brakit 0.8.7 → 0.9.1

package/dist/runtime/index.js

@@ -14,48 +14,10 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/constants/routes.ts
-var DASHBOARD_PREFIX, DASHBOARD_API_REQUESTS, DASHBOARD_API_EVENTS, DASHBOARD_API_FLOWS, DASHBOARD_API_CLEAR, DASHBOARD_API_LOGS, DASHBOARD_API_FETCHES, DASHBOARD_API_ERRORS, DASHBOARD_API_QUERIES, DASHBOARD_API_INGEST, DASHBOARD_API_METRICS, DASHBOARD_API_ACTIVITY, DASHBOARD_API_METRICS_LIVE, DASHBOARD_API_INSIGHTS, DASHBOARD_API_SECURITY, DASHBOARD_API_TAB, DASHBOARD_API_FINDINGS, DASHBOARD_API_FINDINGS_REPORT, VALID_TABS_TUPLE, VALID_TABS;
-var init_routes = __esm({
-  "src/constants/routes.ts"() {
-    "use strict";
-    DASHBOARD_PREFIX = "/__brakit";
-    DASHBOARD_API_REQUESTS = `${DASHBOARD_PREFIX}/api/requests`;
-    DASHBOARD_API_EVENTS = `${DASHBOARD_PREFIX}/api/events`;
-    DASHBOARD_API_FLOWS = `${DASHBOARD_PREFIX}/api/flows`;
-    DASHBOARD_API_CLEAR = `${DASHBOARD_PREFIX}/api/clear`;
-    DASHBOARD_API_LOGS = `${DASHBOARD_PREFIX}/api/logs`;
-    DASHBOARD_API_FETCHES = `${DASHBOARD_PREFIX}/api/fetches`;
-    DASHBOARD_API_ERRORS = `${DASHBOARD_PREFIX}/api/errors`;
-    DASHBOARD_API_QUERIES = `${DASHBOARD_PREFIX}/api/queries`;
-    DASHBOARD_API_INGEST = `${DASHBOARD_PREFIX}/api/ingest`;
-    DASHBOARD_API_METRICS = `${DASHBOARD_PREFIX}/api/metrics`;
-    DASHBOARD_API_ACTIVITY = `${DASHBOARD_PREFIX}/api/activity`;
-    DASHBOARD_API_METRICS_LIVE = `${DASHBOARD_PREFIX}/api/metrics/live`;
-    DASHBOARD_API_INSIGHTS = `${DASHBOARD_PREFIX}/api/insights`;
-    DASHBOARD_API_SECURITY = `${DASHBOARD_PREFIX}/api/security`;
-    DASHBOARD_API_TAB = `${DASHBOARD_PREFIX}/api/tab`;
-    DASHBOARD_API_FINDINGS = `${DASHBOARD_PREFIX}/api/findings`;
-    DASHBOARD_API_FINDINGS_REPORT = `${DASHBOARD_PREFIX}/api/findings/report`;
-    VALID_TABS_TUPLE = [
-      "overview",
-      "actions",
-      "requests",
-      "fetches",
-      "queries",
-      "errors",
-      "logs",
-      "performance",
-      "security"
-    ];
-    VALID_TABS = new Set(VALID_TABS_TUPLE);
-  }
-});
-
-// src/constants/limits.ts
-var MAX_REQUEST_ENTRIES, DEFAULT_MAX_BODY_CAPTURE, DEFAULT_API_LIMIT, MAX_TELEMETRY_ENTRIES, MAX_TAB_NAME_LENGTH, MAX_INGEST_BYTES, TERMINAL_TRUNCATE_LENGTH, SENSITIVE_MASK_MIN_LENGTH, SENSITIVE_MASK_VISIBLE_CHARS, MAX_JSON_BODY_BYTES, ANALYSIS_DEBOUNCE_MS, ISSUE_ID_HASH_LENGTH, ISSUES_DATA_VERSION, SENSITIVE_MASK_PLACEHOLDER, PROJECT_HASH_LENGTH, SECRET_SCAN_ARRAY_LIMIT, PII_SCAN_ARRAY_LIMIT, MIN_SECRET_VALUE_LENGTH, FULL_RECORD_MIN_FIELDS, LIST_PII_MIN_ITEMS, MAX_API_LIMIT, MAX_OBJECT_SCAN_DEPTH, MAX_UNIQUE_ENDPOINTS, MAX_ACCUMULATOR_ENTRIES, ISSUE_PRUNE_TTL_MS;
-var init_limits = __esm({
-  "src/constants/limits.ts"() {
+// src/constants/config.ts
+var MAX_REQUEST_ENTRIES, DEFAULT_MAX_BODY_CAPTURE, DEFAULT_API_LIMIT, MAX_TELEMETRY_ENTRIES, MAX_TAB_NAME_LENGTH, MAX_INGEST_BYTES, TERMINAL_TRUNCATE_LENGTH, SENSITIVE_MASK_MIN_LENGTH, SENSITIVE_MASK_VISIBLE_CHARS, MAX_JSON_BODY_BYTES, ANALYSIS_DEBOUNCE_MS, ISSUE_ID_HASH_LENGTH, ISSUES_DATA_VERSION, SENSITIVE_MASK_PLACEHOLDER, PROJECT_HASH_LENGTH, SECRET_SCAN_ARRAY_LIMIT, PII_SCAN_ARRAY_LIMIT, MIN_SECRET_VALUE_LENGTH, FULL_RECORD_MIN_FIELDS, LIST_PII_MIN_ITEMS, MAX_API_LIMIT, MAX_OBJECT_SCAN_DEPTH, MAX_UNIQUE_ENDPOINTS, MAX_ACCUMULATOR_ENTRIES, ISSUE_PRUNE_TTL_MS, FLOW_GAP_MS, SLOW_REQUEST_THRESHOLD_MS, MIN_POLLING_SEQUENCE, ENDPOINT_TRUNCATE_LENGTH, N1_QUERY_THRESHOLD, ERROR_RATE_THRESHOLD_PCT, MIN_REQUESTS_FOR_INSIGHT, HIGH_QUERY_COUNT_PER_REQ, CROSS_ENDPOINT_MIN_ENDPOINTS, CROSS_ENDPOINT_PCT, CROSS_ENDPOINT_MIN_OCCURRENCES, REDUNDANT_QUERY_MIN_COUNT, LARGE_RESPONSE_BYTES, HIGH_ROW_COUNT, OVERFETCH_MIN_REQUESTS, OVERFETCH_MIN_FIELDS, OVERFETCH_MIN_INTERNAL_IDS, OVERFETCH_NULL_RATIO, REGRESSION_PCT_THRESHOLD, REGRESSION_MIN_INCREASE_MS, REGRESSION_MIN_REQUESTS, QUERY_COUNT_REGRESSION_RATIO, OVERFETCH_MANY_FIELDS, OVERFETCH_UNWRAP_MIN_SIZE, MAX_DUPLICATE_INSIGHTS, INSIGHT_WINDOW_PER_ENDPOINT, CLEAN_HITS_FOR_RESOLUTION, STALE_ISSUE_TTL_MS, STRICT_MODE_MAX_GAP_MS, BASELINE_MIN_SESSIONS, BASELINE_MIN_REQUESTS_PER_SESSION, BASELINE_PENDING_POINTS_MIN, METRICS_DIR, METRICS_FILE, PORT_FILE, ISSUES_FILE, METRICS_FLUSH_INTERVAL_MS, METRICS_MAX_SESSIONS, METRICS_MAX_DATA_POINTS, ISSUES_FLUSH_INTERVAL_MS, SSE_HEARTBEAT_INTERVAL_MS, NOISE_HOSTS, NOISE_PATH_PATTERNS, VALID_ISSUE_STATES, VALID_ISSUE_CATEGORIES, VALID_AI_FIX_STATUSES, TELEMETRY_EVENT_SETUP_COMPLETED, TELEMETRY_EVENT_FIRST_REQUEST, TELEMETRY_EVENT_DASHBOARD_VIEWED, TELEMETRY_EVENT_SESSION, EXIT_REASON_CLEAN, EXIT_REASON_SIGINT, EXIT_REASON_SIGTERM, DETAIL_PREVIEW_LENGTH, KNOWN_DEPENDENCY_NAMES;
+var init_config = __esm({
+  "src/constants/config.ts"() {
     "use strict";
     MAX_REQUEST_ENTRIES = 1e3;
     DEFAULT_MAX_BODY_CAPTURE = 10240;
@@ -82,21 +44,12 @@ var init_limits = __esm({
     MAX_UNIQUE_ENDPOINTS = 500;
     MAX_ACCUMULATOR_ENTRIES = 1e3;
     ISSUE_PRUNE_TTL_MS = 10 * 60 * 1e3;
-  }
-});
-
-// src/constants/thresholds.ts
-var FLOW_GAP_MS, SLOW_REQUEST_THRESHOLD_MS, MIN_POLLING_SEQUENCE, ENDPOINT_TRUNCATE_LENGTH, N1_QUERY_THRESHOLD, ERROR_RATE_THRESHOLD_PCT, SLOW_ENDPOINT_THRESHOLD_MS, MIN_REQUESTS_FOR_INSIGHT, HIGH_QUERY_COUNT_PER_REQ, CROSS_ENDPOINT_MIN_ENDPOINTS, CROSS_ENDPOINT_PCT, CROSS_ENDPOINT_MIN_OCCURRENCES, REDUNDANT_QUERY_MIN_COUNT, LARGE_RESPONSE_BYTES, HIGH_ROW_COUNT, OVERFETCH_MIN_REQUESTS, OVERFETCH_MIN_FIELDS, OVERFETCH_MIN_INTERNAL_IDS, OVERFETCH_NULL_RATIO, REGRESSION_PCT_THRESHOLD, REGRESSION_MIN_INCREASE_MS, REGRESSION_MIN_REQUESTS, QUERY_COUNT_REGRESSION_RATIO, OVERFETCH_MANY_FIELDS, OVERFETCH_UNWRAP_MIN_SIZE, MAX_DUPLICATE_INSIGHTS, INSIGHT_WINDOW_PER_ENDPOINT, CLEAN_HITS_FOR_RESOLUTION, STALE_ISSUE_TTL_MS;
-var init_thresholds = __esm({
-  "src/constants/thresholds.ts"() {
-    "use strict";
     FLOW_GAP_MS = 5e3;
     SLOW_REQUEST_THRESHOLD_MS = 2e3;
     MIN_POLLING_SEQUENCE = 3;
     ENDPOINT_TRUNCATE_LENGTH = 12;
     N1_QUERY_THRESHOLD = 5;
     ERROR_RATE_THRESHOLD_PCT = 20;
-    SLOW_ENDPOINT_THRESHOLD_MS = 1e3;
     MIN_REQUESTS_FOR_INSIGHT = 2;
     HIGH_QUERY_COUNT_PER_REQ = 5;
     CROSS_ENDPOINT_MIN_ENDPOINTS = 3;
@@ -119,25 +72,10 @@ var init_thresholds = __esm({
     INSIGHT_WINDOW_PER_ENDPOINT = 20;
     CLEAN_HITS_FOR_RESOLUTION = 5;
     STALE_ISSUE_TTL_MS = 30 * 60 * 1e3;
-  }
-});
-
-// src/constants/transport.ts
-var SSE_HEARTBEAT_INTERVAL_MS, NOISE_HOSTS, NOISE_PATH_PATTERNS;
-var init_transport = __esm({
-  "src/constants/transport.ts"() {
-    "use strict";
-    SSE_HEARTBEAT_INTERVAL_MS = 3e4;
-    NOISE_HOSTS = ["registry.npmjs.org", "telemetry.nextjs.org", "vitejs.dev"];
-    NOISE_PATH_PATTERNS = [".hot-update.", "__webpack", "__vite"];
-  }
-});
-
-// src/constants/metrics.ts
-var METRICS_DIR, METRICS_FILE, PORT_FILE, ISSUES_FILE, METRICS_FLUSH_INTERVAL_MS, METRICS_MAX_SESSIONS, METRICS_MAX_DATA_POINTS, ISSUES_FLUSH_INTERVAL_MS;
-var init_metrics = __esm({
-  "src/constants/metrics.ts"() {
-    "use strict";
+    STRICT_MODE_MAX_GAP_MS = 2e3;
+    BASELINE_MIN_SESSIONS = 2;
+    BASELINE_MIN_REQUESTS_PER_SESSION = 3;
+    BASELINE_PENDING_POINTS_MIN = 3;
     METRICS_DIR = ".brakit";
     METRICS_FILE = "metrics.json";
     PORT_FILE = ".brakit/port";
@@ -146,14 +84,74 @@ var init_metrics = __esm({
     METRICS_MAX_SESSIONS = 50;
     METRICS_MAX_DATA_POINTS = 200;
     ISSUES_FLUSH_INTERVAL_MS = 1e4;
+    SSE_HEARTBEAT_INTERVAL_MS = 3e4;
+    NOISE_HOSTS = ["registry.npmjs.org", "telemetry.nextjs.org", "vitejs.dev"];
+    NOISE_PATH_PATTERNS = [".hot-update.", "__webpack", "__vite"];
+    VALID_ISSUE_STATES = /* @__PURE__ */ new Set(["open", "fixing", "resolved", "stale", "regressed"]);
+    VALID_ISSUE_CATEGORIES = /* @__PURE__ */ new Set(["security", "performance", "reliability"]);
+    VALID_AI_FIX_STATUSES = /* @__PURE__ */ new Set(["fixed", "wont_fix"]);
+    TELEMETRY_EVENT_SETUP_COMPLETED = "setup_completed";
+    TELEMETRY_EVENT_FIRST_REQUEST = "first_request";
+    TELEMETRY_EVENT_DASHBOARD_VIEWED = "dashboard_viewed";
+    TELEMETRY_EVENT_SESSION = "session";
+    EXIT_REASON_CLEAN = "clean";
+    EXIT_REASON_SIGINT = "sigint";
+    EXIT_REASON_SIGTERM = "sigterm";
+    DETAIL_PREVIEW_LENGTH = 120;
+    KNOWN_DEPENDENCY_NAMES = [
+      "next",
+      "@remix-run/dev",
+      "nuxt",
+      "vite",
+      "astro",
+      "express",
+      "fastify",
+      "hono",
+      "koa",
+      "nest",
+      "prisma",
+      "drizzle-orm",
+      "typeorm",
+      "sequelize"
+    ];
   }
 });
 
-// src/constants/headers.ts
-var BRAKIT_REQUEST_ID_HEADER, BRAKIT_FETCH_ID_HEADER, SENSITIVE_HEADER_NAMES;
-var init_headers = __esm({
-  "src/constants/headers.ts"() {
+// src/constants/labels.ts
+var DASHBOARD_PREFIX, DASHBOARD_API_REQUESTS, DASHBOARD_API_EVENTS, DASHBOARD_API_FLOWS, DASHBOARD_API_CLEAR, DASHBOARD_API_LOGS, DASHBOARD_API_FETCHES, DASHBOARD_API_ERRORS, DASHBOARD_API_QUERIES, DASHBOARD_API_INGEST, DASHBOARD_API_METRICS, DASHBOARD_API_ACTIVITY, DASHBOARD_API_METRICS_LIVE, DASHBOARD_API_INSIGHTS, DASHBOARD_API_SECURITY, DASHBOARD_API_TAB, DASHBOARD_API_FINDINGS, DASHBOARD_API_FINDINGS_REPORT, VALID_TABS_TUPLE, VALID_TABS, BRAKIT_REQUEST_ID_HEADER, BRAKIT_FETCH_ID_HEADER, SENSITIVE_HEADER_NAMES, HTTP_OK, HTTP_NO_CONTENT, HTTP_BAD_REQUEST, HTTP_NOT_FOUND, HTTP_METHOD_NOT_ALLOWED, HTTP_PAYLOAD_TOO_LARGE, HTTP_INTERNAL_ERROR, SECURITY_HEADERS, CONTENT_ENCODING_GZIP, CONTENT_ENCODING_BR, CONTENT_ENCODING_DEFLATE, SEVERITY_ICON, SSE_EVENT_FETCH, SSE_EVENT_LOG, SSE_EVENT_ERROR, SSE_EVENT_QUERY, SSE_EVENT_ISSUES, SDK_EVENT_REQUEST, SDK_EVENT_DB_QUERY, SDK_EVENT_FETCH, SDK_EVENT_LOG, SDK_EVENT_ERROR, SDK_EVENT_AUTH_CHECK, POSTHOG_HOST, POSTHOG_CAPTURE_PATH, POSTHOG_REQUEST_TIMEOUT_MS, SPEED_BUCKET_THRESHOLDS, TIMELINE_FETCH, TIMELINE_LOG, TIMELINE_ERROR, TIMELINE_QUERY;
+var init_labels = __esm({
+  "src/constants/labels.ts"() {
     "use strict";
+    DASHBOARD_PREFIX = "/__brakit";
+    DASHBOARD_API_REQUESTS = `${DASHBOARD_PREFIX}/api/requests`;
+    DASHBOARD_API_EVENTS = `${DASHBOARD_PREFIX}/api/events`;
+    DASHBOARD_API_FLOWS = `${DASHBOARD_PREFIX}/api/flows`;
+    DASHBOARD_API_CLEAR = `${DASHBOARD_PREFIX}/api/clear`;
+    DASHBOARD_API_LOGS = `${DASHBOARD_PREFIX}/api/logs`;
+    DASHBOARD_API_FETCHES = `${DASHBOARD_PREFIX}/api/fetches`;
+    DASHBOARD_API_ERRORS = `${DASHBOARD_PREFIX}/api/errors`;
+    DASHBOARD_API_QUERIES = `${DASHBOARD_PREFIX}/api/queries`;
+    DASHBOARD_API_INGEST = `${DASHBOARD_PREFIX}/api/ingest`;
+    DASHBOARD_API_METRICS = `${DASHBOARD_PREFIX}/api/metrics`;
+    DASHBOARD_API_ACTIVITY = `${DASHBOARD_PREFIX}/api/activity`;
+    DASHBOARD_API_METRICS_LIVE = `${DASHBOARD_PREFIX}/api/metrics/live`;
+    DASHBOARD_API_INSIGHTS = `${DASHBOARD_PREFIX}/api/insights`;
+    DASHBOARD_API_SECURITY = `${DASHBOARD_PREFIX}/api/security`;
+    DASHBOARD_API_TAB = `${DASHBOARD_PREFIX}/api/tab`;
+    DASHBOARD_API_FINDINGS = `${DASHBOARD_PREFIX}/api/findings`;
+    DASHBOARD_API_FINDINGS_REPORT = `${DASHBOARD_PREFIX}/api/findings/report`;
+    VALID_TABS_TUPLE = [
+      "overview",
+      "actions",
+      "requests",
+      "fetches",
+      "queries",
+      "errors",
+      "logs",
+      "performance",
+      "security"
+    ];
+    VALID_TABS = new Set(VALID_TABS_TUPLE);
     BRAKIT_REQUEST_ID_HEADER = "x-brakit-request-id";
     BRAKIT_FETCH_ID_HEADER = "x-brakit-fetch-id";
     SENSITIVE_HEADER_NAMES = /* @__PURE__ */ new Set([
@@ -164,13 +162,53 @@ var init_headers = __esm({
       "x-api-key",
       "x-auth-token"
     ]);
+    HTTP_OK = 200;
+    HTTP_NO_CONTENT = 204;
+    HTTP_BAD_REQUEST = 400;
+    HTTP_NOT_FOUND = 404;
+    HTTP_METHOD_NOT_ALLOWED = 405;
+    HTTP_PAYLOAD_TOO_LARGE = 413;
+    HTTP_INTERNAL_ERROR = 500;
+    SECURITY_HEADERS = {
+      "x-content-type-options": "nosniff",
+      "x-frame-options": "DENY",
+      "referrer-policy": "no-referrer",
+      "content-security-policy": "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; img-src data:"
+    };
+    CONTENT_ENCODING_GZIP = "gzip";
+    CONTENT_ENCODING_BR = "br";
+    CONTENT_ENCODING_DEFLATE = "deflate";
+    SEVERITY_ICON = {
+      critical: "\u2717",
+      warning: "\u26A0",
+      info: "\u2139"
+    };
+    SSE_EVENT_FETCH = "fetch";
+    SSE_EVENT_LOG = "log";
+    SSE_EVENT_ERROR = "error_event";
+    SSE_EVENT_QUERY = "query";
+    SSE_EVENT_ISSUES = "issues";
+    SDK_EVENT_REQUEST = "request";
+    SDK_EVENT_DB_QUERY = "db.query";
+    SDK_EVENT_FETCH = "fetch";
+    SDK_EVENT_LOG = "log";
+    SDK_EVENT_ERROR = "error";
+    SDK_EVENT_AUTH_CHECK = "auth.check";
+    POSTHOG_HOST = "https://us.i.posthog.com";
+    POSTHOG_CAPTURE_PATH = "/i/v0/e/";
+    POSTHOG_REQUEST_TIMEOUT_MS = 3e3;
+    SPEED_BUCKET_THRESHOLDS = [200, 500, 1e3, 2e3, 5e3];
+    TIMELINE_FETCH = "fetch";
+    TIMELINE_LOG = "log";
+    TIMELINE_ERROR = "error";
+    TIMELINE_QUERY = "query";
   }
 });
 
-// src/constants/network.ts
+// src/constants/features.ts
 var CLOUD_SIGNALS, MAX_HEALTH_ERRORS, RECOVERY_WINDOW_MS, LOCALHOST_IPS, LOCALHOST_HOSTNAMES, URL_PARSE_BASE, DIR_MODE_OWNER_ONLY, FILE_MODE_OWNER_ONLY;
-var init_network = __esm({
-  "src/constants/network.ts"() {
+var init_features = __esm({
+  "src/constants/features.ts"() {
     "use strict";
     CLOUD_SIGNALS = [
       "VERCEL",
@@ -203,112 +241,13 @@ var init_network = __esm({
   }
 });
 
-// src/constants/mcp.ts
-var init_mcp = __esm({
-  "src/constants/mcp.ts"() {
-    "use strict";
-  }
-});
-
-// src/constants/encoding.ts
-var CONTENT_ENCODING_GZIP, CONTENT_ENCODING_BR, CONTENT_ENCODING_DEFLATE;
-var init_encoding = __esm({
-  "src/constants/encoding.ts"() {
-    "use strict";
-    CONTENT_ENCODING_GZIP = "gzip";
-    CONTENT_ENCODING_BR = "br";
-    CONTENT_ENCODING_DEFLATE = "deflate";
-  }
-});
-
-// src/constants/severity.ts
-var SEVERITY_ICON;
-var init_severity = __esm({
-  "src/constants/severity.ts"() {
-    "use strict";
-    SEVERITY_ICON = {
-      critical: "\u2717",
-      warning: "\u26A0",
-      info: "\u2139"
-    };
-  }
-});
-
-// src/constants/telemetry.ts
-var POSTHOG_HOST, POSTHOG_CAPTURE_PATH, POSTHOG_REQUEST_TIMEOUT_MS, SPEED_BUCKET_THRESHOLDS;
-var init_telemetry = __esm({
-  "src/constants/telemetry.ts"() {
-    "use strict";
-    POSTHOG_HOST = "https://us.i.posthog.com";
-    POSTHOG_CAPTURE_PATH = "/i/v0/e/";
-    POSTHOG_REQUEST_TIMEOUT_MS = 3e3;
-    SPEED_BUCKET_THRESHOLDS = [200, 500, 1e3, 2e3, 5e3];
-  }
-});
-
-// src/constants/lifecycle.ts
-var VALID_ISSUE_STATES, VALID_ISSUE_CATEGORIES, VALID_AI_FIX_STATUSES;
-var init_lifecycle = __esm({
-  "src/constants/lifecycle.ts"() {
-    "use strict";
-    VALID_ISSUE_STATES = /* @__PURE__ */ new Set(["open", "fixing", "resolved", "stale", "regressed"]);
-    VALID_ISSUE_CATEGORIES = /* @__PURE__ */ new Set(["security", "performance", "reliability"]);
-    VALID_AI_FIX_STATUSES = /* @__PURE__ */ new Set(["fixed", "wont_fix"]);
-  }
-});
-
-// src/constants/cli.ts
-var init_cli = __esm({
-  "src/constants/cli.ts"() {
-    "use strict";
-  }
-});
-
-// src/constants/timeline.ts
-var TIMELINE_FETCH, TIMELINE_LOG, TIMELINE_ERROR, TIMELINE_QUERY;
-var init_timeline = __esm({
-  "src/constants/timeline.ts"() {
-    "use strict";
-    TIMELINE_FETCH = "fetch";
-    TIMELINE_LOG = "log";
-    TIMELINE_ERROR = "error";
-    TIMELINE_QUERY = "query";
-  }
-});
-
-// src/constants/sdk-events.ts
-var SDK_EVENT_REQUEST, SDK_EVENT_DB_QUERY, SDK_EVENT_FETCH, SDK_EVENT_LOG, SDK_EVENT_ERROR, SDK_EVENT_AUTH_CHECK;
-var init_sdk_events = __esm({
-  "src/constants/sdk-events.ts"() {
-    "use strict";
-    SDK_EVENT_REQUEST = "request";
-    SDK_EVENT_DB_QUERY = "db.query";
-    SDK_EVENT_FETCH = "fetch";
-    SDK_EVENT_LOG = "log";
-    SDK_EVENT_ERROR = "error";
-    SDK_EVENT_AUTH_CHECK = "auth.check";
-  }
-});
-
 // src/constants/index.ts
 var init_constants = __esm({
   "src/constants/index.ts"() {
     "use strict";
-    init_routes();
-    init_limits();
-    init_thresholds();
-    init_transport();
-    init_metrics();
-    init_headers();
-    init_network();
-    init_mcp();
-    init_encoding();
-    init_severity();
-    init_telemetry();
-    init_lifecycle();
-    init_cli();
-    init_timeline();
-    init_sdk_events();
+    init_config();
+    init_labels();
+    init_features();
   }
 });
 
@@ -377,7 +316,7 @@ function setupFetchHook(emit) {
         statusCode: msg.response.statusCode ?? 0,
         durationMs: Math.round(performance.now() - info.startTime),
         parentRequestId: info.parentRequestId,
-        timestamp: Date.now()
+        timestamp: performance.now()
       }
     });
   });
@@ -407,7 +346,7 @@ function setupConsoleHook(emit) {
       const ctx = getRequestContext();
       if (!ctx) return;
       const message = format(...args);
-      const timestamp = Date.now();
+      const timestamp = performance.now();
       const parentRequestId = ctx.requestId;
       if (level === "error") {
         const errorArg = args.find((a) => a instanceof Error);
@@ -474,7 +413,7 @@ function createCaptureError(emit) {
         message: error.message,
         stack: error.stack ?? "",
         parentRequestId: ctx?.requestId ?? null,
-        timestamp: Date.now()
+        timestamp: performance.now()
       }
     });
   };
@@ -507,6 +446,7 @@ var init_adapter_registry = __esm({
       constructor() {
         this.adapters = [];
         this.active = [];
+        this.failed = [];
       }
       register(adapter) {
         this.adapters.push(adapter);
@@ -519,6 +459,7 @@ var init_adapter_registry = __esm({
               this.active.push(adapter);
             }
           } catch {
+            this.failed.push(adapter.name);
           }
         }
       }
@@ -534,69 +475,35 @@ var init_adapter_registry = __esm({
       getActive() {
         return this.active;
       }
+      getFailed() {
+        return this.failed;
+      }
     };
   }
 });
 
-// src/instrument/adapters/shared.ts
-import { createRequire } from "module";
-function tryRequire(id) {
-  try {
-    return appRequire(id);
-  } catch {
-    return null;
-  }
-}
-function captureRequestId() {
-  return getRequestContext()?.requestId ?? null;
-}
-var appRequire;
-var init_shared = __esm({
-  "src/instrument/adapters/shared.ts"() {
-    "use strict";
-    init_context();
-    appRequire = createRequire(process.cwd() + "/index.js");
-  }
-});
-
 // src/instrument/adapters/normalize.ts
 function normalizeSQL(sql) {
   if (!sql) return { op: "OTHER", table: "" };
   const trimmed = sql.trim();
-  const op = trimmed.split(/\s+/)[0].toUpperCase();
-  if (/SELECT\s+COUNT/i.test(trimmed)) {
-    const match = trimmed.match(/FROM\s+"?\w+"?\."?(\w+)"?/i);
-    return { op: "SELECT", table: match?.[1] ?? "" };
-  }
-  const tableMatch = trimmed.match(/(?:FROM|INTO|UPDATE)\s+"?\w+"?\."?(\w+)"?/i);
-  const table = tableMatch?.[1] ?? "";
-  switch (op) {
-    case "SELECT":
-      return { op: "SELECT", table };
-    case "INSERT":
-      return { op: "INSERT", table };
-    case "UPDATE":
-      return { op: "UPDATE", table };
-    case "DELETE":
-      return { op: "DELETE", table };
-    default:
-      return { op: "OTHER", table };
-  }
+  const keyword = trimmed.split(/\s+/, 1)[0].toUpperCase();
+  const op = VALID_OPS.has(keyword) ? keyword : "OTHER";
+  const table = trimmed.match(TABLE_RE)?.[1] ?? "";
+  return { op, table };
 }
 function normalizePrismaOp(operation) {
   return PRISMA_OP_MAP[operation] ?? "OTHER";
 }
 function normalizeQueryParams(sql) {
   if (!sql) return null;
-  let n = sql.replace(/'[^']*'/g, "?");
-  n = n.replace(/\b\d+(\.\d+)?\b/g, "?");
-  n = n.replace(/\$\d+/g, "?");
-  return n;
+  return sql.replace(SQL_PARAM_MARKER, "?").replace(SQL_STRING_LITERAL, "?").replace(SQL_NUMBER_LITERAL, "?");
 }
-var PRISMA_OP_MAP;
+var VALID_OPS, TABLE_RE, PRISMA_OP_MAP, SQL_PARAM_MARKER, SQL_STRING_LITERAL, SQL_NUMBER_LITERAL;
 var init_normalize = __esm({
   "src/instrument/adapters/normalize.ts"() {
     "use strict";
+    VALID_OPS = /* @__PURE__ */ new Set(["SELECT", "INSERT", "UPDATE", "DELETE"]);
+    TABLE_RE = /(?:FROM|INTO|UPDATE)\s+(?:"?\w+"?\.)?"?(\w+)"?/i;
     PRISMA_OP_MAP = {
       findUnique: "SELECT",
       findUniqueOrThrow: "SELECT",
@@ -615,156 +522,240 @@ var init_normalize = __esm({
       delete: "DELETE",
       deleteMany: "DELETE"
     };
+    SQL_PARAM_MARKER = /\$\d+/g;
+    SQL_STRING_LITERAL = /'[^']*'/g;
+    SQL_NUMBER_LITERAL = /\b\d+(\.\d+)?\b/g;
   }
 });
 
-// src/instrument/adapters/pg.ts
-var origQuery, proto, pgAdapter;
-var init_pg = __esm({
-  "src/instrument/adapters/pg.ts"() {
-    "use strict";
-    init_shared();
-    init_normalize();
-    origQuery = null;
-    proto = null;
-    pgAdapter = {
-      name: "pg",
-      detect() {
-        return tryRequire("pg") !== null;
-      },
-      patch(emit) {
-        const pg = tryRequire("pg");
-        if (!pg) return;
-        const Client = pg.default?.Client ?? pg.Client;
-        if (!Client || typeof Client !== "function") return;
-        proto = Client.prototype ?? null;
-        if (!proto?.query) return;
-        origQuery = proto.query;
-        const saved = origQuery;
-        proto.query = function(...args) {
-          const first = args[0];
-          const sql = typeof first === "string" ? first : typeof first === "object" && first !== null && "text" in first ? first.text : void 0;
-          const start = performance.now();
-          const requestId = captureRequestId();
-          const { op, table } = normalizeSQL(sql ?? "");
-          const emitQuery = (rowCount) => {
-            emit({
-              type: "query",
-              data: {
-                driver: "pg",
-                source: "pg",
-                sql,
-                normalizedOp: op,
-                table,
-                durationMs: Math.round(performance.now() - start),
-                rowCount: rowCount ?? void 0,
-                parentRequestId: requestId,
-                timestamp: Date.now()
-              }
-            });
-          };
-          const lastIdx = args.length - 1;
-          if (lastIdx >= 0 && typeof args[lastIdx] === "function") {
-            const origCb = args[lastIdx];
-            args[lastIdx] = function(err, res) {
-              emitQuery(res?.rowCount ?? void 0);
-              return origCb.call(this, err, res);
-            };
-            return saved.apply(this, args);
-          }
-          const result = saved.apply(this, args);
-          if (result && typeof result.then === "function") {
-            return result.then((res) => {
-              try {
-                emitQuery(res?.rowCount ?? void 0);
-              } catch {
-              }
-              return res;
-            });
-          }
-          if (result && typeof result.on === "function") {
-            result.on("end", (res) => emitQuery(res?.rowCount ?? void 0));
-            return result;
-          }
-          return result;
-        };
-      },
-      unpatch() {
-        if (proto && origQuery) {
-          proto.query = origQuery;
-          origQuery = null;
-          proto = null;
-        }
-      }
-    };
-  }
-});
-
-// src/instrument/adapters/mysql2.ts
-var originals2, proto2, mysql2Adapter;
-var init_mysql2 = __esm({
+// src/utils/type-guards.ts
+function isString(val) {
+  return typeof val === "string";
+}
+function isNumber(val) {
+  return typeof val === "number" && !isNaN(val);
+}
+function isBoolean(val) {
+  return typeof val === "boolean";
+}
+function isThenable(value) {
+  return value != null && typeof value.then === "function";
+}
+function getErrorMessage(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  return String(err);
+}
+function isValidIssueState(val) {
+  return typeof val === "string" && VALID_ISSUE_STATES.has(val);
+}
+function isValidIssueCategory(val) {
+  return typeof val === "string" && VALID_ISSUE_CATEGORIES.has(val);
+}
+function isValidAiFixStatus(val) {
+  return typeof val === "string" && VALID_AI_FIX_STATUSES.has(val);
+}
+function validateIssuesData(parsed) {
+  if (parsed == null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const obj = parsed;
+  if (obj.version === ISSUES_DATA_VERSION && Array.isArray(obj.issues)) {
+    return parsed;
+  }
+  return null;
+}
+function validateMetricsData(parsed) {
+  if (parsed == null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const obj = parsed;
+  if (obj.version === 1 && Array.isArray(obj.endpoints)) {
+    return parsed;
+  }
+  return null;
+}
+var init_type_guards = __esm({
+  "src/utils/type-guards.ts"() {
+    "use strict";
+    init_config();
+  }
+});
+
+// src/utils/log.ts
+function brakitWarn(message) {
+  process.stderr.write(`${PREFIX} ${message}
+`);
+}
+function brakitDebug(message) {
+  if (process.env.DEBUG_BRAKIT) {
+    process.stderr.write(`${PREFIX}:debug ${message}
+`);
+  }
+}
+var PREFIX;
+var init_log = __esm({
+  "src/utils/log.ts"() {
+    "use strict";
+    PREFIX = "[brakit]";
+  }
+});
+
+// src/instrument/adapters/shared.ts
+import { createRequire } from "module";
+function tryRequire(id) {
+  try {
+    return appRequire(id);
+  } catch {
+    return null;
+  }
+}
+function getActiveRequestId() {
+  return getRequestContext()?.requestId ?? null;
+}
+function getPrototype(lib, className) {
+  const defaultExport = lib.default;
+  const cls = defaultExport?.[className] ?? lib[className];
+  if (!cls || typeof cls !== "function") return null;
+  return cls.prototype ?? null;
+}
+function buildQueryEvent(config, sql, op, table, start, requestId, rowCount) {
+  return {
+    type: "query",
+    data: {
+      driver: config.driver,
+      source: config.driver,
+      sql,
+      normalizedOp: op,
+      table,
+      durationMs: Math.round(performance.now() - start),
+      rowCount: rowCount ?? void 0,
+      parentRequestId: requestId,
+      timestamp: performance.now()
+    }
+  };
+}
+function wrapQueryMethod(original, emit, config) {
+  return function(...args) {
+    const sql = config.extractSql(args);
+    const start = performance.now();
+    const requestId = getActiveRequestId();
+    const { op, table } = normalizeSQL(sql ?? "");
+    const emitQuery = (result2) => {
+      const rowCount = config.extractRowCount?.(result2);
+      emit(buildQueryEvent(config, sql, op, table, start, requestId, rowCount));
+    };
+    const lastIdx = args.length - 1;
+    if (lastIdx >= 0 && typeof args[lastIdx] === "function") {
+      const originalCallback = args[lastIdx];
+      args[lastIdx] = function(...callbackArgs) {
+        emitQuery(callbackArgs[1]);
+        return originalCallback.apply(this, callbackArgs);
+      };
+      return original.apply(this, args);
+    }
+    const result = original.apply(this, args);
+    if (isThenable(result)) {
+      return result.then((res) => {
+        try {
+          emitQuery(res);
+        } catch (e) {
+          brakitDebug(`query telemetry: ${getErrorMessage(e)}`);
+        }
+        return res;
+      });
+    }
+    if (config.supportsEventEmitter && result && typeof result.on === "function") {
+      result.on(
+        "end",
+        (res) => emitQuery(res)
+      );
+      return result;
+    }
+    return result;
+  };
+}
+var appRequire;
+var init_shared = __esm({
+  "src/instrument/adapters/shared.ts"() {
+    "use strict";
+    init_context();
+    init_normalize();
+    init_type_guards();
+    init_log();
+    appRequire = createRequire(process.cwd() + "/index.js");
+  }
+});
+
+// src/instrument/adapters/pg.ts
+var origQuery, proto, pgConfig, pgAdapter;
+var init_pg = __esm({
+  "src/instrument/adapters/pg.ts"() {
+    "use strict";
+    init_shared();
+    origQuery = null;
+    proto = null;
+    pgConfig = {
+      driver: "pg",
+      extractSql: (args) => {
+        const q = args[0];
+        if (typeof q === "string") return q;
+        if (typeof q === "object" && q !== null && "text" in q) return q.text;
+        return void 0;
+      },
+      extractRowCount: (result) => result?.rowCount,
+      supportsEventEmitter: true
+    };
+    pgAdapter = {
+      name: "pg",
+      detect() {
+        return tryRequire("pg") !== null;
+      },
+      /** Monkeypatches pg's Client prototype to intercept database queries and emit telemetry events. */
+      patch(emit) {
+        const pg = tryRequire("pg");
+        if (!pg) return;
+        proto = getPrototype(pg, "Client");
+        if (!proto?.query) return;
+        origQuery = proto.query;
+        proto.query = wrapQueryMethod(origQuery, emit, pgConfig);
+      },
+      unpatch() {
+        if (proto && origQuery) {
+          proto.query = origQuery;
+          origQuery = null;
+          proto = null;
+        }
+      }
+    };
+  }
+});
+
+// src/instrument/adapters/mysql2.ts
+var PATCHED_METHODS, originals2, proto2, mysql2Config, mysql2Adapter;
+var init_mysql2 = __esm({
   "src/instrument/adapters/mysql2.ts"() {
     "use strict";
     init_shared();
-    init_normalize();
+    PATCHED_METHODS = ["query", "execute"];
     originals2 = /* @__PURE__ */ new Map();
     proto2 = null;
+    mysql2Config = {
+      driver: "mysql2",
+      extractSql: (args) => typeof args[0] === "string" ? args[0] : void 0
+    };
     mysql2Adapter = {
       name: "mysql2",
       detect() {
         return tryRequire("mysql2") !== null;
       },
+      /** Monkeypatches mysql2's Connection prototype to intercept database queries and emit telemetry events. */
       patch(emit) {
         const mysql2 = tryRequire("mysql2");
         if (!mysql2) return;
-        proto2 = mysql2.Connection?.prototype ?? null;
+        proto2 = getPrototype(mysql2, "Connection");
         if (!proto2) return;
-        for (const method of ["query", "execute"]) {
+        for (const method of PATCHED_METHODS) {
           const orig = proto2[method];
           if (typeof orig !== "function") continue;
           originals2.set(method, orig);
-          proto2[method] = function(...args) {
-            const first = args[0];
-            const sql = typeof first === "string" ? first : void 0;
-            const start = performance.now();
-            const requestId = captureRequestId();
-            const { op, table } = normalizeSQL(sql ?? "");
-            const emitQuery = () => {
-              emit({
-                type: "query",
-                data: {
-                  driver: "mysql2",
-                  source: "mysql2",
-                  sql,
-                  normalizedOp: op,
-                  table,
-                  durationMs: Math.round(performance.now() - start),
-                  parentRequestId: requestId,
-                  timestamp: Date.now()
-                }
-              });
-            };
-            const lastIdx = args.length - 1;
-            if (lastIdx >= 0 && typeof args[lastIdx] === "function") {
-              const origCb = args[lastIdx];
-              args[lastIdx] = function() {
-                emitQuery();
-                return origCb.apply(this, arguments);
-              };
-              return orig.apply(this, args);
-            }
-            const result = orig.apply(this, args);
-            if (result && typeof result.then === "function") {
-              return result.then((res) => {
-                try {
-                  emitQuery();
-                } catch {
-                }
-                return res;
-              });
-            }
-            return result;
-          };
+          proto2[method] = wrapQueryMethod(orig, emit, mysql2Config);
         }
       },
       unpatch() {
@@ -797,9 +788,8 @@ var init_prisma = __esm({
       patch(emit) {
         const prismaModule = tryRequire("@prisma/client");
         if (!prismaModule) return;
-        const PrismaClient = prismaModule.default?.PrismaClient ?? prismaModule.PrismaClient;
-        if (!PrismaClient || typeof PrismaClient !== "function") return;
-        prismaProto = PrismaClient.prototype;
+        prismaProto = getPrototype(prismaModule, "PrismaClient");
+        if (!prismaProto) return;
         origConnect = prismaProto.$connect;
         if (typeof origConnect !== "function") return;
         const saved = origConnect;
@@ -815,7 +805,7 @@ var init_prisma = __esm({
                     args: opArgs,
                     query
                   }) {
-                    const requestId = captureRequestId();
+                    const requestId = getActiveRequestId();
                     const start = performance.now();
                     const result = await query(opArgs);
                     emit({
@@ -829,7 +819,7 @@ var init_prisma = __esm({
                         table: model,
                         durationMs: Math.round(performance.now() - start),
                         parentRequestId: requestId,
-                        timestamp: Date.now()
+                        timestamp: performance.now()
                       }
                     });
                     return result;
@@ -874,24 +864,35 @@ var init_adapters = __esm({
   }
 });
 
-// src/constants/http.ts
-var HTTP_OK, HTTP_NO_CONTENT, HTTP_BAD_REQUEST, HTTP_NOT_FOUND, HTTP_METHOD_NOT_ALLOWED, HTTP_PAYLOAD_TOO_LARGE, HTTP_INTERNAL_ERROR, SECURITY_HEADERS;
-var init_http = __esm({
-  "src/constants/http.ts"() {
+// src/utils/endpoint.ts
+function isDynamicSegment(segment) {
+  return UUID_RE.test(segment) || NUMERIC_ID_RE.test(segment) || HEX_HASH_RE.test(segment) || ALPHA_TOKEN_RE.test(segment);
+}
+function normalizePath(path) {
+  const qIdx = path.indexOf("?");
+  const pathname = qIdx === -1 ? path : path.slice(0, qIdx);
+  return pathname.split("/").map((seg) => seg && isDynamicSegment(seg) ? DYNAMIC_SEGMENT_PLACEHOLDER : seg).join("/");
+}
+function getEndpointKey(method, path) {
+  return `${method} ${normalizePath(path)}`;
+}
+function extractEndpointFromDesc(desc) {
+  return desc.match(ENDPOINT_PREFIX_RE)?.[1] ?? null;
+}
+function stripQueryString(path) {
+  const i = path.indexOf("?");
+  return i === -1 ? path : path.slice(0, i);
+}
+var UUID_RE, NUMERIC_ID_RE, HEX_HASH_RE, ALPHA_TOKEN_RE, DYNAMIC_SEGMENT_PLACEHOLDER, ENDPOINT_PREFIX_RE;
+var init_endpoint = __esm({
+  "src/utils/endpoint.ts"() {
     "use strict";
-    HTTP_OK = 200;
-    HTTP_NO_CONTENT = 204;
-    HTTP_BAD_REQUEST = 400;
-    HTTP_NOT_FOUND = 404;
-    HTTP_METHOD_NOT_ALLOWED = 405;
-    HTTP_PAYLOAD_TOO_LARGE = 413;
-    HTTP_INTERNAL_ERROR = 500;
-    SECURITY_HEADERS = {
-      "x-content-type-options": "nosniff",
-      "x-frame-options": "DENY",
-      "referrer-policy": "no-referrer",
-      "content-security-policy": "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; img-src data:"
-    };
+    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    NUMERIC_ID_RE = /^\d+$/;
+    HEX_HASH_RE = /^[0-9a-f]{12,}$/i;
+    ALPHA_TOKEN_RE = /^(?=.*[a-zA-Z])(?=.*\d)[a-zA-Z0-9_-]{8,}$/;
+    DYNAMIC_SEGMENT_PLACEHOLDER = ":id";
+    ENDPOINT_PREFIX_RE = /^(\S+\s+\S+)/;
   }
 });
 
@@ -915,6 +916,7 @@ var init_http_status = __esm({
 function detectCategory(req) {
   const { method, url, statusCode, responseHeaders } = req;
   if (req.isStatic) return "static";
+  if (req.isHealthCheck) return "health-check";
   if (statusCode === 307 && (url.includes("__clerk_handshake") || url.includes("__clerk_db_jwt"))) {
     return "auth-handshake";
   }
@@ -1079,20 +1081,41 @@ var init_label = __esm({
 });
 
 // src/analysis/transforms.ts
-function markDuplicates(requests) {
+function isDuplicateCandidate(req) {
+  return DUPLICATE_CATEGORIES.has(req.category);
+}
+function buildRequestKey(req) {
+  return `${req.method} ${stripQueryString(getEffectivePath(req))}`;
+}
+function isStrictModePattern(requests, counts) {
+  if (counts.size === 0 || ![...counts.values()].every((c) => c === 2)) {
+    return false;
+  }
+  const firstByKey = /* @__PURE__ */ new Map();
+  for (const req of requests) {
+    if (!isDuplicateCandidate(req)) continue;
+    const key = buildRequestKey(req);
+    const first = firstByKey.get(key);
+    if (!first) {
+      firstByKey.set(key, req);
+    } else if (Math.abs(req.startedAt - first.startedAt) > STRICT_MODE_MAX_GAP_MS) {
+      return false;
+    }
+  }
+  return true;
+}
+function flagDuplicateRequests(requests) {
   const counts = /* @__PURE__ */ new Map();
   for (const req of requests) {
-    if (req.category !== "data-fetch" && req.category !== "auth-check")
-      continue;
-    const key = `${req.method} ${getEffectivePath(req).split("?")[0]}`;
+    if (!isDuplicateCandidate(req)) continue;
+    const key = buildRequestKey(req);
     counts.set(key, (counts.get(key) ?? 0) + 1);
   }
-  const isStrictMode = counts.size > 0 && [...counts.values()].every((c) => c === 2);
+  const isStrictMode = isStrictModePattern(requests, counts);
   const seen = /* @__PURE__ */ new Set();
   for (const req of requests) {
-    if (req.category !== "data-fetch" && req.category !== "auth-check")
-      continue;
-    const key = `${req.method} ${getEffectivePath(req).split("?")[0]}`;
+    if (!isDuplicateCandidate(req)) continue;
+    const key = buildRequestKey(req);
     if (seen.has(key)) {
       if (isStrictMode) {
         req.isStrictModeDupe = true;
@@ -1104,20 +1127,20 @@ function markDuplicates(requests) {
     }
   }
 }
-function collapsePolling(requests) {
+function mergePollingSequences(requests) {
   const result = [];
   let i = 0;
   while (i < requests.length) {
     const current = requests[i];
-    const currentEffective = getEffectivePath(current).split("?")[0];
+    const currentEffective = stripQueryString(getEffectivePath(current));
     if (current.method === "GET" && current.category === "data-fetch") {
-      let j = i + 1;
-      while (j < requests.length && requests[j].method === "GET" && getEffectivePath(requests[j]).split("?")[0] === currentEffective) {
-        j++;
+      let nextIndex = i + 1;
+      while (nextIndex < requests.length && requests[nextIndex].method === "GET" && stripQueryString(getEffectivePath(requests[nextIndex])) === currentEffective) {
+        nextIndex++;
       }
-      const count = j - i;
+      const count = nextIndex - i;
       if (count >= MIN_POLLING_SEQUENCE) {
-        const last = requests[j - 1];
+        const last = requests[nextIndex - 1];
         const pollingDuration = last.startedAt + last.durationMs - current.startedAt;
         const endpointName = prettifyEndpoint(currentEffective);
         result.push({
@@ -1128,7 +1151,7 @@ function collapsePolling(requests) {
           pollingDurationMs: pollingDuration,
           isDuplicate: false
         });
-        i = j;
+        i = nextIndex;
         continue;
       }
     }
@@ -1141,18 +1164,18 @@ function formatDurationLabel(ms) {
   if (ms < 1e3) return `${ms}ms`;
   return `${(ms / 1e3).toFixed(1)}s`;
 }
-function detectWarnings(requests) {
+function collectRequestWarnings(requests) {
   const warnings = [];
   const duplicateCount = requests.filter((r) => r.isDuplicate).length;
   if (duplicateCount > 0) {
     const unique = new Set(
-      requests.filter((r) => r.isDuplicate).map((r) => `${r.method} ${getEffectivePath(r).split("?")[0]}`)
+      requests.filter((r) => r.isDuplicate).map((r) => buildRequestKey(r))
     );
     const endpoints = unique.size;
     const sameData = requests.filter((r) => r.isDuplicate).every((r) => {
-      const key = `${r.method} ${getEffectivePath(r).split("?")[0]}`;
+      const key = buildRequestKey(r);
       const first = requests.find(
-        (o) => !o.isDuplicate && `${o.method} ${getEffectivePath(o).split("?")[0]}` === key
+        (o) => !o.isDuplicate && buildRequestKey(o) === key
       );
       return first && first.responseBody === r.responseBody;
     });
@@ -1173,18 +1196,30 @@ function detectWarnings(requests) {
   }
   return warnings;
 }
+var DUPLICATE_CATEGORIES;
 var init_transforms = __esm({
   "src/analysis/transforms.ts"() {
     "use strict";
     init_constants();
+    init_config();
     init_categorize();
     init_label();
     init_http_status();
+    init_endpoint();
+    DUPLICATE_CATEGORIES = /* @__PURE__ */ new Set(["data-fetch", "auth-check"]);
   }
 });
 
 // src/analysis/group.ts
 import { randomUUID as randomUUID3 } from "crypto";
+function shouldStartNewFlow(labeled, currentRequests, lastEndTime, currentSourcePage, startedAt) {
+  if (currentRequests.length === 0) return false;
+  const sourcePage = labeled.sourcePage;
+  const isNewPage = sourcePage !== void 0 && currentSourcePage !== void 0 && sourcePage !== currentSourcePage;
+  const isTimeGap = startedAt - lastEndTime > FLOW_GAP_MS;
+  const isPageLoad = labeled.category === "page-load" || labeled.category === "navigation";
+  return isNewPage || isTimeGap || isPageLoad;
+}
 function groupRequestsIntoFlows(requests) {
   if (requests.length === 0) return [];
   const flows = [];
@@ -1195,17 +1230,12 @@ function groupRequestsIntoFlows(requests) {
     if (req.path.startsWith(DASHBOARD_PREFIX)) continue;
     const labeled = labelRequest(req);
     if (labeled.category === "static") continue;
-    const sourcePage = labeled.sourcePage;
-    const gap = currentRequests.length > 0 ? req.startedAt - lastEndTime : 0;
-    const isNewPage = currentRequests.length > 0 && sourcePage !== void 0 && currentSourcePage !== void 0 && sourcePage !== currentSourcePage;
-    const isPageLoad = labeled.category === "page-load" || labeled.category === "navigation";
-    const isTimeGap = currentRequests.length > 0 && gap > FLOW_GAP_MS;
-    if (currentRequests.length > 0 && (isNewPage || isTimeGap || isPageLoad)) {
+    if (shouldStartNewFlow(labeled, currentRequests, lastEndTime, currentSourcePage, req.startedAt)) {
       flows.push(buildFlow(currentRequests));
       currentRequests = [];
     }
     currentRequests.push(labeled);
-    currentSourcePage = sourcePage ?? currentSourcePage;
+    currentSourcePage = labeled.sourcePage ?? currentSourcePage;
     lastEndTime = Math.max(lastEndTime, req.startedAt + req.durationMs);
   }
   if (currentRequests.length > 0) {
@@ -1214,8 +1244,8 @@ function groupRequestsIntoFlows(requests) {
   return flows;
 }
 function buildFlow(rawRequests) {
-  markDuplicates(rawRequests);
-  const requests = collapsePolling(rawRequests);
+  flagDuplicateRequests(rawRequests);
+  const requests = mergePollingSequences(rawRequests);
   const first = requests[0];
   const startTime = first.startedAt;
   const endTime = Math.max(
@@ -1234,7 +1264,7 @@ function buildFlow(rawRequests) {
     startTime,
     totalDurationMs: Math.round(endTime - startTime),
     hasErrors: requests.some((r) => isErrorStatus(r.statusCode)),
-    warnings: detectWarnings(rawRequests),
+    warnings: collectRequestWarnings(rawRequests),
     sourcePage,
     redundancyPct
   };
@@ -1246,20 +1276,20 @@ function getDominantSourcePage(requests) {
       counts.set(req.sourcePage, (counts.get(req.sourcePage) ?? 0) + 1);
     }
   }
-  let best = "";
-  let bestCount = 0;
+  let mostCommonPage = "";
+  let highestCount = 0;
   for (const [page, count] of counts) {
-    if (count > bestCount) {
-      best = page;
-      bestCount = count;
+    if (count > highestCount) {
+      mostCommonPage = page;
+      highestCount = count;
     }
   }
-  return best || requests[0]?.path?.split("?")[0] || "/";
+  return mostCommonPage || (requests[0]?.path ? stripQueryString(requests[0].path) : "") || "/";
 }
 function deriveFlowLabel(requests, sourcePage) {
   const trigger = requests.find((r) => r.category === "api-call") ?? requests.find((r) => r.category === "server-action") ?? requests.find((r) => r.category === "page-load") ?? requests.find((r) => r.category === "navigation") ?? requests.find((r) => r.category === "data-fetch") ?? requests[0];
   if (trigger.category === "page-load" || trigger.category === "navigation") {
-    const pageName = prettifyPageName(trigger.path.split("?")[0]);
+    const pageName = prettifyPageName(stripQueryString(trigger.path));
     return `${pageName} Page`;
   }
   if (trigger.category === "api-call") {
@@ -1288,6 +1318,7 @@ var init_group = __esm({
     "use strict";
     init_constants();
     init_http_status();
+    init_endpoint();
     init_label();
     init_categorize();
     init_transforms();
@@ -1385,12 +1416,28 @@ var init_shared2 = __esm({
   "src/dashboard/api/shared.ts"() {
     "use strict";
     init_constants();
-    init_limits();
-    init_http();
+    init_config();
+    init_labels();
   }
 });
 
 // src/dashboard/api/handlers.ts
+function filterByStatusRange(requests, statusStr) {
+  if (statusStr.endsWith("xx")) {
+    const prefix = parseInt(statusStr[0], 10);
+    return requests.filter(
+      (r) => Math.floor(r.statusCode / 100) === prefix
+    );
+  }
+  const code = parseInt(statusStr, 10);
+  return requests.filter((r) => r.statusCode === code);
+}
+function filterBySearch(requests, searchQuery) {
+  const lower = searchQuery.toLowerCase();
+  return requests.filter(
+    (r) => r.url.toLowerCase().includes(lower) || r.requestBody?.toLowerCase().includes(lower) || r.responseBody?.toLowerCase().includes(lower)
+  );
+}
 function sanitizeRequest(r) {
   return {
     ...r,
@@ -1398,7 +1445,7 @@ function sanitizeRequest(r) {
     responseHeaders: maskSensitiveHeaders(r.responseHeaders)
   };
 }
-function createRequestsHandler(registry) {
+function createRequestsHandler(services) {
   return (req, res) => {
     if (!requireGet(req, res)) return;
     const url = parseRequestUrl(req);
@@ -1408,26 +1455,15 @@ function createRequestsHandler(registry) {
     const rawLimit = parseInt(url.searchParams.get("limit") ?? String(DEFAULT_API_LIMIT), 10);
     const limit = Math.min(Math.max(rawLimit || DEFAULT_API_LIMIT, 1), MAX_API_LIMIT);
     const offset = Math.max(parseInt(url.searchParams.get("offset") ?? "0", 10) || 0, 0);
-    let results = [...registry.get("request-store").getAll()].reverse();
+    let results = [...services.requestStore.getAll()].reverse();
     if (method) {
       results = results.filter((r) => r.method === method.toUpperCase());
     }
     if (status) {
-      if (status.endsWith("xx")) {
-        const prefix = parseInt(status[0], 10);
-        results = results.filter(
-          (r) => Math.floor(r.statusCode / 100) === prefix
-        );
-      } else {
-        const code = parseInt(status, 10);
-        results = results.filter((r) => r.statusCode === code);
-      }
+      results = filterByStatusRange(results, status);
     }
     if (search) {
-      const lower = search.toLowerCase();
-      results = results.filter(
-        (r) => r.url.toLowerCase().includes(lower) || r.requestBody?.toLowerCase().includes(lower) || r.responseBody?.toLowerCase().includes(lower)
-      );
+      results = filterBySearch(results, search);
     }
     const total = results.length;
     results = results.slice(offset, offset + limit);
@@ -1435,96 +1471,84 @@ function createRequestsHandler(registry) {
     sendJson(req, res, HTTP_OK, { total, requests: sanitized });
   };
 }
-function createFlowsHandler(registry) {
+function createFlowsHandler(services) {
   return (req, res) => {
     if (!requireGet(req, res)) return;
-    const flows = groupRequestsIntoFlows(registry.get("request-store").getAll()).reverse().map((flow) => ({
+    const flows = groupRequestsIntoFlows(services.requestStore.getAll()).reverse().map((flow) => ({
       ...flow,
       requests: flow.requests.map(sanitizeRequest)
     }));
     sendJson(req, res, HTTP_OK, { total: flows.length, flows });
   };
 }
-function createClearHandler(registry) {
+function createClearHandler(services) {
   return (req, res) => {
     if (req.method !== "POST") {
       sendJson(req, res, HTTP_METHOD_NOT_ALLOWED, { error: "Method not allowed" });
       return;
     }
-    registry.get("request-store").clear();
-    registry.get("fetch-store").clear();
-    registry.get("log-store").clear();
-    registry.get("error-store").clear();
-    registry.get("query-store").clear();
-    registry.get("metrics-store").reset();
-    if (registry.has("issue-store")) registry.get("issue-store").clear();
-    registry.get("event-bus").emit("store:cleared", void 0);
+    services.requestStore.clear();
+    services.fetchStore.clear();
+    services.logStore.clear();
+    services.errorStore.clear();
+    services.queryStore.clear();
+    services.metricsStore.reset();
+    services.issueStore.clear();
+    services.bus.emit("store:cleared", void 0);
     sendJson(req, res, HTTP_OK, { cleared: true });
   };
 }
-function createFetchesHandler(registry) {
-  return (req, res) => handleTelemetryGet(req, res, registry.get("fetch-store"));
+function createFetchesHandler(services) {
+  return (req, res) => handleTelemetryGet(req, res, services.fetchStore);
 }
-function createLogsHandler(registry) {
-  return (req, res) => handleTelemetryGet(req, res, registry.get("log-store"));
+function createLogsHandler(services) {
+  return (req, res) => handleTelemetryGet(req, res, services.logStore);
 }
-function createErrorsHandler(registry) {
-  return (req, res) => handleTelemetryGet(req, res, registry.get("error-store"));
+function createErrorsHandler(services) {
+  return (req, res) => handleTelemetryGet(req, res, services.errorStore);
 }
-function createQueriesHandler(registry) {
-  return (req, res) => handleTelemetryGet(req, res, registry.get("query-store"));
+function createQueriesHandler(services) {
+  return (req, res) => handleTelemetryGet(req, res, services.queryStore);
 }
 var init_handlers = __esm({
   "src/dashboard/api/handlers.ts"() {
     "use strict";
     init_group();
     init_constants();
-    init_http();
+    init_labels();
     init_shared2();
   }
 });
 
-// src/utils/type-guards.ts
-function isString(val) {
-  return typeof val === "string";
-}
-function isNumber(val) {
-  return typeof val === "number" && !isNaN(val);
-}
-function isBoolean(val) {
-  return typeof val === "boolean";
-}
-function getErrorMessage(err) {
-  if (err instanceof Error) return err.message;
-  if (typeof err === "string") return err;
-  return String(err);
-}
-function isValidIssueState(val) {
-  return typeof val === "string" && VALID_ISSUE_STATES.has(val);
-}
-function isValidIssueCategory(val) {
-  return typeof val === "string" && VALID_ISSUE_CATEGORIES.has(val);
-}
-function isValidAiFixStatus(val) {
-  return typeof val === "string" && VALID_AI_FIX_STATUSES.has(val);
-}
-function validateIssuesData(parsed) {
-  if (parsed != null && typeof parsed === "object" && !Array.isArray(parsed) && parsed.version === ISSUES_DATA_VERSION && Array.isArray(parsed.issues)) {
-    return parsed;
-  }
-  return null;
+// src/utils/static-patterns.ts
+function isStaticPath(urlPath) {
+  return STATIC_PATTERNS.some((p) => p.test(urlPath));
 }
-function validateMetricsData(parsed) {
-  if (parsed != null && typeof parsed === "object" && !Array.isArray(parsed) && parsed.version === 1 && Array.isArray(parsed.endpoints)) {
-    return parsed;
-  }
-  return null;
+function isHealthCheckPath(urlPath) {
+  return HEALTH_CHECK_PATTERNS.some((p) => p.test(urlPath));
 }
-var init_type_guards = __esm({
-  "src/utils/type-guards.ts"() {
+var STATIC_PATTERNS, HEALTH_CHECK_PATTERNS;
+var init_static_patterns = __esm({
+  "src/utils/static-patterns.ts"() {
     "use strict";
-    init_lifecycle();
-    init_limits();
+    STATIC_PATTERNS = [
+      /\.(?:js|css|map|ico|png|jpg|jpeg|gif|svg|webp|woff2?|ttf|eot)$/,
+      /^\/favicon/,
+      /^\/node_modules\//,
+      // Framework-specific static/internal paths
+      /^\/_next\//,
+      /^\/__nextjs/,
+      /^\/@vite\//,
+      /^\/__vite/
+    ];
+    HEALTH_CHECK_PATTERNS = [
+      /^\/health(z|check)?$/i,
+      /^\/ping$/i,
+      /^\/(ready|readiness|liveness)$/i,
+      /^\/status$/i,
+      /^\/__health$/i,
+      /^\/api\/health(z|check)?$/i
+    ];
   }
 });
 
@@ -1545,8 +1569,8 @@ function numOrUndef(val) {
 function headers(val) {
   if (val && typeof val === "object" && !Array.isArray(val)) {
     const result = {};
-    for (const [k, v] of Object.entries(val)) {
-      if (typeof v === "string") result[k] = v;
+    for (const [key, value] of Object.entries(val)) {
+      if (typeof value === "string") result[key] = value;
     }
     return result;
   }
@@ -1610,7 +1634,7 @@ function parseRequestEvent(data, ts) {
     id: str(data.id, randomUUID4()),
     method: str(data.method, "GET"),
     url,
-    path: url.split("?")[0],
+    path: stripQueryString(url),
     headers: headers(data.headers),
     requestBody: isString(data.requestBody) ? data.requestBody : null,
     statusCode: num(data.statusCode, 200),
@@ -1619,7 +1643,8 @@ function parseRequestEvent(data, ts) {
     startedAt: ts,
     durationMs: num(data.durationMs, 0),
     responseSize: num(data.responseSize, 0),
-    isStatic: isBoolean(data.isStatic) ? data.isStatic : false
+    isStatic: isBoolean(data.isStatic) ? data.isStatic : false,
+    isHealthCheck: isBoolean(data.isHealthCheck) ? data.isHealthCheck : isHealthCheckPath(stripQueryString(url))
   };
 }
 function routeSDKEvent(event, stores) {
@@ -1653,7 +1678,9 @@ var init_sdk_event_parser = __esm({
   "src/dashboard/api/sdk-event-parser.ts"() {
     "use strict";
     init_type_guards();
-    init_sdk_events();
+    init_labels();
+    init_static_patterns();
+    init_endpoint();
     LOG_LEVEL_MAP = {
       debug: "debug",
       info: "info",
@@ -1673,28 +1700,28 @@ function isBrakitBatch(msg) {
 function isSDKPayload(msg) {
   return typeof msg === "object" && msg !== null && "_brakit" in msg && "version" in msg && typeof msg.version === "number";
 }
-function createIngestHandler(registry) {
+function createIngestHandler(services) {
   const routeEvent = (event) => {
     switch (event.type) {
       case TIMELINE_FETCH:
-        registry.get("fetch-store").add(event.data);
+        services.fetchStore.add(event.data);
         break;
       case TIMELINE_LOG:
-        registry.get("log-store").add(event.data);
+        services.logStore.add(event.data);
         break;
       case TIMELINE_ERROR:
-        registry.get("error-store").add(event.data);
+        services.errorStore.add(event.data);
         break;
       case TIMELINE_QUERY:
-        registry.get("query-store").add(event.data);
+        services.queryStore.add(event.data);
         break;
     }
   };
-  const queryStore = registry.get("query-store");
-  const fetchStore = registry.get("fetch-store");
-  const logStore = registry.get("log-store");
-  const errorStore = registry.get("error-store");
-  const requestStore = registry.get("request-store");
+  const queryStore = services.queryStore;
+  const fetchStore = services.fetchStore;
+  const logStore = services.logStore;
+  const errorStore = services.errorStore;
+  const requestStore = services.requestStore;
   const stores = {
     addQuery: (data) => queryStore.add(data),
     addFetch: (data) => fetchStore.add(data),
@@ -1754,9 +1781,8 @@ function createIngestHandler(registry) {
 var init_ingest = __esm({
   "src/dashboard/api/ingest.ts"() {
     "use strict";
-    init_limits();
-    init_http();
-    init_timeline();
+    init_config();
+    init_labels();
     init_shared2();
     init_sdk_event_parser();
   }
@@ -1776,11 +1802,11 @@ function createMetricsHandler(metricsStore) {
     sendJson(req, res, HTTP_OK, { endpoints: metricsStore.getAll() });
   };
 }
-var init_metrics2 = __esm({
+var init_metrics = __esm({
   "src/dashboard/api/metrics.ts"() {
     "use strict";
     init_shared2();
-    init_http();
+    init_labels();
   }
 });
 
@@ -1798,61 +1824,55 @@ var init_metrics_live = __esm({
   }
 });
 
-// src/utils/log.ts
-function brakitWarn(message) {
-  process.stderr.write(`${PREFIX} ${message}
-`);
-}
-function brakitDebug(message) {
-  if (process.env.DEBUG_BRAKIT) {
-    process.stderr.write(`${PREFIX}:debug ${message}
-`);
-  }
-}
-var PREFIX;
-var init_log = __esm({
-  "src/utils/log.ts"() {
-    "use strict";
-    PREFIX = "[brakit]";
-  }
-});
-
 // src/dashboard/api/activity.ts
-function createActivityHandler(registry) {
+function buildTimeline(services, requestId) {
+  const fetches = services.fetchStore.getByRequest(requestId);
+  const logs = services.logStore.getByRequest(requestId);
+  const errors = services.errorStore.getByRequest(requestId);
+  const queries = services.queryStore.getByRequest(requestId);
+  const timeline = [];
+  for (const fetch of fetches)
+    timeline.push({ type: TIMELINE_FETCH, timestamp: fetch.timestamp, data: fetch });
+  for (const log of logs)
+    timeline.push({ type: TIMELINE_LOG, timestamp: log.timestamp, data: log });
+  for (const error of errors)
+    timeline.push({ type: TIMELINE_ERROR, timestamp: error.timestamp, data: error });
+  for (const query of queries)
+    timeline.push({ type: TIMELINE_QUERY, timestamp: query.timestamp, data: query });
+  timeline.sort((a, b) => a.timestamp - b.timestamp);
+  return {
+    total: timeline.length,
+    timeline,
+    counts: {
+      fetches: fetches.length,
+      logs: logs.length,
+      errors: errors.length,
+      queries: queries.length
+    }
+  };
+}
+function createActivityHandler(services) {
   return (req, res) => {
     if (!requireGet(req, res)) return;
     try {
       const url = parseRequestUrl(req);
       const requestId = url.searchParams.get("requestId");
-      if (!requestId) {
-        sendJson(req, res, HTTP_BAD_REQUEST, { error: "requestId parameter required" });
+      const requestIds = url.searchParams.get("requestIds");
+      if (!requestId && !requestIds) {
+        sendJson(req, res, HTTP_BAD_REQUEST, { error: "requestId or requestIds parameter required" });
         return;
       }
-      const fetches = registry.get("fetch-store").getByRequest(requestId);
-      const logs = registry.get("log-store").getByRequest(requestId);
-      const errors = registry.get("error-store").getByRequest(requestId);
-      const queries = registry.get("query-store").getByRequest(requestId);
-      const timeline = [];
-      for (const f of fetches)
-        timeline.push({ type: TIMELINE_FETCH, timestamp: f.timestamp, data: f });
-      for (const l of logs)
-        timeline.push({ type: TIMELINE_LOG, timestamp: l.timestamp, data: l });
-      for (const e of errors)
-        timeline.push({ type: TIMELINE_ERROR, timestamp: e.timestamp, data: e });
-      for (const q of queries)
-        timeline.push({ type: TIMELINE_QUERY, timestamp: q.timestamp, data: q });
-      timeline.sort((a, b) => a.timestamp - b.timestamp);
-      sendJson(req, res, HTTP_OK, {
-        requestId,
-        total: timeline.length,
-        timeline,
-        counts: {
-          fetches: fetches.length,
-          logs: logs.length,
-          errors: errors.length,
-          queries: queries.length
-        }
-      });
+      if (requestId) {
+        const result = buildTimeline(services, requestId);
+        sendJson(req, res, HTTP_OK, { requestId, ...result });
+        return;
+      }
+      const ids = (requestIds || "").split(",").filter(Boolean).slice(0, MAX_BATCH_IDS);
+      const activities = {};
+      for (const id of ids) {
+        activities[id] = buildTimeline(services, id);
+      }
+      sendJson(req, res, HTTP_OK, { requestIds: ids, activities });
     } catch (err) {
       brakitDebug(`activity handler error: ${err}`);
       if (!res.headersSent) {
@@ -1861,13 +1881,14 @@ function createActivityHandler(registry) {
     }
   };
 }
+var MAX_BATCH_IDS;
 var init_activity = __esm({
   "src/dashboard/api/activity.ts"() {
     "use strict";
     init_shared2();
-    init_http();
-    init_timeline();
+    init_labels();
     init_log();
+    MAX_BATCH_IDS = 50;
   }
 });
 
@@ -1877,7 +1898,7 @@ var init_api = __esm({
     "use strict";
     init_handlers();
     init_ingest();
-    init_metrics2();
+    init_metrics();
     init_metrics_live();
     init_activity();
   }
@@ -1952,25 +1973,12 @@ var init_issues = __esm({
     "use strict";
     init_shared2();
     init_type_guards();
-    init_http();
-  }
-});
-
-// src/constants/events.ts
-var SSE_EVENT_FETCH, SSE_EVENT_LOG, SSE_EVENT_ERROR, SSE_EVENT_QUERY, SSE_EVENT_ISSUES;
-var init_events = __esm({
-  "src/constants/events.ts"() {
-    "use strict";
-    SSE_EVENT_FETCH = "fetch";
-    SSE_EVENT_LOG = "log";
-    SSE_EVENT_ERROR = "error_event";
-    SSE_EVENT_QUERY = "query";
-    SSE_EVENT_ISSUES = "issues";
+    init_labels();
   }
 });
 
 // src/dashboard/sse.ts
-function createSSEHandler(registry) {
+function createSSEHandler(services) {
   const clients = /* @__PURE__ */ new Set();
   function broadcast(eventType, data) {
     if (clients.size === 0) return;
@@ -1992,7 +2000,7 @@ data: ${data}
       }
     }
   }
-  const bus = registry.get("event-bus");
+  const bus = services.bus;
   bus.on("request:completed", (r) => broadcast(null, JSON.stringify(r)));
   bus.on("telemetry:fetch", (e) => broadcast(SSE_EVENT_FETCH, JSON.stringify(e)));
   bus.on("telemetry:log", (e) => broadcast(SSE_EVENT_LOG, JSON.stringify(e)));
@@ -2042,8 +2050,7 @@ var init_sse = __esm({
   "src/dashboard/sse.ts"() {
     "use strict";
     init_constants();
-    init_http();
-    init_events();
+    init_labels();
     init_shared2();
   }
 });
@@ -2098,7 +2105,7 @@ async function ensureGitignoreAsync(dir, entry) {
 var init_fs = __esm({
   "src/utils/fs.ts"() {
     "use strict";
-    init_limits();
+    init_config();
     init_log();
     init_type_guards();
   }
@@ -2187,7 +2194,7 @@ function computeIssueId(issue) {
 var init_issue_id = __esm({
   "src/utils/issue-id.ts"() {
     "use strict";
-    init_limits();
+    init_config();
   }
 });
 
@@ -2200,10 +2207,7 @@ var init_issue_store = __esm({
   "src/store/issue-store.ts"() {
     "use strict";
     init_fs();
-    init_metrics();
-    init_limits();
-    init_thresholds();
-    init_limits();
+    init_config();
     init_atomic_writer();
     init_log();
     init_type_guards();
@@ -2446,7 +2450,7 @@ function unwrapResponse(parsed) {
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return parsed;
   const obj = parsed;
   const keys = Object.keys(obj);
-  if (keys.length > 3) return parsed;
+  if (keys.length > MAX_WRAPPER_KEYS) return parsed;
   let best = null;
   let bestSize = 0;
   for (const key of keys) {
@@ -2464,10 +2468,12 @@ function unwrapResponse(parsed) {
   }
   return best && bestSize >= OVERFETCH_UNWRAP_MIN_SIZE ? best : parsed;
 }
+var MAX_WRAPPER_KEYS;
 var init_response = __esm({
   "src/utils/response.ts"() {
     "use strict";
-    init_thresholds();
+    init_config();
+    MAX_WRAPPER_KEYS = 3;
   }
 });
 
@@ -2505,92 +2511,154 @@ var init_patterns = __esm({
   }
 });
 
-// src/analysis/rules/exposed-secret.ts
-function findSecretKeys(obj, prefix, depth = 0) {
-  const found = [];
-  if (depth >= MAX_OBJECT_SCAN_DEPTH) return found;
-  if (!obj || typeof obj !== "object") return found;
-  if (Array.isArray(obj)) {
-    for (let i = 0; i < Math.min(obj.length, SECRET_SCAN_ARRAY_LIMIT); i++) {
-      found.push(...findSecretKeys(obj[i], prefix, depth + 1));
+// src/utils/collections.ts
+function getOrCreate(map, key, create) {
+  let value = map.get(key);
+  if (value === void 0) {
+    value = create();
+    map.set(key, value);
+  }
+  return value;
+}
+function deduplicateFindings(items, extract) {
+  const seen = /* @__PURE__ */ new Map();
+  const findings = [];
+  for (const item of items) {
+    const result = extract(item);
+    if (!result) continue;
+    const existing = seen.get(result.key);
+    if (existing) {
+      existing.count++;
+      continue;
+    }
+    seen.set(result.key, result.finding);
+    findings.push(result.finding);
+  }
+  return findings;
+}
+function groupBy(items, keyFn) {
+  const map = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = keyFn(item);
+    if (key == null) continue;
+    let arr = map.get(key);
+    if (!arr) {
+      arr = [];
+      map.set(key, arr);
     }
-    return found;
+    arr.push(item);
+  }
+  return map;
+}
+var init_collections = __esm({
+  "src/utils/collections.ts"() {
+    "use strict";
   }
-  for (const k of Object.keys(obj)) {
-    const val = obj[k];
-    if (SECRET_KEYS.test(k) && typeof val === "string" && val.length >= MIN_SECRET_VALUE_LENGTH && !MASKED_RE.test(val)) {
-      found.push(k);
+});
+
+// src/utils/object-scan.ts
+function walkObject(obj, visitor, options) {
+  const opts = { ...DEFAULTS, ...options };
+  walk(obj, visitor, opts, 0);
+}
+function walk(obj, visitor, opts, depth) {
+  if (depth >= opts.maxDepth) return;
+  if (!obj || typeof obj !== "object") return;
+  if (Array.isArray(obj)) {
+    for (let i = 0; i < Math.min(obj.length, opts.arrayLimit); i++) {
+      walk(obj[i], visitor, opts, depth + 1);
     }
+    return;
+  }
+  for (const key of Object.keys(obj)) {
+    const val = obj[key];
+    visitor(key, val, depth);
     if (typeof val === "object" && val !== null) {
-      found.push(...findSecretKeys(val, prefix + k + ".", depth + 1));
+      walk(val, visitor, opts, depth + 1);
     }
   }
-  return found;
 }
-var exposedSecretRule;
-var init_exposed_secret = __esm({
-  "src/analysis/rules/exposed-secret.ts"() {
+function collectFromObject(obj, match, options) {
+  const results = [];
+  walkObject(obj, (key, value) => {
+    const result = match(key, value);
+    if (result !== null) results.push(result);
+  }, options);
+  return results;
+}
+var DEFAULTS;
+var init_object_scan = __esm({
+  "src/utils/object-scan.ts"() {
+    "use strict";
+    init_config();
+    DEFAULTS = {
+      maxDepth: MAX_OBJECT_SCAN_DEPTH,
+      arrayLimit: SECRET_SCAN_ARRAY_LIMIT
+    };
+  }
+});
+
+// src/analysis/rules/auth-rules.ts
+function findSecretKeys(obj) {
+  return collectFromObject(
+    obj,
+    (key, val) => SECRET_KEYS.test(key) && typeof val === "string" && val.length >= MIN_SECRET_VALUE_LENGTH && !MASKED_RE.test(val) ? key : null
+  );
+}
+function isFrameworkResponse(request) {
+  if (isRedirect(request.statusCode)) return true;
+  if (request.path?.startsWith("/__")) return true;
+  if (request.responseHeaders?.["x-middleware-rewrite"]) return true;
+  return false;
+}
+var exposedSecretRule, tokenInUrlRule, insecureCookieRule, corsCredentialsRule;
+var init_auth_rules = __esm({
+  "src/analysis/rules/auth-rules.ts"() {
     "use strict";
     init_patterns();
-    init_limits();
+    init_config();
     init_http_status();
+    init_collections();
+    init_object_scan();
     exposedSecretRule = {
       id: "exposed-secret",
       severity: "critical",
       name: "Exposed Secret in Response",
       hint: RULE_HINTS["exposed-secret"],
       check(ctx) {
-        const findings = [];
-        const seen = /* @__PURE__ */ new Map();
-        for (const r of ctx.requests) {
-          if (isErrorStatus(r.statusCode)) continue;
-          const parsed = ctx.parsedBodies.response.get(r.id);
-          if (!parsed) continue;
-          const keys = findSecretKeys(parsed, "");
-          if (keys.length === 0) continue;
-          const ep = `${r.method} ${r.path}`;
-          const dedupKey = `${ep}:${keys.sort().join(",")}`;
-          const existing = seen.get(dedupKey);
-          if (existing) {
-            existing.count++;
-            continue;
-          }
-          const finding = {
-            severity: "critical",
-            rule: "exposed-secret",
-            title: "Exposed Secret in Response",
-            desc: `${ep} \u2014 response contains ${keys.join(", ")} field${keys.length > 1 ? "s" : ""}`,
-            hint: this.hint,
-            endpoint: ep,
-            count: 1
+        return deduplicateFindings(ctx.requests, (request) => {
+          if (isErrorStatus(request.statusCode)) return null;
+          const parsed = ctx.parsedBodies.response.get(request.id);
+          if (!parsed) return null;
+          const keys = findSecretKeys(parsed);
+          if (keys.length === 0) return null;
+          const ep = `${request.method} ${request.path}`;
+          return {
+            key: `${ep}:${keys.sort().join(",")}`,
+            finding: {
+              severity: "critical",
+              rule: "exposed-secret",
+              title: "Exposed Secret in Response",
+              desc: `${ep} \u2014 response contains ${keys.join(", ")} field${keys.length > 1 ? "s" : ""}`,
+              hint: this.hint,
+              detail: `Exposed fields: ${keys.join(", ")}. ${keys.length} unmasked secret value${keys.length !== 1 ? "s" : ""} in response body.`,
+              endpoint: ep,
+              count: 1
+            }
           };
-          seen.set(dedupKey, finding);
-          findings.push(finding);
-        }
-        return findings;
+        });
       }
     };
-  }
-});
-
-// src/analysis/rules/token-in-url.ts
-var tokenInUrlRule;
-var init_token_in_url = __esm({
-  "src/analysis/rules/token-in-url.ts"() {
-    "use strict";
-    init_patterns();
     tokenInUrlRule = {
       id: "token-in-url",
       severity: "critical",
       name: "Auth Token in URL",
       hint: RULE_HINTS["token-in-url"],
       check(ctx) {
-        const findings = [];
-        const seen = /* @__PURE__ */ new Map();
-        for (const r of ctx.requests) {
-          const qIdx = r.url.indexOf("?");
-          if (qIdx === -1) continue;
-          const params = r.url.substring(qIdx + 1).split("&");
+        return deduplicateFindings(ctx.requests, (request) => {
+          const qIdx = request.url.indexOf("?");
+          if (qIdx === -1) return null;
+          const params = request.url.substring(qIdx + 1).split("&");
           const flagged = [];
           for (const param of params) {
             const [name, ...rest] = param.split("=");
@@ -2600,222 +2668,64 @@ var init_token_in_url = __esm({
               flagged.push(name);
             }
           }
-          if (flagged.length === 0) continue;
-          const ep = `${r.method} ${r.path}`;
-          const dedupKey = `${ep}:${flagged.sort().join(",")}`;
-          const existing = seen.get(dedupKey);
-          if (existing) {
-            existing.count++;
-            continue;
-          }
-          const finding = {
-            severity: "critical",
-            rule: "token-in-url",
-            title: "Auth Token in URL",
-            desc: `${ep} \u2014 ${flagged.join(", ")} exposed in query string`,
-            hint: this.hint,
-            endpoint: ep,
-            count: 1
-          };
-          seen.set(dedupKey, finding);
-          findings.push(finding);
-        }
-        return findings;
-      }
-    };
-  }
-});
-
-// src/analysis/rules/stack-trace-leak.ts
-var stackTraceLeakRule;
-var init_stack_trace_leak = __esm({
-  "src/analysis/rules/stack-trace-leak.ts"() {
-    "use strict";
-    init_patterns();
-    stackTraceLeakRule = {
-      id: "stack-trace-leak",
-      severity: "critical",
-      name: "Stack Trace Leaked to Client",
-      hint: RULE_HINTS["stack-trace-leak"],
-      check(ctx) {
-        const findings = [];
-        const seen = /* @__PURE__ */ new Map();
-        for (const r of ctx.requests) {
-          if (!r.responseBody) continue;
-          if (!STACK_TRACE_RE.test(r.responseBody)) continue;
-          const ep = `${r.method} ${r.path}`;
-          const existing = seen.get(ep);
-          if (existing) {
-            existing.count++;
-            continue;
-          }
-          const finding = {
-            severity: "critical",
-            rule: "stack-trace-leak",
-            title: "Stack Trace Leaked to Client",
-            desc: `${ep} \u2014 response exposes internal stack trace`,
-            hint: this.hint,
-            endpoint: ep,
-            count: 1
-          };
-          seen.set(ep, finding);
-          findings.push(finding);
-        }
-        return findings;
-      }
-    };
-  }
-});
-
-// src/analysis/rules/error-info-leak.ts
-var CRITICAL_PATTERNS, errorInfoLeakRule;
-var init_error_info_leak = __esm({
-  "src/analysis/rules/error-info-leak.ts"() {
-    "use strict";
-    init_patterns();
-    CRITICAL_PATTERNS = [
-      { re: DB_CONN_RE, label: "database connection string" },
-      { re: SQL_FRAGMENT_RE, label: "SQL query fragment" },
-      { re: SECRET_VAL_RE, label: "secret value" }
-    ];
-    errorInfoLeakRule = {
-      id: "error-info-leak",
-      severity: "critical",
-      name: "Sensitive Data in Error Response",
-      hint: RULE_HINTS["error-info-leak"],
-      check(ctx) {
-        const findings = [];
-        const seen = /* @__PURE__ */ new Map();
-        for (const r of ctx.requests) {
-          if (r.statusCode < 400) continue;
-          if (!r.responseBody) continue;
-          if (r.responseHeaders["x-nextjs-error"] || r.responseHeaders["x-nextjs-matched-path"]) continue;
-          const ep = `${r.method} ${r.path}`;
-          for (const p of CRITICAL_PATTERNS) {
-            if (!p.re.test(r.responseBody)) continue;
-            const dedupKey = `${ep}:${p.label}`;
-            const existing = seen.get(dedupKey);
-            if (existing) {
-              existing.count++;
-              continue;
-            }
-            const finding = {
+          if (flagged.length === 0) return null;
+          const ep = `${request.method} ${request.path}`;
+          return {
+            key: `${ep}:${flagged.sort().join(",")}`,
+            finding: {
               severity: "critical",
-              rule: "error-info-leak",
-              title: "Sensitive Data in Error Response",
-              desc: `${ep} \u2014 error response exposes ${p.label}`,
+              rule: "token-in-url",
+              title: "Auth Token in URL",
+              desc: `${ep} \u2014 ${flagged.join(", ")} exposed in query string`,
               hint: this.hint,
+              detail: `Parameters in URL: ${flagged.join(", ")}. Auth tokens in URLs are logged by proxies, browsers, and CDNs.`,
               endpoint: ep,
               count: 1
-            };
-            seen.set(dedupKey, finding);
-            findings.push(finding);
-          }
-        }
-        return findings;
+            }
+          };
+        });
       }
     };
-  }
-});
-
-// src/analysis/rules/insecure-cookie.ts
-function isFrameworkResponse(r) {
-  if (isRedirect(r.statusCode)) return true;
-  if (r.path?.startsWith("/__")) return true;
-  if (r.responseHeaders?.["x-middleware-rewrite"]) return true;
-  return false;
-}
-var insecureCookieRule;
-var init_insecure_cookie = __esm({
-  "src/analysis/rules/insecure-cookie.ts"() {
-    "use strict";
-    init_patterns();
-    init_http_status();
     insecureCookieRule = {
       id: "insecure-cookie",
       severity: "warning",
       name: "Insecure Cookie",
       hint: RULE_HINTS["insecure-cookie"],
       check(ctx) {
-        const findings = [];
-        const seen = /* @__PURE__ */ new Map();
-        for (const r of ctx.requests) {
-          if (!r.responseHeaders) continue;
-          if (isFrameworkResponse(r)) continue;
-          const setCookie = r.responseHeaders["set-cookie"];
+        const cookieEntries = [];
+        for (const request of ctx.requests) {
+          if (!request.responseHeaders) continue;
+          if (isFrameworkResponse(request)) continue;
+          const setCookie = request.responseHeaders["set-cookie"];
           if (!setCookie) continue;
           const cookies = setCookie.split(/,(?=\s*[A-Za-z0-9_\-]+=)/);
           for (const cookie of cookies) {
-            const cookieName = cookie.trim().split("=")[0].trim();
-            const lower = cookie.toLowerCase();
-            const issues = [];
-            if (!lower.includes("httponly")) issues.push("HttpOnly");
-            if (!lower.includes("samesite")) issues.push("SameSite");
-            if (issues.length === 0) continue;
-            const dedupKey = `${cookieName}:${issues.join(",")}`;
-            const existing = seen.get(dedupKey);
-            if (existing) {
-              existing.count++;
-              continue;
-            }
-            const finding = {
+            cookieEntries.push({ cookie });
+          }
+        }
+        return deduplicateFindings(cookieEntries, ({ cookie }) => {
+          const cookieName = cookie.trim().split("=")[0].trim();
+          const lower = cookie.toLowerCase();
+          const issues = [];
+          if (!lower.includes("httponly")) issues.push("HttpOnly");
+          if (!lower.includes("samesite")) issues.push("SameSite");
+          if (issues.length === 0) return null;
+          return {
+            key: `${cookieName}:${issues.join(",")}`,
+            finding: {
               severity: "warning",
               rule: "insecure-cookie",
               title: "Insecure Cookie",
               desc: `${cookieName} \u2014 missing ${issues.join(", ")} flag${issues.length > 1 ? "s" : ""}`,
               hint: this.hint,
+              detail: `Missing: ${issues.join(", ")}. ${issues.includes("HttpOnly") ? "Cookie accessible via JavaScript (XSS risk). " : ""}${issues.includes("SameSite") ? "Cookie sent on cross-site requests (CSRF risk)." : ""}`,
               endpoint: cookieName,
               count: 1
-            };
-            seen.set(dedupKey, finding);
-            findings.push(finding);
-          }
-        }
-        return findings;
-      }
-    };
-  }
-});
-
-// src/analysis/rules/sensitive-logs.ts
-var sensitiveLogsRule;
-var init_sensitive_logs = __esm({
-  "src/analysis/rules/sensitive-logs.ts"() {
-    "use strict";
-    init_patterns();
-    sensitiveLogsRule = {
-      id: "sensitive-logs",
-      severity: "warning",
-      name: "Sensitive Data in Logs",
-      hint: RULE_HINTS["sensitive-logs"],
-      check(ctx) {
-        let count = 0;
-        for (const log of ctx.logs) {
-          if (!log.message) continue;
-          if (log.message.startsWith("[brakit]")) continue;
-          if (LOG_SECRET_RE.test(log.message)) count++;
-        }
-        if (count === 0) return [];
-        return [{
-          severity: "warning",
-          rule: "sensitive-logs",
-          title: "Sensitive Data in Logs",
-          desc: `Console output contains secret/token values \u2014 ${count} occurrence${count !== 1 ? "s" : ""}`,
-          hint: this.hint,
-          endpoint: "console",
-          count
-        }];
+            }
+          };
+        });
       }
     };
-  }
-});
-
-// src/analysis/rules/cors-credentials.ts
-var corsCredentialsRule;
-var init_cors_credentials = __esm({
-  "src/analysis/rules/cors-credentials.ts"() {
-    "use strict";
-    init_patterns();
     corsCredentialsRule = {
       id: "cors-credentials",
       severity: "warning",
@@ -2824,12 +2734,12 @@ var init_cors_credentials = __esm({
       check(ctx) {
         const findings = [];
         const seen = /* @__PURE__ */ new Set();
-        for (const r of ctx.requests) {
-          if (!r.responseHeaders) continue;
-          const origin = r.responseHeaders["access-control-allow-origin"];
-          const creds = r.responseHeaders["access-control-allow-credentials"];
+        for (const request of ctx.requests) {
+          if (!request.responseHeaders) continue;
+          const origin = request.responseHeaders["access-control-allow-origin"];
+          const creds = request.responseHeaders["access-control-allow-credentials"];
           if (origin !== "*" || creds !== "true") continue;
-          const ep = `${r.method} ${r.path}`;
+          const ep = `${request.method} ${request.path}`;
           if (seen.has(ep)) continue;
           seen.add(ep);
           findings.push({
@@ -2848,25 +2758,13 @@ var init_cors_credentials = __esm({
   }
 });
 
-// src/analysis/rules/response-pii-leak.ts
-function findEmails(obj, depth = 0) {
-  const emails = [];
-  if (depth >= MAX_OBJECT_SCAN_DEPTH) return emails;
-  if (!obj || typeof obj !== "object") return emails;
-  if (Array.isArray(obj)) {
-    for (let i = 0; i < Math.min(obj.length, PII_SCAN_ARRAY_LIMIT); i++) {
-      emails.push(...findEmails(obj[i], depth + 1));
-    }
-    return emails;
-  }
-  for (const v of Object.values(obj)) {
-    if (typeof v === "string" && EMAIL_RE.test(v)) {
-      emails.push(v);
-    } else if (typeof v === "object" && v !== null) {
-      emails.push(...findEmails(v, depth + 1));
-    }
-  }
-  return emails;
+// src/analysis/rules/data-rules.ts
+function findEmails(obj) {
+  return collectFromObject(
+    obj,
+    (_key, val) => typeof val === "string" && EMAIL_RE.test(val) ? val : null,
+    { arrayLimit: PII_SCAN_ARRAY_LIMIT }
+  );
 }
 function topLevelFieldCount(obj) {
   if (Array.isArray(obj)) {
@@ -2939,56 +2837,147 @@ function detectPII(method, reqBody, resBody) {
   const target = unwrapResponse(resBody);
   return detectEchoPII(method, reqBody, target) ?? detectFullRecordPII(target) ?? detectListPII(target) ?? detectSensitiveFieldPII(target);
 }
-var WRITE_METHODS, REASON_LABELS, responsePiiLeakRule;
-var init_response_pii_leak = __esm({
-  "src/analysis/rules/response-pii-leak.ts"() {
+var stackTraceLeakRule, CRITICAL_PATTERNS, errorInfoLeakRule, sensitiveLogsRule, WRITE_METHODS, REASON_LABELS, responsePiiLeakRule;
+var init_data_rules = __esm({
+  "src/analysis/rules/data-rules.ts"() {
     "use strict";
+    init_collections();
     init_patterns();
     init_response();
-    init_limits();
+    init_config();
     init_http_status();
-    WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
-    REASON_LABELS = {
-      echo: "echoes back PII from the request body",
-      "full-record": "returns a full record with email and internal IDs",
-      "list-pii": "returns a list of records containing email addresses",
-      "sensitive-fields": "contains sensitive personal data fields (phone, SSN, date of birth, address, etc.)"
-    };
-    responsePiiLeakRule = {
-      id: "response-pii-leak",
-      severity: "warning",
-      name: "PII Leak in Response",
-      hint: RULE_HINTS["response-pii-leak"],
+    init_object_scan();
+    stackTraceLeakRule = {
+      id: "stack-trace-leak",
+      severity: "critical",
+      name: "Stack Trace Leaked to Client",
+      hint: RULE_HINTS["stack-trace-leak"],
       check(ctx) {
-        const findings = [];
-        const seen = /* @__PURE__ */ new Map();
-        for (const r of ctx.requests) {
-          if (isErrorStatus(r.statusCode)) continue;
-          if (SELF_SERVICE_PATH.test(r.path)) continue;
-          const resJson = ctx.parsedBodies.response.get(r.id);
-          if (!resJson) continue;
-          const reqJson = ctx.parsedBodies.request.get(r.id) ?? null;
-          const detection = detectPII(r.method, reqJson, resJson);
-          if (!detection) continue;
-          const ep = `${r.method} ${r.path}`;
-          const existing = seen.get(ep);
-          if (existing) {
-            existing.count++;
-            continue;
-          }
-          const finding = {
-            severity: "warning",
-            rule: "response-pii-leak",
-            title: "PII Leak in Response",
-            desc: `${ep} \u2014 exposes PII in response`,
-            hint: `Detection: ${REASON_LABELS[detection.reason]}. ${this.hint}`,
-            endpoint: ep,
-            count: 1
+        return deduplicateFindings(ctx.requests, (request) => {
+          if (!request.responseBody) return null;
+          if (!STACK_TRACE_RE.test(request.responseBody)) return null;
+          const ep = `${request.method} ${request.path}`;
+          const firstLine = request.responseBody.split("\n").find((l) => STACK_TRACE_RE.test(l))?.trim() ?? "";
+          return {
+            key: ep,
+            finding: {
+              severity: "critical",
+              rule: "stack-trace-leak",
+              title: "Stack Trace Leaked to Client",
+              desc: `${ep} \u2014 response exposes internal stack trace`,
+              hint: this.hint,
+              detail: firstLine ? `Stack trace: ${firstLine.slice(0, DETAIL_PREVIEW_LENGTH)}` : void 0,
+              endpoint: ep,
+              count: 1
+            }
           };
-          seen.set(ep, finding);
-          findings.push(finding);
+        });
+      }
+    };
+    CRITICAL_PATTERNS = [
+      { re: DB_CONN_RE, label: "database connection string" },
+      { re: SQL_FRAGMENT_RE, label: "SQL query fragment" },
+      { re: SECRET_VAL_RE, label: "secret value" }
+    ];
+    errorInfoLeakRule = {
+      id: "error-info-leak",
+      severity: "critical",
+      name: "Sensitive Data in Error Response",
+      hint: RULE_HINTS["error-info-leak"],
+      check(ctx) {
+        const entries = [];
+        for (const request of ctx.requests) {
+          if (request.statusCode < 400) continue;
+          if (!request.responseBody) continue;
+          if (request.responseHeaders["x-nextjs-error"] || request.responseHeaders["x-nextjs-matched-path"]) continue;
+          const ep = `${request.method} ${request.path}`;
+          for (const pattern of CRITICAL_PATTERNS) {
+            if (pattern.re.test(request.responseBody)) {
+              entries.push({ ep, pattern, body: request.responseBody });
+            }
+          }
         }
-        return findings;
+        return deduplicateFindings(entries, ({ ep, pattern }) => {
+          return {
+            key: `${ep}:${pattern.label}`,
+            finding: {
+              severity: "critical",
+              rule: "error-info-leak",
+              title: "Sensitive Data in Error Response",
+              desc: `${ep} \u2014 error response exposes ${pattern.label}`,
+              hint: this.hint,
+              detail: `Detected: ${pattern.label} in error response body`,
+              endpoint: ep,
+              count: 1
+            }
+          };
+        });
+      }
+    };
+    sensitiveLogsRule = {
+      id: "sensitive-logs",
+      severity: "warning",
+      name: "Sensitive Data in Logs",
+      hint: RULE_HINTS["sensitive-logs"],
+      check(ctx) {
+        let count = 0;
+        for (const log of ctx.logs) {
+          if (!log.message) continue;
+          if (log.message.startsWith("[brakit]")) continue;
+          if (LOG_SECRET_RE.test(log.message)) count++;
+        }
+        if (count === 0) return [];
+        return [{
+          severity: "warning",
+          rule: "sensitive-logs",
+          title: "Sensitive Data in Logs",
+          desc: `Console output contains secret/token values \u2014 ${count} occurrence${count !== 1 ? "s" : ""}`,
+          hint: this.hint,
+          endpoint: "console",
+          count
+        }];
+      }
+    };
+    WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
+    REASON_LABELS = {
+      echo: "echoes back PII from the request body",
+      "full-record": "returns a full record with email and internal IDs",
+      "list-pii": "returns a list of records containing email addresses",
+      "sensitive-fields": "contains sensitive personal data fields (phone, SSN, date of birth, address, etc.)"
+    };
+    responsePiiLeakRule = {
+      id: "response-pii-leak",
+      severity: "warning",
+      name: "PII Leak in Response",
+      hint: RULE_HINTS["response-pii-leak"],
+      check(ctx) {
+        return deduplicateFindings(ctx.requests, (request) => {
+          if (isErrorStatus(request.statusCode)) return null;
+          if (SELF_SERVICE_PATH.test(request.path)) return null;
+          const resJson = ctx.parsedBodies.response.get(request.id);
+          if (!resJson) return null;
+          const reqJson = ctx.parsedBodies.request.get(request.id) ?? null;
+          const detection = detectPII(request.method, reqJson, resJson);
+          if (!detection) return null;
+          const ep = `${request.method} ${request.path}`;
+          const fieldCount = topLevelFieldCount(resJson);
+          const detailParts = [`Pattern: ${REASON_LABELS[detection.reason]}`];
+          if (detection.emailCount > 0) detailParts.push(`${detection.emailCount} email${detection.emailCount !== 1 ? "s" : ""} detected`);
+          if (fieldCount > 0) detailParts.push(`${fieldCount} fields per record`);
+          return {
+            key: ep,
+            finding: {
+              severity: "warning",
+              rule: "response-pii-leak",
+              title: "PII Leak in Response",
+              desc: `${ep} \u2014 exposes PII in response`,
+              hint: this.hint,
+              detail: detailParts.join(". "),
+              endpoint: ep,
+              count: 1
+            }
+          };
+        });
       }
     };
   }
@@ -2998,14 +2987,14 @@ var init_response_pii_leak = __esm({
 function buildBodyCache(requests) {
   const response = /* @__PURE__ */ new Map();
   const request = /* @__PURE__ */ new Map();
-  for (const r of requests) {
-    if (r.responseBody) {
-      const parsed = tryParseJson(r.responseBody);
-      if (parsed != null) response.set(r.id, parsed);
+  for (const req of requests) {
+    if (req.responseBody) {
+      const parsed = tryParseJson(req.responseBody);
+      if (parsed != null) response.set(req.id, parsed);
     }
-    if (r.requestBody) {
-      const parsed = tryParseJson(r.requestBody);
-      if (parsed != null) request.set(r.id, parsed);
+    if (req.requestBody) {
+      const parsed = tryParseJson(req.requestBody);
+      if (parsed != null) request.set(req.id, parsed);
     }
   }
   return { response, request };
@@ -3027,14 +3016,10 @@ var init_scanner = __esm({
   "src/analysis/rules/scanner.ts"() {
     "use strict";
     init_response();
-    init_exposed_secret();
-    init_token_in_url();
-    init_stack_trace_leak();
-    init_error_info_leak();
-    init_insecure_cookie();
-    init_sensitive_logs();
-    init_cors_credentials();
-    init_response_pii_leak();
+    init_log();
+    init_type_guards();
+    init_auth_rules();
+    init_data_rules();
     SecurityScanner = class {
       constructor() {
         this.rules = [];
@@ -3051,7 +3036,8 @@ var init_scanner = __esm({
         for (const rule of this.rules) {
           try {
             findings.push(...rule.check(ctx));
-          } catch {
+          } catch (e) {
+            brakitDebug(`rule ${rule.id} failed: ${getErrorMessage(e)}`);
           }
         }
         return findings;
@@ -3068,14 +3054,8 @@ var init_rules = __esm({
   "src/analysis/rules/index.ts"() {
     "use strict";
     init_scanner();
-    init_exposed_secret();
-    init_token_in_url();
-    init_stack_trace_leak();
-    init_error_info_leak();
-    init_insecure_cookie();
-    init_sensitive_logs();
-    init_cors_credentials();
-    init_response_pii_leak();
+    init_auth_rules();
+    init_data_rules();
   }
 });
 
@@ -3099,48 +3079,6 @@ var init_disposable = __esm({
   }
 });
 
-// src/utils/collections.ts
-function groupBy(items, keyFn) {
-  const map = /* @__PURE__ */ new Map();
-  for (const item of items) {
-    const key = keyFn(item);
-    if (key == null) continue;
-    let arr = map.get(key);
-    if (!arr) {
-      arr = [];
-      map.set(key, arr);
-    }
-    arr.push(item);
-  }
-  return map;
-}
-var init_collections = __esm({
-  "src/utils/collections.ts"() {
-    "use strict";
-  }
-});
-
-// src/utils/endpoint.ts
-function normalizePath(path) {
-  const qIdx = path.indexOf("?");
-  const pathname = qIdx === -1 ? path : path.slice(0, qIdx);
-  return pathname.split("/").map((seg) => seg && DYNAMIC_SEGMENT_RE.test(seg) ? ":id" : seg).join("/");
-}
-function getEndpointKey(method, path) {
-  return `${method} ${normalizePath(path)}`;
-}
-function extractEndpointFromDesc(desc) {
-  return desc.match(ENDPOINT_PREFIX_RE)?.[1] ?? null;
-}
-var DYNAMIC_SEGMENT_RE, ENDPOINT_PREFIX_RE;
-var init_endpoint = __esm({
-  "src/utils/endpoint.ts"() {
-    "use strict";
-    DYNAMIC_SEGMENT_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$|^\d+$|^[0-9a-f]{12,}$|^(?=.*[a-zA-Z])(?=.*\d)[a-zA-Z0-9_-]{8,}$/i;
-    ENDPOINT_PREFIX_RE = /^(\S+\s+\S+)/;
-  }
-});
-
 // src/analysis/insights/query-helpers.ts
 function getQueryShape(q) {
   if (q.sql) return normalizeQueryParams(q.sql) ?? "";
@@ -3161,7 +3099,7 @@ var init_query_helpers = __esm({
 });
 
 // src/analysis/insights/prepare.ts
-function createEndpointGroup() {
+function emptyEndpointGroup() {
   return {
     total: 0,
     errors: 0,
@@ -3173,16 +3111,12 @@ function createEndpointGroup() {
     queryShapeDurations: /* @__PURE__ */ new Map()
   };
 }
-function windowByEndpoint(requests) {
+function keepRecentPerEndpoint(requests) {
   const byEndpoint = /* @__PURE__ */ new Map();
-  for (const r of requests) {
-    const ep = getEndpointKey(r.method, r.path);
-    let list = byEndpoint.get(ep);
-    if (!list) {
-      list = [];
-      byEndpoint.set(ep, list);
-    }
-    list.push(r);
+  for (const request of requests) {
+    const endpointKey = getEndpointKey(request.method, request.path);
+    const list = getOrCreate(byEndpoint, endpointKey, () => []);
+    list.push(request);
   }
   const windowed = [];
   for (const [, reqs] of byEndpoint) {
@@ -3190,54 +3124,67 @@ function windowByEndpoint(requests) {
   }
   return windowed;
 }
+function filterUserRequests(requests) {
+  return requests.filter(
+    (request) => !request.isStatic && !request.isHealthCheck && (!request.path || !request.path.startsWith(DASHBOARD_PREFIX))
+  );
+}
 function extractActiveEndpoints(requests) {
   const endpoints = /* @__PURE__ */ new Set();
-  for (const r of requests) {
-    if (!r.isStatic && (!r.path || !r.path.startsWith(DASHBOARD_PREFIX))) {
-      endpoints.add(getEndpointKey(r.method, r.path));
-    }
+  for (const request of filterUserRequests(requests)) {
+    endpoints.add(getEndpointKey(request.method, request.path));
   }
   return endpoints;
 }
-function prepareContext(ctx) {
-  const nonStatic = ctx.requests.filter(
-    (r) => !r.isStatic && (!r.path || !r.path.startsWith(DASHBOARD_PREFIX))
-  );
-  const queriesByReq = groupBy(ctx.queries, (q) => q.parentRequestId);
-  const fetchesByReq = groupBy(ctx.fetches, (f) => f.parentRequestId);
-  const reqById = new Map(nonStatic.map((r) => [r.id, r]));
-  const recent = windowByEndpoint(nonStatic);
+function aggregateEndpointMetrics(recent, queriesByReq, fetchesByReq) {
   const endpointGroups = /* @__PURE__ */ new Map();
-  for (const r of recent) {
-    const ep = getEndpointKey(r.method, r.path);
-    let g = endpointGroups.get(ep);
-    if (!g) {
-      g = createEndpointGroup();
-      endpointGroups.set(ep, g);
+  for (const request of recent) {
+    const endpointKey = getEndpointKey(request.method, request.path);
+    const group = getOrCreate(endpointGroups, endpointKey, emptyEndpointGroup);
+    group.total++;
+    if (isErrorStatus(request.statusCode)) group.errors++;
+    group.totalDuration += request.durationMs;
+    group.totalSize += request.responseSize ?? 0;
+    const reqQueries = queriesByReq.get(request.id) ?? [];
+    group.queryCount += reqQueries.length;
+    for (const query of reqQueries) {
+      group.totalQueryTimeMs += query.durationMs;
+      const shape = getQueryShape(query);
+      const info = getQueryInfo(query);
+      const shapeDuration = getOrCreate(group.queryShapeDurations, shape, () => ({
+        totalMs: 0,
+        count: 0,
+        label: info.op + (info.table ? ` ${info.table}` : "")
+      }));
+      shapeDuration.totalMs += query.durationMs;
+      shapeDuration.count++;
     }
-    g.total++;
-    if (isErrorStatus(r.statusCode)) g.errors++;
-    g.totalDuration += r.durationMs;
-    g.totalSize += r.responseSize ?? 0;
-    const reqQueries = queriesByReq.get(r.id) ?? [];
-    g.queryCount += reqQueries.length;
-    for (const q of reqQueries) {
-      g.totalQueryTimeMs += q.durationMs;
-      const shape = getQueryShape(q);
-      const info = getQueryInfo(q);
-      let sd = g.queryShapeDurations.get(shape);
-      if (!sd) {
-        sd = { totalMs: 0, count: 0, label: info.op + (info.table ? ` ${info.table}` : "") };
-        g.queryShapeDurations.set(shape, sd);
-      }
-      sd.totalMs += q.durationMs;
-      sd.count++;
+    const reqFetches = fetchesByReq.get(request.id) ?? [];
+    for (const fetch of reqFetches) {
+      group.totalFetchTimeMs += fetch.durationMs;
     }
-    const reqFetches = fetchesByReq.get(r.id) ?? [];
-    for (const f of reqFetches) {
-      g.totalFetchTimeMs += f.durationMs;
+  }
+  return endpointGroups;
+}
+function collectStrictModeDupeIds(ctx) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const flow of ctx.flows) {
+    for (const req of flow.requests) {
+      if (req.isStrictModeDupe) ids.add(req.id);
     }
   }
+  return ids;
+}
+function buildInsightContext(ctx) {
+  const strictModeDupeIds = collectStrictModeDupeIds(ctx);
+  const nonStatic = filterUserRequests(ctx.requests).filter((req) => !strictModeDupeIds.has(req.id));
+  const filteredQueries = strictModeDupeIds.size > 0 ? ctx.queries.filter((q) => !q.parentRequestId || !strictModeDupeIds.has(q.parentRequestId)) : ctx.queries;
+  const filteredFetches = strictModeDupeIds.size > 0 ? ctx.fetches.filter((f) => !f.parentRequestId || !strictModeDupeIds.has(f.parentRequestId)) : ctx.fetches;
+  const queriesByReq = groupBy(filteredQueries, (query) => query.parentRequestId);
+  const fetchesByReq = groupBy(filteredFetches, (fetch) => fetch.parentRequestId);
+  const reqById = new Map(nonStatic.map((request) => [request.id, request]));
+  const recent = keepRecentPerEndpoint(nonStatic);
+  const endpointGroups = aggregateEndpointMetrics(recent, queriesByReq, fetchesByReq);
   return {
     ...ctx,
     nonStatic,
@@ -3254,7 +3201,7 @@ var init_prepare = __esm({
     init_endpoint();
     init_constants();
     init_http_status();
-    init_thresholds();
+    init_config();
     init_query_helpers();
   }
 });
@@ -3265,6 +3212,8 @@ var init_runner = __esm({
   "src/analysis/insights/runner.ts"() {
     "use strict";
     init_prepare();
+    init_log();
+    init_type_guards();
     SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
     InsightRunner = class {
       constructor() {
@@ -3274,12 +3223,13 @@ var init_runner = __esm({
         this.rules.push(rule);
       }
       run(ctx) {
-        const prepared = prepareContext(ctx);
+        const prepared = buildInsightContext(ctx);
         const insights = [];
         for (const rule of this.rules) {
           try {
             insights.push(...rule.check(prepared));
-          } catch {
+          } catch (e) {
+            brakitDebug(`insight rule ${rule.id} failed: ${getErrorMessage(e)}`);
           }
         }
         insights.sort(
@@ -3291,420 +3241,129 @@ var init_runner = __esm({
   }
 });
 
-// src/analysis/insights/rules/n1.ts
-var n1Rule;
-var init_n1 = __esm({
-  "src/analysis/insights/rules/n1.ts"() {
+// src/analysis/insights/rules/query-rules.ts
+var n1Rule, redundantQueryRule, selectStarRule, highRowsRule, queryHeavyRule;
+var init_query_rules = __esm({
+  "src/analysis/insights/rules/query-rules.ts"() {
     "use strict";
     init_query_helpers();
     init_endpoint();
     init_constants();
+    init_patterns();
     n1Rule = {
       id: "n1",
       check(ctx) {
         const insights = [];
-        const seen = /* @__PURE__ */ new Set();
+        const reportedKeys = /* @__PURE__ */ new Set();
         for (const [reqId, reqQueries] of ctx.queriesByReq) {
           const req = ctx.reqById.get(reqId);
           if (!req) continue;
           const endpoint = getEndpointKey(req.method, req.path);
           const shapeGroups = /* @__PURE__ */ new Map();
-          for (const q of reqQueries) {
-            const shape = getQueryShape(q);
+          for (const query of reqQueries) {
+            const shape = getQueryShape(query);
             let group = shapeGroups.get(shape);
             if (!group) {
-              group = { count: 0, distinctSql: /* @__PURE__ */ new Set(), first: q };
+              group = { count: 0, distinctSql: /* @__PURE__ */ new Set(), first: query };
               shapeGroups.set(shape, group);
             }
             group.count++;
-            group.distinctSql.add(q.sql ?? shape);
+            group.distinctSql.add(query.sql ?? shape);
           }
-          for (const [, sg] of shapeGroups) {
-            if (sg.count <= N1_QUERY_THRESHOLD || sg.distinctSql.size <= 1) continue;
-            const info = getQueryInfo(sg.first);
+          for (const [, shapeGroup] of shapeGroups) {
+            if (shapeGroup.count <= N1_QUERY_THRESHOLD || shapeGroup.distinctSql.size <= 1) continue;
+            const info = getQueryInfo(shapeGroup.first);
             const key = `${endpoint}:${info.op}:${info.table || "unknown"}`;
-            if (seen.has(key)) continue;
-            seen.add(key);
+            if (reportedKeys.has(key)) continue;
+            reportedKeys.add(key);
             insights.push({
               severity: "critical",
               type: "n1",
               title: "N+1 Query Pattern",
-              desc: `${endpoint} runs ${sg.count}x ${info.op} ${info.table} with different params in a single request`,
+              desc: `${endpoint} runs ${shapeGroup.count}x ${info.op} ${info.table} with different params in a single request`,
               hint: "This typically happens when fetching related data in a loop. Use a batch query, JOIN, or include/eager-load to fetch all records at once.",
-              nav: "queries"
+              detail: `${shapeGroup.count} queries with ${shapeGroup.distinctSql.size} distinct param variations. Example: ${[...shapeGroup.distinctSql][0]?.slice(0, DETAIL_PREVIEW_LENGTH) ?? info.op + " " + info.table}`
             });
           }
         }
         return insights;
       }
     };
-  }
-});
-
-// src/analysis/insights/rules/cross-endpoint.ts
-var crossEndpointRule;
-var init_cross_endpoint = __esm({
-  "src/analysis/insights/rules/cross-endpoint.ts"() {
-    "use strict";
-    init_query_helpers();
-    init_endpoint();
-    init_constants();
-    crossEndpointRule = {
-      id: "cross-endpoint",
-      check(ctx) {
-        const insights = [];
-        const queryMap = /* @__PURE__ */ new Map();
-        const allEndpoints = /* @__PURE__ */ new Set();
-        for (const [reqId, reqQueries] of ctx.queriesByReq) {
-          const req = ctx.reqById.get(reqId);
-          if (!req) continue;
-          const endpoint = getEndpointKey(req.method, req.path);
-          allEndpoints.add(endpoint);
-          const seenInReq = /* @__PURE__ */ new Set();
-          for (const q of reqQueries) {
-            const shape = getQueryShape(q);
-            let entry = queryMap.get(shape);
-            if (!entry) {
-              entry = { endpoints: /* @__PURE__ */ new Set(), count: 0, first: q };
-              queryMap.set(shape, entry);
-            }
-            entry.count++;
-            if (!seenInReq.has(shape)) {
-              seenInReq.add(shape);
-              entry.endpoints.add(endpoint);
-            }
-          }
-        }
-        if (allEndpoints.size >= CROSS_ENDPOINT_MIN_ENDPOINTS) {
-          for (const [, cem] of queryMap) {
-            if (cem.count < CROSS_ENDPOINT_MIN_OCCURRENCES) continue;
-            if (cem.endpoints.size < CROSS_ENDPOINT_MIN_ENDPOINTS) continue;
-            const p = Math.round(cem.endpoints.size / allEndpoints.size * 100);
-            if (p < CROSS_ENDPOINT_PCT) continue;
-            const info = getQueryInfo(cem.first);
-            const label = info.op + (info.table ? ` ${info.table}` : "");
-            insights.push({
-              severity: "warning",
-              type: "cross-endpoint",
-              title: "Repeated Query Across Endpoints",
-              desc: `${label} runs on ${cem.endpoints.size} of ${allEndpoints.size} endpoints (${p}%).`,
-              hint: "This query runs on most of your endpoints. Load it once in middleware or cache the result to avoid redundant database calls.",
-              nav: "queries"
-            });
-          }
-        }
-        return insights;
-      }
-    };
-  }
-});
-
-// src/analysis/insights/rules/redundant-query.ts
-var redundantQueryRule;
-var init_redundant_query = __esm({
-  "src/analysis/insights/rules/redundant-query.ts"() {
-    "use strict";
-    init_query_helpers();
-    init_endpoint();
-    init_constants();
     redundantQueryRule = {
       id: "redundant-query",
       check(ctx) {
         const insights = [];
-        const seen = /* @__PURE__ */ new Set();
+        const reportedKeys = /* @__PURE__ */ new Set();
         for (const [reqId, reqQueries] of ctx.queriesByReq) {
           const req = ctx.reqById.get(reqId);
           if (!req) continue;
           const endpoint = getEndpointKey(req.method, req.path);
-          const exact = /* @__PURE__ */ new Map();
-          for (const q of reqQueries) {
-            if (!q.sql) continue;
-            let entry = exact.get(q.sql);
+          const identicalQueryMap = /* @__PURE__ */ new Map();
+          for (const query of reqQueries) {
+            if (!query.sql) continue;
+            let entry = identicalQueryMap.get(query.sql);
             if (!entry) {
-              entry = { count: 0, first: q };
-              exact.set(q.sql, entry);
+              entry = { count: 0, first: query };
+              identicalQueryMap.set(query.sql, entry);
             }
             entry.count++;
           }
-          for (const [, e] of exact) {
-            if (e.count < REDUNDANT_QUERY_MIN_COUNT) continue;
-            const info = getQueryInfo(e.first);
+          for (const [, entry] of identicalQueryMap) {
+            if (entry.count < REDUNDANT_QUERY_MIN_COUNT) continue;
+            const info = getQueryInfo(entry.first);
             const label = info.op + (info.table ? ` ${info.table}` : "");
-            const dedupKey = `${endpoint}:${label}`;
-            if (seen.has(dedupKey)) continue;
-            seen.add(dedupKey);
+            const deduplicationKey = `${endpoint}:${label}`;
+            if (reportedKeys.has(deduplicationKey)) continue;
+            reportedKeys.add(deduplicationKey);
             insights.push({
               severity: "warning",
               type: "redundant-query",
               title: "Redundant Query",
-              desc: `${label} runs ${e.count}x with identical params in ${endpoint}.`,
+              desc: `${label} runs ${entry.count}x with identical params in ${endpoint}.`,
               hint: "The exact same query with identical parameters runs multiple times in one request. Cache the first result or lift the query to a shared function.",
-              nav: "queries"
+              detail: entry.first.sql ? `Query: ${entry.first.sql.slice(0, DETAIL_PREVIEW_LENGTH)}` : void 0
             });
           }
         }
         return insights;
       }
     };
-  }
-});
-
-// src/analysis/insights/rules/error.ts
-var errorRule;
-var init_error = __esm({
-  "src/analysis/insights/rules/error.ts"() {
-    "use strict";
-    errorRule = {
-      id: "error",
-      check(ctx) {
-        if (ctx.errors.length === 0) return [];
-        const insights = [];
-        const groups = /* @__PURE__ */ new Map();
-        for (const e of ctx.errors) {
-          const name = e.name || "Error";
-          groups.set(name, (groups.get(name) ?? 0) + 1);
-        }
-        for (const [name, cnt] of groups) {
-          insights.push({
-            severity: "critical",
-            type: "error",
-            title: "Unhandled Error",
-            desc: `${name} \u2014 occurred ${cnt} time${cnt !== 1 ? "s" : ""}`,
-            hint: "Unhandled errors crash request handlers. Wrap async code in try/catch or add error-handling middleware.",
-            nav: "errors"
-          });
-        }
-        return insights;
-      }
-    };
-  }
-});
-
-// src/analysis/insights/rules/error-hotspot.ts
-var errorHotspotRule;
-var init_error_hotspot = __esm({
-  "src/analysis/insights/rules/error-hotspot.ts"() {
-    "use strict";
-    init_constants();
-    errorHotspotRule = {
-      id: "error-hotspot",
-      check(ctx) {
-        const insights = [];
-        for (const [ep, g] of ctx.endpointGroups) {
-          if (g.total < MIN_REQUESTS_FOR_INSIGHT) continue;
-          const errorRate = Math.round(g.errors / g.total * 100);
-          if (errorRate >= ERROR_RATE_THRESHOLD_PCT) {
-            insights.push({
-              severity: "critical",
-              type: "error-hotspot",
-              title: "Error Hotspot",
-              desc: `${ep} \u2014 ${errorRate}% error rate (${g.errors}/${g.total} requests)`,
-              hint: "This endpoint frequently returns errors. Check the response bodies for error details and stack traces.",
-              nav: "requests"
-            });
-          }
-        }
-        return insights;
-      }
-    };
-  }
-});
-
-// src/analysis/insights/rules/duplicate.ts
-var duplicateRule;
-var init_duplicate = __esm({
-  "src/analysis/insights/rules/duplicate.ts"() {
-    "use strict";
-    init_constants();
-    duplicateRule = {
-      id: "duplicate",
-      check(ctx) {
-        const dupCounts = /* @__PURE__ */ new Map();
-        const flowCount = /* @__PURE__ */ new Map();
-        for (const flow of ctx.flows) {
-          if (!flow.requests) continue;
-          const seenInFlow = /* @__PURE__ */ new Set();
-          for (const fr of flow.requests) {
-            if (!fr.isDuplicate) continue;
-            const dupKey = `${fr.method} ${fr.label ?? fr.path ?? fr.url}`;
-            dupCounts.set(dupKey, (dupCounts.get(dupKey) ?? 0) + 1);
-            if (!seenInFlow.has(dupKey)) {
-              seenInFlow.add(dupKey);
-              flowCount.set(dupKey, (flowCount.get(dupKey) ?? 0) + 1);
-            }
-          }
-        }
-        const dupEntries = [...dupCounts.entries()].map(([key, count]) => ({ key, count, flows: flowCount.get(key) ?? 0 })).sort((a, b) => b.count - a.count);
-        const insights = [];
-        for (let i = 0; i < Math.min(dupEntries.length, MAX_DUPLICATE_INSIGHTS); i++) {
-          const d = dupEntries[i];
-          insights.push({
-            severity: "warning",
-            type: "duplicate",
-            title: "Duplicate API Call",
-            desc: `${d.key} loaded ${d.count}x as duplicate across ${d.flows} action${d.flows !== 1 ? "s" : ""}`,
-            hint: "Multiple components independently fetch the same endpoint. Lift the fetch to a parent component, use a data cache, or deduplicate with React Query / SWR.",
-            nav: "actions"
-          });
-        }
-        return insights;
-      }
-    };
-  }
-});
-
-// src/utils/format.ts
-function formatDuration(ms) {
-  if (ms < 1e3) return `${ms}ms`;
-  return `${(ms / 1e3).toFixed(1)}s`;
-}
-function formatSize(bytes) {
-  if (bytes < 1024) return `${bytes}B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
-}
-function pct(part, total) {
-  return total > 0 ? Math.round(part / total * 100) : 0;
-}
-var init_format = __esm({
-  "src/utils/format.ts"() {
-    "use strict";
-  }
-});
-
-// src/analysis/insights/rules/slow.ts
-var slowRule;
-var init_slow = __esm({
-  "src/analysis/insights/rules/slow.ts"() {
-    "use strict";
-    init_format();
-    init_constants();
-    slowRule = {
-      id: "slow",
-      check(ctx) {
-        const insights = [];
-        for (const [ep, g] of ctx.endpointGroups) {
-          if (g.total < MIN_REQUESTS_FOR_INSIGHT) continue;
-          const avgMs = Math.round(g.totalDuration / g.total);
-          if (avgMs < SLOW_ENDPOINT_THRESHOLD_MS) continue;
-          const avgQueryMs = Math.round(g.totalQueryTimeMs / g.total);
-          const avgFetchMs = Math.round(g.totalFetchTimeMs / g.total);
-          const avgAppMs = Math.max(0, avgMs - avgQueryMs - avgFetchMs);
-          const parts = [];
-          if (avgQueryMs > 0) parts.push(`DB ${formatDuration(avgQueryMs)} ${pct(avgQueryMs, avgMs)}%`);
-          if (avgFetchMs > 0) parts.push(`Fetch ${formatDuration(avgFetchMs)} ${pct(avgFetchMs, avgMs)}%`);
-          if (avgAppMs > 0) parts.push(`App ${formatDuration(avgAppMs)} ${pct(avgAppMs, avgMs)}%`);
-          const breakdown = parts.length > 0 ? ` [${parts.join(" \xB7 ")}]` : "";
-          let detail;
-          let slowestMs = 0;
-          for (const [, sd] of g.queryShapeDurations) {
-            const avgShapeMs = sd.totalMs / sd.count;
-            if (avgShapeMs > slowestMs) {
-              slowestMs = avgShapeMs;
-              detail = `Slowest query: ${sd.label} \u2014 avg ${formatDuration(Math.round(avgShapeMs))} (${sd.count}x)`;
-            }
-          }
-          insights.push({
-            severity: "warning",
-            type: "slow",
-            title: "Slow Endpoint",
-            desc: `${ep} \u2014 avg ${formatDuration(avgMs)}${breakdown}`,
-            hint: avgQueryMs >= avgFetchMs && avgQueryMs >= avgAppMs ? "Most time is in database queries. Check the Queries tab for slow or redundant queries." : avgFetchMs >= avgQueryMs && avgFetchMs >= avgAppMs ? "Most time is in outbound HTTP calls. Check if upstream services are slow or if calls can be parallelized." : "Most time is in application code. Profile the handler for CPU-heavy operations or blocking calls.",
-            detail,
-            nav: "requests"
-          });
-        }
-        return insights;
-      }
-    };
-  }
-});
-
-// src/analysis/insights/rules/query-heavy.ts
-var queryHeavyRule;
-var init_query_heavy = __esm({
-  "src/analysis/insights/rules/query-heavy.ts"() {
-    "use strict";
-    init_constants();
-    queryHeavyRule = {
-      id: "query-heavy",
-      check(ctx) {
-        const insights = [];
-        for (const [ep, g] of ctx.endpointGroups) {
-          if (g.total < MIN_REQUESTS_FOR_INSIGHT) continue;
-          const avgQueries = Math.round(g.queryCount / g.total);
-          if (avgQueries > HIGH_QUERY_COUNT_PER_REQ) {
-            insights.push({
-              severity: "warning",
-              type: "query-heavy",
-              title: "Query-Heavy Endpoint",
-              desc: `${ep} \u2014 avg ${avgQueries} queries/request`,
-              hint: "Too many queries per request increases latency. Combine queries with JOINs, use batch operations, or reduce the number of data fetches.",
-              nav: "queries"
-            });
-          }
-        }
-        return insights;
-      }
-    };
-  }
-});
-
-// src/analysis/insights/rules/select-star.ts
-var selectStarRule;
-var init_select_star = __esm({
-  "src/analysis/insights/rules/select-star.ts"() {
-    "use strict";
-    init_query_helpers();
-    init_constants();
-    init_patterns();
     selectStarRule = {
       id: "select-star",
       check(ctx) {
-        const seen = /* @__PURE__ */ new Map();
+        const tableCounts = /* @__PURE__ */ new Map();
         for (const [, reqQueries] of ctx.queriesByReq) {
-          for (const q of reqQueries) {
-            if (!q.sql) continue;
-            const isSelectStar = SELECT_STAR_RE.test(q.sql.trim()) || SELECT_DOT_STAR_RE.test(q.sql);
+          for (const query of reqQueries) {
+            if (!query.sql) continue;
+            const isSelectStar = SELECT_STAR_RE.test(query.sql.trim()) || SELECT_DOT_STAR_RE.test(query.sql);
             if (!isSelectStar) continue;
-            const info = getQueryInfo(q);
-            const key = info.table || "unknown";
-            seen.set(key, (seen.get(key) ?? 0) + 1);
+            const info = getQueryInfo(query);
+            const table = info.table || "unknown";
+            tableCounts.set(table, (tableCounts.get(table) ?? 0) + 1);
           }
         }
         const insights = [];
-        for (const [table, count] of seen) {
+        for (const [table, count] of tableCounts) {
           if (count < OVERFETCH_MIN_REQUESTS) continue;
           insights.push({
             severity: "warning",
             type: "select-star",
             title: "SELECT * Query",
             desc: `SELECT * on ${table} \u2014 ${count} occurrence${count !== 1 ? "s" : ""}`,
-            hint: "SELECT * fetches all columns including ones you don\u2019t need. Specify only required columns to reduce data transfer and memory usage.",
-            nav: "queries"
+            hint: "SELECT * fetches all columns including ones you don\u2019t need. Specify only required columns to reduce data transfer and memory usage."
           });
         }
         return insights;
       }
     };
-  }
-});
-
-// src/analysis/insights/rules/high-rows.ts
-var highRowsRule;
-var init_high_rows = __esm({
-  "src/analysis/insights/rules/high-rows.ts"() {
-    "use strict";
-    init_query_helpers();
-    init_constants();
     highRowsRule = {
       id: "high-rows",
       check(ctx) {
         const seen = /* @__PURE__ */ new Map();
         for (const [, reqQueries] of ctx.queriesByReq) {
-          for (const q of reqQueries) {
-            if (!q.rowCount || q.rowCount <= HIGH_ROW_COUNT) continue;
-            const info = getQueryInfo(q);
+          for (const query of reqQueries) {
+            if (!query.rowCount || query.rowCount <= HIGH_ROW_COUNT) continue;
+            const info = getQueryInfo(query);
             const key = `${info.op} ${info.table || "unknown"}`;
             let entry = seen.get(key);
             if (!entry) {
@@ -3712,7 +3371,7 @@ var init_high_rows = __esm({
               seen.set(key, entry);
             }
             entry.count++;
-            if (q.rowCount > entry.max) entry.max = q.rowCount;
+            if (query.rowCount > entry.max) entry.max = query.rowCount;
           }
         }
         const insights = [];
@@ -3723,39 +3382,81 @@ var init_high_rows = __esm({
             type: "high-rows",
             title: "Large Result Set",
             desc: `${key} returns ${hrs.max}+ rows (${hrs.count}x)`,
-            hint: "Fetching many rows slows responses and wastes memory. Add a LIMIT clause, implement pagination, or filter with a WHERE condition.",
-            nav: "queries"
+            hint: "Fetching many rows slows responses and wastes memory. Add a LIMIT clause, implement pagination, or filter with a WHERE condition."
           });
         }
         return insights;
       }
     };
+    queryHeavyRule = {
+      id: "query-heavy",
+      check(ctx) {
+        const insights = [];
+        for (const [endpointKey, group] of ctx.endpointGroups) {
+          if (group.total < MIN_REQUESTS_FOR_INSIGHT) continue;
+          const avgQueries = Math.round(group.queryCount / group.total);
+          if (avgQueries > HIGH_QUERY_COUNT_PER_REQ) {
+            insights.push({
+              severity: "warning",
+              type: "query-heavy",
+              title: "Query-Heavy Endpoint",
+              desc: `${endpointKey} \u2014 avg ${avgQueries} queries/request`,
+              hint: "Too many queries per request increases latency. Combine queries with JOINs, use batch operations, or reduce the number of data fetches."
+            });
+          }
+        }
+        return insights;
+      }
+    };
   }
 });
 
-// src/analysis/insights/rules/response-overfetch.ts
-var responseOverfetchRule;
-var init_response_overfetch = __esm({
-  "src/analysis/insights/rules/response-overfetch.ts"() {
+// src/utils/format.ts
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  return `${(ms / 1e3).toFixed(1)}s`;
+}
+function formatSize(bytes) {
+  if (bytes < 1024) return `${bytes}B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+}
+function pct(part, total) {
+  return total > 0 ? Math.round(part / total * 100) : 0;
+}
+var init_format = __esm({
+  "src/utils/format.ts"() {
+    "use strict";
+  }
+});
+
+// src/analysis/insights/rules/response-rules.ts
+var responseOverfetchRule, largeResponseRule;
+var init_response_rules = __esm({
+  "src/analysis/insights/rules/response-rules.ts"() {
     "use strict";
     init_endpoint();
     init_response();
     init_http_status();
+    init_format();
     init_patterns();
+    init_log();
+    init_type_guards();
     init_constants();
     responseOverfetchRule = {
       id: "response-overfetch",
       check(ctx) {
         const insights = [];
         const seen = /* @__PURE__ */ new Set();
-        for (const r of ctx.nonStatic) {
-          if (isErrorStatus(r.statusCode) || !r.responseBody) continue;
-          const ep = getEndpointKey(r.method, r.path);
-          if (seen.has(ep)) continue;
+        for (const request of ctx.nonStatic) {
+          if (isErrorStatus(request.statusCode) || !request.responseBody) continue;
+          const endpointKey = getEndpointKey(request.method, request.path);
+          if (seen.has(endpointKey)) continue;
           let parsed;
           try {
-            parsed = JSON.parse(r.responseBody);
-          } catch {
+            parsed = JSON.parse(request.responseBody);
+          } catch (e) {
+            brakitDebug(`json parse: ${getErrorMessage(e)}`);
             continue;
           }
           const target = unwrapResponse(parsed);
@@ -3778,45 +3479,33 @@ var init_response_overfetch = __esm({
             reasons.push(`${fields.length} fields returned`);
           }
           if (reasons.length > 0) {
-            seen.add(ep);
+            seen.add(endpointKey);
             insights.push({
               severity: "info",
               type: "response-overfetch",
               title: "Response Overfetch",
-              desc: `${ep} \u2014 ${reasons.join(", ")}`,
-              hint: "This response returns more data than the client likely needs. Use a DTO or select only required fields to reduce payload size and avoid leaking internal structure.",
-              nav: "requests"
+              desc: `${endpointKey} \u2014 ${reasons.join(", ")}`,
+              hint: "This response returns more data than the client likely needs. Use a DTO or select only required fields to reduce payload size and avoid leaking internal structure."
             });
           }
         }
         return insights;
       }
     };
-  }
-});
-
-// src/analysis/insights/rules/large-response.ts
-var largeResponseRule;
-var init_large_response = __esm({
-  "src/analysis/insights/rules/large-response.ts"() {
-    "use strict";
-    init_format();
-    init_constants();
     largeResponseRule = {
       id: "large-response",
       check(ctx) {
         const insights = [];
-        for (const [ep, g] of ctx.endpointGroups) {
-          if (g.total < OVERFETCH_MIN_REQUESTS) continue;
-          const avgSize = Math.round(g.totalSize / g.total);
+        for (const [endpointKey, group] of ctx.endpointGroups) {
+          if (group.total < OVERFETCH_MIN_REQUESTS) continue;
+          const avgSize = Math.round(group.totalSize / group.total);
           if (avgSize > LARGE_RESPONSE_BYTES) {
             insights.push({
               severity: "info",
               type: "large-response",
               title: "Large Response",
-              desc: `${ep} \u2014 avg ${formatSize(avgSize)} response`,
-              hint: "Large API responses increase network transfer time. Implement pagination, field filtering, or response compression.",
-              nav: "requests"
+              desc: `${endpointKey} \u2014 avg ${formatSize(avgSize)} response`,
+              hint: "Large API responses increase network transfer time. Implement pagination, field filtering, or response compression."
             });
           }
         }
@@ -3826,13 +3515,66 @@ var init_large_response = __esm({
   }
 });
 
-// src/analysis/insights/rules/regression.ts
-var regressionRule;
-var init_regression = __esm({
-  "src/analysis/insights/rules/regression.ts"() {
+// src/analysis/insights/rules/reliability-rules.ts
+function getAdaptiveSlowThreshold(endpointKey, previousMetrics) {
+  if (!previousMetrics) return null;
+  const ep = previousMetrics.find((m) => m.endpoint === endpointKey);
+  if (!ep || ep.sessions.length < BASELINE_MIN_SESSIONS) return null;
+  const valid = ep.sessions.filter((s) => s.requestCount >= BASELINE_MIN_REQUESTS_PER_SESSION);
+  if (valid.length < BASELINE_MIN_SESSIONS) return null;
+  const p95s = valid.map((s) => s.p95DurationMs).sort((a, b) => a - b);
+  const medianP95 = p95s[Math.floor(p95s.length / 2)];
+  return medianP95 * 2;
+}
+var errorRule, errorHotspotRule, regressionRule, slowRule;
+var init_reliability_rules = __esm({
+  "src/analysis/insights/rules/reliability-rules.ts"() {
     "use strict";
     init_format();
     init_constants();
+    errorRule = {
+      id: "error",
+      check(ctx) {
+        if (ctx.errors.length === 0) return [];
+        const insights = [];
+        const groups = /* @__PURE__ */ new Map();
+        for (const error of ctx.errors) {
+          const name = error.name || "Error";
+          groups.set(name, (groups.get(name) ?? 0) + 1);
+        }
+        for (const [name, cnt] of groups) {
+          insights.push({
+            severity: "critical",
+            type: "error",
+            title: "Unhandled Error",
+            desc: `${name} \u2014 occurred ${cnt} time${cnt !== 1 ? "s" : ""}`,
+            hint: "Unhandled errors crash request handlers. Wrap async code in try/catch or add error-handling middleware.",
+            detail: ctx.errors.find((e) => e.name === name)?.message
+          });
+        }
+        return insights;
+      }
+    };
+    errorHotspotRule = {
+      id: "error-hotspot",
+      check(ctx) {
+        const insights = [];
+        for (const [endpointKey, group] of ctx.endpointGroups) {
+          if (group.total < MIN_REQUESTS_FOR_INSIGHT) continue;
+          const errorRate = Math.round(group.errors / group.total * 100);
+          if (errorRate >= ERROR_RATE_THRESHOLD_PCT) {
+            insights.push({
+              severity: "critical",
+              type: "error-hotspot",
+              title: "Error Hotspot",
+              desc: `${endpointKey} \u2014 ${errorRate}% error rate (${group.errors}/${group.total} requests)`,
+              hint: "This endpoint frequently returns errors. Check the response bodies for error details and stack traces."
+            });
+          }
+        }
+        return insights;
+      }
+    };
     regressionRule = {
       id: "regression",
       check(ctx) {
@@ -3851,8 +3593,7 @@ var init_regression = __esm({
               type: "regression",
               title: "Performance Regression",
               desc: `${epMetrics.endpoint} p95 degraded ${formatDuration(prev.p95DurationMs)} \u2192 ${formatDuration(current.p95DurationMs)} (+${p95PctChange}%)`,
-              hint: "This endpoint is slower than the previous session. Check if recent code changes added queries or processing.",
-              nav: "graph"
+              hint: "This endpoint is slower than the previous session. Check if recent code changes added queries or processing."
             });
           }
           if (prev.avgQueryCount > 0 && current.avgQueryCount > prev.avgQueryCount * QUERY_COUNT_REGRESSION_RATIO) {
@@ -3861,8 +3602,136 @@ var init_regression = __esm({
               type: "regression",
               title: "Query Count Regression",
               desc: `${epMetrics.endpoint} queries/request increased ${prev.avgQueryCount} \u2192 ${current.avgQueryCount}`,
-              hint: "This endpoint is making more database queries than before. Check for new N+1 patterns or removed query optimizations.",
-              nav: "queries"
+              hint: "This endpoint is making more database queries than before. Check for new N+1 patterns or removed query optimizations."
+            });
+          }
+        }
+        return insights;
+      }
+    };
+    slowRule = {
+      id: "slow",
+      check(ctx) {
+        const insights = [];
+        for (const [endpointKey, group] of ctx.endpointGroups) {
+          if (group.total < MIN_REQUESTS_FOR_INSIGHT) continue;
+          const avgMs = Math.round(group.totalDuration / group.total);
+          const threshold = getAdaptiveSlowThreshold(endpointKey, ctx.previousMetrics);
+          if (threshold === null || avgMs < threshold) continue;
+          const avgQueryMs = Math.round(group.totalQueryTimeMs / group.total);
+          const avgFetchMs = Math.round(group.totalFetchTimeMs / group.total);
+          const avgAppMs = Math.max(0, avgMs - avgQueryMs - avgFetchMs);
+          const parts = [];
+          if (avgQueryMs > 0) parts.push(`DB ${formatDuration(avgQueryMs)} ${pct(avgQueryMs, avgMs)}%`);
+          if (avgFetchMs > 0) parts.push(`Fetch ${formatDuration(avgFetchMs)} ${pct(avgFetchMs, avgMs)}%`);
+          if (avgAppMs > 0) parts.push(`App ${formatDuration(avgAppMs)} ${pct(avgAppMs, avgMs)}%`);
+          const breakdown = parts.length > 0 ? ` [${parts.join(" \xB7 ")}]` : "";
+          let detail;
+          let slowestMs = 0;
+          for (const [, shapeDuration] of group.queryShapeDurations) {
+            const avgShapeMs = shapeDuration.totalMs / shapeDuration.count;
+            if (avgShapeMs > slowestMs) {
+              slowestMs = avgShapeMs;
+              detail = `Slowest query: ${shapeDuration.label} \u2014 avg ${formatDuration(Math.round(avgShapeMs))} (${shapeDuration.count}x)`;
+            }
+          }
+          insights.push({
+            severity: "warning",
+            type: "slow",
+            title: "Slow Endpoint",
+            desc: `${endpointKey} \u2014 avg ${formatDuration(avgMs)}${breakdown}`,
+            hint: avgQueryMs >= avgFetchMs && avgQueryMs >= avgAppMs ? "Most time is in database queries. Check the Queries tab for slow or redundant queries." : avgFetchMs >= avgQueryMs && avgFetchMs >= avgAppMs ? "Most time is in outbound HTTP calls. Check if upstream services are slow or if calls can be parallelized." : "Most time is in application code. Profile the handler for CPU-heavy operations or blocking calls.",
+            detail
+          });
+        }
+        return insights;
+      }
+    };
+  }
+});
+
+// src/analysis/insights/rules/pattern-rules.ts
+var duplicateRule, crossEndpointRule;
+var init_pattern_rules = __esm({
+  "src/analysis/insights/rules/pattern-rules.ts"() {
+    "use strict";
+    init_query_helpers();
+    init_endpoint();
+    init_constants();
+    duplicateRule = {
+      id: "duplicate",
+      check(ctx) {
+        const dupCounts = /* @__PURE__ */ new Map();
+        const flowCount = /* @__PURE__ */ new Map();
+        for (const flow of ctx.flows) {
+          if (!flow.requests) continue;
+          const seenInFlow = /* @__PURE__ */ new Set();
+          for (const request of flow.requests) {
+            if (!request.isDuplicate) continue;
+            const deduplicationKey = `${request.method} ${request.label ?? request.path ?? request.url}`;
+            dupCounts.set(deduplicationKey, (dupCounts.get(deduplicationKey) ?? 0) + 1);
+            if (!seenInFlow.has(deduplicationKey)) {
+              seenInFlow.add(deduplicationKey);
+              flowCount.set(deduplicationKey, (flowCount.get(deduplicationKey) ?? 0) + 1);
+            }
+          }
+        }
+        const dupEntries = [...dupCounts.entries()].map(([key, count]) => ({ key, count, flows: flowCount.get(key) ?? 0 })).sort((a, b) => b.count - a.count);
+        const insights = [];
+        for (let i = 0; i < Math.min(dupEntries.length, MAX_DUPLICATE_INSIGHTS); i++) {
+          const duplicate = dupEntries[i];
+          insights.push({
+            severity: "warning",
+            type: "duplicate",
+            title: "Duplicate API Call",
+            desc: `${duplicate.key} loaded ${duplicate.count}x as duplicate across ${duplicate.flows} action${duplicate.flows !== 1 ? "s" : ""}`,
+            hint: "Multiple components independently fetch the same endpoint. Lift the fetch to a parent component, use a data cache, or deduplicate with React Query / SWR."
+          });
+        }
+        return insights;
+      }
+    };
+    crossEndpointRule = {
+      id: "cross-endpoint",
+      check(ctx) {
+        const insights = [];
+        const queryMap = /* @__PURE__ */ new Map();
+        const allEndpoints = /* @__PURE__ */ new Set();
+        for (const [reqId, reqQueries] of ctx.queriesByReq) {
+          const req = ctx.reqById.get(reqId);
+          if (!req) continue;
+          const endpoint = getEndpointKey(req.method, req.path);
+          allEndpoints.add(endpoint);
+          const seenInReq = /* @__PURE__ */ new Set();
+          for (const query of reqQueries) {
+            const shape = getQueryShape(query);
+            let entry = queryMap.get(shape);
+            if (!entry) {
+              entry = { endpoints: /* @__PURE__ */ new Set(), count: 0, first: query };
+              queryMap.set(shape, entry);
+            }
+            entry.count++;
+            if (!seenInReq.has(shape)) {
+              seenInReq.add(shape);
+              entry.endpoints.add(endpoint);
+            }
+          }
+        }
+        if (allEndpoints.size >= CROSS_ENDPOINT_MIN_ENDPOINTS) {
+          for (const [, queryMetric] of queryMap) {
+            if (queryMetric.count < CROSS_ENDPOINT_MIN_OCCURRENCES) continue;
+            if (queryMetric.endpoints.size < CROSS_ENDPOINT_MIN_ENDPOINTS) continue;
+            const coveragePct = Math.round(queryMetric.endpoints.size / allEndpoints.size * 100);
+            if (coveragePct < CROSS_ENDPOINT_PCT) continue;
+            const info = getQueryInfo(queryMetric.first);
+            const label = info.op + (info.table ? ` ${info.table}` : "");
+            insights.push({
+              severity: "warning",
+              type: "cross-endpoint",
+              title: "Repeated Query Across Endpoints",
+              desc: `${label} runs on ${queryMetric.endpoints.size} of ${allEndpoints.size} endpoints (${coveragePct}%).`,
+              hint: "This query runs on most of your endpoints. Load it once in middleware or cache the result to avoid redundant database calls.",
+              detail: `Endpoints: ${[...queryMetric.endpoints].slice(0, 5).join(", ")}${queryMetric.endpoints.size > 5 ? ` +${queryMetric.endpoints.size - 5} more` : ""}. Total: ${queryMetric.count} executions.`
             });
           }
         }
@@ -3881,13 +3750,13 @@ var init_security = __esm({
       id: "security",
       check(ctx) {
         if (!ctx.securityFindings) return [];
-        return ctx.securityFindings.map((f) => ({
-          severity: f.severity,
+        return ctx.securityFindings.map((finding) => ({
+          severity: finding.severity,
           type: "security",
-          title: f.title,
-          desc: f.desc,
-          hint: f.hint,
-          nav: "security"
+          title: finding.title,
+          desc: finding.desc,
+          hint: finding.hint,
+          detail: finding.detail
         }));
       }
     };
@@ -3898,19 +3767,10 @@ var init_security = __esm({
 var init_rules2 = __esm({
   "src/analysis/insights/rules/index.ts"() {
     "use strict";
-    init_n1();
-    init_cross_endpoint();
-    init_redundant_query();
-    init_error();
-    init_error_hotspot();
-    init_duplicate();
-    init_slow();
-    init_query_heavy();
-    init_select_star();
-    init_high_rows();
-    init_response_overfetch();
-    init_large_response();
-    init_regression();
+    init_query_rules();
+    init_response_rules();
+    init_reliability_rules();
+    init_pattern_rules();
     init_security();
   }
 });
@@ -3969,8 +3829,7 @@ function insightToIssue(insight) {
     desc: insight.desc,
     hint: insight.hint,
     detail: insight.detail,
-    endpoint: extractEndpointFromDesc(insight.desc) ?? void 0,
-    nav: insight.nav
+    endpoint: extractEndpointFromDesc(insight.desc) ?? void 0
   };
 }
 function securityFindingToIssue(finding) {
@@ -3981,8 +3840,8 @@ function securityFindingToIssue(finding) {
     title: finding.title,
     desc: finding.desc,
     hint: finding.hint,
-    endpoint: finding.endpoint,
-    nav: "security"
+    detail: finding.detail,
+    endpoint: finding.endpoint
   };
 }
 var init_issue_mappers = __esm({
@@ -3997,7 +3856,7 @@ var AnalysisEngine;
 var init_engine = __esm({
   "src/analysis/engine.ts"() {
     "use strict";
-    init_limits();
+    init_config();
     init_disposable();
     init_group();
     init_rules();
@@ -4006,8 +3865,8 @@ var init_engine = __esm({
     init_issue_id();
     init_prepare();
     AnalysisEngine = class {
-      constructor(registry, debounceMs = ANALYSIS_DEBOUNCE_MS) {
-        this.registry = registry;
+      constructor(services, debounceMs = ANALYSIS_DEBOUNCE_MS) {
+        this.services = services;
         this.debounceMs = debounceMs;
         this.cachedInsights = [];
         this.cachedFindings = [];
@@ -4016,7 +3875,7 @@ var init_engine = __esm({
         this.scanner = createDefaultScanner();
       }
       start() {
-        const bus = this.registry.get("event-bus");
+        const bus = this.services.bus;
         this.subs.add(bus.on("request:completed", () => this.scheduleRecompute()));
         this.subs.add(bus.on("telemetry:query", () => this.scheduleRecompute()));
         this.subs.add(bus.on("telemetry:error", () => this.scheduleRecompute()));
@@ -4043,12 +3902,12 @@ var init_engine = __esm({
         }, this.debounceMs);
       }
       recompute() {
-        const allRequests = this.registry.get("request-store").getAll();
-        const queries = this.registry.get("query-store").getAll();
-        const errors = this.registry.get("error-store").getAll();
-        const logs = this.registry.get("log-store").getAll();
-        const fetches = this.registry.get("fetch-store").getAll();
-        const requests = windowByEndpoint(allRequests);
+        const allRequests = this.services.requestStore.getAll();
+        const queries = this.services.queryStore.getAll();
+        const errors = this.services.errorStore.getAll();
+        const logs = this.services.logStore.getAll();
+        const fetches = this.services.fetchStore.getAll();
+        const requests = keepRecentPerEndpoint(allRequests);
         const flows = groupRequestsIntoFlows(requests);
         this.cachedFindings = this.scanner.scan({ requests, logs });
         this.cachedInsights = computeInsights({
@@ -4057,33 +3916,29 @@ var init_engine = __esm({
           errors,
           flows,
           fetches,
-          previousMetrics: this.registry.get("metrics-store").getAll(),
+          previousMetrics: this.services.metricsStore.getAll(),
           securityFindings: this.cachedFindings
         });
-        if (this.registry.has("issue-store")) {
-          const issueStore = this.registry.get("issue-store");
-          for (const finding of this.cachedFindings) {
-            issueStore.upsert(securityFindingToIssue(finding), "passive");
-          }
-          for (const insight of this.cachedInsights) {
-            issueStore.upsert(insightToIssue(insight), "passive");
-          }
-          const currentIssueIds = /* @__PURE__ */ new Set();
-          for (const finding of this.cachedFindings) {
-            currentIssueIds.add(computeIssueId(securityFindingToIssue(finding)));
-          }
-          for (const insight of this.cachedInsights) {
-            currentIssueIds.add(computeIssueId(insightToIssue(insight)));
-          }
-          const activeEndpoints = extractActiveEndpoints(allRequests);
-          issueStore.reconcile(currentIssueIds, activeEndpoints);
-          const update = {
-            insights: this.cachedInsights,
-            findings: this.cachedFindings,
-            issues: issueStore.getAll()
-          };
-          this.registry.get("event-bus").emit("analysis:updated", update);
+        const issueStore = this.services.issueStore;
+        const currentIssueIds = /* @__PURE__ */ new Set();
+        for (const finding of this.cachedFindings) {
+          const issue = securityFindingToIssue(finding);
+          issueStore.upsert(issue, "passive");
+          currentIssueIds.add(computeIssueId(issue));
         }
+        for (const insight of this.cachedInsights) {
+          const issue = insightToIssue(insight);
+          issueStore.upsert(issue, "passive");
+          currentIssueIds.add(computeIssueId(issue));
+        }
+        const activeEndpoints = extractActiveEndpoints(allRequests);
+        issueStore.reconcile(currentIssueIds, activeEndpoints);
+        const update = {
+          insights: this.cachedInsights,
+          findings: this.cachedFindings,
+          issues: issueStore.getAll()
+        };
+        this.services.bus.emit("analysis:updated", update);
       }
     };
   }
@@ -4101,7 +3956,7 @@ var init_src = __esm({
     init_engine();
     init_insights2();
     init_insights();
-    VERSION = "0.8.7";
+    VERSION = "0.9.1";
   }
 });
 
@@ -4121,11 +3976,13 @@ function getBaseStyles() {
   --red:#dc2626;
   --cyan:#0891b2;
   --green-bg:rgba(22,163,74,0.08);--green-bg-subtle:rgba(22,163,74,0.05);--green-border:rgba(22,163,74,0.2);--green-border-subtle:rgba(22,163,74,0.15);
+  --amber-bg:rgba(217,119,6,0.07);--red-bg:rgba(220,38,38,0.07);--blue-bg:rgba(37,99,235,0.08);--cyan-bg:rgba(8,145,178,0.07);
   --sidebar-width:232px;--header-height:52px;
   --radius:8px;--radius-sm:6px;
-  --shadow-sm:0 1px 2px rgba(0,0,0,0.05);
-  --shadow-md:0 1px 3px rgba(0,0,0,0.08),0 1px 2px rgba(0,0,0,0.04);
-  --shadow-lg:0 4px 12px rgba(0,0,0,0.08),0 1px 4px rgba(0,0,0,0.04);
+  --shadow-sm:0 1px 3px rgba(0,0,0,0.06),0 1px 2px rgba(0,0,0,0.03);
+  --shadow-md:0 2px 6px rgba(0,0,0,0.08),0 1px 3px rgba(0,0,0,0.04);
+  --shadow-lg:0 4px 16px rgba(0,0,0,0.1),0 2px 6px rgba(0,0,0,0.05);
+  --transition:0.15s ease;
   --breakdown-db:#6366f1;--breakdown-fetch:#f59e0b;--breakdown-app:#94a3b8;
   --mono:'JetBrains Mono',ui-monospace,SFMono-Regular,'SF Mono',Menlo,Consolas,monospace;
   --sans:Inter,system-ui,-apple-system,sans-serif;
@@ -4243,8 +4100,8 @@ function getFlowStyles() {
 .flow-req-count{font-family:var(--mono);font-size:12px;color:var(--text-muted);flex-shrink:0;text-align:right}
 .flow-badge-pill{font-size:11px;flex-shrink:0;font-family:var(--mono);font-weight:600;padding:2px 10px;border-radius:10px;text-align:center}
 .flow-badge-pill.badge-clean{background:var(--green-bg);color:var(--green)}
-.flow-badge-pill.badge-warn{background:rgba(217,119,6,0.07);color:var(--amber)}
-.flow-badge-pill.badge-error{background:rgba(220,38,38,0.07);color:var(--red)}
+.flow-badge-pill.badge-warn{background:var(--amber-bg);color:var(--amber)}
+.flow-badge-pill.badge-error{background:var(--red-bg);color:var(--red)}
 .flow-duration{font-family:var(--mono);font-size:12px;color:var(--text-muted);flex-shrink:0;width:60px;text-align:right}
 
 /* Flow expand panel */
@@ -4263,23 +4120,23 @@ function getFlowStyles() {
 /* Method badges */
 .method-badge{display:inline-flex;align-items:center;justify-content:center;padding:3px 8px;border-radius:5px;font-size:10px;font-weight:700;font-family:var(--mono);letter-spacing:.3px;flex-shrink:0}
 .method-badge-GET{background:var(--green-bg);color:var(--green)}
-.method-badge-POST{background:rgba(37,99,235,0.08);color:var(--blue)}
-.method-badge-PUT,.method-badge-PATCH{background:rgba(217,119,6,0.08);color:var(--amber)}
-.method-badge-DELETE{background:rgba(220,38,38,0.08);color:var(--red)}
+.method-badge-POST{background:var(--blue-bg);color:var(--blue)}
+.method-badge-PUT,.method-badge-PATCH{background:var(--amber-bg);color:var(--amber)}
+.method-badge-DELETE{background:var(--red-bg);color:var(--red)}
 .method-badge-HEAD,.method-badge-OPTIONS{background:var(--bg-muted);color:var(--text-muted)}
 
 /* Status pills */
 .status-pill{display:inline-flex;align-items:center;padding:1px 7px;border-radius:4px;font-size:11px;font-weight:600;font-family:var(--mono);flex-shrink:0}
 .status-pill-2xx{background:var(--green-bg);color:var(--green)}
-.status-pill-3xx{background:rgba(8,145,178,0.07);color:var(--cyan)}
-.status-pill-4xx{background:rgba(217,119,6,0.07);color:var(--amber)}
-.status-pill-5xx{background:rgba(220,38,38,0.07);color:var(--red)}
+.status-pill-3xx{background:var(--cyan-bg);color:var(--cyan)}
+.status-pill-4xx{background:var(--amber-bg);color:var(--amber)}
+.status-pill-5xx{background:var(--red-bg);color:var(--red)}
 
 .traffic-card-path{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--text);font-weight:500;font-size:13px}
 .traffic-card-path.is-dup{color:var(--text-muted);font-weight:400}
 .traffic-card-dur{color:var(--text-muted);font-size:12px;flex-shrink:0}
 .traffic-card-size{color:var(--text-muted);font-size:11px;flex-shrink:0}
-.traffic-card-dup{font-size:10px;color:var(--amber);flex-shrink:0;font-weight:600;background:rgba(217,119,6,0.07);padding:1px 7px;border-radius:4px}
+.traffic-card-dup{font-size:10px;color:var(--amber);flex-shrink:0;font-weight:600;background:var(--amber-bg);padding:1px 7px;border-radius:4px}
 
 /* Body toggles */
 .traffic-body{padding:0;margin-top:8px}
@@ -4308,7 +4165,7 @@ function getFlowStyles() {
 .flow-subreq .subreq-label.is-dup{color:var(--text-muted);font-weight:400}
 .flow-subreq .subreq-status{flex-shrink:0}
 .flow-subreq .subreq-dur{color:var(--text-muted);font-size:12px;text-align:right;flex-shrink:0}
-.flow-subreq .subreq-dup-tag{font-size:10px;color:var(--amber);flex-shrink:0;font-weight:600;background:rgba(217,119,6,0.07);padding:1px 7px;border-radius:4px}
+.flow-subreq .subreq-dup-tag{font-size:10px;color:var(--amber);flex-shrink:0;font-weight:600;background:var(--amber-bg);padding:1px 7px;border-radius:4px}
 .flow-subreq-detail{display:none;padding:12px 0;border-bottom:1px solid var(--border-subtle)}
 .flow-subreq-detail.open{display:block}
 
@@ -4337,6 +4194,41 @@ function getFlowStyles() {
 /* Strict Mode duplicate banner */
 .strict-mode-dupe{opacity:0.55}
 .strict-mode-banner{font-size:11px;color:var(--text-muted);padding:6px 0 0;font-family:var(--mono)}
+
+/* Flow detail tabs */
+.flow-detail-tabs{display:flex;gap:0;margin-bottom:14px;border-bottom:1px solid var(--border)}
+.flow-tab{padding:8px 16px;font-size:12px;font-family:var(--mono);font-weight:600;color:var(--text-muted);background:none;border:none;border-bottom:2px solid transparent;cursor:pointer;transition:all .15s;letter-spacing:.3px}
+.flow-tab:hover{color:var(--text)}
+.flow-tab.active{color:var(--accent);border-bottom-color:var(--accent)}
+
+/* Waterfall chart \u2014 request bars on time axis, sub-events as text rows */
+.flow-waterfall{padding:0;font-family:var(--mono);font-size:11px}
+.wf-time-axis{display:flex;justify-content:space-between;font-size:9px;color:var(--text-muted);padding:0 0 6px;margin-left:180px;margin-right:56px;border-bottom:1px solid var(--border);margin-bottom:2px}
+.wf-rows{display:flex;flex-direction:column;gap:0}
+
+/* Request group \u2014 request bar + its sub-events */
+.wf-request-group{border-bottom:1px solid var(--border-subtle);padding:2px 0}
+.wf-request-group:last-child{border-bottom:none}
+
+/* Request row \u2014 label | bar on time axis | duration */
+.wf-req-row{display:flex;align-items:center;gap:0;height:24px;transition:background .1s}
+.wf-req-row:hover{background:var(--bg-hover)}
+.wf-req-label{width:180px;flex-shrink:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--text);font-weight:500;padding:0 10px 0 0;font-size:11px}
+.wf-bar-track{flex:1;position:relative;height:14px;min-width:0;overflow:hidden}
+.wf-bar{position:absolute;top:1px;height:12px;border-radius:3px;opacity:0.8;min-width:3px}
+.wf-req-row:hover .wf-bar{opacity:1}
+.wf-req-dur{width:56px;flex-shrink:0;text-align:right;color:var(--text-muted);font-size:10px;padding-left:8px}
+
+/* Sub-event rows \u2014 same layout as request rows: label | bar track | duration */
+.wf-sub-row{display:flex;align-items:center;gap:0;height:20px;transition:background .1s}
+.wf-sub-row:hover{background:var(--bg-hover)}
+.wf-sub-label{width:180px;flex-shrink:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--text-muted);font-size:10px;padding-left:14px;display:flex;align-items:center;gap:6px}
+.wf-sub-dot{width:6px;height:6px;border-radius:2px;flex-shrink:0}
+.wf-sub-bar-sized{height:8px !important;top:3px !important;opacity:0.65}
+.wf-sub-row:hover .wf-sub-bar-sized{opacity:0.9}
+.wf-sub-dur{width:56px;flex-shrink:0;text-align:right;color:var(--text-dim);font-size:9px;padding-left:8px}
+
+.wf-loading{color:var(--text-muted);padding:12px 0;font-size:11px;font-family:var(--mono)}
 `;
 }
 var init_flows = __esm({
@@ -4445,22 +4337,39 @@ function getPerformanceStyles() {
 .perf-badge-lg{padding:4px 12px;font-size:13px;border-radius:var(--radius-sm)}
 .perf-badge-sm{padding:1px 6px;font-size:9px}
 
-/* Overview: endpoint list with inline scatter charts */
-.perf-endpoint-list{padding:16px 28px;display:flex;flex-direction:column;gap:8px}
-.perf-endpoint-card{background:var(--bg-card);border:1px solid var(--border);border-radius:var(--radius);padding:14px 20px 8px;cursor:pointer;transition:all .15s;box-shadow:var(--shadow-sm)}
-.perf-endpoint-card:hover{background:var(--bg-hover);border-color:var(--border-light);box-shadow:var(--shadow-md)}
-.perf-ep-header{display:flex;align-items:center;gap:12px;margin-bottom:8px;flex-wrap:wrap}
-.perf-ep-name{flex:1;font-family:var(--mono);font-size:13px;font-weight:600;color:var(--text);overflow:hidden;text-overflow:ellipsis;white-space:nowrap;min-width:120px}
-.perf-ep-stats{display:flex;align-items:center;gap:14px;flex-shrink:0}
-.perf-ep-stat{font-size:11px;font-family:var(--mono);color:var(--text-muted)}
-.perf-ep-stat-err{color:var(--red)}
-.perf-ep-stat-warn{color:var(--amber)}
-.perf-ep-stat-muted{color:var(--text-dim)}
-.perf-inline-canvas{width:100%;height:88px;border-radius:var(--radius-sm);background:var(--bg-muted);border:1px solid var(--border);display:block}
+/* Overview: summary cards */
+.perf-overview{padding:16px 28px}
+.perf-summary-row{display:flex;gap:8px;margin-bottom:16px}
+.perf-summary-card{flex:1;background:var(--bg-card);border:1px solid var(--border);border-radius:var(--radius);padding:14px 16px;display:flex;flex-direction:column;gap:4px;box-shadow:var(--shadow-sm)}
+.perf-summary-label{font-size:10px;text-transform:uppercase;letter-spacing:.8px;color:var(--text-muted);font-family:var(--sans);font-weight:600}
+.perf-summary-value{font-size:20px;font-weight:700;font-family:var(--mono);color:var(--text)}
+.perf-summary-value-sm{font-size:13px;font-weight:600;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+
+/* Shared table styles */
+.perf-table{width:100%;border-collapse:collapse;font-family:var(--mono);font-size:12px}
+.perf-table thead th{text-align:left;font-size:10px;text-transform:uppercase;letter-spacing:.8px;color:var(--text-muted);font-weight:600;font-family:var(--sans);padding:10px 14px;border-bottom:2px solid var(--border);white-space:nowrap}
+.perf-table tbody td{padding:11px 14px;border-bottom:1px solid var(--border-subtle);color:var(--text)}
+.perf-table-row{cursor:pointer;transition:background var(--transition, .15s ease)}
+.perf-table-row:hover{background:var(--bg-hover)}
+.perf-table tbody tr:last-child td{border-bottom:none}
+.perf-th-right{text-align:right !important}
+.perf-th-center{text-align:center !important}
+.perf-td-right{text-align:right}
+.perf-td-center{text-align:center}
+.perf-td-name{font-weight:600;max-width:240px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.perf-td-muted{color:var(--text-dim)}
+.perf-row-err{background:var(--red-bg)}
+.perf-row-err:hover{background:rgba(220,38,38,0.1)}
+
+/* Heat map table wrapper */
+.perf-heatmap{background:var(--bg-card);border:1px solid var(--border);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow-sm)}
+.perf-hm-p95{display:inline-flex;align-items:center;padding:2px 8px;border-radius:4px;font-size:11px;font-weight:600;border:1px solid}
+.perf-hm-split-bar{display:flex;height:8px;border-radius:4px;overflow:hidden;background:var(--bg-muted);width:100%;min-width:80px}
 
 /* Detail view */
 .perf-detail-header{padding:20px 28px 16px;border-bottom:1px solid var(--border-subtle)}
 .perf-detail-title{display:flex;align-items:center;gap:12px;font-size:17px;font-weight:600;color:var(--text);font-family:var(--mono)}
+.perf-baseline-hint{font-size:11px;font-weight:400;color:var(--text-muted);padding:2px 8px;background:var(--bg-muted);border:1px solid var(--border);border-radius:var(--radius-sm)}
 .perf-metric-row{display:flex;gap:4px;padding:16px 28px;border-bottom:1px solid var(--border-subtle)}
 .perf-metric-card{flex:1;background:var(--bg-muted);border:1px solid var(--border);border-radius:var(--radius-sm);padding:12px 16px;display:flex;flex-direction:column;gap:4px}
 .perf-metric-label{font-size:10px;text-transform:uppercase;letter-spacing:.8px;color:var(--text-muted);font-family:var(--sans);font-weight:600}
@@ -4495,22 +4404,42 @@ span.perf-breakdown-dot.perf-breakdown-app{background:var(--breakdown-app)}
 .perf-canvas{border-radius:var(--radius);background:var(--bg-muted);border:1px solid var(--border)}
 .perf-section-title{font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:.8px;color:var(--text-muted);margin-bottom:10px}
 
-/* Request history table */
+/* Request history */
 .perf-history-wrap{padding:0 28px 20px}
-.perf-history-wrap .col-header{padding:8px 0;margin:0;position:static;background:var(--bg);gap:0}
-.perf-hist-row{display:flex;align-items:center;padding:10px 0;border-bottom:1px solid var(--border-subtle);font-family:var(--mono);font-size:12px}
-.perf-hist-row:hover{background:var(--bg-hover);margin:0 -28px;padding-left:28px;padding-right:28px}
-.perf-hist-row-err{background:rgba(220,38,38,0.04)}
-.perf-hist-row-err:hover{background:rgba(220,38,38,0.08)}
-.perf-hist-row-hl{background:rgba(37,99,235,0.1);margin:0 -28px;padding-left:28px;padding-right:28px;border-left:3px solid #4ade80}
-.perf-hist-row-hl.perf-hist-row-err{background:rgba(220,38,38,0.12);border-left-color:#f87171}
-.perf-col{flex-shrink:0;border-right:1px solid var(--border-subtle);padding-right:16px;margin-right:16px}
-.perf-col:last-child{border-right:none;padding-right:0;margin-right:0}
-.perf-col-date{width:100px;color:var(--text-dim)}
-.perf-col-health{width:60px;display:flex;align-items:center}
-.perf-col-avg{width:70px;color:var(--text)}
-.perf-col-status{width:50px;text-align:center}
-.perf-col-qpr{width:60px;text-align:right;color:var(--text-dim)}
+.perf-hist-row-hl{background:rgba(37,99,235,0.1) !important;border-left:3px solid #4ade80}
+
+/* Callers section */
+.perf-callers{padding:16px 28px;border-bottom:1px solid var(--border-subtle)}
+.perf-callers-list{display:flex;flex-direction:column;gap:0}
+.perf-caller-row{display:flex;align-items:center;gap:12px;padding:8px 12px;border-bottom:1px solid var(--border-subtle);font-family:var(--mono);font-size:12px}
+.perf-caller-row:last-child{border-bottom:none}
+.perf-caller-name{flex:1;font-weight:500;color:var(--text);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.perf-caller-count{color:var(--text-muted);font-size:11px;flex-shrink:0}
+.perf-caller-avg{color:var(--text-dim);font-size:11px;flex-shrink:0}
+
+/* Query breakdown section */
+.perf-queries{padding:16px 28px;border-bottom:1px solid var(--border-subtle)}
+.perf-queries-loading{font-size:11px;color:var(--text-muted);font-family:var(--mono)}
+.perf-queries-list{display:flex;flex-direction:column;gap:0}
+.perf-query-row{display:flex;align-items:center;gap:12px;padding:8px 12px;border-bottom:1px solid var(--border-subtle);font-family:var(--mono);font-size:12px}
+.perf-query-row:last-child{border-bottom:none}
+.perf-query-label{flex:1;font-weight:500;color:var(--accent);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.perf-query-avg{color:var(--text-muted);font-size:11px;flex-shrink:0}
+.perf-query-count{color:var(--text-dim);font-size:11px;flex-shrink:0}
+
+/* Session trends */
+.perf-trends{padding:16px 28px;border-bottom:1px solid var(--border-subtle)}
+.perf-trends-list{display:flex;flex-direction:column;gap:0}
+.perf-trend-row{display:flex;align-items:center;gap:14px;padding:8px 12px;border-bottom:1px solid var(--border-subtle);font-family:var(--mono);font-size:12px}
+.perf-trend-row:last-child{border-bottom:none}
+.perf-trend-current{background:var(--bg-muted);border-radius:var(--radius-sm);font-weight:600}
+.perf-trend-time{width:80px;color:var(--text-dim);font-size:11px;flex-shrink:0}
+.perf-trend-p95{flex-shrink:0}
+.perf-trend-reqs{color:var(--text-muted);font-size:11px;flex-shrink:0}
+.perf-trend-errs{font-size:11px;flex-shrink:0}
+.perf-trend-arrow{font-size:10px;font-weight:600;flex-shrink:0}
+.perf-trend-slower{color:var(--red)}
+.perf-trend-faster{color:var(--green)}
 `;
 }
 var init_graph = __esm({
@@ -4526,9 +4455,10 @@ function getOverviewStyles() {
 .ov-container{padding:24px 28px}
 
 /* Summary banner */
-.ov-summary{display:flex;gap:24px;padding:16px 20px;background:var(--bg-card);border:1px solid var(--border);border-radius:var(--radius);margin-bottom:24px;flex-wrap:wrap;box-shadow:var(--shadow-sm)}
-.ov-stat{display:flex;flex-direction:column;gap:2px}
-.ov-stat-value{font-size:19px;font-weight:700;font-family:var(--mono);color:var(--text)}
+.ov-summary{display:flex;gap:10px;margin-bottom:24px;flex-wrap:wrap}
+.ov-stat{display:flex;flex-direction:column;gap:4px;flex:1;min-width:100px;padding:16px 18px;background:var(--bg-card);border:1px solid var(--border);border-radius:var(--radius);box-shadow:var(--shadow-sm);transition:box-shadow var(--transition, .15s ease)}
+.ov-stat:hover{box-shadow:var(--shadow-md)}
+.ov-stat-value{font-size:22px;font-weight:700;font-family:var(--mono);color:var(--text);line-height:1.2}
 .ov-stat-label{font-size:10px;text-transform:uppercase;letter-spacing:.8px;color:var(--text-muted);font-weight:600}
 
 /* Section header */
@@ -4537,8 +4467,8 @@ function getOverviewStyles() {
 
 /* Insight cards */
 .ov-cards{display:flex;flex-direction:column;gap:8px}
-.ov-card{display:flex;align-items:flex-start;gap:14px;padding:14px 18px;background:var(--bg-card);border:1px solid var(--border);border-radius:var(--radius);cursor:pointer;transition:all .15s;box-shadow:var(--shadow-sm)}
-.ov-card:hover{background:var(--bg-hover);border-color:var(--border-light);box-shadow:var(--shadow-md)}
+.ov-card{display:flex;align-items:flex-start;gap:14px;padding:16px 20px;background:var(--bg-card);border:1px solid var(--border);border-radius:var(--radius);cursor:pointer;transition:all var(--transition, .15s ease);box-shadow:var(--shadow-sm)}
+.ov-card:hover{background:var(--bg-hover);border-color:var(--border-light);box-shadow:var(--shadow-md);transform:translateY(-1px)}
 .ov-card-icon{width:20px;height:20px;display:flex;align-items:center;justify-content:center;flex-shrink:0;font-size:10px;border-radius:50%;margin-top:2px}
 .ov-card-icon.critical{background:rgba(220,38,38,.08);color:var(--red)}
 .ov-card-icon.warning{background:rgba(217,119,6,.08);color:var(--amber)}
@@ -4547,6 +4477,7 @@ function getOverviewStyles() {
 .ov-card-body{flex:1;min-width:0}
 .ov-card-title{font-size:13px;font-weight:600;color:var(--text);margin-bottom:2px}
 .ov-card-desc{font-size:12px;color:var(--text-dim);line-height:1.5}
+.ov-card-detail{font-size:11px;font-family:var(--mono);color:var(--text-muted);margin-top:6px;padding:8px 10px;background:var(--bg-muted);border:1px solid var(--border-subtle);border-radius:var(--radius-sm);line-height:1.5}
 .ov-card-desc strong{color:var(--text);font-family:var(--mono);font-weight:600}
 .ov-card-arrow{color:var(--text-muted);font-size:12px;flex-shrink:0;margin-top:2px;font-family:var(--mono);transition:transform .15s}
 
@@ -4842,7 +4773,7 @@ function getTimelineStyles() {
 }
 `;
 }
-var init_timeline2 = __esm({
+var init_timeline = __esm({
   "src/dashboard/styles/timeline.ts"() {
     "use strict";
   }
@@ -4862,7 +4793,7 @@ var init_styles = __esm({
     init_graph();
     init_overview();
     init_security2();
-    init_timeline2();
+    init_timeline();
   }
 });
 
@@ -4915,7 +4846,7 @@ var init_page = __esm({
 });
 
 // src/telemetry/config.ts
-import { homedir as homedir2 } from "os";
+import { homedir as homedir2, platform } from "os";
 import { join as join3 } from "path";
 import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
 import { randomUUID as randomUUID5 } from "crypto";
@@ -4930,11 +4861,17 @@ function readConfig() {
 function writeConfig(config) {
   try {
     if (!existsSync5(CONFIG_DIR))
-      mkdirSync3(CONFIG_DIR, { recursive: true, mode: DIR_MODE_OWNER_ONLY });
-    writeFileSync3(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", {
-      mode: FILE_MODE_OWNER_ONLY
-    });
-  } catch {
+      mkdirSync3(CONFIG_DIR, { recursive: true, ...IS_WINDOWS ? {} : { mode: DIR_MODE_OWNER_ONLY } });
+    writeFileSync3(
+      CONFIG_PATH,
+      JSON.stringify(config, null, 2) + "\n",
+      IS_WINDOWS ? {} : { mode: FILE_MODE_OWNER_ONLY }
+    );
+  } catch (err) {
+    if (process.env.BRAKIT_DEBUG) {
+      process.stderr.write(`[brakit] config write failed: ${err?.message ?? err}
+`);
+    }
   }
 }
 function getOrCreateConfig() {
@@ -4956,11 +4893,12 @@ function isTelemetryEnabled() {
   cachedEnabled = readConfig()?.telemetry ?? true;
   return cachedEnabled;
 }
-var CONFIG_DIR, CONFIG_PATH, cachedEnabled;
-var init_config = __esm({
+var IS_WINDOWS, CONFIG_DIR, CONFIG_PATH, cachedEnabled;
+var init_config2 = __esm({
   "src/telemetry/config.ts"() {
     "use strict";
-    init_network();
+    init_features();
+    IS_WINDOWS = platform() === "win32";
     CONFIG_DIR = join3(homedir2(), ".brakit");
     CONFIG_PATH = join3(CONFIG_DIR, "config.json");
     cachedEnabled = null;
@@ -4968,9 +4906,49 @@ var init_config = __esm({
 });
 
 // src/telemetry/index.ts
-import { platform, release, arch } from "os";
+import { platform as platform2, release, arch } from "os";
 import { spawn } from "child_process";
+function commonProperties() {
+  return {
+    brakit_version: VERSION,
+    node_version: process.version,
+    os: `${platform2()}-${release()}`,
+    arch: arch(),
+    $lib: "brakit",
+    $process_person_profile: false,
+    $geoip_disable: true
+  };
+}
+function sendToPosthog(event, properties) {
+  if (!isTelemetryEnabled()) return;
+  const config = getOrCreateConfig();
+  const payload = {
+    api_key: POSTHOG_KEY,
+    event,
+    distinct_id: config.anonymousId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    properties: { ...commonProperties(), ...properties }
+  };
+  try {
+    const body = JSON.stringify(payload);
+    const url = `${POSTHOG_HOST}${POSTHOG_CAPTURE_PATH}`;
+    const child = spawn(
+      process.execPath,
+      [
+        "-e",
+        `fetch(${JSON.stringify(url)},{method:"POST",headers:{"content-type":"application/json"},body:${JSON.stringify(body)},signal:AbortSignal.timeout(${POSTHOG_REQUEST_TIMEOUT_MS})}).catch(()=>{})`
+      ],
+      { detached: true, stdio: "ignore" }
+    );
+    child.unref();
+  } catch {
+  }
+}
+function trackEvent(event, properties) {
+  sendToPosthog(event, { sdk: "node", ...properties });
+}
 function initSession(framework, packageManager, isCustomCommand, adapters) {
+  getOrCreateConfig();
   session.startTime = Date.now();
   session.framework = framework;
   session.packageManager = packageManager;
@@ -4990,7 +4968,25 @@ function recordTabViewed(tab) {
   session.tabsViewed.add(tab);
 }
 function recordDashboardOpened() {
+  if (session.dashboardOpened) return;
   session.dashboardOpened = true;
+  session.dashboardOpenedAt = Date.now();
+  trackEvent(TELEMETRY_EVENT_DASHBOARD_VIEWED, {
+    time_to_dashboard_ms: session.startTime > 0 ? Date.now() - session.startTime : null,
+    request_count_at_open: session.requestCount
+  });
+}
+function recordSetupCompleted(info) {
+  session.frameworkCandidates = info.frameworkCandidates;
+  session.adaptersFailed = info.adaptersFailed;
+  session.setupDurationMs = info.setupDurationMs;
+  session.setupSucceeded = true;
+}
+function recordFirstRequest() {
+  if (!session.firstRequestAt) session.firstRequestAt = Date.now();
+}
+function recordExitReason(reason) {
+  if (session.exitReason === "unknown") session.exitReason = reason;
 }
 function speedBucket(ms) {
   if (ms === 0) return "none";
@@ -5001,12 +4997,11 @@ function speedBucket(ms) {
   }
   return `>${t[t.length - 1]}ms`;
 }
-function trackSession(registry) {
+function trackSession(services) {
   if (!isTelemetryEnabled()) return;
   const isFirstSession = readConfig() === null;
-  const config = getOrCreateConfig();
-  const metricsStore = registry.get("metrics-store");
-  const analysisEngine = registry.get("analysis-engine");
+  const metricsStore = services.metricsStore;
+  const analysisEngine = services.analysisEngine;
   const live = metricsStore.getLiveEndpoints();
   const insights = analysisEngine.getInsights();
   const findings = analysisEngine.getFindings();
@@ -5018,64 +5013,49 @@ function trackSession(registry) {
     totalDuration += ep.summary.p95Ms * ep.summary.totalRequests;
     if (ep.summary.p95Ms > slowestP95) slowestP95 = ep.summary.p95Ms;
   }
-  const payload = {
-    api_key: POSTHOG_KEY,
-    event: "session",
-    distinct_id: config.anonymousId,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    properties: {
-      brakit_version: VERSION,
-      node_version: process.version,
-      os: `${platform()}-${release()}`,
-      arch: arch(),
-      framework: session.framework,
-      package_manager: session.packageManager,
-      is_custom_command: session.isCustomCommand,
-      first_session: isFirstSession,
-      adapters_detected: session.adapters,
-      request_count: session.requestCount,
-      error_count: registry.get("error-store").getAll().length,
-      query_count: registry.get("query-store").getAll().length,
-      fetch_count: registry.get("fetch-store").getAll().length,
-      insight_count: insights.length,
-      finding_count: findings.length,
-      insight_types: [...session.insightTypes],
-      rules_triggered: [...session.rulesTriggered],
-      endpoint_count: live.length,
-      avg_duration_ms: totalRequests > 0 ? Math.round(totalDuration / totalRequests) : 0,
-      slowest_endpoint_bucket: speedBucket(slowestP95),
-      tabs_viewed: [...session.tabsViewed],
-      dashboard_opened: session.dashboardOpened,
-      explain_used: session.explainUsed,
-      session_duration_s: Math.round((Date.now() - session.startTime) / 1e3),
-      $lib: "brakit",
-      $process_person_profile: false,
-      $geoip_disable: true
-    }
-  };
-  try {
-    const body = JSON.stringify(payload);
-    const url = `${POSTHOG_HOST}${POSTHOG_CAPTURE_PATH}`;
-    const child = spawn(
-      process.execPath,
-      [
-        "-e",
-        `fetch(${JSON.stringify(url)},{method:"POST",headers:{"content-type":"application/json"},body:${JSON.stringify(body)},signal:AbortSignal.timeout(${POSTHOG_REQUEST_TIMEOUT_MS})}).catch(()=>{})`
-      ],
-      { detached: true, stdio: "ignore" }
-    );
-    child.unref();
-  } catch {
-  }
+  const now = Date.now();
+  sendToPosthog(TELEMETRY_EVENT_SESSION, {
+    sdk: "node",
+    framework: session.framework,
+    package_manager: session.packageManager,
+    is_custom_command: session.isCustomCommand,
+    first_session: isFirstSession,
+    adapters_detected: session.adapters,
+    request_count: session.requestCount,
+    error_count: services.errorStore.getAll().length,
+    query_count: services.queryStore.getAll().length,
+    fetch_count: services.fetchStore.getAll().length,
+    insight_count: insights.length,
+    finding_count: findings.length,
+    insight_types: [...session.insightTypes],
+    rules_triggered: [...session.rulesTriggered],
+    endpoint_count: live.length,
+    avg_duration_ms: totalRequests > 0 ? Math.round(totalDuration / totalRequests) : 0,
+    slowest_endpoint_bucket: speedBucket(slowestP95),
+    tabs_viewed: [...session.tabsViewed],
+    dashboard_opened: session.dashboardOpened,
+    explain_used: session.explainUsed,
+    session_duration_s: Math.round((now - session.startTime) / 1e3),
+    // Enhanced fields
+    setup_succeeded: session.setupSucceeded,
+    setup_duration_ms: session.setupDurationMs,
+    framework_detection_candidates: session.frameworkCandidates,
+    adapters_failed: session.adaptersFailed,
+    time_to_first_request_ms: session.firstRequestAt ? session.firstRequestAt - session.startTime : null,
+    time_to_dashboard_ms: session.dashboardOpenedAt ? session.dashboardOpenedAt - session.startTime : null,
+    exit_reason: session.exitReason
+  });
+  getOrCreateConfig();
 }
 var POSTHOG_KEY, session;
-var init_telemetry2 = __esm({
+var init_telemetry = __esm({
   "src/telemetry/index.ts"() {
     "use strict";
     init_src();
+    init_config2();
+    init_labels();
     init_config();
-    init_telemetry();
-    init_config();
+    init_config2();
     POSTHOG_KEY = "phc_E9TwydCGnSfPLIUhNxChpeg32TSowjk31KiPhnLPP0x";
     session = {
       startTime: 0,
@@ -5088,7 +5068,14 @@ var init_telemetry2 = __esm({
       rulesTriggered: /* @__PURE__ */ new Set(),
       tabsViewed: /* @__PURE__ */ new Set(),
       dashboardOpened: false,
-      explainUsed: false
+      explainUsed: false,
+      frameworkCandidates: [],
+      adaptersFailed: [],
+      setupDurationMs: 0,
+      setupSucceeded: false,
+      firstRequestAt: 0,
+      dashboardOpenedAt: 0,
+      exitReason: "unknown"
     };
   }
 });
@@ -5097,32 +5084,30 @@ var init_telemetry2 = __esm({
 function isDashboardRequest(url) {
   return url === DASHBOARD_PREFIX || url.startsWith(DASHBOARD_PREFIX + "/");
 }
-function createDashboardHandler(registry) {
-  const metricsStore = registry.get("metrics-store");
+function createDashboardHandler(services) {
+  const metricsStore = services.metricsStore;
   const routes = {
-    [DASHBOARD_API_REQUESTS]: createRequestsHandler(registry),
-    [DASHBOARD_API_EVENTS]: createSSEHandler(registry),
-    [DASHBOARD_API_FLOWS]: createFlowsHandler(registry),
-    [DASHBOARD_API_CLEAR]: createClearHandler(registry),
-    [DASHBOARD_API_LOGS]: createLogsHandler(registry),
-    [DASHBOARD_API_FETCHES]: createFetchesHandler(registry),
-    [DASHBOARD_API_ERRORS]: createErrorsHandler(registry),
-    [DASHBOARD_API_QUERIES]: createQueriesHandler(registry),
+    [DASHBOARD_API_REQUESTS]: createRequestsHandler(services),
+    [DASHBOARD_API_EVENTS]: createSSEHandler(services),
+    [DASHBOARD_API_FLOWS]: createFlowsHandler(services),
+    [DASHBOARD_API_CLEAR]: createClearHandler(services),
+    [DASHBOARD_API_LOGS]: createLogsHandler(services),
+    [DASHBOARD_API_FETCHES]: createFetchesHandler(services),
+    [DASHBOARD_API_ERRORS]: createErrorsHandler(services),
+    [DASHBOARD_API_QUERIES]: createQueriesHandler(services),
     [DASHBOARD_API_METRICS]: createMetricsHandler(metricsStore),
     [DASHBOARD_API_METRICS_LIVE]: createLiveMetricsHandler(metricsStore),
-    [DASHBOARD_API_INGEST]: createIngestHandler(registry),
-    [DASHBOARD_API_ACTIVITY]: createActivityHandler(registry)
+    [DASHBOARD_API_INGEST]: createIngestHandler(services),
+    [DASHBOARD_API_ACTIVITY]: createActivityHandler(services)
   };
-  if (registry.has("issue-store")) {
-    const issueStore = registry.get("issue-store");
-    routes[DASHBOARD_API_INSIGHTS] = createIssuesHandler(issueStore);
-    routes[DASHBOARD_API_SECURITY] = createIssuesHandler(issueStore);
-    routes[DASHBOARD_API_FINDINGS] = createFindingsHandler(issueStore);
-    routes[DASHBOARD_API_FINDINGS_REPORT] = createIssuesReportHandler(
-      issueStore,
-      registry.get("event-bus")
-    );
-  }
+  const issueStore = services.issueStore;
+  routes[DASHBOARD_API_INSIGHTS] = createIssuesHandler(issueStore);
+  routes[DASHBOARD_API_SECURITY] = createIssuesHandler(issueStore);
+  routes[DASHBOARD_API_FINDINGS] = createFindingsHandler(issueStore);
+  routes[DASHBOARD_API_FINDINGS_REPORT] = createIssuesReportHandler(
+    issueStore,
+    services.bus
+  );
   routes[DASHBOARD_API_TAB] = (req, res) => {
     const raw = (req.url ?? "").split("tab=")[1];
     if (raw) {
@@ -5133,7 +5118,7 @@ function createDashboardHandler(registry) {
     res.end();
   };
   return (req, res, config) => {
-    const path = (req.url ?? "/").split("?")[0];
+    const path = stripQueryString(req.url ?? "/");
     const handler = routes[path];
     if (handler) {
       handler(req, res);
@@ -5151,13 +5136,14 @@ function createDashboardHandler(registry) {
 var init_router = __esm({
   "src/dashboard/router.ts"() {
     "use strict";
+    init_endpoint();
     init_constants();
-    init_http();
+    init_labels();
     init_api();
     init_issues();
     init_sse();
     init_page();
-    init_telemetry2();
+    init_telemetry();
   }
 });
 
@@ -5198,51 +5184,6 @@ var init_event_bus = __esm({
   }
 });
 
-// src/core/service-registry.ts
-var ServiceRegistry;
-var init_service_registry = __esm({
-  "src/core/service-registry.ts"() {
-    "use strict";
-    ServiceRegistry = class {
-      constructor() {
-        this.services = /* @__PURE__ */ new Map();
-      }
-      register(name, service) {
-        this.services.set(name, service);
-      }
-      get(name) {
-        const service = this.services.get(name);
-        if (!service) throw new Error(`Service "${name}" not registered`);
-        return service;
-      }
-      has(name) {
-        return this.services.has(name);
-      }
-    };
-  }
-});
-
-// src/utils/static-patterns.ts
-function isStaticPath(urlPath) {
-  return STATIC_PATTERNS.some((p) => p.test(urlPath));
-}
-var STATIC_PATTERNS;
-var init_static_patterns = __esm({
-  "src/utils/static-patterns.ts"() {
-    "use strict";
-    STATIC_PATTERNS = [
-      /\.(?:js|css|map|ico|png|jpg|jpeg|gif|svg|webp|woff2?|ttf|eot)$/,
-      /^\/favicon/,
-      /^\/node_modules\//,
-      // Framework-specific static/internal paths
-      /^\/_next\//,
-      /^\/__nextjs/,
-      /^\/@vite\//,
-      /^\/__vite/
-    ];
-  }
-});
-
 // src/store/request-store.ts
 function flattenHeaders(headers2) {
   const flat = {};
@@ -5258,6 +5199,7 @@ var init_request_store = __esm({
     "use strict";
     init_constants();
     init_static_patterns();
+    init_endpoint();
     RequestStore = class {
       constructor(maxEntries = MAX_REQUEST_ENTRIES) {
         this.maxEntries = maxEntries;
@@ -5266,7 +5208,7 @@ var init_request_store = __esm({
       }
       capture(input) {
         const url = input.url;
-        const path = url.split("?")[0];
+        const path = stripQueryString(url);
         let requestBodyStr = null;
         if (input.requestBody && input.requestBody.length > 0) {
           requestBodyStr = input.requestBody.subarray(0, input.config.maxBodyCapture).toString("utf-8");
@@ -5291,7 +5233,8 @@ var init_request_store = __esm({
           startedAt: input.startTime,
           durationMs: Math.round((input.endTime ?? performance.now()) - input.startTime),
           responseSize: input.responseBody?.length ?? 0,
-          isStatic: isStaticPath(path)
+          isStatic: isStaticPath(path),
+          isHealthCheck: isHealthCheckPath(path)
         };
         this.requests.push(entry);
         if (this.requests.length > this.maxEntries) {
@@ -5368,50 +5311,6 @@ var init_telemetry_store = __esm({
   }
 });
 
-// src/store/fetch-store.ts
-var FetchStore;
-var init_fetch_store = __esm({
-  "src/store/fetch-store.ts"() {
-    "use strict";
-    init_telemetry_store();
-    FetchStore = class extends TelemetryStore {
-    };
-  }
-});
-
-// src/store/log-store.ts
-var LogStore;
-var init_log_store = __esm({
-  "src/store/log-store.ts"() {
-    "use strict";
-    init_telemetry_store();
-    LogStore = class extends TelemetryStore {
-    };
-  }
-});
-
-// src/store/error-store.ts
-var ErrorStore;
-var init_error_store = __esm({
-  "src/store/error-store.ts"() {
-    "use strict";
-    init_telemetry_store();
-    ErrorStore = class extends TelemetryStore {
-    };
-  }
-});
-
-// src/store/query-store.ts
-var QueryStore;
-var init_query_store = __esm({
-  "src/store/query-store.ts"() {
-    "use strict";
-    init_telemetry_store();
-    QueryStore = class extends TelemetryStore {
-    };
-  }
-});
-
 // src/utils/math.ts
 function percentile(values, p) {
   if (values.length === 0) return 0;
@@ -5458,6 +5357,17 @@ var init_metrics_store = __esm({
         this.dirty = false;
         this.accumulators = /* @__PURE__ */ new Map();
         this.pendingPoints = /* @__PURE__ */ new Map();
+        /**
+         * Compute the adaptive performance baseline for an endpoint.
+         * Returns the median p95 across historical sessions, or null when
+         * there isn't enough data to establish a meaningful baseline.
+         */
+        /**
+         * Cached baselines — invalidated on flush (when sessions change) and
+         * on new request recordings (when pending points grow). Avoids recomputing
+         * on every getLiveEndpoints() API call.
+         */
+        this.baselineCache = /* @__PURE__ */ new Map();
         this.data = { version: 1, endpoints: [] };
       }
       start() {
@@ -5482,7 +5392,7 @@ var init_metrics_store = __esm({
         this.flush(true);
       }
       recordRequest(req, metrics) {
-        if (req.isStatic) return;
+        if (req.isStatic || req.isHealthCheck) return;
         this.dirty = true;
         const key = getEndpointKey(req.method, req.path);
         let acc = this.accumulators.get(key);
@@ -5531,6 +5441,38 @@ var init_metrics_store = __esm({
       getEndpoint(endpoint) {
         return this.endpointIndex.get(endpoint);
       }
+      getEndpointBaseline(endpoint) {
+        const pending2 = this.pendingPoints.get(endpoint);
+        const pointCount = pending2?.length ?? 0;
+        const cached = this.baselineCache.get(endpoint);
+        if (cached && cached.pointCount === pointCount) return cached.value;
+        const value = this.computeBaseline(endpoint, pending2);
+        this.baselineCache.set(endpoint, { value, pointCount });
+        return value;
+      }
+      computeBaseline(endpoint, pending2) {
+        const ep = this.endpointIndex.get(endpoint);
+        if (ep && ep.sessions.length >= BASELINE_MIN_SESSIONS) {
+          const validSessions = ep.sessions.filter(
+            (s) => s.requestCount >= BASELINE_MIN_REQUESTS_PER_SESSION
+          );
+          if (validSessions.length >= BASELINE_MIN_SESSIONS) {
+            const p95s = validSessions.map((s) => s.p95DurationMs).sort((a, b) => a - b);
+            return p95s[Math.floor(p95s.length / 2)];
+          }
+        }
+        if (ep && ep.sessions.length === 1) {
+          const session2 = ep.sessions[0];
+          if (session2.requestCount >= BASELINE_MIN_REQUESTS_PER_SESSION) {
+            return session2.p95DurationMs;
+          }
+        }
+        if (pending2 && pending2.length >= BASELINE_PENDING_POINTS_MIN) {
+          const warmDurations = pending2.slice(1).map((r) => r.durationMs).sort((a, b) => a - b);
+          return warmDurations[Math.floor(warmDurations.length / 2)];
+        }
+        return null;
+      }
       getLiveEndpoints() {
         const merged = /* @__PURE__ */ new Map();
         for (const ep of this.data.endpoints) {
@@ -5545,27 +5487,35 @@ var init_metrics_store = __esm({
         const endpoints = [];
         for (const [endpoint, requests] of merged) {
           if (requests.length === 0) continue;
-          const durations = requests.map((r) => r.durationMs);
+          const warmRequests = requests.length > 1 ? requests.slice(1) : requests;
+          const warmDurations = warmRequests.map((r) => r.durationMs);
           const errors = requests.filter((r) => isErrorStatus(r.statusCode)).length;
-          const totalQueries = requests.reduce((s, r) => s + r.queryCount, 0);
-          const totalQueryTime = requests.reduce((s, r) => s + (r.queryTimeMs ?? 0), 0);
-          const totalFetchTime = requests.reduce((s, r) => s + (r.fetchTimeMs ?? 0), 0);
-          const n = requests.length;
-          const avgDurationMs = Math.round(durations.reduce((s, d) => s + d, 0) / n);
+          const totalQueries = warmRequests.reduce((s, r) => s + r.queryCount, 0);
+          const totalQueryTime = warmRequests.reduce((s, r) => s + (r.queryTimeMs ?? 0), 0);
+          const totalFetchTime = warmRequests.reduce((s, r) => s + (r.fetchTimeMs ?? 0), 0);
+          const n = warmRequests.length;
+          const avgDurationMs = Math.round(warmDurations.reduce((s, d) => s + d, 0) / n);
           const avgQueryTimeMs = Math.round(totalQueryTime / n);
           const avgFetchTimeMs = Math.round(totalFetchTime / n);
+          const p95Ms = percentile(warmDurations, 0.95);
+          const medianMs = percentile(warmDurations, 0.5);
+          const epData = this.endpointIndex.get(endpoint);
           endpoints.push({
             endpoint,
             requests,
             summary: {
-              p95Ms: percentile(durations, 0.95),
-              errorRate: errors / n,
+              p95Ms,
+              medianMs,
+              errorRate: errors / requests.length,
+              // Error rate uses ALL requests
               avgQueryCount: Math.round(totalQueries / n),
-              totalRequests: n,
+              totalRequests: requests.length,
               avgQueryTimeMs,
               avgFetchTimeMs,
               avgAppTimeMs: Math.max(0, avgDurationMs - avgQueryTimeMs - avgFetchTimeMs)
-            }
+            },
+            sessions: epData?.sessions,
+            baselineP95Ms: this.getEndpointBaseline(endpoint)
           });
         }
         endpoints.sort((a, b) => b.summary.p95Ms - a.summary.p95Ms);
@@ -5576,6 +5526,7 @@ var init_metrics_store = __esm({
         this.endpointIndex.clear();
         this.accumulators.clear();
         this.pendingPoints.clear();
+        this.baselineCache.clear();
         this.dirty = false;
         this.persistence.remove();
       }
@@ -5617,6 +5568,7 @@ var init_metrics_store = __esm({
           epMetrics.dataPoints = existing.concat(points).slice(-METRICS_MAX_DATA_POINTS);
         }
         this.pendingPoints.clear();
+        this.baselineCache.clear();
         if (!this.dirty) return;
         if (sync) {
           this.persistence.saveSync(this.data);
@@ -5710,10 +5662,6 @@ var init_store = __esm({
     "use strict";
     init_request_store();
     init_telemetry_store();
-    init_fetch_store();
-    init_log_store();
-    init_error_store();
-    init_query_store();
     init_metrics_store();
     init_persistence();
   }
@@ -5745,9 +5693,9 @@ function formatConsoleLine(issue, suffix) {
   }
   return line;
 }
-function startTerminalInsights(registry, proxyPort) {
-  const bus = registry.get("event-bus");
-  const metricsStore = registry.get("metrics-store");
+function startTerminalInsights(services, proxyPort) {
+  const bus = services.bus;
+  const metricsStore = services.metricsStore;
   const printedKeys = /* @__PURE__ */ new Set();
   const resolvedKeys = /* @__PURE__ */ new Set();
   const dashUrl = `localhost:${proxyPort}${DASHBOARD_PREFIX}`;
@@ -5818,8 +5766,8 @@ var init_terminal = __esm({
     "use strict";
     init_src();
     init_constants();
-    init_limits();
-    init_severity();
+    init_config();
+    init_labels();
     SEVERITY_COLOR = {
       critical: pc.red,
       warning: pc.yellow,
@@ -5914,8 +5862,14 @@ function outgoingToIncoming(headers2) {
   }
   return result;
 }
+function getDecompressor(encoding) {
+  if (encoding === CONTENT_ENCODING_GZIP) return gunzip;
+  if (encoding === CONTENT_ENCODING_BR) return brotliDecompress;
+  if (encoding === CONTENT_ENCODING_DEFLATE) return inflate;
+  return null;
+}
 function decompressAsync(body, encoding) {
-  const decompressor = encoding === CONTENT_ENCODING_GZIP ? gunzip : encoding === CONTENT_ENCODING_BR ? brotliDecompress : encoding === CONTENT_ENCODING_DEFLATE ? inflate : null;
+  const decompressor = getDecompressor(encoding);
   if (!decompressor) return Promise.resolve(body);
   return new Promise((resolve6) => {
     decompressor(body, (err, result) => {
@@ -5929,7 +5883,7 @@ function toBuffer(chunk) {
   if (typeof chunk === "string") return Buffer.from(chunk);
   return null;
 }
-function captureInProcess(req, res, requestId, requestStore) {
+function captureInProcess(req, res, requestId, requestStore, isChild = false) {
   const startTime = performance.now();
   const method = req.method ?? "GET";
   const resChunks = [];
@@ -5975,30 +5929,32 @@ function captureInProcess(req, res, requestId, requestStore) {
     const responseHeaders = outgoingToIncoming(res.getHeaders());
     const responseContentType = String(res.getHeader("content-type") ?? "");
     const capturedChunks = resChunks.slice();
-    void (async () => {
-      try {
-        let body = capturedChunks.length > 0 ? Buffer.concat(capturedChunks) : null;
-        if (body && encoding && !truncated) {
-          body = await decompressAsync(body, encoding);
+    if (!isChild) {
+      void (async () => {
+        try {
+          let body = capturedChunks.length > 0 ? Buffer.concat(capturedChunks) : null;
+          if (body && encoding && !truncated) {
+            body = await decompressAsync(body, encoding);
+          }
+          requestStore.capture({
+            requestId,
+            method,
+            url: req.url ?? "/",
+            requestHeaders: req.headers,
+            requestBody: null,
+            statusCode,
+            responseHeaders,
+            responseBody: body,
+            responseContentType,
+            startTime,
+            endTime,
+            config: { maxBodyCapture: DEFAULT_MAX_BODY_CAPTURE }
+          });
+        } catch (e) {
+          brakitDebug(`capture store: ${getErrorMessage(e)}`);
         }
-        requestStore.capture({
-          requestId,
-          method,
-          url: req.url ?? "/",
-          requestHeaders: req.headers,
-          requestBody: null,
-          statusCode,
-          responseHeaders,
-          responseBody: body,
-          responseContentType,
-          startTime,
-          endTime,
-          config: { maxBodyCapture: DEFAULT_MAX_BODY_CAPTURE }
-        });
-      } catch (e) {
-        brakitDebug(`capture store: ${getErrorMessage(e)}`);
-      }
-    })();
+      })();
+    }
     return result;
   };
 }
@@ -6046,13 +6002,15 @@ function installInterceptor(deps) {
         deps.handleDashboard(req, res, deps.config);
         return true;
       }
-      const requestId = randomUUID8();
+      const propagated = req.headers[BRAKIT_REQUEST_ID_HEADER];
+      const requestId = propagated ?? randomUUID8();
+      const isChild = propagated !== void 0;
       const ctx = {
         requestId,
         url,
         method: req.method ?? "GET"
       };
-      captureInProcess(req, res, requestId, deps.requestStore);
+      captureInProcess(req, res, requestId, deps.requestStore, isChild);
       return storage.run(
         ctx,
         () => original.apply(this, [event, ...args])
@@ -6075,7 +6033,8 @@ var init_interceptor = __esm({
     init_safe_wrap();
     init_guard();
     init_capture();
-    init_http();
+    init_labels();
+    init_constants();
     originalEmit = null;
   }
 });
@@ -6093,18 +6052,12 @@ function setup() {
   initPromise = doSetup();
   return initPromise;
 }
-function createStores(bus, registry) {
+function createStores(bus) {
   const requestStore = new RequestStore();
-  const fetchStore = new FetchStore();
-  const logStore = new LogStore();
-  const errorStore = new ErrorStore();
-  const queryStore = new QueryStore();
-  registry.register("event-bus", bus);
-  registry.register("request-store", requestStore);
-  registry.register("fetch-store", fetchStore);
-  registry.register("log-store", logStore);
-  registry.register("error-store", errorStore);
-  registry.register("query-store", queryStore);
+  const fetchStore = new TelemetryStore();
+  const logStore = new TelemetryStore();
+  const errorStore = new TelemetryStore();
+  const queryStore = new TelemetryStore();
   bus.on("telemetry:fetch", (data) => fetchStore.add(data));
   bus.on("telemetry:query", (data) => queryStore.add(data));
   bus.on("telemetry:log", (data) => logStore.add(data));
@@ -6124,31 +6077,33 @@ function installHooks(bus) {
   adapterRegistry.patchAll(telemetryEmit);
   const cwd = process.cwd();
   let framework = "unknown";
+  let frameworkCandidates = [];
   try {
     const pkg = JSON.parse(
-      // readFileSync is acceptable here — runs once at startup
       __require("fs").readFileSync(resolve5(cwd, "package.json"), "utf-8")
     );
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     framework = detectFrameworkFromDeps(allDeps);
+    frameworkCandidates = KNOWN_DEPENDENCY_NAMES.filter((dep) => dep in allDeps);
   } catch {
   }
   return {
     framework,
-    adapterNames: adapterRegistry.getActive().map((a) => a.name)
+    adapterNames: adapterRegistry.getActive().map((a) => a.name),
+    adaptersFailed: [...adapterRegistry.getFailed()],
+    frameworkCandidates
   };
 }
-function startAnalysis(registry, stores, dataDir) {
-  const bus = registry.get("event-bus");
+function startAnalysis(bus, stores, dataDir, services) {
   const metricsStore = new MetricsStore(new FileMetricsPersistence(dataDir));
   metricsStore.start();
-  registry.register("metrics-store", metricsStore);
   const issueStore = new IssueStore(dataDir);
   issueStore.start();
-  registry.register("issue-store", issueStore);
-  const analysisEngine = new AnalysisEngine(registry);
+  services.metricsStore = metricsStore;
+  services.issueStore = issueStore;
+  const analysisEngine = new AnalysisEngine(services);
   analysisEngine.start();
-  registry.register("analysis-engine", analysisEngine);
+  services.analysisEngine = analysisEngine;
   bus.on("request:completed", (req) => {
     const queries = stores.queryStore.getByRequest(req.id);
     const fetches = stores.fetchStore.getByRequest(req.id);
@@ -6160,7 +6115,7 @@ function startAnalysis(registry, stores, dataDir) {
   });
   return { analysisEngine, metricsStore, issueStore };
 }
-function registerLifecycle(registry, stores, services, cwd) {
+function registerLifecycle(allServices, stores, services, cwd) {
   let telemetrySent = false;
   const sendTelemetry = () => {
     if (telemetrySent) return;
@@ -6172,7 +6127,7 @@ function registerLifecycle(registry, stores, services, cwd) {
     recordRulesTriggered(
       services.analysisEngine.getFindings().map((f) => f.rule)
     );
-    trackSession(registry);
+    trackSession(allServices);
   };
   let teardownCalled = false;
   const runTeardown = () => {
@@ -6191,7 +6146,14 @@ function registerLifecycle(registry, stores, services, cwd) {
     }
   };
   health.setTeardown(runTeardown);
+  process.on("SIGINT", () => {
+    recordExitReason(EXIT_REASON_SIGINT);
+  });
+  process.on("SIGTERM", () => {
+    recordExitReason(EXIT_REASON_SIGTERM);
+  });
   process.on("beforeExit", () => {
+    recordExitReason(EXIT_REASON_CLEAN);
     sendTelemetry();
   });
   process.on("exit", () => {
@@ -6199,22 +6161,36 @@ function registerLifecycle(registry, stores, services, cwd) {
   });
 }
 async function doSetup() {
+  const setupStart = Date.now();
   brakitDebug(`[setup] doSetup called at ${(/* @__PURE__ */ new Date()).toISOString()}`);
   const bus = new EventBus();
-  const registry = new ServiceRegistry();
   const cwd = process.cwd();
-  const stores = createStores(bus, registry);
-  const { framework, adapterNames } = installHooks(bus);
+  const stores = createStores(bus);
+  const services = {
+    bus,
+    ...stores
+  };
+  const { framework, adapterNames, adaptersFailed, frameworkCandidates } = installHooks(bus);
   initSession(framework, detectPackageManagerSync(cwd), false, adapterNames);
+  const setupDurationMs = Date.now() - setupStart;
+  recordSetupCompleted({ frameworkCandidates, adaptersFailed, setupDurationMs });
+  trackEvent(TELEMETRY_EVENT_SETUP_COMPLETED, {
+    framework,
+    framework_detection_candidates: frameworkCandidates,
+    adapters_detected: adapterNames,
+    adapters_failed: adaptersFailed,
+    hooks_installed: ["fetch", "console", "error"],
+    setup_duration_ms: setupDurationMs
+  });
   const dataDir = getProjectDataDir(cwd);
-  const services = startAnalysis(registry, stores, dataDir);
+  const analysisServices = startAnalysis(bus, stores, dataDir, services);
   const config = {
     proxyPort: 0,
     targetPort: 0,
     showStatic: false,
     maxBodyCapture: DEFAULT_MAX_BODY_CAPTURE
   };
-  const handleDashboard = createDashboardHandler(registry);
+  const handleDashboard = createDashboardHandler(services);
   installInterceptor({
     handleDashboard,
     config,
@@ -6222,6 +6198,11 @@ async function doSetup() {
     onFirstRequest(port) {
       setBrakitPort(port);
       brakitDebug(`[setup] onFirstRequest fired, port=${port}`);
+      recordFirstRequest();
+      trackEvent(TELEMETRY_EVENT_FIRST_REQUEST, {
+        port,
+        time_to_first_request_ms: Date.now() - setupStart
+      });
       void (async () => {
         try {
           const dir = resolve5(cwd, METRICS_DIR);
@@ -6247,14 +6228,14 @@ async function doSetup() {
           brakitDebug(`port file write failed: ${getErrorMessage(err)}`);
         }
       })();
-      startTerminalInsights(registry, port);
+      startTerminalInsights(services, port);
       process.stdout.write(
         `  brakit v${VERSION} \u2014 http://localhost:${port}${DASHBOARD_PREFIX}
 `
       );
     }
   });
-  registerLifecycle(registry, stores, services, cwd);
+  registerLifecycle(services, stores, analysisServices, cwd);
 }
 var initPromise;
 var init_setup = __esm({
@@ -6266,12 +6247,8 @@ var init_setup = __esm({
     init_adapters();
     init_router();
     init_event_bus();
-    init_service_registry();
     init_request_store();
-    init_fetch_store();
-    init_log_store();
-    init_error_store();
-    init_query_store();
+    init_telemetry_store();
     init_store();
     init_issue_store();
     init_engine();
@@ -6284,7 +6261,7 @@ var init_setup = __esm({
     init_type_guards();
     init_fs();
     init_project();
-    init_telemetry2();
+    init_telemetry();
     initPromise = null;
   }
 });