@reprova/sdk 0.5.0 → 0.6.1

package/README.md

@@ -95,6 +95,39 @@ it ever reaches the captured bug — `repro run` reports `DIFFERENT FAILURE`
 instead of reproducing the original error. `setAuthClaims` is a no-op
 outside a Reprova request context, so it's safe to call unconditionally.
 
+## Framework adapters (auth claims + migration_id for anything else)
+
+`setAuthClaims` (above) and `sdk.setMigrationId` cover apps that can call
+something from inside their own request/startup code. Some frameworks
+resolve both through their own machinery instead — a DI container, a
+non-Express request shape — with no single call site to hook. One call
+covers both at once:
+
+```ts
+const sdk = Reprova.init({ dsn: process.env.REPROVA_DSN, release: gitSha });
+
+sdk.registerFrameworkAdapter({
+  // Return undefined (not {}) to fall back to the built-in req.auth/req.user
+  // check instead of claiming "no auth" — useful if your framework only
+  // sometimes populates its own property.
+  extractAuthClaims: (rawRequest) => {
+    const req = rawRequest as { auth_context?: Record<string, unknown> };
+    return req.auth_context; // e.g. Medusa's own auth context
+  },
+  // Called once at registration — re-register (or call sdk.setMigrationId
+  // directly) if it can change during the process's lifetime.
+  resolveMigrationId: async () => {
+    const row = await db.query('SELECT name FROM my_migrations_table ORDER BY applied_at DESC LIMIT 1');
+    return row?.name ?? 'unknown';
+  },
+});
+```
+
+Both fields are optional independently — supply only the one your framework
+needs. Neither ever throws into request handling: `extractAuthClaims`
+falls back to `req.auth ?? req.user` on error or `undefined`, and a
+rejected `resolveMigrationId` just leaves `migration_id` as `'unknown'`.
+
 ## Prisma (optional enrichment — automatic footprints)
 
 One call wires both automatic footprints and `migration_id`:
@@ -229,6 +262,48 @@ exported individually — pass the SAME logger instance to `createDrizzleCache`
 to get the merge behavior; omit it to run the cache standalone (exact
 SELECT PKs, no `where_shape`, no write coverage).
 
+## N+1 query detection (automatic once any ORM adapter above is wired up)
+
+Every adapter above feeds the same per-request footprint (one entry per
+query call). The SDK watches that footprint on every response — success or
+failure — for the same `(model, operation)` shape executed repeatedly as
+separate calls in one request: a `for` loop firing one `findUnique` per
+item instead of a single batched query. No exception, no 5xx — the request
+usually returns 200 while doing far more DB round-trips than it should,
+which is exactly the case nothing else here catches.
+
+```ts
+const sdk = Reprova.init({ dsn: process.env.REPROVA_DSN, release: gitSha, n1Threshold: 5 });
+```
+
+`n1Threshold` (default `5`) is how many times the same shape has to repeat
+in one request before it's flagged; `0` disables detection entirely. It
+can't mistake one efficient query for N+1: an `include`/join produces
+exactly one footprint entry per relation regardless of how many rows it
+returns, so only genuinely separate calls count.
+
+## Retry storm detection (automatic — no wiring needed)
+
+Every outbound `fetch()` call is already recorded per request (host,
+method, path, status, outcome — used for outbound-call replay). The SDK
+watches those calls, on every response, for the same `(host, method, path)`
+called repeatedly with at least one failure among the attempts — a naive
+retry loop hammering an already-struggling dependency instead of backing
+off. Repetition alone isn't enough to flag: calling the same endpoint
+several times and getting `200` every time is normal pagination or batch
+fetching, not a storm — only repeats that include a failure (a `5xx`, or a
+network error/timeout) count.
+
+```ts
+const sdk = Reprova.init({ dsn: process.env.REPROVA_DSN, release: gitSha, retryStormThreshold: 3 });
+```
+
+`retryStormThreshold` (default `3`, lower than `n1Threshold`'s `5` since
+real backoff configs commonly cap around 3 attempts) is how many calls to
+the same target it takes before a repeat-with-failures is flagged; `0`
+disables it. The query string is stripped before grouping, since a real
+retry commonly varies a request id or cache-busting param per attempt.
+
 ## NestJS (optional enrichment — original stacks + replay parity)
 
 Nest's exception layer catches thrown errors before Express error middleware

package/dist/cjs/context.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.contextStorage = void 0;
+exports.currentContext = currentContext;
+exports.setAuthClaims = setAuthClaims;
+const async_hooks_1 = require("async_hooks");
+exports.contextStorage = new async_hooks_1.AsyncLocalStorage();
+function currentContext() {
+    return exports.contextStorage.getStore();
+}
+/**
+ * Explicitly records the authenticated identity for the in-flight request.
+ * Auto-detection already covers `req.auth` (express-oauth2-jwt-bearer/Auth0)
+ * and `req.user` (Passport and most hand-rolled Express JWT middleware) —
+ * see detectAuthClaims in sdk.ts — so most apps need zero code changes. This
+ * is the escape hatch for anything else: a custom property, a non-Express
+ * framework. Call it from inside your own auth middleware once the token is
+ * verified, e.g. `setAuthClaims(decoded)` right after `jwt.verify`. Without
+ * captured claims one way or the other, replay has nothing to re-sign into a
+ * token and the app bounces the replayed request as unauthenticated before
+ * it ever reaches the captured bug. No-ops outside a Reprova request
+ * context.
+ */
+function setAuthClaims(claims) {
+    const ctx = currentContext();
+    if (ctx)
+        ctx.request.authClaims = claims;
+}

package/dist/cjs/distributionBaselinePoller.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DistributionBaselinePoller = void 0;
+const httpFetch_js_1 = require("./httpFetch.js");
+const WARN_INTERVAL_MS = 60_000;
+// Same start()/stop()/setInterval+unref shape as RulesPoller and
+// IdempotencySettingsPoller — periodically fetches the tenant's current
+// aggregate baselines (and the drift-detection on/off toggle) so a running
+// process can check each response against a live baseline without a
+// redeploy, and so drift detection stays off by default until an admin
+// opts in from the dashboard. Falls back to disabled + no baselines before
+// the first successful poll and on any failure, so a bad response or an
+// unreachable control plane fails closed (no captures), not open (spurious
+// captures from a stale or empty baseline).
+class DistributionBaselinePoller {
+    enabled = false;
+    baselines = new Map();
+    timer = null;
+    lastWarnAt = 0;
+    endpoint;
+    apiKey;
+    intervalMs;
+    constructor(opts) {
+        this.endpoint = opts.endpoint;
+        this.apiKey = opts.apiKey;
+        this.intervalMs = opts.intervalMs ?? 60_000;
+    }
+    start() {
+        void this.refresh();
+        this.timer = setInterval(() => void this.refresh(), this.intervalMs);
+        if (this.timer.unref)
+            this.timer.unref();
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    isEnabled() {
+        return this.enabled;
+    }
+    getBaseline(route, field) {
+        return this.baselines.get(`${route}\x00${field}`);
+    }
+    async refresh() {
+        try {
+            const res = await (0, httpFetch_js_1.httpFetch)(this.endpoint, {
+                headers: { 'X-Reprova-Key': this.apiKey },
+            });
+            if (!res.ok) {
+                this.warnOnce(`reprova: distribution baselines fetch returned ${res.status}`);
+                return;
+            }
+            const body = (await res.json());
+            this.applyResponse(body);
+        }
+        catch (err) {
+            this.warnOnce(`reprova: distribution baselines fetch error: ${err.message}`);
+        }
+    }
+    // Applies an already-fetched response directly, with no network call —
+    // used by replay mode to seed a one-time snapshot the CLI fetched ahead of
+    // time (there's no live control plane to poll from inside a replayed
+    // app), so drift detection (checkDistributionDriftIfAny/
+    // captureWriteCountDriftIfAny in sdk.ts) sees exactly the same shape it
+    // would from a real refresh().
+    seed(body) {
+        this.applyResponse(body);
+    }
+    applyResponse(body) {
+        this.enabled = body.enabled ?? false;
+        const next = new Map();
+        for (const b of body.baselines ?? []) {
+            next.set(`${b.route}\x00${b.field}`, { sampleCount: b.sample_count, mean: b.mean, stddev: b.stddev });
+        }
+        this.baselines = next;
+    }
+    warnOnce(msg) {
+        const now = Date.now();
+        if (now - this.lastWarnAt > WARN_INTERVAL_MS) {
+            this.lastWarnAt = now;
+            console.warn(msg);
+        }
+    }
+}
+exports.DistributionBaselinePoller = DistributionBaselinePoller;

package/dist/cjs/distributionDrift.js

@@ -0,0 +1,170 @@
+"use strict";
+// Distributional drift, numeric-only v1 slice: baseline the typical range
+// of a numeric response field per (route, field) using Welford's online
+// mean/variance algorithm, and flag a value that's implausibly far from
+// that baseline — a `total` field that's normally 10-500 suddenly
+// returning -40, with no rule authored and no equality asserted anywhere.
+// Unlike business-invariant-rules and idempotency-key matching, this is a
+// statistical guess with real false-positive risk (there's no
+// "asymptotically safe" case the way an app-asserted equality is), so it's
+// off by default and the thresholds below are fixed, not yet
+// tenant-configurable.
+//
+// Deliberately scoped to numeric fields only for this slice — categorical
+// novelty (a status enum emitting a never-seen value) is a structurally
+// different mechanism (tracking a bounded set of distinct values, not a
+// running mean/variance) and is left for a later slice.
+//
+// Observes the top-level fields of a JSON object response body only — not
+// nested objects/arrays, and not array-shaped top-level responses (a list
+// endpoint's items each have their own values; there's no single baseline
+// for "the array"). That keeps the walk trivial and the key space bounded
+// to (route, field) instead of an unbounded set of JSON paths.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DistributionDriftReporter = exports.WriteCountDrift = exports.ValueDistributionDrift = void 0;
+exports.newWelfordState = newWelfordState;
+exports.updateWelfordState = updateWelfordState;
+exports.isDrift = isDrift;
+exports.extractTopLevelNumericFields = extractTopLevelNumericFields;
+const httpFetch_js_1 = require("./httpFetch.js");
+const MIN_SAMPLES = 200;
+const SIGMA_MULTIPLIER = 6;
+class ValueDistributionDrift extends Error {
+}
+exports.ValueDistributionDrift = ValueDistributionDrift;
+// Same mean/variance mechanism, same MIN_SAMPLES/SIGMA_MULTIPLIER thresholds,
+// entirely different observation site: prisma.ts's observeWriteCountDrift
+// baselines a Prisma updateMany/deleteMany/createMany's affected-row count
+// per (route, operation:model) instead of an HTTP response field's value. Shares
+// WelfordState/updateWelfordState/isDrift directly — the math doesn't care
+// what number it's baselining — and DistributionDriftReporter/
+// DistributionBaselinePoller are already fully generic (record/getBaseline
+// take arbitrary string keys), so a second instance of each, pointed at a
+// separate control-plane endpoint, is all that's needed there too. Kept as
+// a distinct Error class/trigger since it's a conceptually separate
+// question ("did this write touch a weird number of rows" vs. "is this
+// response value weird") with its own independent dashboard toggle.
+class WriteCountDrift extends Error {
+}
+exports.WriteCountDrift = WriteCountDrift;
+function newWelfordState() {
+    return { count: 0, mean: 0, m2: 0, min: Infinity, max: -Infinity };
+}
+// Standard single-pass Welford update — mean and M2 (sum of squared
+// deviations from the running mean) stay numerically stable across an
+// unbounded stream, unlike naively accumulating sum/sum-of-squares.
+function updateWelfordState(state, x) {
+    state.count++;
+    const delta = x - state.mean;
+    state.mean += delta / state.count;
+    const delta2 = x - state.mean;
+    state.m2 += delta * delta2;
+    if (x < state.min)
+        state.min = x;
+    if (x > state.max)
+        state.max = x;
+}
+// A value is drift when the baseline has enough samples to trust AND the
+// value is more than SIGMA_MULTIPLIER standard deviations from the mean.
+// A zero-variance baseline (every sample identical so far) treats ANY
+// different value as infinite deviation — flagged, since after MIN_SAMPLES
+// consistent observations a field that never varied suddenly doing so is
+// exactly the kind of thing worth surfacing, not a numerical edge case to
+// special-case away.
+function isDrift(value, baseline) {
+    if (baseline.sampleCount < MIN_SAMPLES)
+        return false;
+    const deviation = baseline.stddev === 0 ? (value !== baseline.mean ? Infinity : 0) : Math.abs(value - baseline.mean) / baseline.stddev;
+    return deviation > SIGMA_MULTIPLIER;
+}
+// Extracts finite numeric values from the response body's OWN top-level
+// keys — null/NaN/Infinity are skipped (not a "value", nothing to
+// baseline), and a non-object or array body yields nothing (see module doc
+// for why array-shaped top-level responses are out of scope for this slice).
+function extractTopLevelNumericFields(body) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return {};
+    const out = {};
+    for (const [k, v] of Object.entries(body)) {
+        if (typeof v === 'number' && Number.isFinite(v))
+            out[k] = v;
+    }
+    return out;
+}
+const WARN_INTERVAL_MS = 60_000;
+// Accumulates local Welford state per (route, field) since the last flush
+// and periodically reports it as a delta — same start/stop/periodic-flush
+// shape as BatchTransport/InferenceReporter. The control plane merges each
+// report into the tenant's cumulative baseline via the parallel-variance
+// formula; a dropped/failed flush only ever loses that batch's
+// contribution (undercounts), never double-reports on retry, since there
+// is no retry — same trade-off every other reporter in this SDK already
+// makes.
+class DistributionDriftReporter {
+    states = new Map();
+    timer = null;
+    lastWarnAt = 0;
+    endpoint;
+    apiKey;
+    flushIntervalMs;
+    constructor(opts) {
+        this.endpoint = opts.endpoint;
+        this.apiKey = opts.apiKey;
+        this.flushIntervalMs = opts.flushIntervalMs ?? 30_000;
+    }
+    start() {
+        this.timer = setInterval(() => void this.flush(), this.flushIntervalMs);
+        if (this.timer.unref)
+            this.timer.unref();
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    record(route, field, value) {
+        const key = `${route}\x00${field}`;
+        let entry = this.states.get(key);
+        if (!entry) {
+            entry = { route, field, state: newWelfordState() };
+            this.states.set(key, entry);
+        }
+        updateWelfordState(entry.state, value);
+    }
+    async flush() {
+        if (this.states.size === 0)
+            return;
+        const observations = [...this.states.values()].map(({ route, field, state }) => ({
+            route,
+            field,
+            count: state.count,
+            mean: state.mean,
+            m2: state.m2,
+            min: state.min,
+            max: state.max,
+        }));
+        this.states.clear();
+        try {
+            const res = await (0, httpFetch_js_1.httpFetch)(this.endpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'X-Reprova-Key': this.apiKey },
+                body: JSON.stringify({ observations }),
+            });
+            if (!res.ok) {
+                this.warnOnce(`reprova: distribution baseline report returned ${res.status}`);
+            }
+        }
+        catch (err) {
+            this.warnOnce(`reprova: distribution baseline report error: ${err.message}`);
+        }
+    }
+    warnOnce(msg) {
+        const now = Date.now();
+        if (now - this.lastWarnAt > WARN_INTERVAL_MS) {
+            this.lastWarnAt = now;
+            console.warn(msg);
+        }
+    }
+}
+exports.DistributionDriftReporter = DistributionDriftReporter;

package/dist/cjs/drizzle.js

@@ -0,0 +1,204 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDrizzleLogger = createDrizzleLogger;
+exports.createDrizzleCache = createDrizzleCache;
+exports.createDrizzleFootprint = createDrizzleFootprint;
+const node_crypto_1 = require("node:crypto");
+const context_js_1 = require("./context.js");
+const OP_BY_KEYWORD = {
+    select: 'select',
+    insert: 'insert',
+    update: 'update',
+    delete: 'delete',
+};
+// First SQL keyword → operation.
+function opOf(sql) {
+    const m = /^\s*(select|insert|update|delete)\b/i.exec(sql);
+    return m ? OP_BY_KEYWORD[m[1].toLowerCase()] : undefined;
+}
+// The principal table, from the op-appropriate clause.
+function tableOf(sql, op) {
+    let m = null;
+    if (op === 'select' || op === 'delete')
+        m = /\bfrom\s+"?([A-Za-z0-9_]+)"?/i.exec(sql);
+    else if (op === 'insert')
+        m = /\binto\s+"?([A-Za-z0-9_]+)"?/i.exec(sql);
+    else if (op === 'update')
+        m = /\bupdate\s+"?([A-Za-z0-9_]+)"?/i.exec(sql);
+    return m ? m[1] : undefined;
+}
+// Column names referenced in the WHERE clause — the right-hand identifier of
+// each `"table"."col"` (or a bare `"col"`). Names only; values are `?`.
+function whereColumns(sql) {
+    const wIdx = sql.search(/\bwhere\b/i);
+    if (wIdx < 0)
+        return [];
+    const tail = sql.slice(wIdx + 5);
+    const cols = new Set();
+    const re = /"([A-Za-z0-9_]+)"(?:\s*\.\s*"([A-Za-z0-9_]+)")?/g;
+    let m;
+    while ((m = re.exec(tail)) !== null)
+        cols.add(m[2] ?? m[1]);
+    return [...cols].sort();
+}
+function extractPks(rows, pkCols) {
+    if (pkCols.length === 0)
+        return [];
+    const seen = new Set();
+    const pks = [];
+    for (const row of rows) {
+        const vals = pkCols.map((c) => row[c]);
+        if (vals.some((v) => v === undefined))
+            continue; // column not selected — can't form a PK
+        const pk = vals.map((v) => String(v)).join(':');
+        if (!seen.has(pk)) {
+            seen.add(pk);
+            pks.push(pk);
+        }
+    }
+    return pks;
+}
+// Drizzle's own cache key: SHA-256(sql + '-' + JSON.stringify(params)) — see
+// drizzle-orm/cache/core/cache.js. Reimplemented (not imported) so a query's
+// hash computed here from `logger.logQuery`'s (sql, params) matches the hash
+// Drizzle later passes to `cache.put()` for the SAME query, letting the two
+// hooks correlate without ever importing 'drizzle-orm'.
+// Node's own crypto module (not WebCrypto's `crypto.subtle`, which only
+// became a stable global in Node 19+) — createHash has existed since
+// Node's earliest crypto module, so this works on any Node version this
+// SDK targets. Stays async (a plain value from an async function resolves
+// immediately) so callers don't need to change.
+async function hashQuery(sql, params) {
+    const data = `${sql}-${JSON.stringify(params)}`;
+    return (0, node_crypto_1.createHash)('sha256').update(data).digest('hex');
+}
+// A pending SELECT footprint entry, keyed by query hash, waiting to be
+// upgraded by a paired cache's put(). Linked to its logger via WeakMap so the
+// map is GC'd along with the logger if the app never pairs a cache to it.
+const pendingByLogger = new WeakMap();
+// Creates a Drizzle-compatible logger that records footprints.
+// Usage: drizzle(client, { logger: createDrizzleLogger() })
+function createDrizzleLogger(opts = {}) {
+    const captureWhereShape = opts.captureWhereShape !== false;
+    const forward = opts.forward;
+    const pending = new Map();
+    const logger = {
+        logQuery(query, params) {
+            try {
+                const ctx = context_js_1.contextStorage.getStore();
+                if (ctx) {
+                    const op = opOf(query);
+                    const table = op ? tableOf(query, op) : undefined;
+                    if (op && table) {
+                        const where = captureWhereShape ? whereColumns(query).join(',') || undefined : undefined;
+                        const entry = {
+                            model: table,
+                            op,
+                            pks: [],
+                            where_shape: where,
+                            count: 0,
+                            note: 'drizzle: shape-only (no result access — PKs/count unavailable)',
+                            resolved: true,
+                        };
+                        ctx.footprint.push(entry);
+                        // A paired cache can upgrade this SAME entry once the real rows
+                        // are known — see createDrizzleCache(). Mutations get nothing
+                        // more from Drizzle's cache hook, so they stay as pushed above.
+                        if (op === 'select') {
+                            hashQuery(query, params)
+                                .then((h) => pending.set(h, entry))
+                                .catch(() => { });
+                        }
+                    }
+                }
+            }
+            catch { /* never break a query */ }
+            try {
+                forward?.logQuery(query, params);
+            }
+            catch { /* ignore */ }
+        },
+    };
+    pendingByLogger.set(logger, pending);
+    return logger;
+}
+// node-postgres (`pg`) QueryResult vs. mysql2's `[rows, fields]` tuple — the
+// two response shapes `cache.put()` actually sees for Reprova's two real
+// customer-database dialects (Postgres, MySQL; see agent/internal/dialect).
+// Unrecognized shapes degrade to "no rows found" rather than guessing.
+function rowsFromResponse(response) {
+    if (Array.isArray(response)) {
+        const [rows] = response; // mysql2: client.query() resolves [rows, fields]
+        return Array.isArray(rows) ? rows : undefined;
+    }
+    const rows = response?.rows;
+    return Array.isArray(rows) ? rows : undefined;
+}
+// Creates a Drizzle Cache that observes (never serves) query results to
+// upgrade SELECT footprints with exact primary keys and row counts.
+// Usage: drizzle(client, { cache: createDrizzleCache({ logger }) })
+function createDrizzleCache(opts = {}) {
+    const primaryKey = opts.primaryKey ?? (() => ['id']);
+    const pending = opts.logger ? pendingByLogger.get(opts.logger) : undefined;
+    return {
+        // 'all' — every SELECT is observed automatically; apps never need to
+        // call Drizzle's own `.$withCache()` for this to work.
+        strategy() {
+            return 'all';
+        },
+        // Always a miss: this cache exists to OBSERVE results, never to REPLACE a
+        // real query with a stale one.
+        async get() {
+            return undefined;
+        },
+        async put(hashedQuery, response, tables) {
+            try {
+                if (!tables || tables.length === 0)
+                    return;
+                const rows = rowsFromResponse(response);
+                if (!rows)
+                    return;
+                const primary = tables[0];
+                const pks = extractPks(rows, primaryKey(primary));
+                const count = rows.length;
+                const note = count === 0 ? 'returned 0 rows' : undefined;
+                const linked = pending?.get(hashedQuery);
+                const ctx = context_js_1.contextStorage.getStore();
+                if (linked) {
+                    pending.delete(hashedQuery);
+                    linked.model = primary;
+                    linked.pks = pks;
+                    linked.count = count;
+                    linked.note = note;
+                }
+                else if (ctx) {
+                    ctx.footprint.push({ model: primary, op: 'select', pks, count, note, resolved: true });
+                }
+                // Joined/subquery tables: recorded as referenced, without PKs — same
+                // convention as the Kysely adapter (result columns can't be reliably
+                // attributed to a joined table's own primary key).
+                if (ctx) {
+                    for (const t of tables.slice(1)) {
+                        ctx.footprint.push({ model: t, op: 'select', pks: [], count: 0, note: 'referenced (join/subquery)', resolved: true });
+                    }
+                }
+            }
+            catch { /* never break a query */ }
+        },
+        // Drizzle's mutation hook gets table names only — no rows, no count, and
+        // it races the real query (Promise.all internally). Nothing usable to
+        // record here; mutations are already captured (shape-only) by the paired
+        // logger.
+        async onMutate() { },
+    };
+}
+// Convenience: builds a linked logger+cache pair in one call, the
+// recommended way to get exact SELECT pks/count without double-counting.
+// Usage:
+//   const { logger, cache } = createDrizzleFootprint();
+//   const db = drizzle(client, { logger, cache });
+function createDrizzleFootprint(opts = {}) {
+    const logger = createDrizzleLogger({ captureWhereShape: opts.captureWhereShape });
+    const cache = createDrizzleCache({ primaryKey: opts.primaryKey, logger });
+    return { logger, cache };
+}

package/dist/cjs/frameworkAdapter.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/httpFetch.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.httpFetch = httpFetch;
+const node_http_1 = __importDefault(require("node:http"));
+const node_https_1 = __importDefault(require("node:https"));
+// Node 18+ ships a global fetch; older Node (found live: Node 14, still a
+// real LTS for legacy apps) has none at all. node-fetch isn't a safe
+// replacement here — v3+ is ESM-only, the exact same require(ESM) trap
+// @marcbachmann/cel-js caused (see invariantRules.ts's own doc comment on
+// loadEnv). Every internal caller in this SDK only ever needs a small,
+// stable subset of the Fetch API (GET/POST, headers, a string body,
+// .ok/.status/.json()/.text()), so this implements just that on top of
+// Node's own always-available http/https modules, and delegates to a real
+// global fetch when one exists (the common case — zero overhead, zero
+// behavior change on any Node version that already has one).
+function httpFetch(url, init) {
+    const globalFetch = globalThis.fetch;
+    if (typeof globalFetch === 'function') {
+        return globalFetch(url, init);
+    }
+    return new Promise((resolve, reject) => {
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch (err) {
+            reject(err);
+            return;
+        }
+        const lib = parsed.protocol === 'https:' ? node_https_1.default : node_http_1.default;
+        const req = lib.request({
+            hostname: parsed.hostname,
+            port: parsed.port || undefined,
+            path: `${parsed.pathname}${parsed.search}`,
+            method: init?.method ?? 'GET',
+            headers: init?.headers,
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (chunk) => chunks.push(chunk));
+            res.on('end', () => {
+                const text = Buffer.concat(chunks).toString('utf8');
+                const status = res.statusCode ?? 0;
+                resolve({
+                    ok: status >= 200 && status < 300,
+                    status,
+                    json: async () => JSON.parse(text),
+                    text: async () => text,
+                });
+            });
+        });
+        req.on('error', reject);
+        if (init?.body)
+            req.write(init.body);
+        req.end();
+    });
+}