@warmdrift/kgauto-compiler 2.0.0-alpha.7 → 2.0.0-alpha.71

package/dist/glassbox-routes/index.d.ts

@@ -0,0 +1,191 @@
+import { G as GlassboxEvent } from '../types-B--CYzMo.js';
+import { a as TraceDetail, b as TraceSummary, c as TraceCounterfactual } from '../types-DSeJJ6tt.js';
+export { A as AdvisoryRecord, T as TraceHealth, d as TraceSectionRewrite } from '../types-DSeJJ6tt.js';
+import '../ir-BEQ28muo.js';
+import '../dialect.js';
+
+/**
+ * proxy(req) — Glass-Box replay query handler.
+ *
+ * GET /api/glassbox/proxy?traceId=<id>   → single compile_outcomes row for trace
+ * GET /api/glassbox/proxy?limit=<N>      → N most-recent compile_outcomes rows
+ * GET /api/glassbox/proxy                → defaults to limit=20
+ *
+ * Brain reads go through PostgREST on Supabase. We always filter by
+ * `app_id=eq.<appId>` even though the scoped JWT's RLS policy already
+ * enforces tenant isolation — the explicit filter trims the network payload
+ * and makes the query intent obvious to anyone reading logs.
+ *
+ * Scrub: the optional `scrub` hook runs on each row before responding so
+ * sensitive payloads (rendered prompts, tool calls) can be redacted at the
+ * proxy boundary. Default is identity (no-op).
+ */
+
+/**
+ * Typed boundary transformer: compile_outcomes row (snake_case, Postgres
+ * native) → TraceSummary (camelCase, TypeScript native + extension wire
+ * contract). Single canonical mapping site — every DB-shape ↔ wire-shape
+ * crossing routes through here so renderer-expected fields can't silently
+ * go missing. See `feedback_typed_boundary_transformers.md` for the rule.
+ */
+declare function rowToSummary(row: Record<string, unknown>): TraceSummary;
+/**
+ * Typed boundary transformer (L-118): compile_outcomes row → TraceDetail.
+ * Single canonical mapping site for the detail-view wire contract. Pre-018
+ * brain rows return NULL for the new columns; this transformer applies
+ * type-safe defaults (0 for token columns, undefined for optional strings)
+ * so the renderer never crashes on missing fields.
+ *
+ * alpha.28 extends the field set per the renderer design contract — every
+ * extended field has a default. The `counterfactuals` + `projectedDailyCost`
+ * fields are populated by the proxy AFTER this transformer runs (they need
+ * profile lookup / brain query / async I/O).
+ */
+declare function rowToDetail(row: Record<string, unknown>): TraceDetail;
+
+/**
+ * computeCounterfactuals — for a served trace, compute up to 2 cheaper
+ * alternatives that ALSO meet the archetype quality floor.
+ *
+ * Pure function. Called at detail-view time by the proxy's `rowToDetail`
+ * path. The cost-equivalent answer to "what could this have run on without
+ * tanking quality?" lets the Glass-Box render `💰 Cheaper alternatives` so a
+ * founder sees the actual cost of the routing choice rather than just the
+ * served cost.
+ *
+ * Mechanism (per design contract Phase 0 spec):
+ *   1. Walk the archetype's full default fallback chain.
+ *   2. For each model in the chain (excluding the served model):
+ *      - Skip if archetypePerf[archetype] < ARCHETYPE_FLOOR_DEFAULT (6).
+ *        Matches the cliff-advisor work — never recommend a swap that
+ *        violates the quality floor. (Composition with Builder C is
+ *        intentional.)
+ *      - Skip if profile missing.
+ *      - Compute estimated cost at the OBSERVED token counts:
+ *          non_cached_in = tokensIn - cacheReadInputTokens
+ *          cost = (non_cached_in / 1e6) * profile.costInputPer1m
+ *               + (cacheable_in   / 1e6) * profile.costInputPer1m
+ *                                       * profile.lowering.cache.discount
+ *               + (tokensOut      / 1e6) * profile.costOutputPer1m
+ *      - Only include if estimatedCostUsd ≤ 0.9 × servedCostUsd
+ *        (≥10% cheaper — below that's noise of token-count estimation).
+ *   3. Sort cheapest first.
+ *   4. Cap to top 2.
+ *
+ * Edge cases:
+ *   - tokensIn === 0 → return [] (can't meaningfully estimate).
+ *   - servedCostUsd === 0 → return [] (no baseline to beat).
+ *   - Zero matching alternatives → return [] (renderer hides the card).
+ *   - Served model isn't in the chain (e.g. forceModel'd off-chain) → use
+ *     the chain for the archetype anyway.
+ */
+
+/** Only surface swaps that save at least 10% vs. served. */
+declare const COUNTERFACTUAL_MIN_SAVINGS_RATIO = 0.1;
+/** Cap on alternatives surfaced per trace. */
+declare const COUNTERFACTUAL_MAX_RESULTS = 2;
+interface ComputeCounterfactualsArgs {
+    servedModel: string;
+    servedCostUsd: number;
+    archetype: string;
+    tokensIn: number;
+    tokensOut: number;
+    /** Defaults to 0 when caller doesn't know. */
+    cacheReadInputTokens?: number;
+    /** Reserved for future per-mode chain selection. */
+    toolOrchestration?: 'parallel' | 'sequential' | 'either';
+}
+declare function computeCounterfactuals(args: ComputeCounterfactualsArgs): TraceCounterfactual[];
+
+/**
+ * Public entry point for `@warmdrift/kgauto-compiler/glassbox-routes`.
+ *
+ * One factory call from a Vercel Edge consumer route handler gets you both
+ * the replay-query (`proxy`) and live-SSE (`stream`) endpoints that the
+ * Glass-Box Chrome panel reads. Wiring is ~6 lines per app:
+ *
+ *   // app/api/glassbox/proxy/route.ts
+ *   import { createGlassboxRoutes } from '@warmdrift/kgauto-compiler/glassbox-routes';
+ *   const { proxy } = createGlassboxRoutes({
+ *     installToken:  process.env.GLASSBOX_INSTALL_TOKEN!,
+ *     extensionId:   process.env.GLASSBOX_EXTENSION_ID!,
+ *     brainEndpoint: process.env.GLASSBOX_BRAIN_ENDPOINT!,
+ *     brainJwt:      process.env.GLASSBOX_BRAIN_JWT!,      // scoped JWT (RLS via app_id claim)
+ *     brainAnonKey:  process.env.GLASSBOX_BRAIN_ANON_KEY!, // project anon/publishable key (Supabase apikey header)
+ *     appId:         'playbacksam',
+ *   });
+ *   export { proxy as GET };
+ *
+ * Auth model (defense in depth):
+ *   - Bearer install token   → primary, constant-time compared
+ *   - chrome-extension Origin → secondary CSRF gate
+ *
+ * Scrub: optional sanitization runs at the proxy boundary before events or
+ * rows leave the consumer's infrastructure. Per pii-scrubber-call-site-not-
+ * package: kgauto stays naive to PII policy; consumers pass scrub hooks
+ * that encode their own data-handling rules.
+ *
+ * Brain reads use the scoped JWT minted via migration 013. RLS enforces
+ * `app_id = jwt.claim.app_id`; the proxy filter is belt-and-suspenders for
+ * payload size + log legibility.
+ */
+
+interface GlassboxRoutesConfig {
+    /** Bearer token validated on every request via constant-time compare. Required. */
+    installToken: string;
+    /** chrome-extension://<id> — exact match required on Origin header. Required. */
+    extensionId: string;
+    /** Brain endpoint base (e.g. https://kgauto-brain.supabase.co). Used by `proxy` for replay queries. */
+    brainEndpoint: string;
+    /** Scoped JWT for brain reads. Use the per-consumer JWT minted via migration 013 (claim: app_id). Drives RLS via the `app_id` claim; sent as `Authorization: Bearer <jwt>` only. */
+    brainJwt: string;
+    /**
+     * Anon/publishable key for the Supabase `apikey` header. Supabase requires
+     * `apikey` to be one of the project's known keys (anon or service_role) —
+     * the scoped JWT in `brainJwt` doesn't qualify there. Pass the project's
+     * legacy `anon` key (JWT format, role=anon) or the modern `sb_publishable_...`
+     * key. Safe to expose at the wire (that's what "publishable" means).
+     *
+     * Pre-alpha.24 this was missing and `brainJwt` was used as apikey too — first
+     * real call always 401'd against real Supabase. Catching this required a
+     * pre-publish smoke against the real brain; unit tests with mocked fetch
+     * couldn't surface it. See L-117 in command-center/learnings.md.
+     */
+    brainAnonKey: string;
+    /** App scope filter — must match the JWT's app_id claim. */
+    appId: string;
+    /**
+     * Optional sanitization hook. Called with each event/trace BEFORE it leaves the consumer.
+     * Default: identity (no scrub). PII policy lives at the call-site, not in the package.
+     */
+    scrub?: (event: GlassboxEvent | Record<string, unknown>) => GlassboxEvent | Record<string, unknown>;
+    /**
+     * Test-only seam: override the brain fetch implementation. Production
+     * code never sets this; tests use it to mock PostgREST responses.
+     */
+    fetch?: typeof fetch;
+    /**
+     * Test-only seam: override the per-trace live-stream subscriber. Production
+     * code resolves to the alpha.17 `subscribe()` export; tests inject a fake
+     * source ReadableStream<GlassboxEvent>.
+     */
+    subscribe?: (traceId: string) => ReadableStream<GlassboxEvent>;
+    /**
+     * Test-only seam: override the per-app "tail-all" subscriber (alpha.26).
+     * Production code resolves to the `subscribeApp()` export; tests inject
+     * a fake source. Backs the extension's default Live tab mode when no
+     * traceId is supplied in the URL.
+     */
+    subscribeApp?: (args: {
+        appId: string;
+    }) => ReadableStream<GlassboxEvent>;
+}
+interface GlassboxRoutes {
+    /** GET /api/glassbox/proxy?traceId=<id>  OR  ?limit=20 (recent traces) */
+    proxy: (req: Request) => Promise<Response>;
+    /** GET /api/glassbox/stream?traceId=<id>  (SSE) */
+    stream: (req: Request) => Promise<Response>;
+}
+declare function createGlassboxRoutes(config: GlassboxRoutesConfig): GlassboxRoutes;
+
+export { COUNTERFACTUAL_MAX_RESULTS, COUNTERFACTUAL_MIN_SAVINGS_RATIO, type ComputeCounterfactualsArgs, type GlassboxRoutes, type GlassboxRoutesConfig, TraceCounterfactual, TraceDetail, TraceSummary, computeCounterfactuals, createGlassboxRoutes, rowToDetail, rowToSummary };