostics_channel";
 function isNoise(origin) {
@@ -770,7 +778,7 @@ var init_request_store = __esm({
           responseHeaders: flattenHeaders(input.responseHeaders),
           responseBody: responseBodyStr,
           startedAt: input.startTime,
-          durationMs: Math.round(performance.now() - input.startTime),
+          durationMs: Math.round((input.endTime ?? performance.now()) - input.startTime),
           responseSize: input.responseBody?.length ?? 0,
           isStatic: isStaticPath(path)
         };
@@ -1297,25 +1305,52 @@ var init_math = __esm({
   }
 });
 
+// src/utils/endpoint.ts
+function getEndpointKey(method, path) {
+  return `${method} ${path}`;
+}
+var init_endpoint = __esm({
+  "src/utils/endpoint.ts"() {
+    "use strict";
+  }
+});
+
 // src/store/metrics/metrics-store.ts
 import { randomUUID as randomUUID4 } from "crypto";
+function createAccumulator() {
+  return {
+    durations: [],
+    queryCounts: [],
+    errorCount: 0,
+    totalDurationSum: 0,
+    totalRequestCount: 0,
+    totalErrorCount: 0,
+    totalQuerySum: 0,
+    totalQueryTimeMs: 0,
+    totalFetchTimeMs: 0
+  };
+}
 var MetricsStore;
 var init_metrics_store = __esm({
   "src/store/metrics/metrics-store.ts"() {
     "use strict";
     init_constants();
     init_math();
+    init_endpoint();
     MetricsStore = class {
       constructor(persistence) {
         this.persistence = persistence;
         this.data = persistence.load();
+        for (const ep of this.data.endpoints) {
+          this.endpointIndex.set(ep.endpoint, ep);
+        }
       }
       data;
+      endpointIndex = /* @__PURE__ */ new Map();
       sessionId = randomUUID4();
       sessionStart = Date.now();
       flushTimer = null;
       accumulators = /* @__PURE__ */ new Map();
-      /** Pending data points not yet flushed to disk. */
       pendingPoints = /* @__PURE__ */ new Map();
       start() {
         this.flushTimer = setInterval(
@@ -1329,19 +1364,25 @@ var init_metrics_store = __esm({
           clearInterval(this.flushTimer);
           this.flushTimer = null;
         }
-        this.flush();
+        this.flush(true);
       }
-      recordRequest(req, queryCount) {
+      recordRequest(req, metrics) {
         if (req.isStatic) return;
-        const key = req.method + " " + req.path;
+        const key = getEndpointKey(req.method, req.path);
         let acc = this.accumulators.get(key);
         if (!acc) {
-          acc = { durations: [], errorCount: 0, queryCounts: [] };
+          acc = createAccumulator();
           this.accumulators.set(key, acc);
         }
         acc.durations.push(req.durationMs);
-        acc.queryCounts.push(queryCount);
+        acc.queryCounts.push(metrics.queryCount);
         if (req.statusCode >= 400) acc.errorCount++;
+        acc.totalDurationSum += req.durationMs;
+        acc.totalRequestCount++;
+        acc.totalQuerySum += metrics.queryCount;
+        acc.totalQueryTimeMs += metrics.queryTimeMs;
+        acc.totalFetchTimeMs += metrics.fetchTimeMs;
+        if (req.statusCode >= 400) acc.totalErrorCount++;
         const timestamp = Math.round(
           Date.now() - (performance.now() - req.startedAt)
         );
@@ -1349,7 +1390,9 @@ var init_metrics_store = __esm({
           timestamp,
           durationMs: req.durationMs,
           statusCode: req.statusCode,
-          queryCount
+          queryCount: metrics.queryCount,
+          queryTimeMs: metrics.queryTimeMs,
+          fetchTimeMs: metrics.fetchTimeMs
         };
         let pending2 = this.pendingPoints.get(key);
         if (!pending2) {
@@ -1362,20 +1405,18 @@ var init_metrics_store = __esm({
         return this.data.endpoints;
       }
       getEndpoint(endpoint) {
-        return this.data.endpoints.find((e) => e.endpoint === endpoint);
+        return this.endpointIndex.get(endpoint);
       }
-      /** Returns live per-request data for the performance tab. */
       getLiveEndpoints() {
         const merged = /* @__PURE__ */ new Map();
         for (const ep of this.data.endpoints) {
           if (ep.dataPoints && ep.dataPoints.length > 0) {
-            merged.set(ep.endpoint, [...ep.dataPoints]);
+            merged.set(ep.endpoint, ep.dataPoints);
           }
         }
         for (const [endpoint, points] of this.pendingPoints) {
-          const existing = merged.get(endpoint) || [];
-          existing.push(...points);
-          merged.set(endpoint, existing);
+          const existing = merged.get(endpoint);
+          merged.set(endpoint, existing ? existing.concat(points) : points);
         }
         const endpoints = [];
         for (const [endpoint, requests] of merged) {
@@ -1383,14 +1424,23 @@ var init_metrics_store = __esm({
           const durations = requests.map((r) => r.durationMs);
           const errors = requests.filter((r) => r.statusCode >= 400).length;
           const totalQueries = requests.reduce((s, r) => s + r.queryCount, 0);
+          const totalQueryTime = requests.reduce((s, r) => s + (r.queryTimeMs ?? 0), 0);
+          const totalFetchTime = requests.reduce((s, r) => s + (r.fetchTimeMs ?? 0), 0);
+          const n = requests.length;
+          const avgDurationMs = Math.round(durations.reduce((s, d) => s + d, 0) / n);
+          const avgQueryTimeMs = Math.round(totalQueryTime / n);
+          const avgFetchTimeMs = Math.round(totalFetchTime / n);
           endpoints.push({
             endpoint,
             requests,
             summary: {
               p95Ms: percentile(durations, 0.95),
-              errorRate: requests.length > 0 ? errors / requests.length : 0,
-              avgQueryCount: requests.length > 0 ? Math.round(totalQueries / requests.length) : 0,
-              totalRequests: requests.length
+              errorRate: errors / n,
+              avgQueryCount: Math.round(totalQueries / n),
+              totalRequests: n,
+              avgQueryTimeMs,
+              avgFetchTimeMs,
+              avgAppTimeMs: Math.max(0, avgDurationMs - avgQueryTimeMs - avgFetchTimeMs)
             }
           });
         }
@@ -1399,33 +1449,27 @@ var init_metrics_store = __esm({
       }
       reset() {
         this.data = { version: 1, endpoints: [] };
+        this.endpointIndex.clear();
         this.accumulators.clear();
         this.pendingPoints.clear();
         this.persistence.remove();
       }
-      flush() {
+      flush(sync = false) {
         for (const [endpoint, acc] of this.accumulators) {
           if (acc.durations.length === 0) continue;
+          const n = acc.totalRequestCount;
           const session = {
             sessionId: this.sessionId,
             startedAt: this.sessionStart,
-            avgDurationMs: Math.round(
-              acc.durations.reduce((s, d) => s + d, 0) / acc.durations.length
-            ),
+            avgDurationMs: Math.round(acc.totalDurationSum / n),
             p95DurationMs: percentile(acc.durations, 0.95),
-            requestCount: acc.durations.length,
-            errorCount: acc.errorCount,
-            avgQueryCount: acc.queryCounts.length > 0 ? Math.round(
-              acc.queryCounts.reduce((s, c) => s + c, 0) / acc.queryCounts.length
-            ) : 0
+            requestCount: n,
+            errorCount: acc.totalErrorCount,
+            avgQueryCount: n > 0 ? Math.round(acc.totalQuerySum / n) : 0,
+            avgQueryTimeMs: n > 0 ? Math.round(acc.totalQueryTimeMs / n) : 0,
+            avgFetchTimeMs: n > 0 ? Math.round(acc.totalFetchTimeMs / n) : 0
           };
-          let epMetrics = this.data.endpoints.find(
-            (e) => e.endpoint === endpoint
-          );
-          if (!epMetrics) {
-            epMetrics = { endpoint, sessions: [] };
-            this.data.endpoints.push(epMetrics);
-          }
+          const epMetrics = this.getOrCreateEndpoint(endpoint);
           const existingIdx = epMetrics.sessions.findIndex(
             (s) => s.sessionId === this.sessionId
           );
@@ -1437,23 +1481,31 @@ var init_metrics_store = __esm({
           if (epMetrics.sessions.length > METRICS_MAX_SESSIONS) {
             epMetrics.sessions = epMetrics.sessions.slice(-METRICS_MAX_SESSIONS);
           }
+          acc.durations.length = 0;
+          acc.queryCounts.length = 0;
+          acc.errorCount = 0;
         }
         for (const [endpoint, points] of this.pendingPoints) {
           if (points.length === 0) continue;
-          let epMetrics = this.data.endpoints.find(
-            (e) => e.endpoint === endpoint
-          );
-          if (!epMetrics) {
-            epMetrics = { endpoint, sessions: [] };
-            this.data.endpoints.push(epMetrics);
-          }
-          const existing = epMetrics.dataPoints || [];
-          epMetrics.dataPoints = [...existing, ...points].slice(
-            -METRICS_MAX_DATA_POINTS
-          );
+          const epMetrics = this.getOrCreateEndpoint(endpoint);
+          const existing = epMetrics.dataPoints ?? [];
+          epMetrics.dataPoints = existing.concat(points).slice(-METRICS_MAX_DATA_POINTS);
         }
         this.pendingPoints.clear();
-        this.persistence.save(this.data);
+        if (sync) {
+          this.persistence.saveSync(this.data);
+        } else {
+          this.persistence.save(this.data);
+        }
+      }
+      getOrCreateEndpoint(endpoint) {
+        let ep = this.endpointIndex.get(endpoint);
+        if (!ep) {
+          ep = { endpoint, sessions: [] };
+          this.data.endpoints.push(ep);
+          this.endpointIndex.set(endpoint, ep);
+        }
+        return ep;
       }
     };
   }
@@ -1488,8 +1540,10 @@ import {
   writeFileSync as writeFileSync2,
   mkdirSync as mkdirSync2,
   existsSync as existsSync2,
-  unlinkSync
+  unlinkSync,
+  renameSync
 } from "fs";
+import { writeFile as writeFile2, mkdir, rename } from "fs/promises";
 import { resolve as resolve2 } from "path";
 var FileMetricsPersistence;
 var init_persistence = __esm({
@@ -1500,9 +1554,13 @@ var init_persistence = __esm({
     FileMetricsPersistence = class {
       metricsDir;
       metricsPath;
+      tmpPath;
+      writing = false;
+      pendingData = null;
       constructor(rootDir) {
         this.metricsDir = resolve2(rootDir, METRICS_DIR);
         this.metricsPath = resolve2(rootDir, METRICS_FILE);
+        this.tmpPath = this.metricsPath + ".tmp";
       }
       load() {
         try {
@@ -1513,18 +1571,27 @@ var init_persistence = __esm({
               return parsed;
             }
           }
-        } catch {
+        } catch (err) {
+          process.stderr.write(`[brakit] failed to load metrics: ${err.message}
+`);
         }
         return { version: 1, endpoints: [] };
       }
       save(data) {
+        if (this.writing) {
+          this.pendingData = data;
+          return;
+        }
+        this.writeAsync(data);
+      }
+      saveSync(data) {
         try {
-          if (!existsSync2(this.metricsDir)) {
-            mkdirSync2(this.metricsDir, { recursive: true });
-            ensureGitignore(this.metricsDir, METRICS_DIR);
-          }
-          writeFileSync2(this.metricsPath, JSON.stringify(data, null, 2));
-        } catch {
+          this.ensureDir();
+          writeFileSync2(this.tmpPath, JSON.stringify(data));
+          renameSync(this.tmpPath, this.metricsPath);
+        } catch (err) {
+          process.stderr.write(`[brakit] failed to save metrics: ${err.message}
+`);
         }
       }
       remove() {
@@ -1535,6 +1602,33 @@ var init_persistence = __esm({
         } catch {
         }
       }
+      async writeAsync(data) {
+        this.writing = true;
+        try {
+          if (!existsSync2(this.metricsDir)) {
+            await mkdir(this.metricsDir, { recursive: true });
+            ensureGitignore(this.metricsDir, METRICS_DIR);
+          }
+          await writeFile2(this.tmpPath, JSON.stringify(data));
+          await rename(this.tmpPath, this.metricsPath);
+        } catch (err) {
+          process.stderr.write(`[brakit] failed to save metrics: ${err.message}
+`);
+        } finally {
+          this.writing = false;
+          if (this.pendingData) {
+            const next = this.pendingData;
+            this.pendingData = null;
+            this.writeAsync(next);
+          }
+        }
+      }
+      ensureDir() {
+        if (!existsSync2(this.metricsDir)) {
+          mkdirSync2(this.metricsDir, { recursive: true });
+          ensureGitignore(this.metricsDir, METRICS_DIR);
+        }
+      }
     };
   }
 });
@@ -2056,6 +2150,7 @@ function getBaseStyles() {
   --shadow-sm:0 1px 2px rgba(0,0,0,0.05);
   --shadow-md:0 1px 3px rgba(0,0,0,0.08),0 1px 2px rgba(0,0,0,0.04);
   --shadow-lg:0 4px 12px rgba(0,0,0,0.08),0 1px 4px rgba(0,0,0,0.04);
+  --breakdown-db:#6366f1;--breakdown-fetch:#f59e0b;--breakdown-app:#94a3b8;
   --mono:'JetBrains Mono',ui-monospace,SFMono-Regular,'SF Mono',Menlo,Consolas,monospace;
   --sans:Inter,system-ui,-apple-system,sans-serif;
 }
@@ -2384,6 +2479,30 @@ function getPerformanceStyles() {
 .perf-metric-label{font-size:10px;text-transform:uppercase;letter-spacing:.8px;color:var(--text-muted);font-family:var(--sans);font-weight:600}
 .perf-metric-value{font-size:21px;font-weight:700;font-family:var(--mono)}
 
+/* Time breakdown */
+.perf-breakdown{padding:16px 28px;border-bottom:1px solid var(--border-subtle)}
+.perf-breakdown-bar{display:flex;height:10px;border-radius:5px;overflow:hidden;background:var(--bg-muted);border:1px solid var(--border)}
+.perf-breakdown-bar-sm{height:6px;border-radius:3px;flex:1}
+.perf-breakdown-seg{min-width:2px;transition:width .3s}
+.perf-breakdown-db{background:var(--breakdown-db)}
+.perf-breakdown-fetch{background:var(--breakdown-fetch)}
+.perf-breakdown-app{background:var(--breakdown-app)}
+.perf-breakdown-legend{display:flex;gap:16px;margin-top:8px;font-size:11px;font-family:var(--mono);color:var(--text-muted)}
+.perf-breakdown-item{display:flex;align-items:center;gap:5px}
+.perf-breakdown-dot{width:8px;height:8px;border-radius:50%;flex-shrink:0}
+span.perf-breakdown-dot.perf-breakdown-db{background:var(--breakdown-db)}
+span.perf-breakdown-dot.perf-breakdown-fetch{background:var(--breakdown-fetch)}
+span.perf-breakdown-dot.perf-breakdown-app{background:var(--breakdown-app)}
+.perf-breakdown-inline{margin:0 0 8px;display:flex;align-items:center;gap:10px}
+.perf-breakdown-labels{display:flex;gap:8px;font-size:10px;font-family:var(--mono);color:var(--text-muted);flex-shrink:0}
+.perf-breakdown-lbl{display:flex;align-items:center;gap:3px}
+.perf-col-breakdown{flex:1;min-width:140px;display:flex;align-items:center;gap:4px;flex-wrap:wrap}
+.perf-bd-tag{display:inline-flex;align-items:center;gap:3px;padding:1px 6px;border-radius:3px;font-size:10px;font-family:var(--mono);font-weight:500;white-space:nowrap}
+.perf-bd-tag-db{color:#818cf8;background:rgba(99,102,241,0.1)}
+.perf-bd-tag-fetch{color:#fbbf24;background:rgba(245,158,11,0.1)}
+.perf-bd-tag-app{color:var(--breakdown-app);background:rgba(148,163,184,0.1)}
+.perf-col-muted{color:var(--text-dim)}
+
 /* Chart */
 .perf-chart-wrap{padding:16px 28px}
 .perf-canvas{border-radius:var(--radius);background:var(--bg-muted);border:1px solid var(--border)}
@@ -2579,7 +2698,7 @@ var init_project = __esm({
 });
 
 // src/analysis/rules/patterns.ts
-var SECRET_KEYS, TOKEN_PARAMS, SAFE_PARAMS, STACK_TRACE_RE, DB_CONN_RE, SQL_FRAGMENT_RE, SECRET_VAL_RE, LOG_SECRET_RE, MASKED_RE, EMAIL_RE, INTERNAL_ID_KEYS, INTERNAL_ID_SUFFIX, RULE_HINTS;
+var SECRET_KEYS, TOKEN_PARAMS, SAFE_PARAMS, STACK_TRACE_RE, DB_CONN_RE, SQL_FRAGMENT_RE, SECRET_VAL_RE, LOG_SECRET_RE, MASKED_RE, EMAIL_RE, INTERNAL_ID_KEYS, INTERNAL_ID_SUFFIX, SELECT_STAR_RE, SELECT_DOT_STAR_RE, RULE_HINTS;
 var init_patterns = __esm({
   "src/analysis/rules/patterns.ts"() {
     "use strict";
@@ -2595,6 +2714,8 @@ var init_patterns = __esm({
     EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
     INTERNAL_ID_KEYS = /^(id|_id|userId|user_id|createdBy|updatedBy|organizationId|org_id|tenantId|tenant_id)$/;
     INTERNAL_ID_SUFFIX = /Id$|_id$/;
+    SELECT_STAR_RE = /^SELECT\s+\*/i;
+    SELECT_DOT_STAR_RE = /\.\*\s+FROM/i;
     RULE_HINTS = {
       "exposed-secret": "Never include secret fields in API responses. Strip sensitive fields before returning.",
       "token-in-url": "Pass tokens in the Authorization header, not URL query parameters.",
@@ -2955,6 +3076,36 @@ var init_cors_credentials = __esm({
   }
 });
 
+// src/utils/response.ts
+function unwrapResponse(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return parsed;
+  const obj = parsed;
+  const keys = Object.keys(obj);
+  if (keys.length > 3) return parsed;
+  let best = null;
+  let bestSize = 0;
+  for (const key of keys) {
+    const val = obj[key];
+    if (Array.isArray(val) && val.length > bestSize) {
+      best = val;
+      bestSize = val.length;
+    } else if (val && typeof val === "object" && !Array.isArray(val)) {
+      const size = Object.keys(val).length;
+      if (size > bestSize) {
+        best = val;
+        bestSize = size;
+      }
+    }
+  }
+  return best && bestSize >= OVERFETCH_UNWRAP_MIN_SIZE ? best : parsed;
+}
+var init_response = __esm({
+  "src/utils/response.ts"() {
+    "use strict";
+    init_thresholds();
+  }
+});
+
 // src/analysis/rules/response-pii-leak.ts
 function tryParseJson2(body) {
   if (!body) return null;
@@ -2996,28 +3147,6 @@ function hasInternalIds(obj) {
   }
   return false;
 }
-function unwrapResponse(parsed) {
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return parsed;
-  const obj = parsed;
-  const keys = Object.keys(obj);
-  if (keys.length > 3) return parsed;
-  let best = null;
-  let bestSize = 0;
-  for (const key of keys) {
-    const val = obj[key];
-    if (Array.isArray(val) && val.length > bestSize) {
-      best = val;
-      bestSize = val.length;
-    } else if (val && typeof val === "object" && !Array.isArray(val)) {
-      const size = Object.keys(val).length;
-      if (size > bestSize) {
-        best = val;
-        bestSize = size;
-      }
-    }
-  }
-  return best && bestSize >= 3 ? best : parsed;
-}
 function detectPII(method, reqBody, resBody) {
   const target = unwrapResponse(resBody);
   if (WRITE_METHODS.has(method) && reqBody && typeof reqBody === "object") {
@@ -3065,6 +3194,7 @@ var init_response_pii_leak = __esm({
   "src/analysis/rules/response-pii-leak.ts"() {
     "use strict";
     init_patterns();
+    init_response();
     WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
     FULL_RECORD_MIN_FIELDS = 5;
     LIST_PII_MIN_ITEMS = 2;
@@ -3176,7 +3306,28 @@ var init_rules = __esm({
   }
 });
 
-// src/analysis/insights.ts
+// src/utils/collections.ts
+function groupBy(items, keyFn) {
+  const map = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = keyFn(item);
+    if (key == null) continue;
+    let arr = map.get(key);
+    if (!arr) {
+      arr = [];
+      map.set(key, arr);
+    }
+    arr.push(item);
+  }
+  return map;
+}
+var init_collections = __esm({
+  "src/utils/collections.ts"() {
+    "use strict";
+  }
+});
+
+// src/analysis/insights/query-helpers.ts
 function getQueryShape(q) {
   if (q.sql) return normalizeQueryParams(q.sql) ?? "";
   return `${q.operation ?? q.normalizedOp ?? "?"}:${q.model ?? q.table ?? ""}`;
@@ -3188,400 +3339,781 @@ function getQueryInfo(q) {
     table: q.table ?? q.model ?? ""
   };
 }
-function formatDuration(ms) {
-  if (ms < 1e3) return `${ms}ms`;
-  return `${(ms / 1e3).toFixed(1)}s`;
-}
-function formatSize(bytes) {
-  if (bytes < 1024) return `${bytes}B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+var init_query_helpers = __esm({
+  "src/analysis/insights/query-helpers.ts"() {
+    "use strict";
+    init_normalize();
+  }
+});
+
+// src/analysis/insights/prepare.ts
+function createEndpointGroup() {
+  return {
+    total: 0,
+    errors: 0,
+    totalDuration: 0,
+    queryCount: 0,
+    totalSize: 0,
+    totalQueryTimeMs: 0,
+    totalFetchTimeMs: 0,
+    queryShapeDurations: /* @__PURE__ */ new Map()
+  };
 }
-function computeInsights(ctx) {
-  const insights = [];
+function prepareContext(ctx) {
   const nonStatic = ctx.requests.filter(
     (r) => !r.isStatic && (!r.path || !r.path.startsWith(DASHBOARD_PREFIX))
   );
-  const queriesByReq = /* @__PURE__ */ new Map();
-  for (const q of ctx.queries) {
-    if (!q.parentRequestId) continue;
-    let arr = queriesByReq.get(q.parentRequestId);
-    if (!arr) {
-      arr = [];
-      queriesByReq.set(q.parentRequestId, arr);
-    }
-    arr.push(q);
-  }
-  const reqById = /* @__PURE__ */ new Map();
-  for (const r of nonStatic) reqById.set(r.id, r);
-  const n1Seen = /* @__PURE__ */ new Set();
-  for (const [reqId, reqQueries] of queriesByReq) {
-    const req = reqById.get(reqId);
-    if (!req) continue;
-    const endpoint = `${req.method} ${req.path}`;
-    const shapeGroups = /* @__PURE__ */ new Map();
-    for (const q of reqQueries) {
-      const shape = getQueryShape(q);
-      let group = shapeGroups.get(shape);
-      if (!group) {
-        group = { count: 0, distinctSql: /* @__PURE__ */ new Set(), first: q };
-        shapeGroups.set(shape, group);
-      }
-      group.count++;
-      group.distinctSql.add(q.sql ?? shape);
-    }
-    for (const [, sg] of shapeGroups) {
-      if (sg.count <= N1_QUERY_THRESHOLD || sg.distinctSql.size <= 1) continue;
-      const info = getQueryInfo(sg.first);
-      const key = `${endpoint}:${info.op}:${info.table || "unknown"}`;
-      if (n1Seen.has(key)) continue;
-      n1Seen.add(key);
-      insights.push({
-        severity: "critical",
-        type: "n1",
-        title: "N+1 Query Pattern",
-        desc: `${endpoint} runs ${sg.count}x ${info.op} ${info.table} with different params in a single request`,
-        hint: "This typically happens when fetching related data in a loop. Use a batch query, JOIN, or include/eager-load to fetch all records at once.",
-        nav: "queries"
-      });
-    }
-  }
-  const ceQueryMap = /* @__PURE__ */ new Map();
-  const ceAllEndpoints = /* @__PURE__ */ new Set();
-  for (const [reqId, reqQueries] of queriesByReq) {
-    const req = reqById.get(reqId);
-    if (!req) continue;
-    const endpoint = `${req.method} ${req.path}`;
-    ceAllEndpoints.add(endpoint);
-    const seenInReq = /* @__PURE__ */ new Set();
-    for (const q of reqQueries) {
-      const shape = getQueryShape(q);
-      let entry = ceQueryMap.get(shape);
-      if (!entry) {
-        entry = { endpoints: /* @__PURE__ */ new Set(), count: 0, first: q };
-        ceQueryMap.set(shape, entry);
-      }
-      entry.count++;
-      if (!seenInReq.has(shape)) {
-        seenInReq.add(shape);
-        entry.endpoints.add(endpoint);
-      }
-    }
-  }
-  if (ceAllEndpoints.size >= CROSS_ENDPOINT_MIN_ENDPOINTS) {
-    for (const [, cem] of ceQueryMap) {
-      if (cem.count < CROSS_ENDPOINT_MIN_OCCURRENCES) continue;
-      if (cem.endpoints.size < CROSS_ENDPOINT_MIN_ENDPOINTS) continue;
-      const pct = Math.round(cem.endpoints.size / ceAllEndpoints.size * 100);
-      if (pct < CROSS_ENDPOINT_PCT) continue;
-      const info = getQueryInfo(cem.first);
-      const label = info.op + (info.table ? ` ${info.table}` : "");
-      insights.push({
-        severity: "warning",
-        type: "cross-endpoint",
-        title: "Repeated Query Across Endpoints",
-        desc: `${label} runs on ${cem.endpoints.size} of ${ceAllEndpoints.size} endpoints (${pct}%).`,
-        hint: "This query runs on most of your endpoints. Load it once in middleware or cache the result to avoid redundant database calls.",
-        nav: "queries"
-      });
-    }
-  }
-  const rqSeen = /* @__PURE__ */ new Set();
-  for (const [reqId, reqQueries] of queriesByReq) {
-    const req = reqById.get(reqId);
-    if (!req) continue;
-    const endpoint = `${req.method} ${req.path}`;
-    const exact = /* @__PURE__ */ new Map();
-    for (const q of reqQueries) {
-      if (!q.sql) continue;
-      let entry = exact.get(q.sql);
-      if (!entry) {
-        entry = { count: 0, first: q };
-        exact.set(q.sql, entry);
-      }
-      entry.count++;
-    }
-    for (const [, e] of exact) {
-      if (e.count < REDUNDANT_QUERY_MIN_COUNT) continue;
-      const info = getQueryInfo(e.first);
-      const label = info.op + (info.table ? ` ${info.table}` : "");
-      const dedupKey = `${endpoint}:${label}`;
-      if (rqSeen.has(dedupKey)) continue;
-      rqSeen.add(dedupKey);
-      insights.push({
-        severity: "warning",
-        type: "redundant-query",
-        title: "Redundant Query",
-        desc: `${label} runs ${e.count}x with identical params in ${endpoint}.`,
-        hint: "The exact same query with identical parameters runs multiple times in one request. Cache the first result or lift the query to a shared function.",
-        nav: "queries"
-      });
-    }
-  }
-  if (ctx.errors.length > 0) {
-    const errGroups = /* @__PURE__ */ new Map();
-    for (const e of ctx.errors) {
-      const name = e.name || "Error";
-      errGroups.set(name, (errGroups.get(name) ?? 0) + 1);
-    }
-    for (const [name, cnt] of errGroups) {
-      insights.push({
-        severity: "critical",
-        type: "error",
-        title: "Unhandled Error",
-        desc: `${name} \u2014 occurred ${cnt} time${cnt !== 1 ? "s" : ""}`,
-        hint: "Unhandled errors crash request handlers. Wrap async code in try/catch or add error-handling middleware.",
-        nav: "errors"
-      });
-    }
-  }
+  const queriesByReq = groupBy(ctx.queries, (q) => q.parentRequestId);
+  const fetchesByReq = groupBy(ctx.fetches, (f) => f.parentRequestId);
+  const reqById = new Map(nonStatic.map((r) => [r.id, r]));
   const endpointGroups = /* @__PURE__ */ new Map();
   for (const r of nonStatic) {
-    const ep = `${r.method} ${r.path}`;
+    const ep = getEndpointKey(r.method, r.path);
     let g = endpointGroups.get(ep);
     if (!g) {
-      g = { total: 0, errors: 0, totalDuration: 0, queryCount: 0, totalSize: 0 };
+      g = createEndpointGroup();
       endpointGroups.set(ep, g);
     }
     g.total++;
     if (r.statusCode >= 400) g.errors++;
     g.totalDuration += r.durationMs;
-    g.queryCount += (queriesByReq.get(r.id) ?? []).length;
     g.totalSize += r.responseSize ?? 0;
-  }
-  for (const [ep, g] of endpointGroups) {
-    if (g.total < MIN_REQUESTS_FOR_INSIGHT) continue;
-    const errorRate = Math.round(g.errors / g.total * 100);
-    if (errorRate >= ERROR_RATE_THRESHOLD_PCT) {
-      insights.push({
-        severity: "critical",
-        type: "error-hotspot",
-        title: "Error Hotspot",
-        desc: `${ep} \u2014 ${errorRate}% error rate (${g.errors}/${g.total} requests)`,
-        hint: "This endpoint frequently returns errors. Check the response bodies for error details and stack traces.",
-        nav: "requests"
-      });
-    }
-  }
-  const dupCounts = /* @__PURE__ */ new Map();
-  const flowCount = /* @__PURE__ */ new Map();
-  for (const flow of ctx.flows) {
-    if (!flow.requests) continue;
-    const seenInFlow = /* @__PURE__ */ new Set();
-    for (const fr of flow.requests) {
-      if (!fr.isDuplicate) continue;
-      const dupKey = `${fr.method} ${fr.label ?? fr.path ?? fr.url}`;
-      dupCounts.set(dupKey, (dupCounts.get(dupKey) ?? 0) + 1);
-      if (!seenInFlow.has(dupKey)) {
-        seenInFlow.add(dupKey);
-        flowCount.set(dupKey, (flowCount.get(dupKey) ?? 0) + 1);
-      }
-    }
-  }
-  const dupEntries = [...dupCounts.entries()].map(([key, count]) => ({ key, count, flows: flowCount.get(key) ?? 0 })).sort((a, b) => b.count - a.count);
-  for (let i = 0; i < Math.min(dupEntries.length, 3); i++) {
-    const d = dupEntries[i];
-    insights.push({
-      severity: "warning",
-      type: "duplicate",
-      title: "Duplicate API Call",
-      desc: `${d.key} loaded ${d.count}x as duplicate across ${d.flows} action${d.flows !== 1 ? "s" : ""}`,
-      hint: "Multiple components independently fetch the same endpoint. Lift the fetch to a parent component, use a data cache, or deduplicate with React Query / SWR.",
-      nav: "actions"
-    });
-  }
-  for (const [ep, g] of endpointGroups) {
-    if (g.total < MIN_REQUESTS_FOR_INSIGHT) continue;
-    const avgMs = Math.round(g.totalDuration / g.total);
-    if (avgMs >= SLOW_ENDPOINT_THRESHOLD_MS) {
-      insights.push({
-        severity: "warning",
-        type: "slow",
-        title: "Slow Endpoint",
-        desc: `${ep} \u2014 avg ${formatDuration(avgMs)} across ${g.total} request${g.total !== 1 ? "s" : ""}`,
-        hint: "Consistently slow responses hurt user experience. Check the Queries tab to see if database queries are the bottleneck.",
-        nav: "requests"
-      });
-    }
-  }
-  for (const [ep, g] of endpointGroups) {
-    if (g.total < MIN_REQUESTS_FOR_INSIGHT) continue;
-    const avgQueries = Math.round(g.queryCount / g.total);
-    if (avgQueries > HIGH_QUERY_COUNT_PER_REQ) {
-      insights.push({
-        severity: "warning",
-        type: "query-heavy",
-        title: "Query-Heavy Endpoint",
-        desc: `${ep} \u2014 avg ${avgQueries} queries/request`,
-        hint: "Too many queries per request increases latency. Combine queries with JOINs, use batch operations, or reduce the number of data fetches.",
-        nav: "queries"
-      });
-    }
-  }
-  const selectStarSeen = /* @__PURE__ */ new Map();
-  for (const [, reqQueries] of queriesByReq) {
+    const reqQueries = queriesByReq.get(r.id) ?? [];
+    g.queryCount += reqQueries.length;
     for (const q of reqQueries) {
-      if (!q.sql) continue;
-      const isSelectStar = /^SELECT\s+\*/i.test(q.sql.trim()) || /\.\*\s+FROM/i.test(q.sql);
-      if (!isSelectStar) continue;
+      g.totalQueryTimeMs += q.durationMs;
+      const shape = getQueryShape(q);
       const info = getQueryInfo(q);
-      const key = info.table || "unknown";
-      selectStarSeen.set(key, (selectStarSeen.get(key) ?? 0) + 1);
+      let sd = g.queryShapeDurations.get(shape);
+      if (!sd) {
+        sd = { totalMs: 0, count: 0, label: info.op + (info.table ? ` ${info.table}` : "") };
+        g.queryShapeDurations.set(shape, sd);
+      }
+      sd.totalMs += q.durationMs;
+      sd.count++;
     }
-  }
-  for (const [table, count] of selectStarSeen) {
-    if (count < OVERFETCH_MIN_REQUESTS) continue;
-    insights.push({
-      severity: "warning",
-      type: "select-star",
-      title: "SELECT * Query",
-      desc: `SELECT * on ${table} \u2014 ${count} occurrence${count !== 1 ? "s" : ""}`,
-      hint: "SELECT * fetches all columns including ones you don\u2019t need. Specify only required columns to reduce data transfer and memory usage.",
-      nav: "queries"
-    });
-  }
-  const highRowSeen = /* @__PURE__ */ new Map();
-  for (const [, reqQueries] of queriesByReq) {
-    for (const q of reqQueries) {
-      if (!q.rowCount || q.rowCount <= HIGH_ROW_COUNT) continue;
-      const info = getQueryInfo(q);
-      const key = `${info.op} ${info.table || "unknown"}`;
-      let entry = highRowSeen.get(key);
-      if (!entry) {
-        entry = { max: 0, count: 0 };
-        highRowSeen.set(key, entry);
-      }
-      entry.count++;
-      if (q.rowCount > entry.max) entry.max = q.rowCount;
+    const reqFetches = fetchesByReq.get(r.id) ?? [];
+    for (const f of reqFetches) {
+      g.totalFetchTimeMs += f.durationMs;
     }
   }
-  for (const [key, hrs] of highRowSeen) {
-    if (hrs.count < OVERFETCH_MIN_REQUESTS) continue;
-    insights.push({
-      severity: "warning",
-      type: "high-rows",
-      title: "Large Result Set",
-      desc: `${key} returns ${hrs.max}+ rows (${hrs.count}x)`,
-      hint: "Fetching many rows slows responses and wastes memory. Add a LIMIT clause, implement pagination, or filter with a WHERE condition.",
-      nav: "queries"
-    });
+  return {
+    ...ctx,
+    nonStatic,
+    queriesByReq,
+    fetchesByReq,
+    reqById,
+    endpointGroups
+  };
+}
+var init_prepare = __esm({
+  "src/analysis/insights/prepare.ts"() {
+    "use strict";
+    init_collections();
+    init_endpoint();
+    init_constants();
+    init_query_helpers();
   }
-  const overfetchSeen = /* @__PURE__ */ new Set();
-  for (const r of nonStatic) {
-    if (r.statusCode >= 400 || !r.responseBody) continue;
-    const ep = `${r.method} ${r.path}`;
-    if (overfetchSeen.has(ep)) continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(r.responseBody);
-    } catch {
-      continue;
-    }
-    let target = parsed;
-    if (target && typeof target === "object" && !Array.isArray(target)) {
-      const topKeys = Object.keys(target);
-      if (topKeys.length <= 3) {
-        let best = null;
-        let bestSize = 0;
-        for (const k of topKeys) {
-          const val = target[k];
-          if (Array.isArray(val) && val.length > bestSize) {
-            best = val;
-            bestSize = val.length;
-          } else if (val && typeof val === "object" && !Array.isArray(val)) {
-            const size = Object.keys(val).length;
-            if (size > bestSize) {
-              best = val;
-              bestSize = size;
-            }
+});
+
+// src/analysis/insights/runner.ts
+var SEVERITY_ORDER, InsightRunner;
+var init_runner = __esm({
+  "src/analysis/insights/runner.ts"() {
+    "use strict";
+    init_prepare();
+    SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
+    InsightRunner = class {
+      rules = [];
+      register(rule) {
+        this.rules.push(rule);
+      }
+      run(ctx) {
+        const prepared = prepareContext(ctx);
+        const insights = [];
+        for (const rule of this.rules) {
+          try {
+            insights.push(...rule.check(prepared));
+          } catch {
           }
         }
-        if (best && bestSize >= 3) target = best;
+        insights.sort(
+          (a, b) => (SEVERITY_ORDER[a.severity] ?? 2) - (SEVERITY_ORDER[b.severity] ?? 2)
+        );
+        return insights;
       }
-    }
-    const inspectObj = Array.isArray(target) && target.length > 0 ? target[0] : target;
-    if (!inspectObj || typeof inspectObj !== "object" || Array.isArray(inspectObj)) continue;
-    const fields = Object.keys(inspectObj);
-    if (fields.length < OVERFETCH_MIN_FIELDS) continue;
-    let internalIdCount = 0;
-    let nullCount = 0;
-    for (const key of fields) {
-      if (INTERNAL_ID_SUFFIX.test(key) || key === "id" || key === "_id") internalIdCount++;
-      const val = inspectObj[key];
-      if (val === null || val === void 0) nullCount++;
-    }
-    const nullRatio = nullCount / fields.length;
-    const reasons = [];
-    if (internalIdCount >= OVERFETCH_MIN_INTERNAL_IDS) reasons.push(`${internalIdCount} internal ID fields`);
-    if (nullRatio >= OVERFETCH_NULL_RATIO) reasons.push(`${Math.round(nullRatio * 100)}% null fields`);
-    if (fields.length >= OVERFETCH_MIN_FIELDS && reasons.length === 0 && fields.length >= 12) {
-      reasons.push(`${fields.length} fields returned`);
-    }
-    if (reasons.length > 0) {
-      overfetchSeen.add(ep);
-      insights.push({
-        severity: "info",
-        type: "response-overfetch",
-        title: "Response Overfetch",
-        desc: `${ep} \u2014 ${reasons.join(", ")}`,
-        hint: "This response returns more data than the client likely needs. Use a DTO or select only required fields to reduce payload size and avoid leaking internal structure.",
-        nav: "requests"
-      });
-    }
-  }
-  for (const [ep, g] of endpointGroups) {
-    if (g.total < OVERFETCH_MIN_REQUESTS) continue;
-    const avgSize = Math.round(g.totalSize / g.total);
-    if (avgSize > LARGE_RESPONSE_BYTES) {
-      insights.push({
-        severity: "info",
-        type: "large-response",
-        title: "Large Response",
-        desc: `${ep} \u2014 avg ${formatSize(avgSize)} response`,
-        hint: "Large API responses increase network transfer time. Implement pagination, field filtering, or response compression.",
-        nav: "requests"
-      });
-    }
-  }
-  if (ctx.securityFindings) {
-    for (const f of ctx.securityFindings) {
-      insights.push({
-        severity: f.severity,
-        type: "security",
-        title: f.title,
-        desc: f.desc,
-        hint: f.hint,
-        nav: "security"
-      });
-    }
+    };
   }
-  const severityOrder = { critical: 0, warning: 1, info: 2 };
-  insights.sort((a, b) => (severityOrder[a.severity] ?? 2) - (severityOrder[b.severity] ?? 2));
-  return insights;
-}
-var init_insights2 = __esm({
-  "src/analysis/insights.ts"() {
+});
+
+// src/analysis/insights/rules/n1.ts
+var n1Rule;
+var init_n1 = __esm({
+  "src/analysis/insights/rules/n1.ts"() {
     "use strict";
-    init_constants();
+    init_query_helpers();
+    init_endpoint();
     init_thresholds();
-    init_normalize();
-    init_patterns();
+    n1Rule = {
+      id: "n1",
+      check(ctx) {
+        const insights = [];
+        const seen = /* @__PURE__ */ new Set();
+        for (const [reqId, reqQueries] of ctx.queriesByReq) {
+          const req = ctx.reqById.get(reqId);
+          if (!req) continue;
+          const endpoint = getEndpointKey(req.method, req.path);
+          const shapeGroups = /* @__PURE__ */ new Map();
+          for (const q of reqQueries) {
+            const shape = getQueryShape(q);
+            let group = shapeGroups.get(shape);
+            if (!group) {
+              group = { count: 0, distinctSql: /* @__PURE__ */ new Set(), first: q };
+              shapeGroups.set(shape, group);
+            }
+            group.count++;
+            group.distinctSql.add(q.sql ?? shape);
+          }
+          for (const [, sg] of shapeGroups) {
+            if (sg.count <= N1_QUERY_THRESHOLD || sg.distinctSql.size <= 1) continue;
+            const info = getQueryInfo(sg.first);
+            const key = `${endpoint}:${info.op}:${info.table || "unknown"}`;
+            if (seen.has(key)) continue;
+            seen.add(key);
+            insights.push({
+              severity: "critical",
+              type: "n1",
+              title: "N+1 Query Pattern",
+              desc: `${endpoint} runs ${sg.count}x ${info.op} ${info.table} with different params in a single request`,
+              hint: "This typically happens when fetching related data in a loop. Use a batch query, JOIN, or include/eager-load to fetch all records at once.",
+              nav: "queries"
+            });
+          }
+        }
+        return insights;
+      }
+    };
   }
 });
 
-// src/analysis/engine.ts
-var AnalysisEngine;
-var init_engine = __esm({
-  "src/analysis/engine.ts"() {
+// src/analysis/insights/rules/cross-endpoint.ts
+var crossEndpointRule;
+var init_cross_endpoint = __esm({
+  "src/analysis/insights/rules/cross-endpoint.ts"() {
+    "use strict";
+    init_query_helpers();
+    init_endpoint();
+    init_thresholds();
+    crossEndpointRule = {
+      id: "cross-endpoint",
+      check(ctx) {
+        const insights = [];
+        const queryMap = /* @__PURE__ */ new Map();
+        const allEndpoints = /* @__PURE__ */ new Set();
+        for (const [reqId, reqQueries] of ctx.queriesByReq) {
+          const req = ctx.reqById.get(reqId);
+          if (!req) continue;
+          const endpoint = getEndpointKey(req.method, req.path);
+          allEndpoints.add(endpoint);
+          const seenInReq = /* @__PURE__ */ new Set();
+          for (const q of reqQueries) {
+            const shape = getQueryShape(q);
+            let entry = queryMap.get(shape);
+            if (!entry) {
+              entry = { endpoints: /* @__PURE__ */ new Set(), count: 0, first: q };
+              queryMap.set(shape, entry);
+            }
+            entry.count++;
+            if (!seenInReq.has(shape)) {
+              seenInReq.add(shape);
+              entry.endpoints.add(endpoint);
+            }
+          }
+        }
+        if (allEndpoints.size >= CROSS_ENDPOINT_MIN_ENDPOINTS) {
+          for (const [, cem] of queryMap) {
+            if (cem.count < CROSS_ENDPOINT_MIN_OCCURRENCES) continue;
+            if (cem.endpoints.size < CROSS_ENDPOINT_MIN_ENDPOINTS) continue;
+            const p = Math.round(cem.endpoints.size / allEndpoints.size * 100);
+            if (p < CROSS_ENDPOINT_PCT) continue;
+            const info = getQueryInfo(cem.first);
+            const label = info.op + (info.table ? ` ${info.table}` : "");
+            insights.push({
+              severity: "warning",
+              type: "cross-endpoint",
+              title: "Repeated Query Across Endpoints",
+              desc: `${label} runs on ${cem.endpoints.size} of ${allEndpoints.size} endpoints (${p}%).`,
+              hint: "This query runs on most of your endpoints. Load it once in middleware or cache the result to avoid redundant database calls.",
+              nav: "queries"
+            });
+          }
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/redundant-query.ts
+var redundantQueryRule;
+var init_redundant_query = __esm({
+  "src/analysis/insights/rules/redundant-query.ts"() {
+    "use strict";
+    init_query_helpers();
+    init_endpoint();
+    init_thresholds();
+    redundantQueryRule = {
+      id: "redundant-query",
+      check(ctx) {
+        const insights = [];
+        const seen = /* @__PURE__ */ new Set();
+        for (const [reqId, reqQueries] of ctx.queriesByReq) {
+          const req = ctx.reqById.get(reqId);
+          if (!req) continue;
+          const endpoint = getEndpointKey(req.method, req.path);
+          const exact = /* @__PURE__ */ new Map();
+          for (const q of reqQueries) {
+            if (!q.sql) continue;
+            let entry = exact.get(q.sql);
+            if (!entry) {
+              entry = { count: 0, first: q };
+              exact.set(q.sql, entry);
+            }
+            entry.count++;
+          }
+          for (const [, e] of exact) {
+            if (e.count < REDUNDANT_QUERY_MIN_COUNT) continue;
+            const info = getQueryInfo(e.first);
+            const label = info.op + (info.table ? ` ${info.table}` : "");
+            const dedupKey = `${endpoint}:${label}`;
+            if (seen.has(dedupKey)) continue;
+            seen.add(dedupKey);
+            insights.push({
+              severity: "warning",
+              type: "redundant-query",
+              title: "Redundant Query",
+              desc: `${label} runs ${e.count}x with identical params in ${endpoint}.`,
+              hint: "The exact same query with identical parameters runs multiple times in one request. Cache the first result or lift the query to a shared function.",
+              nav: "queries"
+            });
+          }
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/error.ts
+var errorRule;
+var init_error = __esm({
+  "src/analysis/insights/rules/error.ts"() {
+    "use strict";
+    errorRule = {
+      id: "error",
+      check(ctx) {
+        if (ctx.errors.length === 0) return [];
+        const insights = [];
+        const groups = /* @__PURE__ */ new Map();
+        for (const e of ctx.errors) {
+          const name = e.name || "Error";
+          groups.set(name, (groups.get(name) ?? 0) + 1);
+        }
+        for (const [name, cnt] of groups) {
+          insights.push({
+            severity: "critical",
+            type: "error",
+            title: "Unhandled Error",
+            desc: `${name} \u2014 occurred ${cnt} time${cnt !== 1 ? "s" : ""}`,
+            hint: "Unhandled errors crash request handlers. Wrap async code in try/catch or add error-handling middleware.",
+            nav: "errors"
+          });
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/error-hotspot.ts
+var errorHotspotRule;
+var init_error_hotspot = __esm({
+  "src/analysis/insights/rules/error-hotspot.ts"() {
+    "use strict";
+    init_thresholds();
+    errorHotspotRule = {
+      id: "error-hotspot",
+      check(ctx) {
+        const insights = [];
+        for (const [ep, g] of ctx.endpointGroups) {
+          if (g.total < MIN_REQUESTS_FOR_INSIGHT) continue;
+          const errorRate = Math.round(g.errors / g.total * 100);
+          if (errorRate >= ERROR_RATE_THRESHOLD_PCT) {
+            insights.push({
+              severity: "critical",
+              type: "error-hotspot",
+              title: "Error Hotspot",
+              desc: `${ep} \u2014 ${errorRate}% error rate (${g.errors}/${g.total} requests)`,
+              hint: "This endpoint frequently returns errors. Check the response bodies for error details and stack traces.",
+              nav: "requests"
+            });
+          }
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/duplicate.ts
+var duplicateRule;
+var init_duplicate = __esm({
+  "src/analysis/insights/rules/duplicate.ts"() {
+    "use strict";
+    init_thresholds();
+    duplicateRule = {
+      id: "duplicate",
+      check(ctx) {
+        const dupCounts = /* @__PURE__ */ new Map();
+        const flowCount = /* @__PURE__ */ new Map();
+        for (const flow of ctx.flows) {
+          if (!flow.requests) continue;
+          const seenInFlow = /* @__PURE__ */ new Set();
+          for (const fr of flow.requests) {
+            if (!fr.isDuplicate) continue;
+            const dupKey = `${fr.method} ${fr.label ?? fr.path ?? fr.url}`;
+            dupCounts.set(dupKey, (dupCounts.get(dupKey) ?? 0) + 1);
+            if (!seenInFlow.has(dupKey)) {
+              seenInFlow.add(dupKey);
+              flowCount.set(dupKey, (flowCount.get(dupKey) ?? 0) + 1);
+            }
+          }
+        }
+        const dupEntries = [...dupCounts.entries()].map(([key, count]) => ({ key, count, flows: flowCount.get(key) ?? 0 })).sort((a, b) => b.count - a.count);
+        const insights = [];
+        for (let i = 0; i < Math.min(dupEntries.length, MAX_DUPLICATE_INSIGHTS); i++) {
+          const d = dupEntries[i];
+          insights.push({
+            severity: "warning",
+            type: "duplicate",
+            title: "Duplicate API Call",
+            desc: `${d.key} loaded ${d.count}x as duplicate across ${d.flows} action${d.flows !== 1 ? "s" : ""}`,
+            hint: "Multiple components independently fetch the same endpoint. Lift the fetch to a parent component, use a data cache, or deduplicate with React Query / SWR.",
+            nav: "actions"
+          });
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/utils/format.ts
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  return `${(ms / 1e3).toFixed(1)}s`;
+}
+function formatSize(bytes) {
+  if (bytes < 1024) return `${bytes}B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+}
+function pct(part, total) {
+  return total > 0 ? Math.round(part / total * 100) : 0;
+}
+var init_format = __esm({
+  "src/utils/format.ts"() {
+    "use strict";
+  }
+});
+
+// src/analysis/insights/rules/slow.ts
+var slowRule;
+var init_slow = __esm({
+  "src/analysis/insights/rules/slow.ts"() {
+    "use strict";
+    init_format();
+    init_thresholds();
+    slowRule = {
+      id: "slow",
+      check(ctx) {
+        const insights = [];
+        for (const [ep, g] of ctx.endpointGroups) {
+          if (g.total < MIN_REQUESTS_FOR_INSIGHT) continue;
+          const avgMs = Math.round(g.totalDuration / g.total);
+          if (avgMs < SLOW_ENDPOINT_THRESHOLD_MS) continue;
+          const avgQueryMs = Math.round(g.totalQueryTimeMs / g.total);
+          const avgFetchMs = Math.round(g.totalFetchTimeMs / g.total);
+          const avgAppMs = Math.max(0, avgMs - avgQueryMs - avgFetchMs);
+          const parts = [];
+          if (avgQueryMs > 0) parts.push(`DB ${formatDuration(avgQueryMs)} ${pct(avgQueryMs, avgMs)}%`);
+          if (avgFetchMs > 0) parts.push(`Fetch ${formatDuration(avgFetchMs)} ${pct(avgFetchMs, avgMs)}%`);
+          if (avgAppMs > 0) parts.push(`App ${formatDuration(avgAppMs)} ${pct(avgAppMs, avgMs)}%`);
+          const breakdown = parts.length > 0 ? ` [${parts.join(" \xB7 ")}]` : "";
+          let detail;
+          let slowestMs = 0;
+          for (const [, sd] of g.queryShapeDurations) {
+            const avgShapeMs = sd.totalMs / sd.count;
+            if (avgShapeMs > slowestMs) {
+              slowestMs = avgShapeMs;
+              detail = `Slowest query: ${sd.label} \u2014 avg ${formatDuration(Math.round(avgShapeMs))} (${sd.count}x)`;
+            }
+          }
+          insights.push({
+            severity: "warning",
+            type: "slow",
+            title: "Slow Endpoint",
+            desc: `${ep} \u2014 avg ${formatDuration(avgMs)}${breakdown}`,
+            hint: avgQueryMs >= avgFetchMs && avgQueryMs >= avgAppMs ? "Most time is in database queries. Check the Queries tab for slow or redundant queries." : avgFetchMs >= avgQueryMs && avgFetchMs >= avgAppMs ? "Most time is in outbound HTTP calls. Check if upstream services are slow or if calls can be parallelized." : "Most time is in application code. Profile the handler for CPU-heavy operations or blocking calls.",
+            detail,
+            nav: "requests"
+          });
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/query-heavy.ts
+var queryHeavyRule;
+var init_query_heavy = __esm({
+  "src/analysis/insights/rules/query-heavy.ts"() {
+    "use strict";
+    init_thresholds();
+    queryHeavyRule = {
+      id: "query-heavy",
+      check(ctx) {
+        const insights = [];
+        for (const [ep, g] of ctx.endpointGroups) {
+          if (g.total < MIN_REQUESTS_FOR_INSIGHT) continue;
+          const avgQueries = Math.round(g.queryCount / g.total);
+          if (avgQueries > HIGH_QUERY_COUNT_PER_REQ) {
+            insights.push({
+              severity: "warning",
+              type: "query-heavy",
+              title: "Query-Heavy Endpoint",
+              desc: `${ep} \u2014 avg ${avgQueries} queries/request`,
+              hint: "Too many queries per request increases latency. Combine queries with JOINs, use batch operations, or reduce the number of data fetches.",
+              nav: "queries"
+            });
+          }
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/select-star.ts
+var selectStarRule;
+var init_select_star = __esm({
+  "src/analysis/insights/rules/select-star.ts"() {
+    "use strict";
+    init_query_helpers();
+    init_thresholds();
+    init_patterns();
+    selectStarRule = {
+      id: "select-star",
+      check(ctx) {
+        const seen = /* @__PURE__ */ new Map();
+        for (const [, reqQueries] of ctx.queriesByReq) {
+          for (const q of reqQueries) {
+            if (!q.sql) continue;
+            const isSelectStar = SELECT_STAR_RE.test(q.sql.trim()) || SELECT_DOT_STAR_RE.test(q.sql);
+            if (!isSelectStar) continue;
+            const info = getQueryInfo(q);
+            const key = info.table || "unknown";
+            seen.set(key, (seen.get(key) ?? 0) + 1);
+          }
+        }
+        const insights = [];
+        for (const [table, count] of seen) {
+          if (count < OVERFETCH_MIN_REQUESTS) continue;
+          insights.push({
+            severity: "warning",
+            type: "select-star",
+            title: "SELECT * Query",
+            desc: `SELECT * on ${table} \u2014 ${count} occurrence${count !== 1 ? "s" : ""}`,
+            hint: "SELECT * fetches all columns including ones you don\u2019t need. Specify only required columns to reduce data transfer and memory usage.",
+            nav: "queries"
+          });
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/high-rows.ts
+var highRowsRule;
+var init_high_rows = __esm({
+  "src/analysis/insights/rules/high-rows.ts"() {
+    "use strict";
+    init_query_helpers();
+    init_thresholds();
+    highRowsRule = {
+      id: "high-rows",
+      check(ctx) {
+        const seen = /* @__PURE__ */ new Map();
+        for (const [, reqQueries] of ctx.queriesByReq) {
+          for (const q of reqQueries) {
+            if (!q.rowCount || q.rowCount <= HIGH_ROW_COUNT) continue;
+            const info = getQueryInfo(q);
+            const key = `${info.op} ${info.table || "unknown"}`;
+            let entry = seen.get(key);
+            if (!entry) {
+              entry = { max: 0, count: 0 };
+              seen.set(key, entry);
+            }
+            entry.count++;
+            if (q.rowCount > entry.max) entry.max = q.rowCount;
+          }
+        }
+        const insights = [];
+        for (const [key, hrs] of seen) {
+          if (hrs.count < OVERFETCH_MIN_REQUESTS) continue;
+          insights.push({
+            severity: "warning",
+            type: "high-rows",
+            title: "Large Result Set",
+            desc: `${key} returns ${hrs.max}+ rows (${hrs.count}x)`,
+            hint: "Fetching many rows slows responses and wastes memory. Add a LIMIT clause, implement pagination, or filter with a WHERE condition.",
+            nav: "queries"
+          });
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/response-overfetch.ts
+var responseOverfetchRule;
+var init_response_overfetch = __esm({
+  "src/analysis/insights/rules/response-overfetch.ts"() {
+    "use strict";
+    init_endpoint();
+    init_response();
+    init_patterns();
+    init_thresholds();
+    responseOverfetchRule = {
+      id: "response-overfetch",
+      check(ctx) {
+        const insights = [];
+        const seen = /* @__PURE__ */ new Set();
+        for (const r of ctx.nonStatic) {
+          if (r.statusCode >= 400 || !r.responseBody) continue;
+          const ep = getEndpointKey(r.method, r.path);
+          if (seen.has(ep)) continue;
+          let parsed;
+          try {
+            parsed = JSON.parse(r.responseBody);
+          } catch {
+            continue;
+          }
+          const target = unwrapResponse(parsed);
+          const inspectObj = Array.isArray(target) && target.length > 0 ? target[0] : target;
+          if (!inspectObj || typeof inspectObj !== "object" || Array.isArray(inspectObj)) continue;
+          const fields = Object.keys(inspectObj);
+          if (fields.length < OVERFETCH_MIN_FIELDS) continue;
+          let internalIdCount = 0;
+          let nullCount = 0;
+          for (const key of fields) {
+            if (INTERNAL_ID_SUFFIX.test(key) || key === "id" || key === "_id") internalIdCount++;
+            const val = inspectObj[key];
+            if (val === null || val === void 0) nullCount++;
+          }
+          const nullRatio = nullCount / fields.length;
+          const reasons = [];
+          if (internalIdCount >= OVERFETCH_MIN_INTERNAL_IDS) reasons.push(`${internalIdCount} internal ID fields`);
+          if (nullRatio >= OVERFETCH_NULL_RATIO) reasons.push(`${Math.round(nullRatio * 100)}% null fields`);
+          if (reasons.length === 0 && fields.length >= OVERFETCH_MANY_FIELDS) {
+            reasons.push(`${fields.length} fields returned`);
+          }
+          if (reasons.length > 0) {
+            seen.add(ep);
+            insights.push({
+              severity: "info",
+              type: "response-overfetch",
+              title: "Response Overfetch",
+              desc: `${ep} \u2014 ${reasons.join(", ")}`,
+              hint: "This response returns more data than the client likely needs. Use a DTO or select only required fields to reduce payload size and avoid leaking internal structure.",
+              nav: "requests"
+            });
+          }
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/large-response.ts
+var largeResponseRule;
+var init_large_response = __esm({
+  "src/analysis/insights/rules/large-response.ts"() {
+    "use strict";
+    init_format();
+    init_thresholds();
+    largeResponseRule = {
+      id: "large-response",
+      check(ctx) {
+        const insights = [];
+        for (const [ep, g] of ctx.endpointGroups) {
+          if (g.total < OVERFETCH_MIN_REQUESTS) continue;
+          const avgSize = Math.round(g.totalSize / g.total);
+          if (avgSize > LARGE_RESPONSE_BYTES) {
+            insights.push({
+              severity: "info",
+              type: "large-response",
+              title: "Large Response",
+              desc: `${ep} \u2014 avg ${formatSize(avgSize)} response`,
+              hint: "Large API responses increase network transfer time. Implement pagination, field filtering, or response compression.",
+              nav: "requests"
+            });
+          }
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/regression.ts
+var regressionRule;
+var init_regression = __esm({
+  "src/analysis/insights/rules/regression.ts"() {
+    "use strict";
+    init_format();
+    init_thresholds();
+    regressionRule = {
+      id: "regression",
+      check(ctx) {
+        if (!ctx.previousMetrics || ctx.previousMetrics.length === 0) return [];
+        const insights = [];
+        for (const epMetrics of ctx.previousMetrics) {
+          if (epMetrics.sessions.length < 2) continue;
+          const prev = epMetrics.sessions[epMetrics.sessions.length - 2];
+          const current = epMetrics.sessions[epMetrics.sessions.length - 1];
+          if (prev.requestCount < REGRESSION_MIN_REQUESTS || current.requestCount < REGRESSION_MIN_REQUESTS) continue;
+          const p95Increase = current.p95DurationMs - prev.p95DurationMs;
+          const p95PctChange = prev.p95DurationMs > 0 ? Math.round(p95Increase / prev.p95DurationMs * 100) : 0;
+          if (p95Increase >= REGRESSION_MIN_INCREASE_MS && p95PctChange >= REGRESSION_PCT_THRESHOLD) {
+            insights.push({
+              severity: "warning",
+              type: "regression",
+              title: "Performance Regression",
+              desc: `${epMetrics.endpoint} p95 degraded ${formatDuration(prev.p95DurationMs)} \u2192 ${formatDuration(current.p95DurationMs)} (+${p95PctChange}%)`,
+              hint: "This endpoint is slower than the previous session. Check if recent code changes added queries or processing.",
+              nav: "graph"
+            });
+          }
+          if (prev.avgQueryCount > 0 && current.avgQueryCount > prev.avgQueryCount * QUERY_COUNT_REGRESSION_RATIO) {
+            insights.push({
+              severity: "warning",
+              type: "regression",
+              title: "Query Count Regression",
+              desc: `${epMetrics.endpoint} queries/request increased ${prev.avgQueryCount} \u2192 ${current.avgQueryCount}`,
+              hint: "This endpoint is making more database queries than before. Check for new N+1 patterns or removed query optimizations.",
+              nav: "queries"
+            });
+          }
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/security.ts
+var securityRule;
+var init_security2 = __esm({
+  "src/analysis/insights/rules/security.ts"() {
+    "use strict";
+    securityRule = {
+      id: "security",
+      check(ctx) {
+        if (!ctx.securityFindings) return [];
+        return ctx.securityFindings.map((f) => ({
+          severity: f.severity,
+          type: "security",
+          title: f.title,
+          desc: f.desc,
+          hint: f.hint,
+          nav: "security"
+        }));
+      }
+    };
+  }
+});
+
+// src/analysis/insights/index.ts
+function createDefaultInsightRunner() {
+  const runner = new InsightRunner();
+  runner.register(n1Rule);
+  runner.register(crossEndpointRule);
+  runner.register(redundantQueryRule);
+  runner.register(errorRule);
+  runner.register(errorHotspotRule);
+  runner.register(duplicateRule);
+  runner.register(slowRule);
+  runner.register(queryHeavyRule);
+  runner.register(selectStarRule);
+  runner.register(highRowsRule);
+  runner.register(responseOverfetchRule);
+  runner.register(largeResponseRule);
+  runner.register(regressionRule);
+  runner.register(securityRule);
+  return runner;
+}
+function computeInsights(ctx) {
+  return createDefaultInsightRunner().run(ctx);
+}
+var init_insights2 = __esm({
+  "src/analysis/insights/index.ts"() {
+    "use strict";
+    init_runner();
+    init_runner();
+    init_n1();
+    init_cross_endpoint();
+    init_redundant_query();
+    init_error();
+    init_error_hotspot();
+    init_duplicate();
+    init_slow();
+    init_query_heavy();
+    init_select_star();
+    init_high_rows();
+    init_response_overfetch();
+    init_large_response();
+    init_regression();
+    init_security2();
+  }
+});
+
+// src/analysis/insights.ts
+var init_insights3 = __esm({
+  "src/analysis/insights.ts"() {
     "use strict";
-    init_request_log();
-    init_store();
-    init_request_log();
-    init_group();
-    init_rules();
     init_insights2();
+  }
+});
+
+// src/analysis/engine.ts
+var AnalysisEngine;
+var init_engine = __esm({
+  "src/analysis/engine.ts"() {
+    "use strict";
+    init_request_log();
+    init_store();
+    init_request_log();
+    init_group();
+    init_rules();
+    init_insights3();
     AnalysisEngine = class {
-      constructor(debounceMs = 300) {
+      constructor(metricsStore, debounceMs = 300) {
+        this.metricsStore = metricsStore;
         this.debounceMs = debounceMs;
         this.scanner = createDefaultScanner();
         this.boundRequestListener = () => this.scheduleRecompute();
@@ -3639,6 +4171,7 @@ var init_engine = __esm({
         const queries = defaultQueryStore.getAll();
         const errors = defaultErrorStore.getAll();
         const logs = defaultLogStore.getAll();
+        const fetches = defaultFetchStore.getAll();
         const flows = groupRequestsIntoFlows(requests);
         this.cachedFindings = this.scanner.scan({ requests, logs });
         this.cachedInsights = computeInsights({
@@ -3646,6 +4179,8 @@ var init_engine = __esm({
           queries,
           errors,
           flows,
+          fetches,
+          previousMetrics: this.metricsStore.getAll(),
           securityFindings: this.cachedFindings
         });
         for (const fn of this.listeners) {
@@ -3668,8 +4203,9 @@ var init_src = __esm({
     init_adapter_registry();
     init_rules();
     init_engine();
+    init_insights3();
     init_insights2();
-    VERSION = "0.7.4";
+    VERSION = "0.7.6";
   }
 });
 
@@ -4282,7 +4818,7 @@ function getFlowInsights() {
   }
   `;
 }
-var init_insights3 = __esm({
+var init_insights4 = __esm({
   "src/dashboard/client/views/flows/insights.ts"() {
     "use strict";
     init_constants();
@@ -4474,7 +5010,7 @@ function getFlowsView() {
 var init_flows2 = __esm({
   "src/dashboard/client/views/flows.ts"() {
     "use strict";
-    init_insights3();
+    init_insights4();
     init_detail();
   }
 });
@@ -5090,6 +5626,27 @@ function getGraphOverview() {
         (s.avgQueryCount > 0 ? '<span class="perf-ep-stat' + (s.avgQueryCount > HIGH_QUERY_THRESHOLD ? ' perf-ep-stat-warn' : '') + '">' + s.avgQueryCount + ' q/req</span>' : '') +
         '<span class="perf-ep-stat perf-ep-stat-muted">' + s.totalRequests + ' req' + (s.totalRequests !== 1 ? 's' : '') + '</span>';
 
+      var ovTotal = (s.avgQueryTimeMs || 0) + (s.avgFetchTimeMs || 0) + (s.avgAppTimeMs || 0);
+      var ovBarHtml = '';
+      if (ovTotal > 0) {
+        var ovDbPct = Math.round((s.avgQueryTimeMs || 0) / ovTotal * 100);
+        var ovFetchPct = Math.round((s.avgFetchTimeMs || 0) / ovTotal * 100);
+        var ovAppPct = Math.max(0, 100 - ovDbPct - ovFetchPct);
+        ovBarHtml =
+          '<div class="perf-breakdown-inline">' +
+            '<div class="perf-breakdown-bar perf-breakdown-bar-sm">' +
+              (ovDbPct > 0 ? '<div class="perf-breakdown-seg perf-breakdown-db" style="width:' + ovDbPct + '%"></div>' : '') +
+              (ovFetchPct > 0 ? '<div class="perf-breakdown-seg perf-breakdown-fetch" style="width:' + ovFetchPct + '%"></div>' : '') +
+              (ovAppPct > 0 ? '<div class="perf-breakdown-seg perf-breakdown-app" style="width:' + ovAppPct + '%"></div>' : '') +
+            '</div>' +
+            '<span class="perf-breakdown-labels">' +
+              (ovDbPct > 0 ? '<span class="perf-breakdown-lbl"><span class="perf-breakdown-dot perf-breakdown-db"></span>' + fmtMs(s.avgQueryTimeMs || 0) + '</span>' : '') +
+              (ovFetchPct > 0 ? '<span class="perf-breakdown-lbl"><span class="perf-breakdown-dot perf-breakdown-fetch"></span>' + fmtMs(s.avgFetchTimeMs || 0) + '</span>' : '') +
+              '<span class="perf-breakdown-lbl"><span class="perf-breakdown-dot perf-breakdown-app"></span>' + fmtMs(s.avgAppTimeMs || 0) + '</span>' +
+            '</span>' +
+          '</div>';
+      }
+
       var chartId = 'inline-scatter-' + idx;
 
       card.innerHTML =
@@ -5097,6 +5654,7 @@ function getGraphOverview() {
           '<span class="perf-ep-name">' + escHtml(ep.endpoint) + '</span>' +
           '<span class="perf-ep-stats">' + statsHtml + '</span>' +
         '</div>' +
+        ovBarHtml +
         '<canvas id="' + chartId + '" class="perf-inline-canvas"></canvas>';
 
       list.appendChild(card);
@@ -5132,7 +5690,6 @@ function getGraphDetail() {
     var g = healthGrade(s.p95Ms);
     var errors = Math.round(s.errorRate * s.totalRequests);
 
-    // header
     var header = document.createElement('div');
     header.className = 'perf-detail-header';
     header.innerHTML =
@@ -5142,7 +5699,6 @@ function getGraphDetail() {
       '</div>';
     container.appendChild(header);
 
-    // metric cards
     var metrics = document.createElement('div');
     metrics.className = 'perf-metric-row';
     metrics.innerHTML =
@@ -5151,7 +5707,38 @@ function getGraphDetail() {
       buildMetricCard('Queries/req', String(s.avgQueryCount), s.avgQueryCount > ${HIGH_QUERY_COUNT_PER_REQ} ? 'var(--amber)' : 'var(--text)');
     container.appendChild(metrics);
 
-    // scatter chart
+    var totalAvg = (s.avgQueryTimeMs || 0) + (s.avgFetchTimeMs || 0) + (s.avgAppTimeMs || 0);
+    if (totalAvg > 0) {
+      var dbPct = Math.round((s.avgQueryTimeMs || 0) / totalAvg * 100);
+      var fetchPct = Math.round((s.avgFetchTimeMs || 0) / totalAvg * 100);
+      var appPct = Math.max(0, 100 - dbPct - fetchPct);
+
+      var breakdown = document.createElement('div');
+      breakdown.className = 'perf-breakdown';
+
+      var breakdownLabel = document.createElement('div');
+      breakdownLabel.className = 'perf-section-title';
+      breakdownLabel.textContent = 'Time Breakdown';
+      breakdown.appendChild(breakdownLabel);
+
+      var bar = document.createElement('div');
+      bar.className = 'perf-breakdown-bar';
+      if (dbPct > 0) bar.innerHTML += '<div class="perf-breakdown-seg perf-breakdown-db" style="width:' + dbPct + '%"></div>';
+      if (fetchPct > 0) bar.innerHTML += '<div class="perf-breakdown-seg perf-breakdown-fetch" style="width:' + fetchPct + '%"></div>';
+      if (appPct > 0) bar.innerHTML += '<div class="perf-breakdown-seg perf-breakdown-app" style="width:' + appPct + '%"></div>';
+      breakdown.appendChild(bar);
+
+      var legend = document.createElement('div');
+      legend.className = 'perf-breakdown-legend';
+      legend.innerHTML =
+        '<span class="perf-breakdown-item"><span class="perf-breakdown-dot perf-breakdown-db"></span>DB ' + fmtMs(s.avgQueryTimeMs || 0) + ' (' + dbPct + '%)</span>' +
+        '<span class="perf-breakdown-item"><span class="perf-breakdown-dot perf-breakdown-fetch"></span>Fetch ' + fmtMs(s.avgFetchTimeMs || 0) + ' (' + fetchPct + '%)</span>' +
+        '<span class="perf-breakdown-item"><span class="perf-breakdown-dot perf-breakdown-app"></span>App ' + fmtMs(s.avgAppTimeMs || 0) + ' (' + appPct + '%)</span>';
+      breakdown.appendChild(legend);
+
+      container.appendChild(breakdown);
+    }
+
     var chartWrap = document.createElement('div');
     chartWrap.className = 'perf-chart-wrap';
     var chartLabel = document.createElement('div');
@@ -5169,7 +5756,6 @@ function getGraphDetail() {
 
     drawScatterChart(canvas, ep.requests);
 
-    // recent requests table
     if (ep.requests.length > 0) {
       var tableWrap = document.createElement('div');
       tableWrap.className = 'perf-history-wrap';
@@ -5180,6 +5766,7 @@ function getGraphDetail() {
         '<span class="perf-col perf-col-date">Time</span>' +
         '<span class="perf-col perf-col-health">Health</span>' +
         '<span class="perf-col perf-col-avg">Duration</span>' +
+        '<span class="perf-col perf-col-breakdown">Breakdown</span>' +
         '<span class="perf-col perf-col-status">Status</span>' +
         '<span class="perf-col perf-col-qpr">Queries</span>';
       tableWrap.appendChild(colHeader);
@@ -5198,10 +5785,20 @@ function getGraphDetail() {
         var row = document.createElement('div');
         row.className = 'perf-hist-row' + (isError ? ' perf-hist-row-err' : '');
         row.setAttribute('data-req-idx', item.origIdx);
+        var rDbMs = r.queryTimeMs || 0;
+        var rFetchMs = r.fetchTimeMs || 0;
+        var rAppMs = Math.max(0, r.durationMs - rDbMs - rFetchMs);
+        var breakdownParts = [];
+        if (rDbMs > 0) breakdownParts.push('<span class="perf-bd-tag perf-bd-tag-db">DB ' + fmtMs(rDbMs) + '</span>');
+        if (rFetchMs > 0) breakdownParts.push('<span class="perf-bd-tag perf-bd-tag-fetch">Fetch ' + fmtMs(rFetchMs) + '</span>');
+        breakdownParts.push('<span class="perf-bd-tag perf-bd-tag-app">App ' + fmtMs(rAppMs) + '</span>');
+        var breakdownHtml = breakdownParts.join('');
+
         row.innerHTML =
           '<span class="perf-col perf-col-date">' + timeStr + '</span>' +
           '<span class="perf-col perf-col-health"><span class="perf-badge perf-badge-sm" style="color:' + rg.color + ';background:' + rg.bg + ';border-color:' + rg.border + '">' + rg.label + '</span></span>' +
           '<span class="perf-col perf-col-avg">' + fmtMs(r.durationMs) + '</span>' +
+          '<span class="perf-col perf-col-breakdown">' + breakdownHtml + '</span>' +
           '<span class="perf-col perf-col-status" style="color:' + (isError ? 'var(--red)' : 'var(--text-muted)') + '">' + r.statusCode + '</span>' +
           '<span class="perf-col perf-col-qpr">' + r.queryCount + '</span>';
         tableWrap.appendChild(row);
@@ -5744,7 +6341,7 @@ function getSecurityView() {
   }
   `;
 }
-var init_security2 = __esm({
+var init_security3 = __esm({
   "src/dashboard/client/views/security.ts"() {
     "use strict";
   }
@@ -6009,7 +6606,7 @@ var init_client = __esm({
     init_timeline2();
     init_graph2();
     init_overview3();
-    init_security2();
+    init_security3();
     init_app2();
   }
 });
@@ -6113,7 +6710,7 @@ function createDashboardHandler(deps) {
   routes[DASHBOARD_API_TAB] = (req, res) => {
     const raw = (req.url ?? "").split("tab=")[1];
     if (raw) {
-      const tab = decodeURIComponent(raw).slice(0, 32);
+      const tab = decodeURIComponent(raw).slice(0, MAX_TAB_NAME_LENGTH);
       if (VALID_TABS.has(tab) && isTelemetryEnabled()) recordTabViewed(tab);
     }
     res.writeHead(204);
@@ -6166,6 +6763,9 @@ var init_router = __esm({
 
 // src/output/terminal.ts
 import pc from "picocolors";
+function print(line) {
+  process.stdout.write(line + "\n");
+}
 function severityIcon(severity) {
   if (severity === "critical") return pc.red("\u2717");
   if (severity === "warning") return pc.yellow("\u26A0");
@@ -6184,7 +6784,12 @@ function formatConsoleLine(insight, dashboardUrl, suffix) {
   const title = colorTitle(insight.severity, insight.title);
   const desc = pc.dim(truncate(insight.desc) + (suffix ?? ""));
   const link = pc.dim(`\u2192  ${dashboardUrl}`);
-  return `  ${icon} ${title} \u2014 ${desc}  ${link}`;
+  let line = `  ${icon} ${title} \u2014 ${desc}  ${link}`;
+  if (insight.detail) {
+    line += `
+    ${pc.dim("\u2514 " + insight.detail)}`;
+  }
+  return line;
 }
 function createConsoleInsightListener(proxyPort, metricsStore) {
   const printedKeys = /* @__PURE__ */ new Set();
@@ -6199,7 +6804,7 @@ function createConsoleInsightListener(proxyPort, metricsStore) {
       printedKeys.add(key);
       let suffix;
       if (insight.type === "slow") {
-        const ep = metricsStore.getAll().find((e) => e.endpoint === endpoint);
+        const ep = metricsStore.getEndpoint(endpoint);
         if (ep && ep.sessions.length > 1) {
           const prev = ep.sessions[ep.sessions.length - 2];
           suffix = ` (\u2191 from ${prev.p95DurationMs < 1e3 ? prev.p95DurationMs + "ms" : (prev.p95DurationMs / 1e3).toFixed(1) + "s"})`;
@@ -6208,8 +6813,8 @@ function createConsoleInsightListener(proxyPort, metricsStore) {
       lines.push(formatConsoleLine(insight, dashUrl, suffix));
     }
     if (lines.length > 0) {
-      console.log();
-      for (const line of lines) console.log(line);
+      print("");
+      for (const line of lines) print(line);
     }
   };
 }
@@ -6342,6 +6947,7 @@ function captureInProcess(req, res, requestId) {
     } catch {
     }
     const result = originalEnd.apply(this, args);
+    const endTime = performance.now();
     try {
       const encoding = String(res.getHeader("content-encoding") ?? "").toLowerCase();
       let body = resChunks.length > 0 ? Buffer.concat(resChunks) : null;
@@ -6359,6 +6965,7 @@ function captureInProcess(req, res, requestId) {
         responseBody: body,
         responseContentType: String(res.getHeader("content-type") ?? ""),
         startTime,
+        endTime,
         config: { maxBodyCapture: DEFAULT_MAX_BODY_CAPTURE }
       });
     } catch {
@@ -6374,42 +6981,15 @@ var init_capture = __esm({
   }
 });
 
-// src/runtime/setup.ts
-var setup_exports = {};
-__export(setup_exports, {
-  setup: () => setup
-});
+// src/runtime/interceptor.ts
 import http from "http";
 import { randomUUID as randomUUID6 } from "crypto";
-function setup() {
-  if (initialized) return;
-  initialized = true;
-  setEmitter(routeEvent2);
-  setupFetchHook();
-  setupConsoleHook();
-  setupErrorHook();
-  const registry = createDefaultRegistry();
-  registry.patchAll(routeEvent2);
-  const cwd = process.cwd();
-  const metricsStore = new MetricsStore(new FileMetricsPersistence(cwd));
-  metricsStore.start();
-  const analysisEngine = new AnalysisEngine();
-  analysisEngine.start();
-  const config = {
-    proxyPort: 0,
-    targetPort: 0,
-    showStatic: false,
-    maxBodyCapture: DEFAULT_MAX_BODY_CAPTURE
-  };
-  const handleDashboard = createDashboardHandler({ metricsStore, analysisEngine });
-  onRequest((req) => {
-    const queryCount = defaultQueryStore.getByRequest(req.id).length;
-    metricsStore.recordRequest(req, queryCount);
-  });
-  const originalEmit = http.Server.prototype.emit;
+function installInterceptor(deps) {
+  originalEmit = http.Server.prototype.emit;
+  const saved = originalEmit;
   let bannerPrinted = false;
   http.Server.prototype.emit = safeWrap(
-    originalEmit,
+    saved,
     function(original, event, ...args) {
       if (event !== "request") return original.apply(this, [event, ...args]);
       const req = args[0];
@@ -6419,9 +6999,8 @@ function setup() {
         const port = req.socket.localPort;
         if (port) {
           bannerPrinted = true;
-          config.proxyPort = port;
-          analysisEngine.onUpdate(createConsoleInsightListener(port, metricsStore));
-          console.log(`  brakit v${VERSION} \u2014 http://localhost:${port}${DASHBOARD_PREFIX}`);
+          deps.config.proxyPort = port;
+          deps.onFirstRequest(port);
         }
       }
       if (isDashboardRequest(url)) {
@@ -6430,7 +7009,7 @@ function setup() {
           res.end("Not Found");
           return true;
         }
-        handleDashboard(req, res, config);
+        deps.handleDashboard(req, res, deps.config);
         return true;
       }
       const requestId = randomUUID6();
@@ -6446,8 +7025,72 @@ function setup() {
       );
     }
   );
-  health.setTeardown(() => {
+}
+function uninstallInterceptor() {
+  if (originalEmit) {
     http.Server.prototype.emit = originalEmit;
+    originalEmit = null;
+  }
+}
+var originalEmit;
+var init_interceptor = __esm({
+  "src/runtime/interceptor.ts"() {
+    "use strict";
+    init_context();
+    init_router();
+    init_safe_wrap();
+    init_guard();
+    init_capture();
+    originalEmit = null;
+  }
+});
+
+// src/runtime/setup.ts
+var setup_exports = {};
+__export(setup_exports, {
+  setup: () => setup
+});
+function setup() {
+  if (initialized) return;
+  initialized = true;
+  setEmitter(routeEvent2);
+  setupFetchHook();
+  setupConsoleHook();
+  setupErrorHook();
+  const registry = createDefaultRegistry();
+  registry.patchAll(routeEvent2);
+  const cwd = process.cwd();
+  const metricsStore = new MetricsStore(new FileMetricsPersistence(cwd));
+  metricsStore.start();
+  const analysisEngine = new AnalysisEngine(metricsStore);
+  analysisEngine.start();
+  const config = {
+    proxyPort: 0,
+    targetPort: 0,
+    showStatic: false,
+    maxBodyCapture: DEFAULT_MAX_BODY_CAPTURE
+  };
+  const handleDashboard = createDashboardHandler({ metricsStore, analysisEngine });
+  onRequest((req) => {
+    const queries = defaultQueryStore.getByRequest(req.id);
+    const fetches = defaultFetchStore.getByRequest(req.id);
+    metricsStore.recordRequest(req, {
+      queryCount: queries.length,
+      queryTimeMs: queries.reduce((s, q) => s + q.durationMs, 0),
+      fetchTimeMs: fetches.reduce((s, f) => s + f.durationMs, 0)
+    });
+  });
+  installInterceptor({
+    handleDashboard,
+    config,
+    onFirstRequest(port) {
+      analysisEngine.onUpdate(createConsoleInsightListener(port, metricsStore));
+      process.stdout.write(`  brakit v${VERSION} \u2014 http://localhost:${port}${DASHBOARD_PREFIX}
+`);
+    }
+  });
+  health.setTeardown(() => {
+    uninstallInterceptor();
     analysisEngine.stop();
     metricsStore.stop();
   });
@@ -6472,7 +7115,6 @@ var initialized;
 var init_setup = __esm({
   "src/runtime/setup.ts"() {
     "use strict";
-    init_context();
     init_transport2();
     init_fetch();
     init_console();
@@ -6485,10 +7127,8 @@ var init_setup = __esm({
     init_terminal();
     init_src();
     init_constants();
-    init_safe_wrap();
     init_health2();
-    init_guard();
-    init_capture();
+    init_interceptor();
     initialized = false;
   }
 });