Stale Lead SLA Monitor & Unassigned Alerting (Python)

import datetime

def main(input_data, hs_client, http_client, secret, console):
    raw = input_data[0] if isinstance(input_data, list) and input_data else (input_data or {})
    contact_id = raw.get('contact_id') or raw.get('contactId') or raw.get('objectId') or raw.get('hs_object_id')

    sla_days = int(input_data.get('sla_days', 5))
    cutoff = datetime.datetime.utcnow() - datetime.timedelta(days=sla_days)

    contacts_to_scan = []
    if contact_id:
        c = hs_client.crm.contacts.basic_api.get_by_id(contact_id, properties=['email', 'firstname', 'lastname', 'hs_lead_status', 'createdate', 'notes_last_contacted'])
        contacts_to_scan = [c]
    else:
        contacts = hs_client.crm.contacts.basic_api.get_page(
            limit=100,
            properties=['email', 'firstname', 'lastname', 'hs_lead_status', 'createdate', 'notes_last_contacted']
        )
        contacts_to_scan = contacts.results or []

    breached = []
    for c in contacts_to_scan:
        status = (c.properties.get('hs_lead_status') or '').upper()
        is_unworked = not status or status in ('NEW', 'OPEN', 'UNQUALIFIED')
        create_str = c.properties.get('createdate')
        last_contact = c.properties.get('notes_last_contacted')

        if is_unworked and create_str and not last_contact:
            c_date = datetime.datetime.fromisoformat(create_str.replace('Z', '+00:00'))
            if c_date.replace(tzinfo=None) < cutoff:
                breached.append(c.id)
                hs_client.crm.contacts.basic_api.update(c.id, properties={
                    "lead_sla_breached": "true",
                    "lead_sla_breach_date": datetime.datetime.utcnow().isoformat() + "Z"
                })

    webhook_url = input_data.get('slack_webhook_url')
    if breached and webhook_url:
        http_client.post(webhook_url, {"text": f"⚠️ SLA Alert: {len(breached)} unworked leads breached {sla_days}-day SLA."})

    return {"scanned": len(contacts_to_scan), "breachedCount": len(breached), "breachedContactIds": breached}