prisma-schema-auditor 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 EddieRydell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,62 @@
+# prisma-schema-auditor
+
+Static analysis for Prisma schemas: deterministic constraint contracts + normalization lint findings (1NF/2NF; 3NF+ via invariants).
+
+## Install
+
+```bash
+npm install --save-dev prisma-schema-auditor
+```
+
+## Usage
+
+### CLI
+
+```bash
+# Analyze default prisma/schema.prisma
+npx prisma-schema-auditor
+
+# Specify schema path and output format
+npx prisma-schema-auditor --schema ./prisma/schema.prisma --format text
+
+# Write JSON output to file
+npx prisma-schema-auditor --out audit.json --pretty
+
+# Fail CI on warnings or errors
+npx prisma-schema-auditor --fail-on warning
+```
+
+### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--schema <path>` | Path to Prisma schema file | `prisma/schema.prisma` |
+| `--invariants <path>` | Path to invariants file (JSON) | - |
+| `--format <fmt>` | Output format: `json` or `text` | `json` |
+| `--out <path>` | Write output to file | stdout |
+| `--fail-on <severity>` | Exit 1 if findings at severity or above | - |
+| `--no-timestamp` | Omit timestamp from output | `false` |
+| `--pretty` | Pretty-print JSON output | `false` |
+
+### Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | OK |
+| 1 | Findings at or above `--fail-on` threshold |
+| 2 | CLI usage error |
+| 3 | Schema parse error |
+
+### Programmatic API
+
+```typescript
+import { audit } from 'prisma-schema-auditor';
+
+const result = await audit('prisma/schema.prisma');
+console.log(result.contract);   // Constraint contract
+console.log(result.findings);   // Normalization findings
+```
+
+## License
+
+MIT

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function main(argv?: string[]): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAkCA,wBAAsB,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAmH3D"}

package/dist/cli.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { resolve } from 'node:path';
+import { existsSync, writeFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { audit } from './index.js';
+import { toJson } from './core/report/toJson.js';
+import { toText } from './core/report/toText.js';
+/** Exit codes. */
+const EXIT_OK = 0;
+const EXIT_ISSUES = 1;
+const EXIT_CLI_ERROR = 2;
+const EXIT_PARSE_ERROR = 3;
+function printUsage() {
+    process.stdout.write(`Usage: prisma-schema-auditor [options]
+
+Options:
+  --schema <path>       Path to Prisma schema file (default: prisma/schema.prisma)
+  --invariants <path>   Path to invariants file (JSON)
+  --format <fmt>        Output format: json | text (default: json)
+  --out <path>          Write output to file instead of stdout
+  --fail-on <severity>  Exit 1 if findings at this severity or above: error | warning | info
+  --no-timestamp        Omit timestamp from output
+  --pretty              Pretty-print JSON output
+  --help                Show this help message
+`);
+}
+export async function main(argv) {
+    let args;
+    try {
+        args = parseArgs({
+            args: argv,
+            options: {
+                schema: { type: 'string' },
+                invariants: { type: 'string' },
+                format: { type: 'string', default: 'json' },
+                out: { type: 'string' },
+                'fail-on': { type: 'string' },
+                'no-timestamp': { type: 'boolean', default: false },
+                pretty: { type: 'boolean', default: false },
+                help: { type: 'boolean', default: false },
+            },
+            strict: true,
+        });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : 'Invalid arguments';
+        process.stderr.write(`Error: ${detail}. Use --help for usage.\n`);
+        return EXIT_CLI_ERROR;
+    }
+    if (args.values['help'] === true) {
+        printUsage();
+        return EXIT_OK;
+    }
+    // Resolve schema path
+    const schemaPath = resolve(typeof args.values['schema'] === 'string'
+        ? args.values['schema']
+        : 'prisma/schema.prisma');
+    if (!existsSync(schemaPath)) {
+        process.stderr.write(`Error: Schema file not found: ${schemaPath}\n`);
+        return EXIT_CLI_ERROR;
+    }
+    // Validate format
+    const format = (args.values['format'] ?? 'json');
+    if (format !== 'json' && format !== 'text') {
+        process.stderr.write(`Error: Invalid format "${format}". Must be "json" or "text".\n`);
+        return EXIT_CLI_ERROR;
+    }
+    const outputFormat = format;
+    // Validate fail-on
+    const failOn = args.values['fail-on'];
+    if (failOn !== undefined &&
+        failOn !== 'error' &&
+        failOn !== 'warning' &&
+        failOn !== 'info') {
+        process.stderr.write(`Error: Invalid --fail-on value "${failOn}". Must be "error", "warning", or "info".\n`);
+        return EXIT_CLI_ERROR;
+    }
+    const noTimestamp = args.values['no-timestamp'] === true;
+    const pretty = args.values['pretty'] === true;
+    // Resolve invariants path if provided
+    const invariantsArg = args.values['invariants'];
+    let invariantsPath;
+    if (invariantsArg !== undefined) {
+        invariantsPath = resolve(invariantsArg);
+        if (!existsSync(invariantsPath)) {
+            process.stderr.write(`Error: Invariants file not found: ${invariantsPath}\n`);
+            return EXIT_CLI_ERROR;
+        }
+    }
+    // Run audit
+    let result;
+    try {
+        result = await audit({ schemaPath, invariantsPath, noTimestamp });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : '';
+        process.stderr.write(`Error: Failed to parse schema.${detail !== '' ? ` ${detail}` : ''}\n`);
+        return EXIT_PARSE_ERROR;
+    }
+    // Format output
+    const output = outputFormat === 'json' ? toJson(result, pretty) : toText(result);
+    // Write output
+    const outPath = args.values['out'];
+    if (outPath !== undefined) {
+        writeFileSync(resolve(outPath), output, 'utf-8');
+    }
+    else {
+        process.stdout.write(output);
+        process.stdout.write('\n');
+    }
+    // Check fail-on threshold
+    if (failOn !== undefined && result.findings.length > 0) {
+        const severityOrder = { info: 0, warning: 1, error: 2 };
+        const threshold = severityOrder[failOn];
+        const hasFailure = result.findings.some((f) => severityOrder[f.severity] >= threshold);
+        if (hasFailure) {
+            return EXIT_ISSUES;
+        }
+    }
+    return EXIT_OK;
+}
+if (process.argv[1] !== undefined && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    main()
+        .then((code) => {
+        process.exitCode = code;
+    })
+        .catch(() => {
+        process.exitCode = EXIT_PARSE_ERROR;
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,kBAAkB;AAClB,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;;;;;;;;;;;CAWH,CACE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAe;IACxC,IAAI,IAAkC,CAAC;IAEvC,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC;YACf,IAAI,EAAE,IAAI;YACV,OAAO,EAAE;gBACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;gBAC3C,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC7B,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBACnD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;aAC1C;YACD,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,2BAA2B,CAAC,CAAC;QAClE,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,UAAU,EAAE,CAAC;QACb,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,OAAO,CACxB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QACvB,CAAC,CAAC,sBAAsB,CAC3B,CAAC;IAEF,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,IAAI,CAAC,CAAC;QACtE,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,kBAAkB;IAClB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAW,CAAC;IAC3D,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,MAAM,gCAAgC,CACjE,CAAC;QACF,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,YAAY,GAAiB,MAAM,CAAC;IAE1C,mBAAmB;IACnB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAuB,CAAC;IAC5D,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,MAAM,EACjB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,MAAM,6CAA6C,CACvF,CAAC;QACF,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IAE9C,sCAAsC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAuB,CAAC;IACtE,IAAI,cAAkC,CAAC;IACvC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;YAC9E,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;IAED,YAAY;IACZ,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7F,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,gBAAgB;IAChB,MAAM,MAAM,GACV,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEpE,eAAe;IACf,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAuB,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,aAAa,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAC9C,CAAC;QACF,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACjG,IAAI,EAAE;SACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC;IACtC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/core/analysis/computeKeys.d.ts

@@ -0,0 +1,13 @@
+import type { ConstraintContract } from '../report/reportTypes.js';
+/** A candidate key for a model. */
+export interface CandidateKey {
+    readonly fields: readonly string[];
+    readonly model: string;
+    readonly source: 'pk' | 'unique';
+}
+/**
+ * Extract candidate keys from the constraint contract for a given model.
+ * A candidate key is either the primary key or a unique constraint.
+ */
+export declare function extractCandidateKeys(contract: ConstraintContract, modelName: string): readonly CandidateKey[];
+//# sourceMappingURL=computeKeys.d.ts.map

package/dist/core/analysis/computeKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeKeys.d.ts","sourceRoot":"","sources":["../../../src/core/analysis/computeKeys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,MAAM,GAChB,SAAS,YAAY,EAAE,CAyBzB"}

package/dist/core/analysis/computeKeys.js

@@ -0,0 +1,27 @@
+/**
+ * Extract candidate keys from the constraint contract for a given model.
+ * A candidate key is either the primary key or a unique constraint.
+ */
+export function extractCandidateKeys(contract, modelName) {
+    const model = contract.models.find((m) => m.name === modelName);
+    if (model === undefined) {
+        return [];
+    }
+    const keys = [];
+    if (model.primaryKey !== null) {
+        keys.push({
+            fields: model.primaryKey.fields,
+            model: modelName,
+            source: 'pk',
+        });
+    }
+    for (const uq of model.uniqueConstraints) {
+        keys.push({
+            fields: uq.fields,
+            model: modelName,
+            source: 'unique',
+        });
+    }
+    return keys;
+}
+//# sourceMappingURL=computeKeys.js.map

package/dist/core/analysis/computeKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeKeys.js","sourceRoot":"","sources":["../../../src/core/analysis/computeKeys.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA4B,EAC5B,SAAiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAmB,EAAE,CAAC;IAEhC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC;YACR,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC/B,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC;YACR,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/analysis/inferFds.d.ts

@@ -0,0 +1,31 @@
+import type { ConstraintContract } from '../report/reportTypes.js';
+/** A functional dependency: determinant → dependent fields. */
+export interface FunctionalDependency {
+    readonly determinant: readonly string[];
+    readonly dependent: readonly string[];
+    readonly model: string;
+    readonly source: 'pk' | 'unique' | 'fk' | 'invariant';
+}
+/**
+ * Infer functional dependencies from the constraint contract.
+ *
+ * Rules:
+ * - PK → all non-PK fields (full functional dependency)
+ * - Unique → all non-key fields (candidate key dependency)
+ * - FK fields → referenced PK fields (referential dependency)
+ */
+export declare function inferFunctionalDependencies(contract: ConstraintContract): readonly FunctionalDependency[];
+/**
+ * Compute the attribute closure of a set of attributes under given FDs.
+ * Uses Armstrong's axioms (reflexivity, augmentation, transitivity).
+ *
+ * Given attributes X and a set of FDs, returns X+ (all attributes
+ * functionally determined by X).
+ */
+export declare function attributeClosure(attributes: readonly string[], fds: readonly FunctionalDependency[], modelName: string): ReadonlySet<string>;
+/**
+ * Check if a set of attributes is a superkey for a model.
+ * A superkey determines all attributes in the model.
+ */
+export declare function isSuperkey(attributes: readonly string[], allFields: readonly string[], fds: readonly FunctionalDependency[], modelName: string): boolean;
+//# sourceMappingURL=inferFds.d.ts.map

package/dist/core/analysis/inferFds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inferFds.d.ts","sourceRoot":"","sources":["../../../src/core/analysis/inferFds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAiB,MAAM,0BAA0B,CAAC;AAElF,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,WAAW,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,GAC3B,SAAS,oBAAoB,EAAE,CAmCjC;AAoBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,GAAG,EAAE,SAAS,oBAAoB,EAAE,EACpC,SAAS,EAAE,MAAM,GAChB,WAAW,CAAC,MAAM,CAAC,CAoBrB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,GAAG,EAAE,SAAS,oBAAoB,EAAE,EACpC,SAAS,EAAE,MAAM,GAChB,OAAO,CAGT"}

package/dist/core/analysis/inferFds.js

@@ -0,0 +1,87 @@
+/**
+ * Infer functional dependencies from the constraint contract.
+ *
+ * Rules:
+ * - PK → all non-PK fields (full functional dependency)
+ * - Unique → all non-key fields (candidate key dependency)
+ * - FK fields → referenced PK fields (referential dependency)
+ */
+export function inferFunctionalDependencies(contract) {
+    const fds = [];
+    for (const model of contract.models) {
+        const allFieldNames = model.fields.map((f) => f.name);
+        // PK → all other fields
+        if (model.primaryKey !== null) {
+            const pkFields = model.primaryKey.fields;
+            const dependent = allFieldNames.filter((f) => !pkFields.includes(f));
+            if (dependent.length > 0) {
+                fds.push({
+                    determinant: pkFields,
+                    dependent,
+                    model: model.name,
+                    source: 'pk',
+                });
+            }
+        }
+        // Unique → all other fields
+        addUniqueFds(model, allFieldNames, fds);
+        // FK → referenced fields (namespaced to prevent collision with local fields)
+        for (const fk of model.foreignKeys) {
+            fds.push({
+                determinant: fk.fields,
+                dependent: fk.referencedFields.map((f) => `${fk.referencedModel}.${f}`),
+                model: model.name,
+                source: 'fk',
+            });
+        }
+    }
+    return fds;
+}
+function addUniqueFds(model, allFieldNames, fds) {
+    for (const uq of model.uniqueConstraints) {
+        const dependent = allFieldNames.filter((f) => !uq.fields.includes(f));
+        if (dependent.length > 0) {
+            fds.push({
+                determinant: uq.fields,
+                dependent,
+                model: model.name,
+                source: 'unique',
+            });
+        }
+    }
+}
+/**
+ * Compute the attribute closure of a set of attributes under given FDs.
+ * Uses Armstrong's axioms (reflexivity, augmentation, transitivity).
+ *
+ * Given attributes X and a set of FDs, returns X+ (all attributes
+ * functionally determined by X).
+ */
+export function attributeClosure(attributes, fds, modelName) {
+    const closure = new Set(attributes);
+    const modelFds = fds.filter((fd) => fd.model === modelName);
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const fd of modelFds) {
+            if (fd.determinant.every((attr) => closure.has(attr))) {
+                for (const dep of fd.dependent) {
+                    if (!closure.has(dep)) {
+                        closure.add(dep);
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+    return closure;
+}
+/**
+ * Check if a set of attributes is a superkey for a model.
+ * A superkey determines all attributes in the model.
+ */
+export function isSuperkey(attributes, allFields, fds, modelName) {
+    const closure = attributeClosure(attributes, fds, modelName);
+    return allFields.every((f) => closure.has(f));
+}
+//# sourceMappingURL=inferFds.js.map

package/dist/core/analysis/inferFds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inferFds.js","sourceRoot":"","sources":["../../../src/core/analysis/inferFds.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA4B;IAE5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAEtD,wBAAwB;QACxB,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YACzC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC;oBACP,WAAW,EAAE,QAAQ;oBACrB,SAAS;oBACT,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,MAAM,EAAE,IAAI;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAExC,6EAA6E;QAC7E,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC;gBACP,WAAW,EAAE,EAAE,CAAC,MAAM;gBACtB,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;gBACvE,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CACnB,KAAoB,EACpB,aAAuB,EACvB,GAA2B;IAE3B,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC;gBACP,WAAW,EAAE,EAAE,CAAC,MAAM;gBACtB,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA6B,EAC7B,GAAoC,EACpC,SAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAE5D,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACtD,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;oBAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACtB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBACjB,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,UAA6B,EAC7B,SAA4B,EAC5B,GAAoC,EACpC,SAAiB;IAEjB,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/core/analysis/normalizeChecks/check1nf.d.ts

@@ -0,0 +1,11 @@
+import type { ConstraintContract, Finding } from '../../report/reportTypes.js';
+/**
+ * Check for 1NF violations (heuristic-based).
+ *
+ * Checks:
+ * - NF1_LIST_IN_STRING_SUSPECTED: String fields with names suggesting list values
+ * - NF1_REPEATING_GROUP_SUSPECTED: Fields with numeric suffixes (phone1, phone2)
+ * - NF1_JSON_RELATION_SUSPECTED: Json fields suggesting embedded relations
+ */
+export declare function check1nf(contract: ConstraintContract): readonly Finding[];
+//# sourceMappingURL=check1nf.d.ts.map

package/dist/core/analysis/normalizeChecks/check1nf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check1nf.d.ts","sourceRoot":"","sources":["../../../../src/core/analysis/normalizeChecks/check1nf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAgC,MAAM,6BAA6B,CAAC;AAc7G;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,OAAO,EAAE,CAUzE"}

package/dist/core/analysis/normalizeChecks/check1nf.js

@@ -0,0 +1,91 @@
+/**
+ * Patterns that suggest a string field contains a delimited list of values.
+ * Matches field names ending in Ids, List, Csv, Array, Tags, Items, Values (case-insensitive).
+ */
+const LIST_IN_STRING_PATTERN = /(?:ids|list|csv|array|tags|items|values)$/i;
+/**
+ * Pattern to detect repeating groups: field names ending with a numeric suffix.
+ * e.g., phone1, phone2, address1, address2
+ */
+const REPEATING_GROUP_PATTERN = /^(.+?)(\d+)$/;
+/**
+ * Check for 1NF violations (heuristic-based).
+ *
+ * Checks:
+ * - NF1_LIST_IN_STRING_SUSPECTED: String fields with names suggesting list values
+ * - NF1_REPEATING_GROUP_SUSPECTED: Fields with numeric suffixes (phone1, phone2)
+ * - NF1_JSON_RELATION_SUSPECTED: Json fields suggesting embedded relations
+ */
+export function check1nf(contract) {
+    const findings = [];
+    for (const model of contract.models) {
+        checkListInString(model, findings);
+        checkRepeatingGroups(model, findings);
+        checkJsonRelation(model, findings);
+    }
+    return findings;
+}
+function checkListInString(model, findings) {
+    for (const field of model.fields) {
+        if (field.type === 'String' && LIST_IN_STRING_PATTERN.test(field.name)) {
+            findings.push({
+                rule: 'NF1_LIST_IN_STRING_SUSPECTED',
+                severity: 'warning',
+                normalForm: '1NF',
+                model: model.name,
+                field: field.name,
+                message: `String field "${field.name}" may contain a delimited list of values. Consider normalizing into a separate table.`,
+            });
+        }
+    }
+}
+function checkRepeatingGroups(model, findings) {
+    // Group fields by their base name (strip trailing digits)
+    const groups = new Map();
+    for (const field of model.fields) {
+        const match = REPEATING_GROUP_PATTERN.exec(field.name);
+        if (match?.[1] !== undefined) {
+            const baseName = match[1];
+            const existing = groups.get(baseName);
+            if (existing !== undefined) {
+                existing.push(field);
+            }
+            else {
+                groups.set(baseName, [field]);
+            }
+        }
+    }
+    // Only flag groups with 2+ numbered fields of the same type
+    for (const [baseName, fields] of groups) {
+        if (fields.length >= 2) {
+            const firstType = fields[0]?.type;
+            const allSameType = firstType !== undefined && fields.every((f) => f.type === firstType);
+            if (allSameType) {
+                const fieldNames = fields.map((f) => f.name).join(', ');
+                findings.push({
+                    rule: 'NF1_REPEATING_GROUP_SUSPECTED',
+                    severity: 'warning',
+                    normalForm: '1NF',
+                    model: model.name,
+                    field: null,
+                    message: `Fields [${fieldNames}] appear to be a repeating group for "${baseName}". Consider normalizing into a separate table.`,
+                });
+            }
+        }
+    }
+}
+function checkJsonRelation(model, findings) {
+    for (const field of model.fields) {
+        if (field.type === 'Json') {
+            findings.push({
+                rule: 'NF1_JSON_RELATION_SUSPECTED',
+                severity: 'info',
+                normalForm: '1NF',
+                model: model.name,
+                field: field.name,
+                message: `Json field "${field.name}" may contain structured data that could be normalized into related tables.`,
+            });
+        }
+    }
+}
+//# sourceMappingURL=check1nf.js.map

package/dist/core/analysis/normalizeChecks/check1nf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check1nf.js","sourceRoot":"","sources":["../../../../src/core/analysis/normalizeChecks/check1nf.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,sBAAsB,GAAG,4CAA4C,CAAC;AAE5E;;;GAGG;AACH,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,QAA4B;IACnD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACnC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoB,EAAE,QAAmB;IAClE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,OAAO,EAAE,iBAAiB,KAAK,CAAC,IAAI,uFAAuF;aAC5H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAoB,EAAE,QAAmB;IACrE,0DAA0D;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAElD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAClC,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YACzF,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,+BAA+B;oBACrC,QAAQ,EAAE,SAAS;oBACnB,UAAU,EAAE,KAAK;oBACjB,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,WAAW,UAAU,yCAAyC,QAAQ,gDAAgD;iBAChI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoB,EAAE,QAAmB;IAClE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B;gBACnC,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,OAAO,EAAE,eAAe,KAAK,CAAC,IAAI,6EAA6E;aAChH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/core/analysis/normalizeChecks/check2nf.d.ts

@@ -0,0 +1,13 @@
+import type { ConstraintContract, Finding } from '../../report/reportTypes.js';
+import type { FunctionalDependency } from '../inferFds.js';
+/**
+ * Check for 2NF violations (heuristic-based).
+ *
+ * Checks:
+ * - NF2_PARTIAL_DEPENDENCY_SUSPECTED: Composite key models with fields that
+ *   appear to depend on only part of the key (detected via FK relationships)
+ * - NF2_JOIN_TABLE_DUPLICATED_ATTR_SUSPECTED: Join tables (composite PK with
+ *   only FK fields) that carry extra non-key attributes
+ */
+export declare function check2nf(contract: ConstraintContract, fds: readonly FunctionalDependency[]): readonly Finding[];
+//# sourceMappingURL=check2nf.d.ts.map

package/dist/core/analysis/normalizeChecks/check2nf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check2nf.d.ts","sourceRoot":"","sources":["../../../../src/core/analysis/normalizeChecks/check2nf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAiB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG3D;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,SAAS,oBAAoB,EAAE,GACnC,SAAS,OAAO,EAAE,CAcpB"}

package/dist/core/analysis/normalizeChecks/check2nf.js

@@ -0,0 +1,80 @@
+import { extractCandidateKeys } from '../computeKeys.js';
+/**
+ * Check for 2NF violations (heuristic-based).
+ *
+ * Checks:
+ * - NF2_PARTIAL_DEPENDENCY_SUSPECTED: Composite key models with fields that
+ *   appear to depend on only part of the key (detected via FK relationships)
+ * - NF2_JOIN_TABLE_DUPLICATED_ATTR_SUSPECTED: Join tables (composite PK with
+ *   only FK fields) that carry extra non-key attributes
+ */
+export function check2nf(contract, fds) {
+    const findings = [];
+    for (const model of contract.models) {
+        const keys = extractCandidateKeys(contract, model.name);
+        const compositePk = keys.find((k) => k.source === 'pk' && k.fields.length > 1);
+        if (compositePk !== undefined) {
+            checkPartialDependency(model, compositePk.fields, fds, findings);
+            checkJoinTableDuplicatedAttr(model, compositePk.fields, findings);
+        }
+    }
+    return findings;
+}
+/**
+ * Detect possible partial dependencies in composite-key models.
+ *
+ * When FK fields form a proper subset of the composite PK, non-key attributes
+ * may depend on only that subset rather than the full key — a 2NF violation.
+ * One finding is emitted per FK subset (not per field) since without declared
+ * invariants we cannot attribute specific fields to the subset.
+ */
+function checkPartialDependency(model, pkFields, fds, findings) {
+    const hasNonKeyFields = model.fields.some((f) => !pkFields.includes(f.name));
+    if (!hasNonKeyFields) {
+        return;
+    }
+    const fkFds = fds.filter((fd) => fd.model === model.name && fd.source === 'fk');
+    for (const fkFd of fkFds) {
+        const isProperSubset = fkFd.determinant.length < pkFields.length &&
+            fkFd.determinant.every((f) => pkFields.includes(f));
+        if (isProperSubset) {
+            findings.push({
+                rule: 'NF2_PARTIAL_DEPENDENCY_SUSPECTED',
+                severity: 'warning',
+                normalForm: '2NF',
+                model: model.name,
+                field: null,
+                message: `Composite-key model "${model.name}" has FK fields (${fkFd.determinant.join(', ')}) that are a proper subset of the primary key. Non-key attributes may depend on this subset rather than the full key, which would violate 2NF.`,
+            });
+        }
+    }
+}
+/**
+ * Detect join tables with extra attributes. A join table has a composite PK
+ * where all PK fields are also FK fields. Extra non-key attributes suggest
+ * the table should be an entity with its own identity.
+ */
+function checkJoinTableDuplicatedAttr(model, pkFields, findings) {
+    // Check if all PK fields are FK fields
+    const fkFieldSets = model.foreignKeys.map((fk) => fk.fields).flat();
+    const allPkFieldsAreFk = pkFields.every((f) => fkFieldSets.includes(f));
+    if (!allPkFieldsAreFk) {
+        return;
+    }
+    // Find non-key, non-FK fields
+    const allFkFields = new Set(fkFieldSets);
+    const extraFields = model.fields
+        .map((f) => f.name)
+        .filter((name) => !pkFields.includes(name) && !allFkFields.has(name));
+    if (extraFields.length > 0) {
+        findings.push({
+            rule: 'NF2_JOIN_TABLE_DUPLICATED_ATTR_SUSPECTED',
+            severity: 'warning',
+            normalForm: '2NF',
+            model: model.name,
+            field: null,
+            message: `Join table "${model.name}" has extra attributes [${extraFields.join(', ')}] beyond its composite key. Consider whether this should be a first-class entity.`,
+        });
+    }
+}
+//# sourceMappingURL=check2nf.js.map

package/dist/core/analysis/normalizeChecks/check2nf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check2nf.js","sourceRoot":"","sources":["../../../../src/core/analysis/normalizeChecks/check2nf.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CACtB,QAA4B,EAC5B,GAAoC;IAEpC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE/E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACjE,4BAA4B,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAC7B,KAAoB,EACpB,QAA2B,EAC3B,GAAoC,EACpC,QAAmB;IAEnB,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAEhF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,cAAc,GAClB,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;YACzC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtD,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kCAAkC;gBACxC,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,wBAAwB,KAAK,CAAC,IAAI,oBAAoB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,gJAAgJ;aAC3O,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CACnC,KAAoB,EACpB,QAA2B,EAC3B,QAAmB;IAEnB,uCAAuC;IACvC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,8BAA8B;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,0CAA0C;YAChD,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,KAAK;YACjB,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,eAAe,KAAK,CAAC,IAAI,2BAA2B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,mFAAmF;SACvK,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}