@warmdrift/kgauto-check 0.2.0 → 0.4.0

package/dist/index.d.ts

@@ -16,6 +16,12 @@ declare const CallSiteSchema: z.ZodObject<{
     model: z.ZodString;
     /** How the model id is selected at this site. */
     modelSelection: z.ZodOptional<z.ZodEnum<["hardcoded", "config", "env", "dynamic"]>>;
+    /**
+     * 0.4.0 (Amendment B): where the request is served, when the code shows it — the
+     * provider's own API, or a cloud platform that serves the provider's models on its
+     * own lifecycle schedule. Omit when you cannot tell.
+     */
+    platform: z.ZodOptional<z.ZodEnum<["provider-api", "vertex", "bedrock", "azure", "other"]>>;
     /**
      * Best-guess intent archetype from kgauto's dialect (ask, classify,
      * critique, extract, generate, hunt, plan, summarize, transform).
@@ -47,6 +53,7 @@ declare const CallSiteSchema: z.ZodObject<{
     id: string;
     model: string;
     modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+    platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
     archetype?: string | undefined;
     estInputTokens?: number | undefined;
     maxInputTokens?: number | undefined;
@@ -63,6 +70,7 @@ declare const CallSiteSchema: z.ZodObject<{
     id: string;
     model: string;
     modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+    platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
     archetype?: string | undefined;
     estInputTokens?: number | undefined;
     maxInputTokens?: number | undefined;
@@ -76,6 +84,38 @@ declare const CallSiteSchema: z.ZodObject<{
     estCallsPerMonth?: number | undefined;
     notes?: string | undefined;
 }>;
+/**
+ * 0.4.0 (R5) — a model id the project holds where no literal call site
+ * carries it: a model picker, a config default, an environment default, a
+ * list of supported models. The card reports on its lifecycle; there is no
+ * request shape to check it against.
+ */
+declare const ModelMentionSchema: z.ZodObject<{
+    /** Model id exactly as written in the project. */
+    model: z.ZodString;
+    /** Where it is written, e.g. "src/config/models.ts:14". */
+    where: z.ZodString;
+    modelSelection: z.ZodOptional<z.ZodEnum<["hardcoded", "config", "env", "dynamic"]>>;
+    /**
+     * 0.4.0 (Amendment B): where the request is served, when the code shows it — the
+     * provider's own API, or a cloud platform that serves the provider's models on its
+     * own lifecycle schedule. Omit when you cannot tell.
+     */
+    platform: z.ZodOptional<z.ZodEnum<["provider-api", "vertex", "bedrock", "azure", "other"]>>;
+    notes: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    model: string;
+    where: string;
+    modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+    platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
+    notes?: string | undefined;
+}, {
+    model: string;
+    where: string;
+    modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+    platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
+    notes?: string | undefined;
+}>;
 declare const ExtractSchema: z.ZodObject<{
     project: z.ZodObject<{
         name: z.ZodString;
@@ -87,6 +127,7 @@ declare const ExtractSchema: z.ZodObject<{
         name: string;
         description?: string | undefined;
     }>;
+    /** May be empty (0.4.0): a project with no literal call site still gets a card. */
     callSites: z.ZodArray<z.ZodObject<{
         /** Agent-chosen stable label, e.g. "api/summarize.ts:42" or "hunt loop". */
         id: z.ZodString;
@@ -94,6 +135,12 @@ declare const ExtractSchema: z.ZodObject<{
         model: z.ZodString;
         /** How the model id is selected at this site. */
         modelSelection: z.ZodOptional<z.ZodEnum<["hardcoded", "config", "env", "dynamic"]>>;
+        /**
+         * 0.4.0 (Amendment B): where the request is served, when the code shows it — the
+         * provider's own API, or a cloud platform that serves the provider's models on its
+         * own lifecycle schedule. Omit when you cannot tell.
+         */
+        platform: z.ZodOptional<z.ZodEnum<["provider-api", "vertex", "bedrock", "azure", "other"]>>;
         /**
          * Best-guess intent archetype from kgauto's dialect (ask, classify,
          * critique, extract, generate, hunt, plan, summarize, transform).
@@ -125,6 +172,7 @@ declare const ExtractSchema: z.ZodObject<{
         id: string;
         model: string;
         modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+        platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
         archetype?: string | undefined;
         estInputTokens?: number | undefined;
         maxInputTokens?: number | undefined;
@@ -141,6 +189,7 @@ declare const ExtractSchema: z.ZodObject<{
         id: string;
         model: string;
         modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+        platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
         archetype?: string | undefined;
         estInputTokens?: number | undefined;
         maxInputTokens?: number | undefined;
@@ -154,6 +203,33 @@ declare const ExtractSchema: z.ZodObject<{
         estCallsPerMonth?: number | undefined;
         notes?: string | undefined;
     }>, "many">;
+    /** Model ids no call site carries (0.4.0). */
+    models: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        /** Model id exactly as written in the project. */
+        model: z.ZodString;
+        /** Where it is written, e.g. "src/config/models.ts:14". */
+        where: z.ZodString;
+        modelSelection: z.ZodOptional<z.ZodEnum<["hardcoded", "config", "env", "dynamic"]>>;
+        /**
+         * 0.4.0 (Amendment B): where the request is served, when the code shows it — the
+         * provider's own API, or a cloud platform that serves the provider's models on its
+         * own lifecycle schedule. Omit when you cannot tell.
+         */
+        platform: z.ZodOptional<z.ZodEnum<["provider-api", "vertex", "bedrock", "azure", "other"]>>;
+        notes: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        model: string;
+        where: string;
+        modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+        platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
+        notes?: string | undefined;
+    }, {
+        model: string;
+        where: string;
+        modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+        platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
+        notes?: string | undefined;
+    }>, "many">>;
     notes: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     project: {
@@ -164,6 +240,7 @@ declare const ExtractSchema: z.ZodObject<{
         id: string;
         model: string;
         modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+        platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
         archetype?: string | undefined;
         estInputTokens?: number | undefined;
         maxInputTokens?: number | undefined;
@@ -178,6 +255,13 @@ declare const ExtractSchema: z.ZodObject<{
         notes?: string | undefined;
     }[];
     notes?: string | undefined;
+    models?: {
+        model: string;
+        where: string;
+        modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+        platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
+        notes?: string | undefined;
+    }[] | undefined;
 }, {
     project: {
         name: string;
@@ -187,6 +271,7 @@ declare const ExtractSchema: z.ZodObject<{
         id: string;
         model: string;
         modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+        platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
         archetype?: string | undefined;
         estInputTokens?: number | undefined;
         maxInputTokens?: number | undefined;
@@ -201,23 +286,125 @@ declare const ExtractSchema: z.ZodObject<{
         notes?: string | undefined;
     }[];
     notes?: string | undefined;
+    models?: {
+        model: string;
+        where: string;
+        modelSelection?: "hardcoded" | "config" | "env" | "dynamic" | undefined;
+        platform?: "provider-api" | "vertex" | "bedrock" | "azure" | "other" | undefined;
+        notes?: string | undefined;
+    }[] | undefined;
 }>;
 type CallSite = z.infer<typeof CallSiteSchema>;
+type ModelMention = z.infer<typeof ModelMentionSchema>;
 type Extract = z.infer<typeof ExtractSchema>;
 
+/**
+ * The lifecycle ledger's row shape (R1). The data lives in
+ * `lifecycle-ledger.ts`, generated from the providers' saved pages by
+ * `scripts/build-ledger.mjs` — never typed by hand.
+ */
+type LedgerProvider = 'anthropic' | 'openai' | 'google' | 'deepseek';
+/** The provider's word, mapped onto one small set. `pageWord` keeps the page's own text. */
+type LedgerWord = 'deprecated' | 'retired' | 'shut down' | 'legacy' | 'rerouted' | 'scheduled for shutdown';
+interface LedgerRow {
+    /** The model id exactly as the page writes it. */
+    id: string;
+    provider: LedgerProvider;
+    word: LedgerWord;
+    /** The page's own status text for this row (a table cell, a section heading or a sentence). */
+    pageWord: string;
+    /** ISO date the page gives for the announcement / deprecation, when it gives one. */
+    announced?: string;
+    /** ISO date the page gives for retirement, shutdown or discontinuation. */
+    shutdown?: string;
+    /** ISO date the page gives as a floor ("not sooner than", "at earliest"). */
+    shutdownFloor?: string;
+    /** The page's date text, verbatim. */
+    dateText?: string;
+    /** The replacement the page names, backticks removed. */
+    replacement?: string;
+    /** Where the page says requests to this id are now routed. */
+    routesTo?: string;
+    /** DeepSeek: the model the page said the name pointed to when it announced the discontinuation. */
+    pointedTo?: string;
+    /** How the id was matched when the page names it by display name ("GPT-4o (…)"). */
+    matchedBy?: 'display-name';
+    /** The page section the row sits in, when the page is split by family. */
+    section?: string;
+    /** A second sentence from the same page that the row relies on. */
+    note?: string;
+    url: string;
+    /** ISO date the page was read. */
+    readOn: string;
+    /** The page line (or sentence) the row was built from, verbatim. */
+    quote: string;
+    /** A second page that confirms the row, with its own quote and read date. */
+    alsoUrl?: string;
+    alsoQuote?: string;
+    alsoReadOn?: string;
+}
+interface LedgerSource {
+    provider: LedgerProvider;
+    url: string;
+    /** ISO UTC time of the curl. */
+    readAt: string;
+    /** sha256 of the saved page bytes. */
+    sha256: string;
+}
+
+/**
+ * R3 — an id is matched as a developer writes it; R1/R2 — the ledger is read
+ * before the catalog. Pure functions over the generated ledger and the
+ * compiler's catalog; no network.
+ */
+
+interface Resolution {
+    /** The id exactly as configured. */
+    configured: string;
+    /** The id looked up. */
+    base: string;
+    /** What was done to get from one to the other, in words; empty when nothing was. */
+    steps: string[];
+    /** Set when the id is a partner platform's form: its lifecycle dates may differ from the provider's own API. */
+    partner?: Partner;
+}
+/** A cloud platform that serves a provider's models on its own lifecycle schedule. */
+type Partner = 'vertex' | 'bedrock' | 'azure';
+/**
+ * The prefix, Bedrock and Vertex forms are rewritten to the provider's own
+ * id. A dated snapshot is NOT stripped here — the lookup tries the dated id
+ * first, because the pages list dated snapshots as rows of their own.
+ */
+declare function resolveId(configured: string): Resolution;
+interface LedgerHit {
+    row?: LedgerRow;
+    /** The id the ledger row was found under, when it differs from the resolved base. */
+    via?: string;
+    /** The id the catalog should be read under. */
+    catalogId: string;
+}
+declare function lookupLedger(res: Resolution): LedgerHit;
+
 /**
  * The deterministic check engine. Every finding carries a confidence tier —
  * the mechanical answer to "how much confidence?":
  *
- *   certain          — a catalog or extract fact; stated flatly.
- *   likely           — priced/inferred from the agent's own estimates.
+ *   certain          — the provider's own page, or a fact read from the
+ *                      developer's code; stated flatly.
+ *   likely           — priced/inferred from the agent's own estimates, or a
+ *                      kgauto catalog value no provider page is cited for.
  *   measurable-only  — honestly unknowable from a code read; each one is
  *                      exactly what the observe day exists to measure.
  *
- * Checks run against the SAME bundled roster the kgauto compiler executes
- * (`@warmdrift/kgauto-compiler` is a real dependency, not a copy) — parity
- * by construction. No network, no writes: the card's destination sentence
- * is true because there is no code path that could make it false.
+ * 0.4.0: the provider's word comes first. A model id is resolved as the
+ * developer wrote it (R3), looked up in the lifecycle ledger read from the
+ * providers' deprecation pages (R1), then in the compiler's catalog, whose
+ * `providerLifecycle` is the page's word with its read date (R2). kgauto's own
+ * routing `status` is never printed as a fact about the model, and a limit
+ * that is only a kgauto default is never printed as certain (R4).
+ *
+ * No network, no writes: the card's destination sentence is true because
+ * there is no code path that could make it false.
  */
 
 type Confidence = 'certain' | 'likely' | 'measurable-only';
@@ -228,7 +415,7 @@ interface Finding {
     confidence: Confidence;
     title: string;
     detail: string;
-    /** Where the claim comes from — catalog field, extract field, arithmetic. */
+    /** Where the claim comes from — a provider page with its URL, a catalog field, an extract field, arithmetic. */
     basis: string;
     callSites: string[];
 }
@@ -238,22 +425,58 @@ interface CheckResult {
     catalogVersion: string;
 }
 interface EngineOptions {
-    /** Test seam: profile lookup override. Defaults to the bundled roster. */
+    /** Test seam: catalog lookup override for a resolved id. Defaults to the bundled roster. */
     resolve?: (id: string) => {
         canonical: string;
         profile: ModelProfile | undefined;
     };
-    /** Test seam: full roster override (for cheaper-candidate scans). */
+    /** Test seam: full roster override (for cheaper-candidate scans and the family sort). */
     roster?: () => ModelProfile[];
 }
 declare const DESTINATION_SENTENCE: string;
+type Line = Omit<Finding, 'id' | 'callSites'>;
+/** What the check knows about one model id as configured. */
+interface ModelAnalysis {
+    res: Resolution;
+    /** The id as the card prints it: as configured, with what it was looked up as. */
+    shown: string;
+    row?: LedgerRow;
+    /** The ledger id the row was found under, when it differs from the looked-up id. */
+    via?: string;
+    /** The catalog profile the request checks run against; absent = the checks skip this id. */
+    profile?: ModelProfile;
+    /** The id the profile was found under. */
+    canonical: string;
+    lines: Line[];
+    /** The partner platform the site runs on, when the extract shows one. */
+    partner?: Partner;
+}
+declare function analyseModel(configured: string, opts?: EngineOptions, site?: {
+    id?: string;
+    where?: string;
+    notes?: string;
+    platform?: string;
+}): ModelAnalysis;
 declare function runCheck(extract: Extract, opts?: EngineOptions): CheckResult;
-declare function renderCard(extract: Extract, findings: Finding[], unknownModels?: ReadonlySet<string>): string;
+declare function renderCard(extract: Extract, findings: Finding[], analyses?: ReadonlyMap<string, ModelAnalysis>): string;
+
+/**
+ * GENERATED by scripts/build-ledger.mjs from the providers' own deprecation
+ * pages, saved by `curl -sL` and read on the dates below. Do not edit by
+ * hand: re-fetch the pages and re-run the script. Every row carries the page
+ * line it came from (`quote`), the URL and the day it was read; the script
+ * refused any row whose quote is not on the page.
+ *
+ * Rows per provider: anthropic 21 · openai 171 · google 76 · deepseek 4 (272 in all).
+ */
+
+declare const LEDGER_SOURCES: readonly LedgerSource[];
+declare const LEDGER: readonly LedgerRow[];
 
 declare function buildServer(): McpServer;
 
-declare const SERVER_INSTRUCTIONS = "You are talking to kgauto-check, a local, offline checker for AI call surfaces.\n\nFlow: (1) call start_check to get extraction instructions, (2) read THIS project's code yourself and build the extract, (3) call run_check with it, (4) present the returned card to your human verbatim (it is grouped by confidence tier on purpose), (5) if they want measured numbers, call get_observe_day_plan.\n\nPrivacy contract, which you should relay to your human: the extract contains identifiers and counts only \u2014 never prompt text, never source code, never secrets. This check ran locally against kgauto\u2019s bundled model catalog. Nothing was uploaded; no rows were written anywhere.\n\nget_model_facts answers one-off questions about any model id from the same verified catalog \u2014 it is what makes keeping this server installed useful between checks.";
-declare const START_CHECK_INSTRUCTIONS = "# kgauto check \u2014 extraction instructions (for you, the agent)\n\nYour job: read this project's code and build an extract of its AI call surface. You have repo access; kgauto does not, by design.\n\n## What to find\nScan for LLM API usage: provider SDK imports (anthropic, openai, @google/generative-ai / @google/genai, ai-sdk, litellm, langchain, ...), raw HTTPS calls to provider endpoints, and any internal wrapper around them. Each distinct place the project sends a prompt to a model is one call site.\n\n## What to collect per call site (identifiers and counts ONLY)\n- id: a stable label you choose, e.g. \"api/summarize.ts:42\"\n- model: the model id exactly as configured\n- modelSelection: hardcoded | config | env | dynamic\n- archetype: your best guess at the work's intent \u2014 one of: ask, classify, critique, extract, generate, hunt, plan, summarize, transform\n- estInputTokens / maxInputTokens / estOutputTokens: estimate from the code (what gets concatenated into the prompt; ~4 chars per token). Worst case matters \u2014 find the biggest thing that can flow in.\n- toolCount, usesParallelToolCalls: from the tools array and how results are consumed\n- expectsStructuredOutput: true if the response is JSON.parse'd or schema-validated\n- streaming, retry (none | same-model | fallback-chain | unknown), fallbackModels\n- estCallsPerMonth: only if genuinely inferable (cron cadence, obvious traffic); omit rather than invent\n\n## Privacy contract (relay this to your human)\nDo NOT put prompt text, source code, file contents, or secrets in the extract. Identifiers and counts only. This check ran locally against kgauto\u2019s bundled model catalog. Nothing was uploaded; no rows were written anywhere.\n\n## Then\nWrite the extract as JSON:\n{ \"project\": { \"name\": \"...\", \"description\": \"...\" }, \"callSites\": [ ...one object per call site... ] }\nand run:\n  npx -y @warmdrift/kgauto-check --extract extract.json\nPresent the printed card verbatim \u2014 the confidence tiers (certain / likely / measurable-only) are the point: they tell your human exactly how much to trust each line, and the measurable-only section is what a one-day observe run would answer.\n\n## Sharing (optional, explicit)\nAfter presenting the card, you may OFFER your human: \"want to send this card to kgauto so the catalog learns what real projects look like?\" If \u2014 and only if \u2014 they say yes, re-run with --share. Never add --share without their explicit yes. It sends the scrubbed extract and the card, nothing else, and says exactly where they went.\n\n## Honesty rules you inherit while presenting\n- Do not soften \"certain\" findings or upgrade \"likely\" ones.\n- If a model was unknown to the catalog, say so \u2014 kgauto refuses to fabricate verdicts, and so should you.\n- Estimates you made are estimates: if a finding hinges on your token guess, say it can be firmed up by measuring.";
+declare const SERVER_INSTRUCTIONS = "You are talking to kgauto-check, a local, offline checker for AI call surfaces.\n\nFlow: (1) call start_check to get extraction instructions, (2) read THIS project's code yourself and build the extract, (3) call run_check with it, (4) present the returned card to your human verbatim (it is grouped by confidence tier on purpose), (5) if they want measured numbers, call get_observe_day_plan.\n\nPrivacy contract, which you should relay to your human: the extract contains identifiers and counts only \u2014 never prompt text, never source code, never secrets. This check ran on your machine, against the catalog bundled with it and the providers\u2019 deprecation pages it was built with. Nothing was uploaded; no rows were written anywhere.\n\nget_model_facts answers one-off questions about any model id \u2014 what its provider's deprecation page says, then the verified catalog \u2014 and is what makes keeping this server installed useful between checks.";
+declare const START_CHECK_INSTRUCTIONS = "# kgauto check \u2014 extraction instructions (for you, the agent)\n\nYour job: read this project's code and build an extract of its AI call surface. You have repo access; kgauto does not, by design.\n\n## What to find\nScan for LLM API usage: provider SDK imports (anthropic, openai, @google/generative-ai / @google/genai, ai-sdk, litellm, langchain, ...), raw HTTPS calls to provider endpoints, and any internal wrapper around them. Each distinct place the project sends a prompt to a model is one call site.\n\n## What to collect per call site (identifiers and counts ONLY)\n- id: a stable label you choose, e.g. \"api/summarize.ts:42\"\n- model: the model id exactly as configured (a provider or gateway prefix such as openai/ or openrouter/anthropic/ is fine; the check says what it looked the id up as)\n- modelSelection: hardcoded | config | env | dynamic\n- platform: state it for EVERY call site \u2014 where the request is served: provider-api (the provider's own API), vertex, bedrock, azure, or other (a gateway or another host). Tell it from the SDK imported (e.g. @anthropic-ai/sdk vs @anthropic-ai/vertex-sdk or @aws-sdk/client-bedrock-runtime; google-genai vs google.cloud.aiplatform / @google-cloud/aiplatform), the base URL (api.openai.com vs *.openai.azure.com; generativelanguage.googleapis.com vs *-aiplatform.googleapis.com), and the credentials used (a provider API key vs cloud credentials, a project and location). A lifecycle line is stated as certain only for provider-api; a cloud platform keeps its own schedule. If you truly cannot tell, write other and say why in notes.\n- archetype: your best guess at the work's intent \u2014 one of: ask, classify, critique, extract, generate, hunt, plan, summarize, transform\n- estInputTokens / maxInputTokens / estOutputTokens: estimate from the code (what gets concatenated into the prompt; ~4 chars per token). Worst case matters \u2014 find the biggest thing that can flow in.\n- toolCount, usesParallelToolCalls: from the tools array and how results are consumed\n- expectsStructuredOutput: true if the response is JSON.parse'd or schema-validated\n- streaming, retry (none | same-model | fallback-chain | unknown), fallbackModels\n- estCallsPerMonth: only if genuinely inferable (cron cadence, obvious traffic); omit rather than invent\n\n## Model ids with no call site\nIf the project holds model ids that no call site above carries \u2014 a model picker, a config or environment default, a list of supported models \u2014 list each once under \"models\" (identifiers only):\n- model: the id exactly as written\n- where: file:line where it is written\n- modelSelection: hardcoded | config | env | dynamic (optional)\n- platform: provider-api | vertex | bedrock | azure | other (as above)\nIf you find no call site at all (the project spawns a CLI, or takes the model as a run-time argument), \"callSites\" may be an empty array: the check still prints a card, about the ids in \"models\", and says no call site was found to check a request shape against. Never invent a model id to fill a call site.\n\n## Privacy contract (relay this to your human)\nDo NOT put prompt text, source code, file contents, or secrets in the extract. Identifiers and counts only. This check ran on your machine, against the catalog bundled with it and the providers\u2019 deprecation pages it was built with. Nothing was uploaded; no rows were written anywhere.\n\n## Then\nWrite the extract as JSON:\n{ \"project\": { \"name\": \"...\", \"description\": \"...\" }, \"callSites\": [ ...one object per call site, or none... ], \"models\": [ ...optional, ids no call site carries... ] }\nand run:\n  npx -y @warmdrift/kgauto-check --extract extract.json\nPresent the printed card verbatim \u2014 the confidence tiers (certain / likely / measurable-only) are the point: they tell your human exactly how much to trust each line, and the measurable-only section is what a one-day observe run would answer.\n\n## Sharing (optional, explicit)\nAfter presenting the card, you may OFFER your human: \"want to send this card to kgauto so the catalog learns what real projects look like?\" If \u2014 and only if \u2014 they say yes, re-run with --share. Never add --share without their explicit yes. It sends the scrubbed extract and the card, nothing else, and says exactly where they went.\n\n## Honesty rules you inherit while presenting\n- Do not soften \"certain\" findings or upgrade \"likely\" ones.\n- If a model was unknown to the catalog, say so \u2014 kgauto refuses to fabricate verdicts, and so should you.\n- A line that names a provider's word (retired, shut down, deprecated, legacy) carries the page it was read on: quote it as written.\n- Estimates you made are estimates: if a finding hinges on your token guess, say it can be firmed up by measuring.";
 
 /**
  * Rung 2 of the ladder: the one-day observe run. v1 of this tool hands the
@@ -264,7 +487,11 @@ declare const START_CHECK_INSTRUCTIONS = "# kgauto check \u2014 extraction instr
  */
 declare const OBSERVE_DAY_PLAN = "# The one-day observe run (for you, the agent \u2014 decision stays with your human)\n\n## What it is\nOne day of your project's normal traffic, observed. No routing changes: every call still goes to exactly the model your code chooses today. The observation records, per call: model, token counts in/out, cost at verified prices, latency, success/failure with a classified error code, and per-attempt rows when retries happen. Identifiers and counts \u2014 prompt text is never required.\n\n## What it answers (the measurable-only tier of your check card)\n- actual failure rate per model \u2014 including walkaway failures that green health checks miss\n- actual input-waste ratio per call site (the >85% input-share signal, measured instead of estimated)\n- which call sites dominate spend\n- the evidence base for whether a cheaper model could hold quality here (kgauto's judged eval runs on real captured cases, never on price alone)\n\n## The two honesty requirements (non-negotiable, relay both)\n1. **Destination, named before anything runs.** Your human gets one plain sentence stating exactly where outcome rows land and what is in them, BEFORE the first row is written. \"Nothing is uploaded\" was true of the check because it writes nothing; the observe day writes rows, so it must say where.\n2. **Observation never intervenes.** If your project uses fallback chains, observing must not pin a model and silently disable the chain \u2014 a forced pin is an intervention sold as observation. Rows are recorded per attempt, so the chain's real behaviour is what gets measured.\n\n## How to proceed\nThe integration is small (the kgauto compiler's call/record path with your existing keys), but because rows now land somewhere, the wiring starts with that destination sentence and your human's explicit yes. Next step: have your human reply to whoever pointed them at kgauto \u2014 the observe day is set up per-project, together.";
 
-/** One model id → catalog card. Honest miss on unknown models (s51). */
+/**
+ * One model id → what the provider's page says first (the lifecycle ledger,
+ * then the catalog profile's providerLifecycle), then the catalog card.
+ * Honest miss on an id in neither (s51).
+ */
 declare function renderModelFacts(model: string): string;
 
 /** One source of truth: package.json, read at runtime (dist/ sits one level
@@ -272,4 +499,4 @@ declare function renderModelFacts(model: string): string;
  * two declarations of one fact. */
 declare const CHECK_VERSION: string;
 
-export { CHECK_VERSION, type CallSite, CallSiteSchema, type CheckResult, type Confidence, DESTINATION_SENTENCE, type EngineOptions, type Extract, ExtractSchema, type Finding, OBSERVE_DAY_PLAN, SERVER_INSTRUCTIONS, START_CHECK_INSTRUCTIONS, type Severity, buildServer, renderCard, renderModelFacts, runCheck };
+export { CHECK_VERSION, type CallSite, CallSiteSchema, type CheckResult, type Confidence, DESTINATION_SENTENCE, type EngineOptions, type Extract, ExtractSchema, type Finding, LEDGER, LEDGER_SOURCES, type LedgerProvider, type LedgerRow, type LedgerSource, type LedgerWord, type ModelAnalysis, type ModelMention, ModelMentionSchema, OBSERVE_DAY_PLAN, SERVER_INSTRUCTIONS, START_CHECK_INSTRUCTIONS, type Severity, analyseModel, buildServer, lookupLedger, renderCard, renderModelFacts, resolveId, runCheck };

package/dist/index.js

@@ -3,24 +3,36 @@ import {
   CallSiteSchema,
   DESTINATION_SENTENCE,
   ExtractSchema,
+  LEDGER,
+  LEDGER_SOURCES,
+  ModelMentionSchema,
   OBSERVE_DAY_PLAN,
   SERVER_INSTRUCTIONS,
   START_CHECK_INSTRUCTIONS,
+  analyseModel,
   buildServer,
+  lookupLedger,
   renderCard,
   renderModelFacts,
+  resolveId,
   runCheck
-} from "./chunk-BWPYT7JO.js";
+} from "./chunk-XWIGHIJP.js";
 export {
   CHECK_VERSION,
   CallSiteSchema,
   DESTINATION_SENTENCE,
   ExtractSchema,
+  LEDGER,
+  LEDGER_SOURCES,
+  ModelMentionSchema,
   OBSERVE_DAY_PLAN,
   SERVER_INSTRUCTIONS,
   START_CHECK_INSTRUCTIONS,
+  analyseModel,
   buildServer,
+  lookupLedger,
   renderCard,
   renderModelFacts,
+  resolveId,
   runCheck
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@warmdrift/kgauto-check",
-  "version": "0.2.0",
-  "description": "Point your AI at your project \u2014 kgauto's local check, as a pure CLI for coding agents. Your agent extracts the project's AI surface (identifiers and counts, never code) and this tool checks it against kgauto's verified model catalog: statuses, prices, cliffs, capability mismatches, resilience. Fully offline; --share is the one explicit opt-in exception.",
+  "version": "0.4.0",
+  "description": "Point your AI at your project — kgauto's local check, as a pure CLI for coding agents. Your agent extracts the project's AI surface (identifiers and counts, never code) and this tool checks it against kgauto's verified model catalog: statuses, prices, cliffs, capability mismatches, resilience. Fully offline; --share is the one explicit opt-in exception.",
   "type": "module",
   "bin": {
     "kgauto-check": "dist/bin.js"
@@ -39,7 +39,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@warmdrift/kgauto-compiler": "^2.0.0-alpha.88",
+    "@warmdrift/kgauto-compiler": "^2.0.0-alpha.132",
     "zod": "^3.23.0"
   },
   "devDependencies": {
@@ -48,4 +48,4 @@
     "typescript": "^5.4.0",
     "vitest": "^2.0.0"
   }
-}
+}