When their API changes, your fix is already a pull request.
Nalvis watches the providers your SaaS depends on, finds the call sites a breaking change actually touches, and opens a reviewable fix. Deterministic when it can be. Human-reviewed when it can’t.
Free GitHub Action · Hosted watcher from $14/mo · No code sent to an LLM
Launching with the modern TypeScript stack
- Algoliasearch SDK v5v1
- Clerkauth SDK / APIv1
- Svixwebhook OpenAPIv1
Two paths. One trust boundary.
The change decides the path. Your source code always stays in CI.
- Step 01 / 05active
Watch
A provider publishes a schema, SDK, or migration change.
Specs, changelogs and release notes — all public sources.
- Step 02 / 05queued
Diff
We reduce the release to the changes that can break callers.
OpenAPI and GraphQL diffing, filtered down to caller-visible surface.
openapi.diff · algolia3 breakinginitIndex(indexName): IndexremovedIndex.search(query, opts)removedsearch({ requests: [...] })addedclient.getSettings(...)unchangedrequests[].indexName: stringaddedOnly caller-visible changes survive the reduction: removals, renames, required params, enum shifts. - Step 03 / 05queued
Trace locally
The Action resolves imports and finds only affected call sites inside your CI runner.
Symbol-aware AST matching. Nothing is uploaded to do it.
Your CI runnersource never leaves- src/search/products.ts2 call sites
- src/api/handlers.ts—
- src/lib/algolia.ts4 call sites
- src/jobs/reindex.ts1 call sites
- src/utils/format.ts—
ast · symbol-aware3 files · 7 refs - Step 04 / 05queued
Choose the safe lane
Mechanical changes take the deterministic matrix. Semantic changes take a reviewed recipe.
If neither lane is safe, you get an advisory with exact call sites instead of a guess.
MatrixRenamed method, moved parameter, changed enum. Same input, same transform.
Reviewed recipeSemantic migration. AI drafts from public docs, a maintainer approves and fixture-tests it.
The AI side never crosses into your CI or your source. - Step 05 / 05queued
Open PR
A focused PR with evidence, tests, and the official migration source. You review; Nalvis never auto-merges.
Every transform is versioned and inspectable before you approve it.
fix(algolia): migrate initIndex → client.searchopenconst index = client.initIndex('products')await index.search(query)await client.search({requests: [{ indexName: 'products', query }],})- typecheckpassed
- unit testspassed
- codemod fixturespassed
source: algolia v5 migration guidereview required · no auto-merge
Mechanical gets automated. Semantic gets reviewed.
We do not pretend every breaking change can be fixed the same way — or fixed at all without a human.
Matrix flow — mechanical and deterministic
A renamed method or a moved parameter has exactly one correct rewrite. We encode it once, test it against fixtures, and apply it identically everywhere.
const index = client.initIndex('products');
await index.search(query)await client.search({
requests: [{ indexName: 'products', query }]
})- OpenAPI / GraphQL diff isolates caller-visible changes
- Symbol-aware AST matching, not regex over strings
- Deterministic codemod — same input, same transform
- Your existing tests run locally before anything is proposed
- A single focused pull request for you to review
Reviewed recipe flow — semantic, not guessed
Some migrations change meaning, not just names. The hosted AI reads public provider material only and drafts a candidate recipe. A maintainer must approve it before it can ever run in your CI.
- 1Public docsSpecs, changelogs and official migration guides
- 2AI candidateDrafts a recipe from those public sources only
- 3Maintainer reviewA human reads, edits or rejects it
- 4Fixture testsRecipe must pass real-world fixture repos
- 5Approved recipeVersioned, signed, published
- 6Local CI applyRuns on your runner, against your code
- The AI sees public documentation only — never your repository
- Maintainer approval is mandatory, not advisory
- If no safe recipe exists, you get an advisory with exact call sites
- You still review the pull request; nothing merges itself
Provider specs, changelogs, migration docs, recipe drafts, maintainer review.
Checkout, AST scan, codemod application, tests, pull request creation.
Why buy it when the engine is free?
You may not need to. The engine that finds and fixes call sites is open source and stays that way.
- GitHub Action (spec diff, AST scan, codemods, PRs)includedincluded
- Published codemod matrix and reviewed recipesincludedincluded
- Run it on one repo — or many, if you operate itincludedincluded
- Continuous upstream monitoring of provider releasesnot includedincluded
- Runs triggered only when a change actually affects younot includedincluded
- Multi-repo status and historynot includedincluded
- Slack alertsnot includedincluded
- Maintained reviewed recipes as providers movenot includedincluded
If one repo and a cron job works for you, use the free version. Pay only when the watching and coordination become the work.
What we watch, and what we're working toward.
We add a provider when we can diff it honestly and test the transforms. No delivery dates we can't keep.
Available in v1
- AlgoliaSDK / OpenAPI method shiftsv1
- ClerkAuth SDK and API migrationsv1
- SvixWebhook API surfacev1
Upcoming — not available yet
- ShopifyQuarterly Admin API changes — reviewed recipe laneRecipe lane
- TwilioMessaging and Verify firstResearching
- StripeGuided major-version upgradesResearching
- PostHogCapture and query APIsResearching
Your repository is not training data.
We'd rather be precise than absolute: triggering a hosted run does need repository identifiers and status metadata. Your source code never leaves CI.
Source stays on your runner
The Action checks out and analyses your code inside your GitHub-hosted or self-hosted runner. Nothing is uploaded to analyse it.
The hosted side sees metadata, not code
To trigger a run we need repository identifiers, run status and a recipe ID. That is the whole payload — no files, no snippets, no diffs of your source.
Transforms are versioned and inspectable
Every codemod and reviewed recipe is published, versioned and readable before it ever runs. You can pin one, or read it line by line.
PRs never auto-merge
Nalvis opens a pull request and stops. A human on your side approves it, or closes it.
Be early enough to shape what we watch.
V1 covers Algolia, Clerk and Svix. Which provider gets added next is decided by the people on this list.