Jev brand crisis detectionalert on the spike, not the mention

import { TypeSafeClient, noul, score } from '@typesafe-ai/sdk';

const client = new TypeSafeClient({
  timeout: 4000,
  retry: { maxRetries: 1, backoffInitialMs: 200 },
});

const QUESTIONS = {
  severity: score('How much damage this mention does to the brand it names if it is left unanswered', [
    'None. Neutral or positive, or not really about the brand.',
    'Low. A mild grumble with no specifics.',
    'Medium. A concrete complaint about the product, stated in public.',
    'High. A concrete claim about money lost, data lost, or a paid feature that is broken.',
    'Severe. Fraud, discrimination, safety, a legal threat, or a demand that others leave.',
  ]),
  reach_risk: score('How likely this text is to be screenshotted, quoted and repeated by strangers', [
    'Inert. Nobody outside the conversation would care.',
    'Low. Interesting to existing customers only.',
    'Medium. A clean story a stranger could understand without context.',
    'High. Has a quotable line, a number, or a named person in it.',
    'Extreme. Reads like a headline on its own.',
  ]),
  is_about_us: noul('This text is about the brand named in brand_name, and not a different company with a similar name'),
  factual_claim: noul('The text makes a specific factual claim that could be checked and could be wrong'),
  legal_or_regulatory: noul('The text mentions lawyers, a regulator, a lawsuit, or a formal complaint'),
  calls_for_action: noul('The text asks other people to cancel, boycott, switch, or report the brand'),
};

export async function scoreMention(mention) {
  const { answers, usage } = await client.systemOne({
    state: {
      brand_name: 'OpenTweet',
      mention_text: mention.text,
      platform: mention.platform,
      is_reply: mention.isReply,
    },
    questions: QUESTIONS,
  });

  return {
    severity: answers.severity.score,
    severityConfidence: answers.severity.confidence,
    reachRisk: answers.reach_risk.score,
    isAboutUs: answers.is_about_us.noul,
    factualClaim: answers.factual_claim.noul,
    legal: answers.legal_or_regulatory.noul,
    callsForAction: answers.calls_for_action.noul,
    inputTokens: usage.input_tokens,
  };
}

const WINDOW_MINUTES = 15;
const BASELINE_WINDOWS = 96;   // 24 hours of 15-minute buckets
const Z_ALERT = 4.5;
const MIN_MENTIONS = 5;
const MIN_LOAD = 3;

function median(values: number[]): number {
  const s = [...values].sort((a, b) => a - b);
  const mid = Math.floor(s.length / 2);
  return s.length % 2 ? s[mid] : (s[mid - 1] + s[mid]) / 2;
}

// Median absolute deviation instead of a standard deviation, because the
// history a crisis detector learns from contains previous crises, and one of
// those inflates a standard deviation enough to hide the next one.
function robustZ(current: number, history: number[]): number {
  const m = median(history);
  const mad = median(history.map((v) => Math.abs(v - m)));
  const scale = mad > 0 ? mad * 1.4826 : 0.5;
  return (current - m) / scale;
}

export function evaluateWindow(current, history) {
  if (history.length < BASELINE_WINDOWS / 4) return { alert: false, reason: 'baseline_too_short' };
  if (current.count < MIN_MENTIONS) return { alert: false, reason: 'too_few_mentions' };
  if (current.load < MIN_LOAD) return { alert: false, reason: 'below_absolute_floor' };

  const z = robustZ(current.load, history.map((w) => w.load));

  return {
    alert: z >= Z_ALERT,
    z: Number(z.toFixed(2)),
    load: Number(current.load.toFixed(2)),
    baseline: Number(median(history.map((w) => w.load)).toFixed(2)),
    count: current.count,
  };
}

curl -X POST https://opentweet.io/api/v1/posts \
  -H "Authorization: Bearer ot_your_key" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: incident-2026-09-18-statement" \
  -d '{
    "text": "Between 13:40 and 15:10 UTC today some accounts were charged twice. We have stopped the job, refunds are going out automatically, and nothing needs to be requested. Full write-up in the replies.",
    "is_thread": true,
    "thread_tweets": [
      "What happened: a retry in our billing worker ran without the idempotency key it is supposed to carry.",
      "Who is affected: 214 accounts. Every one of them is already queued for an automatic refund.",
      "What we changed: the key is now required at the call site and the worker refuses to start without it."
    ],
    "platforms": ["x", "bluesky", "linkedin"],
    "publish_now": true
  }'