@reprova/sdk 0.4.0 → 0.6.0

package/dist/cjs/drizzle.js

@@ -0,0 +1,204 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDrizzleLogger = createDrizzleLogger;
+exports.createDrizzleCache = createDrizzleCache;
+exports.createDrizzleFootprint = createDrizzleFootprint;
+const node_crypto_1 = require("node:crypto");
+const context_js_1 = require("./context.js");
+const OP_BY_KEYWORD = {
+    select: 'select',
+    insert: 'insert',
+    update: 'update',
+    delete: 'delete',
+};
+// First SQL keyword → operation.
+function opOf(sql) {
+    const m = /^\s*(select|insert|update|delete)\b/i.exec(sql);
+    return m ? OP_BY_KEYWORD[m[1].toLowerCase()] : undefined;
+}
+// The principal table, from the op-appropriate clause.
+function tableOf(sql, op) {
+    let m = null;
+    if (op === 'select' || op === 'delete')
+        m = /\bfrom\s+"?([A-Za-z0-9_]+)"?/i.exec(sql);
+    else if (op === 'insert')
+        m = /\binto\s+"?([A-Za-z0-9_]+)"?/i.exec(sql);
+    else if (op === 'update')
+        m = /\bupdate\s+"?([A-Za-z0-9_]+)"?/i.exec(sql);
+    return m ? m[1] : undefined;
+}
+// Column names referenced in the WHERE clause — the right-hand identifier of
+// each `"table"."col"` (or a bare `"col"`). Names only; values are `?`.
+function whereColumns(sql) {
+    const wIdx = sql.search(/\bwhere\b/i);
+    if (wIdx < 0)
+        return [];
+    const tail = sql.slice(wIdx + 5);
+    const cols = new Set();
+    const re = /"([A-Za-z0-9_]+)"(?:\s*\.\s*"([A-Za-z0-9_]+)")?/g;
+    let m;
+    while ((m = re.exec(tail)) !== null)
+        cols.add(m[2] ?? m[1]);
+    return [...cols].sort();
+}
+function extractPks(rows, pkCols) {
+    if (pkCols.length === 0)
+        return [];
+    const seen = new Set();
+    const pks = [];
+    for (const row of rows) {
+        const vals = pkCols.map((c) => row[c]);
+        if (vals.some((v) => v === undefined))
+            continue; // column not selected — can't form a PK
+        const pk = vals.map((v) => String(v)).join(':');
+        if (!seen.has(pk)) {
+            seen.add(pk);
+            pks.push(pk);
+        }
+    }
+    return pks;
+}
+// Drizzle's own cache key: SHA-256(sql + '-' + JSON.stringify(params)) — see
+// drizzle-orm/cache/core/cache.js. Reimplemented (not imported) so a query's
+// hash computed here from `logger.logQuery`'s (sql, params) matches the hash
+// Drizzle later passes to `cache.put()` for the SAME query, letting the two
+// hooks correlate without ever importing 'drizzle-orm'.
+// Node's own crypto module (not WebCrypto's `crypto.subtle`, which only
+// became a stable global in Node 19+) — createHash has existed since
+// Node's earliest crypto module, so this works on any Node version this
+// SDK targets. Stays async (a plain value from an async function resolves
+// immediately) so callers don't need to change.
+async function hashQuery(sql, params) {
+    const data = `${sql}-${JSON.stringify(params)}`;
+    return (0, node_crypto_1.createHash)('sha256').update(data).digest('hex');
+}
+// A pending SELECT footprint entry, keyed by query hash, waiting to be
+// upgraded by a paired cache's put(). Linked to its logger via WeakMap so the
+// map is GC'd along with the logger if the app never pairs a cache to it.
+const pendingByLogger = new WeakMap();
+// Creates a Drizzle-compatible logger that records footprints.
+// Usage: drizzle(client, { logger: createDrizzleLogger() })
+function createDrizzleLogger(opts = {}) {
+    const captureWhereShape = opts.captureWhereShape !== false;
+    const forward = opts.forward;
+    const pending = new Map();
+    const logger = {
+        logQuery(query, params) {
+            try {
+                const ctx = context_js_1.contextStorage.getStore();
+                if (ctx) {
+                    const op = opOf(query);
+                    const table = op ? tableOf(query, op) : undefined;
+                    if (op && table) {
+                        const where = captureWhereShape ? whereColumns(query).join(',') || undefined : undefined;
+                        const entry = {
+                            model: table,
+                            op,
+                            pks: [],
+                            where_shape: where,
+                            count: 0,
+                            note: 'drizzle: shape-only (no result access — PKs/count unavailable)',
+                            resolved: true,
+                        };
+                        ctx.footprint.push(entry);
+                        // A paired cache can upgrade this SAME entry once the real rows
+                        // are known — see createDrizzleCache(). Mutations get nothing
+                        // more from Drizzle's cache hook, so they stay as pushed above.
+                        if (op === 'select') {
+                            hashQuery(query, params)
+                                .then((h) => pending.set(h, entry))
+                                .catch(() => { });
+                        }
+                    }
+                }
+            }
+            catch { /* never break a query */ }
+            try {
+                forward?.logQuery(query, params);
+            }
+            catch { /* ignore */ }
+        },
+    };
+    pendingByLogger.set(logger, pending);
+    return logger;
+}
+// node-postgres (`pg`) QueryResult vs. mysql2's `[rows, fields]` tuple — the
+// two response shapes `cache.put()` actually sees for Reprova's two real
+// customer-database dialects (Postgres, MySQL; see agent/internal/dialect).
+// Unrecognized shapes degrade to "no rows found" rather than guessing.
+function rowsFromResponse(response) {
+    if (Array.isArray(response)) {
+        const [rows] = response; // mysql2: client.query() resolves [rows, fields]
+        return Array.isArray(rows) ? rows : undefined;
+    }
+    const rows = response?.rows;
+    return Array.isArray(rows) ? rows : undefined;
+}
+// Creates a Drizzle Cache that observes (never serves) query results to
+// upgrade SELECT footprints with exact primary keys and row counts.
+// Usage: drizzle(client, { cache: createDrizzleCache({ logger }) })
+function createDrizzleCache(opts = {}) {
+    const primaryKey = opts.primaryKey ?? (() => ['id']);
+    const pending = opts.logger ? pendingByLogger.get(opts.logger) : undefined;
+    return {
+        // 'all' — every SELECT is observed automatically; apps never need to
+        // call Drizzle's own `.$withCache()` for this to work.
+        strategy() {
+            return 'all';
+        },
+        // Always a miss: this cache exists to OBSERVE results, never to REPLACE a
+        // real query with a stale one.
+        async get() {
+            return undefined;
+        },
+        async put(hashedQuery, response, tables) {
+            try {
+                if (!tables || tables.length === 0)
+                    return;
+                const rows = rowsFromResponse(response);
+                if (!rows)
+                    return;
+                const primary = tables[0];
+                const pks = extractPks(rows, primaryKey(primary));
+                const count = rows.length;
+                const note = count === 0 ? 'returned 0 rows' : undefined;
+                const linked = pending?.get(hashedQuery);
+                const ctx = context_js_1.contextStorage.getStore();
+                if (linked) {
+                    pending.delete(hashedQuery);
+                    linked.model = primary;
+                    linked.pks = pks;
+                    linked.count = count;
+                    linked.note = note;
+                }
+                else if (ctx) {
+                    ctx.footprint.push({ model: primary, op: 'select', pks, count, note, resolved: true });
+                }
+                // Joined/subquery tables: recorded as referenced, without PKs — same
+                // convention as the Kysely adapter (result columns can't be reliably
+                // attributed to a joined table's own primary key).
+                if (ctx) {
+                    for (const t of tables.slice(1)) {
+                        ctx.footprint.push({ model: t, op: 'select', pks: [], count: 0, note: 'referenced (join/subquery)', resolved: true });
+                    }
+                }
+            }
+            catch { /* never break a query */ }
+        },
+        // Drizzle's mutation hook gets table names only — no rows, no count, and
+        // it races the real query (Promise.all internally). Nothing usable to
+        // record here; mutations are already captured (shape-only) by the paired
+        // logger.
+        async onMutate() { },
+    };
+}
+// Convenience: builds a linked logger+cache pair in one call, the
+// recommended way to get exact SELECT pks/count without double-counting.
+// Usage:
+//   const { logger, cache } = createDrizzleFootprint();
+//   const db = drizzle(client, { logger, cache });
+function createDrizzleFootprint(opts = {}) {
+    const logger = createDrizzleLogger({ captureWhereShape: opts.captureWhereShape });
+    const cache = createDrizzleCache({ primaryKey: opts.primaryKey, logger });
+    return { logger, cache };
+}

package/dist/cjs/frameworkAdapter.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/httpFetch.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.httpFetch = httpFetch;
+const node_http_1 = __importDefault(require("node:http"));
+const node_https_1 = __importDefault(require("node:https"));
+// Node 18+ ships a global fetch; older Node (found live: Node 14, still a
+// real LTS for legacy apps) has none at all. node-fetch isn't a safe
+// replacement here — v3+ is ESM-only, the exact same require(ESM) trap
+// @marcbachmann/cel-js caused (see invariantRules.ts's own doc comment on
+// loadEnv). Every internal caller in this SDK only ever needs a small,
+// stable subset of the Fetch API (GET/POST, headers, a string body,
+// .ok/.status/.json()/.text()), so this implements just that on top of
+// Node's own always-available http/https modules, and delegates to a real
+// global fetch when one exists (the common case — zero overhead, zero
+// behavior change on any Node version that already has one).
+function httpFetch(url, init) {
+    const globalFetch = globalThis.fetch;
+    if (typeof globalFetch === 'function') {
+        return globalFetch(url, init);
+    }
+    return new Promise((resolve, reject) => {
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch (err) {
+            reject(err);
+            return;
+        }
+        const lib = parsed.protocol === 'https:' ? node_https_1.default : node_http_1.default;
+        const req = lib.request({
+            hostname: parsed.hostname,
+            port: parsed.port || undefined,
+            path: `${parsed.pathname}${parsed.search}`,
+            method: init?.method ?? 'GET',
+            headers: init?.headers,
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (chunk) => chunks.push(chunk));
+            res.on('end', () => {
+                const text = Buffer.concat(chunks).toString('utf8');
+                const status = res.statusCode ?? 0;
+                resolve({
+                    ok: status >= 200 && status < 300,
+                    status,
+                    json: async () => JSON.parse(text),
+                    text: async () => text,
+                });
+            });
+        });
+        req.on('error', reject);
+        if (init?.body)
+            req.write(init.body);
+        req.end();
+    });
+}

package/dist/cjs/idempotency.js

@@ -0,0 +1,132 @@
+"use strict";
+// Idempotency/consistency checks: two independent, domain-agnostic
+// detectors for "silent 200" bugs, unlike business-invariant rules — neither
+// needs a dashboard-authored condition tree, since neither depends on
+// knowing anything about the app's data model.
+//
+// 1. Idempotency-key mismatch: the app itself asserts two requests are "the
+//    same operation" by sending an identical value in a known header (e.g.
+//    Stripe-style Idempotency-Key). If the response differs between them,
+//    that's unambiguously a bug — no heuristic tuning needed, the app told
+//    us these should match.
+// 2. Duplicate-read mismatch: the SAME GET (route + query + caller
+//    identity) repeated within a short window returning a different
+//    result. Real false-positive risk exists here (data can legitimately
+//    change between two reads), so it's scoped tight: a short window turns
+//    it into "did two near-simultaneous reads of what should be the same
+//    snapshot disagree" (a race-condition/double-fetch signal), not general
+//    staleness detection — and it's skipped entirely when no caller
+//    identity is available, since an identity-less GET trivially disagrees
+//    across different callers.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HashMismatchCache = exports.DuplicateReadMismatch = exports.IdempotencyKeyMismatch = exports.DEFAULT_IDEMPOTENCY_SETTINGS = void 0;
+exports.hashResponseBody = hashResponseBody;
+exports.findIdempotencyKey = findIdempotencyKey;
+exports.extractIdentity = extractIdentity;
+const node_crypto_1 = require("node:crypto");
+// Mirrors the control plane's idempotency_settings table defaults — used
+// before the first successful poll, and if polling never succeeds at all
+// (e.g. an older control plane without this endpoint yet).
+exports.DEFAULT_IDEMPOTENCY_SETTINGS = {
+    key_check_enabled: true,
+    header_names: ['Idempotency-Key', 'X-Idempotency-Key'],
+    ttl_ms: 86_400_000,
+    max_keys: 100_000,
+    duplicate_read_enabled: false,
+    duplicate_read_window_ms: 500,
+};
+// One reusable Error class per detector, mirroring BusinessInvariantViolation
+// — per-endpoint identity comes from capture()'s errorType override, not a
+// per-instance subclass, so many distinct endpoints share one class without
+// collapsing into a single issue.
+class IdempotencyKeyMismatch extends Error {
+}
+exports.IdempotencyKeyMismatch = IdempotencyKeyMismatch;
+class DuplicateReadMismatch extends Error {
+}
+exports.DuplicateReadMismatch = DuplicateReadMismatch;
+// Deterministic regardless of key insertion order, so { a:1, b:2 } and
+// { b:2, a:1 } hash identically — otherwise two genuinely-equivalent
+// responses serialized in a different key order would look like a mismatch
+// that isn't one.
+function stableStringify(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(',')}]`;
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(',')}}`;
+}
+function hashResponseBody(body) {
+    return (0, node_crypto_1.createHash)('sha256').update(stableStringify(body)).digest('hex');
+}
+// Bounded signature -> last-seen-hash cache with TTL + LRU eviction, shared
+// by both detectors — the underlying mechanism ("has this signature's hash
+// changed within its window") is identical for both; only what goes into
+// the signature and how long it's remembered differs. Map iteration order
+// is insertion order, and delete-then-reinsert on every access keeps it in
+// least-recently-used order, so eviction always drops the LRU entry.
+class HashMismatchCache {
+    maxKeys;
+    ttlMs;
+    map = new Map();
+    constructor(maxKeys, ttlMs) {
+        this.maxKeys = maxKeys;
+        this.ttlMs = ttlMs;
+    }
+    // Settings can change on every poll — reconfigure in place rather than
+    // recreating the cache, so a TTL/cap edit doesn't silently drop everything
+    // currently tracked.
+    configure(maxKeys, ttlMs) {
+        this.maxKeys = maxKeys;
+        this.ttlMs = ttlMs;
+    }
+    // Records `hash` for `signature`, returning true if a live (non-expired)
+    // prior hash for the same signature exists and differs from this one.
+    checkAndRecord(signature, hash, now = Date.now()) {
+        const existing = this.map.get(signature);
+        this.map.delete(signature); // re-inserted below either way, refreshing LRU order
+        const mismatch = !!existing && existing.expiresAt > now && existing.hash !== hash;
+        this.map.set(signature, { hash, expiresAt: now + this.ttlMs });
+        while (this.map.size > this.maxKeys) {
+            const oldest = this.map.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.map.delete(oldest);
+        }
+        return mismatch;
+    }
+    get size() {
+        return this.map.size;
+    }
+}
+exports.HashMismatchCache = HashMismatchCache;
+// Checks each configured header name case-insensitively — Node normalizes
+// incoming header names to lowercase, and captureHeaders (stack.ts) passes
+// that through unchanged, so ctx.request.headers keys are already lowercase.
+function findIdempotencyKey(headers, headerNames) {
+    for (const name of headerNames) {
+        const value = headers[name.toLowerCase()];
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+// A small, conventional set of claim keys checked in order — not exhaustive,
+// just enough to cover common shapes (Auth0/JWT `sub`, a plain `id`,
+// Passport-style `userId`/`user_id`). Returns undefined, never a guess, when
+// none match: duplicate-read detection is skipped entirely without an
+// identity, rather than risk comparing two different callers' data and
+// calling the difference a bug.
+const IDENTITY_CLAIM_KEYS = ['sub', 'id', 'userId', 'user_id'];
+function extractIdentity(authClaims) {
+    if (!authClaims)
+        return undefined;
+    for (const key of IDENTITY_CLAIM_KEYS) {
+        const value = authClaims[key];
+        if (typeof value === 'string' || typeof value === 'number')
+            return String(value);
+    }
+    return undefined;
+}

package/dist/cjs/idempotencySettingsPoller.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdempotencySettingsPoller = void 0;
+const idempotency_js_1 = require("./idempotency.js");
+const httpFetch_js_1 = require("./httpFetch.js");
+const WARN_INTERVAL_MS = 60_000;
+// Same start()/stop()/setInterval+unref shape as RulesPoller — periodically
+// fetches the tenant's dashboard-configured idempotency-check settings so a
+// toggle flipped in the dashboard reaches a running process without a
+// redeploy. Falls back to DEFAULT_IDEMPOTENCY_SETTINGS before the first
+// successful poll and keeps the last-known-good settings on any failure,
+// never throwing and never leaving the detectors unconfigured.
+class IdempotencySettingsPoller {
+    settings = idempotency_js_1.DEFAULT_IDEMPOTENCY_SETTINGS;
+    timer = null;
+    lastWarnAt = 0;
+    endpoint;
+    apiKey;
+    intervalMs;
+    constructor(opts) {
+        this.endpoint = opts.endpoint;
+        this.apiKey = opts.apiKey;
+        this.intervalMs = opts.intervalMs ?? 60_000;
+    }
+    start() {
+        void this.refresh(); // don't wait a full interval before settings are usable
+        this.timer = setInterval(() => void this.refresh(), this.intervalMs);
+        if (this.timer.unref)
+            this.timer.unref(); // don't block process exit
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    getSettings() {
+        return this.settings;
+    }
+    async refresh() {
+        try {
+            const res = await (0, httpFetch_js_1.httpFetch)(this.endpoint, {
+                headers: { 'X-Reprova-Key': this.apiKey },
+            });
+            if (!res.ok) {
+                this.warnOnce(`reprova: idempotency settings fetch returned ${res.status}`);
+                return;
+            }
+            this.seed((await res.json()));
+        }
+        catch (err) {
+            this.warnOnce(`reprova: idempotency settings fetch error: ${err.message}`);
+        }
+    }
+    // Applies an already-fetched settings object directly, with no network
+    // call — used by replay mode to seed a one-time snapshot the CLI fetched
+    // ahead of time (there's no live control plane to poll from inside a
+    // replayed app), so checkIdempotencyIfAny (sdk.ts) sees exactly the same
+    // shape it would from a real refresh().
+    seed(settings) {
+        this.settings = settings;
+    }
+    warnOnce(msg) {
+        const now = Date.now();
+        if (now - this.lastWarnAt > WARN_INTERVAL_MS) {
+            this.lastWarnAt = now;
+            console.warn(msg);
+        }
+    }
+}
+exports.IdempotencySettingsPoller = IdempotencySettingsPoller;

package/dist/cjs/index.js

@@ -0,0 +1,96 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDrift = exports.updateWelfordState = exports.newWelfordState = exports.WriteCountDrift = exports.ValueDistributionDrift = exports.InferenceReporter = exports.IdempotencySettingsPoller = exports.hashResponseBody = exports.extractIdentity = exports.findIdempotencyKey = exports.DuplicateReadMismatch = exports.IdempotencyKeyMismatch = exports.HashMismatchCache = exports.DEFAULT_IDEMPOTENCY_SETTINGS = exports.RulesPoller = exports.BusinessInvariantViolation = exports.operationMatchesHook = exports.evaluateInvariant = exports.compileInvariant = exports.PotentialRetryStorm = exports.describeRetryStorm = exports.detectRetryStorm = exports.PotentialNPlusOneQuery = exports.describeNPlusOne = exports.detectNPlusOne = exports.createDrizzleFootprint = exports.createDrizzleCache = exports.createDrizzleLogger = exports.createNextAdapter = exports.createNestContextInterceptor = exports.createNestExceptionFilter = exports.installKnexHooks = exports.MongoSchemaReporter = exports.discoverMongooseSchema = exports.reprovaMongoosePlugin = exports.installMikroOrmSubscriber = exports.installTypeOrmQueryLogger = exports.installTypeOrmSubscriber = exports.installSequelizeHooks = exports.createKyselyPlugin = exports.instrumentLegacyPrismaClient = exports.recordPrismaOperation = exports.createPrismaExtension = exports.setAuthClaims = exports.currentContext = exports.contextStorage = exports.replayErrorHandler = exports.forwardAsyncErrors = exports.wrapResponse = exports.Reprova = void 0;
+exports.SDK_VERSION = exports.DistributionBaselinePoller = exports.DistributionDriftReporter = exports.extractTopLevelNumericFields = void 0;
+var sdk_js_1 = require("./sdk.js");
+Object.defineProperty(exports, "Reprova", { enumerable: true, get: function () { return sdk_js_1.Reprova; } });
+Object.defineProperty(exports, "wrapResponse", { enumerable: true, get: function () { return sdk_js_1.wrapResponse; } });
+Object.defineProperty(exports, "forwardAsyncErrors", { enumerable: true, get: function () { return sdk_js_1.forwardAsyncErrors; } });
+Object.defineProperty(exports, "replayErrorHandler", { enumerable: true, get: function () { return sdk_js_1.replayErrorHandler; } });
+var context_js_1 = require("./context.js");
+Object.defineProperty(exports, "contextStorage", { enumerable: true, get: function () { return context_js_1.contextStorage; } });
+Object.defineProperty(exports, "currentContext", { enumerable: true, get: function () { return context_js_1.currentContext; } });
+Object.defineProperty(exports, "setAuthClaims", { enumerable: true, get: function () { return context_js_1.setAuthClaims; } });
+var prisma_js_1 = require("./prisma.js");
+Object.defineProperty(exports, "createPrismaExtension", { enumerable: true, get: function () { return prisma_js_1.createPrismaExtension; } });
+Object.defineProperty(exports, "recordPrismaOperation", { enumerable: true, get: function () { return prisma_js_1.recordPrismaOperation; } });
+var legacyPrisma_js_1 = require("./legacyPrisma.js");
+Object.defineProperty(exports, "instrumentLegacyPrismaClient", { enumerable: true, get: function () { return legacyPrisma_js_1.instrumentLegacyPrismaClient; } });
+var kysely_js_1 = require("./kysely.js");
+Object.defineProperty(exports, "createKyselyPlugin", { enumerable: true, get: function () { return kysely_js_1.createKyselyPlugin; } });
+var sequelize_js_1 = require("./sequelize.js");
+Object.defineProperty(exports, "installSequelizeHooks", { enumerable: true, get: function () { return sequelize_js_1.installSequelizeHooks; } });
+var typeorm_js_1 = require("./typeorm.js");
+Object.defineProperty(exports, "installTypeOrmSubscriber", { enumerable: true, get: function () { return typeorm_js_1.installTypeOrmSubscriber; } });
+Object.defineProperty(exports, "installTypeOrmQueryLogger", { enumerable: true, get: function () { return typeorm_js_1.installTypeOrmQueryLogger; } });
+var mikroorm_js_1 = require("./mikroorm.js");
+Object.defineProperty(exports, "installMikroOrmSubscriber", { enumerable: true, get: function () { return mikroorm_js_1.installMikroOrmSubscriber; } });
+var mongoose_js_1 = require("./mongoose.js");
+Object.defineProperty(exports, "reprovaMongoosePlugin", { enumerable: true, get: function () { return mongoose_js_1.reprovaMongoosePlugin; } });
+Object.defineProperty(exports, "discoverMongooseSchema", { enumerable: true, get: function () { return mongoose_js_1.discoverMongooseSchema; } });
+var mongoSchemaReporter_js_1 = require("./mongoSchemaReporter.js");
+Object.defineProperty(exports, "MongoSchemaReporter", { enumerable: true, get: function () { return mongoSchemaReporter_js_1.MongoSchemaReporter; } });
+var knex_js_1 = require("./knex.js");
+Object.defineProperty(exports, "installKnexHooks", { enumerable: true, get: function () { return knex_js_1.installKnexHooks; } });
+var nest_js_1 = require("./nest.js");
+Object.defineProperty(exports, "createNestExceptionFilter", { enumerable: true, get: function () { return nest_js_1.createNestExceptionFilter; } });
+Object.defineProperty(exports, "createNestContextInterceptor", { enumerable: true, get: function () { return nest_js_1.createNestContextInterceptor; } });
+var nextjs_js_1 = require("./nextjs.js");
+Object.defineProperty(exports, "createNextAdapter", { enumerable: true, get: function () { return nextjs_js_1.createNextAdapter; } });
+var drizzle_js_1 = require("./drizzle.js");
+Object.defineProperty(exports, "createDrizzleLogger", { enumerable: true, get: function () { return drizzle_js_1.createDrizzleLogger; } });
+Object.defineProperty(exports, "createDrizzleCache", { enumerable: true, get: function () { return drizzle_js_1.createDrizzleCache; } });
+Object.defineProperty(exports, "createDrizzleFootprint", { enumerable: true, get: function () { return drizzle_js_1.createDrizzleFootprint; } });
+var nPlusOne_js_1 = require("./nPlusOne.js");
+Object.defineProperty(exports, "detectNPlusOne", { enumerable: true, get: function () { return nPlusOne_js_1.detectNPlusOne; } });
+Object.defineProperty(exports, "describeNPlusOne", { enumerable: true, get: function () { return nPlusOne_js_1.describeNPlusOne; } });
+Object.defineProperty(exports, "PotentialNPlusOneQuery", { enumerable: true, get: function () { return nPlusOne_js_1.PotentialNPlusOneQuery; } });
+var retryStorm_js_1 = require("./retryStorm.js");
+Object.defineProperty(exports, "detectRetryStorm", { enumerable: true, get: function () { return retryStorm_js_1.detectRetryStorm; } });
+Object.defineProperty(exports, "describeRetryStorm", { enumerable: true, get: function () { return retryStorm_js_1.describeRetryStorm; } });
+Object.defineProperty(exports, "PotentialRetryStorm", { enumerable: true, get: function () { return retryStorm_js_1.PotentialRetryStorm; } });
+var invariantRules_js_1 = require("./invariantRules.js");
+Object.defineProperty(exports, "compileInvariant", { enumerable: true, get: function () { return invariantRules_js_1.compileInvariant; } });
+Object.defineProperty(exports, "evaluateInvariant", { enumerable: true, get: function () { return invariantRules_js_1.evaluateInvariant; } });
+Object.defineProperty(exports, "operationMatchesHook", { enumerable: true, get: function () { return invariantRules_js_1.operationMatchesHook; } });
+Object.defineProperty(exports, "BusinessInvariantViolation", { enumerable: true, get: function () { return invariantRules_js_1.BusinessInvariantViolation; } });
+var rulesPoller_js_1 = require("./rulesPoller.js");
+Object.defineProperty(exports, "RulesPoller", { enumerable: true, get: function () { return rulesPoller_js_1.RulesPoller; } });
+var idempotency_js_1 = require("./idempotency.js");
+Object.defineProperty(exports, "DEFAULT_IDEMPOTENCY_SETTINGS", { enumerable: true, get: function () { return idempotency_js_1.DEFAULT_IDEMPOTENCY_SETTINGS; } });
+Object.defineProperty(exports, "HashMismatchCache", { enumerable: true, get: function () { return idempotency_js_1.HashMismatchCache; } });
+Object.defineProperty(exports, "IdempotencyKeyMismatch", { enumerable: true, get: function () { return idempotency_js_1.IdempotencyKeyMismatch; } });
+Object.defineProperty(exports, "DuplicateReadMismatch", { enumerable: true, get: function () { return idempotency_js_1.DuplicateReadMismatch; } });
+Object.defineProperty(exports, "findIdempotencyKey", { enumerable: true, get: function () { return idempotency_js_1.findIdempotencyKey; } });
+Object.defineProperty(exports, "extractIdentity", { enumerable: true, get: function () { return idempotency_js_1.extractIdentity; } });
+Object.defineProperty(exports, "hashResponseBody", { enumerable: true, get: function () { return idempotency_js_1.hashResponseBody; } });
+var idempotencySettingsPoller_js_1 = require("./idempotencySettingsPoller.js");
+Object.defineProperty(exports, "IdempotencySettingsPoller", { enumerable: true, get: function () { return idempotencySettingsPoller_js_1.IdempotencySettingsPoller; } });
+var invariantInference_js_1 = require("./invariantInference.js");
+Object.defineProperty(exports, "InferenceReporter", { enumerable: true, get: function () { return invariantInference_js_1.InferenceReporter; } });
+var distributionDrift_js_1 = require("./distributionDrift.js");
+Object.defineProperty(exports, "ValueDistributionDrift", { enumerable: true, get: function () { return distributionDrift_js_1.ValueDistributionDrift; } });
+Object.defineProperty(exports, "WriteCountDrift", { enumerable: true, get: function () { return distributionDrift_js_1.WriteCountDrift; } });
+Object.defineProperty(exports, "newWelfordState", { enumerable: true, get: function () { return distributionDrift_js_1.newWelfordState; } });
+Object.defineProperty(exports, "updateWelfordState", { enumerable: true, get: function () { return distributionDrift_js_1.updateWelfordState; } });
+Object.defineProperty(exports, "isDrift", { enumerable: true, get: function () { return distributionDrift_js_1.isDrift; } });
+Object.defineProperty(exports, "extractTopLevelNumericFields", { enumerable: true, get: function () { return distributionDrift_js_1.extractTopLevelNumericFields; } });
+Object.defineProperty(exports, "DistributionDriftReporter", { enumerable: true, get: function () { return distributionDrift_js_1.DistributionDriftReporter; } });
+var distributionBaselinePoller_js_1 = require("./distributionBaselinePoller.js");
+Object.defineProperty(exports, "DistributionBaselinePoller", { enumerable: true, get: function () { return distributionBaselinePoller_js_1.DistributionBaselinePoller; } });
+__exportStar(require("./proto.gen.js"), exports);
+exports.SDK_VERSION = '0.1.0';

package/dist/cjs/invariantInference.js

@@ -0,0 +1,90 @@
+"use strict";
+// Invariant inference, v1 slice: instead of hand-authoring a
+// business-invariant-rule condition tree, passively observe whether a
+// same-named numeric field on a parent row equals the sum of that same
+// field across an already-included to-many relation (Invoice.total vs
+// sum(lineItems.total)) — and report pass/fail counts to the control plane.
+// Once a candidate has been observed enough times at a high enough pass
+// rate, the dashboard offers it as a one-click "confirm" that creates a
+// normal business_invariant_rule — no new evaluation mechanism needed once
+// confirmed, it becomes an ordinary dashboard-authored rule.
+//
+// Deliberately scoped down from the general idea: only the same-field-name
+// shape (not every numeric-field-pair combination, which would be
+// combinatorial and noisy), only `sum` (no `count`), and no dashboard-
+// configurable thresholds yet — see PROGRESS.md for the fuller design this
+// is a first slice of.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InferenceReporter = void 0;
+const httpFetch_js_1 = require("./httpFetch.js");
+const WARN_INTERVAL_MS = 60_000;
+// Reports observation deltas, not cumulative totals — the control plane
+// owns the running (checked_count, held_count) per candidate; the SDK only
+// ever adds to it. That makes a dropped/failed flush harmless to correctness
+// (the next flush's delta is unaffected by a prior one failing) at the cost
+// of only ever undercounting on a genuine send failure, never overcounting.
+class InferenceReporter {
+    counts = new Map();
+    timer = null;
+    lastWarnAt = 0;
+    endpoint;
+    apiKey;
+    flushIntervalMs;
+    constructor(opts) {
+        this.endpoint = opts.endpoint;
+        this.apiKey = opts.apiKey;
+        this.flushIntervalMs = opts.flushIntervalMs ?? 30_000;
+    }
+    start() {
+        this.timer = setInterval(() => void this.flush(), this.flushIntervalMs);
+        if (this.timer.unref)
+            this.timer.unref(); // don't block process exit
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    record(model, field, relation, held) {
+        const key = `${model}\x00${field}\x00${relation}`;
+        let c = this.counts.get(key);
+        if (!c) {
+            c = { model, field, relation, checked: 0, held: 0 };
+            this.counts.set(key, c);
+        }
+        c.checked++;
+        if (held)
+            c.held++;
+    }
+    async flush() {
+        if (this.counts.size === 0)
+            return;
+        const observations = [...this.counts.values()];
+        this.counts.clear();
+        try {
+            const res = await (0, httpFetch_js_1.httpFetch)(this.endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Reprova-Key': this.apiKey,
+                },
+                body: JSON.stringify({ observations }),
+            });
+            if (!res.ok) {
+                this.warnOnce(`reprova: inferred-invariant observation report returned ${res.status}`);
+            }
+        }
+        catch (err) {
+            this.warnOnce(`reprova: inferred-invariant observation report error: ${err.message}`);
+        }
+    }
+    warnOnce(msg) {
+        const now = Date.now();
+        if (now - this.lastWarnAt > WARN_INTERVAL_MS) {
+            this.lastWarnAt = now;
+            console.warn(msg);
+        }
+    }
+}
+exports.InferenceReporter = InferenceReporter;