@warmdrift/kgauto-check 0.4.0 → 0.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Communicating Vessels contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -13,13 +13,13 @@ Or the manual version — your part is two steps.
 **Step 1 — add the check to your agent (once).** Claude Code: run this in a terminal, then start a fresh session in your project (new MCP servers load at session start):
 
 ```bash
-claude mcp add kgauto-check -- npx -y @warmdrift/kgauto-check
+claude mcp add kgauto-check -- npx -y @warmdrift/kgauto-check@0.4.1
 ```
 
 Cursor and most other agents — add to your MCP config, then restart the app:
 
 ```json
-{ "mcpServers": { "kgauto-check": { "command": "npx", "args": ["-y", "@warmdrift/kgauto-check"] } } }
+{ "mcpServers": { "kgauto-check": { "command": "npx", "args": ["-y", "@warmdrift/kgauto-check@0.4.1"] } } }
 ```
 
 **Step 2 — paste the ask**, in your agent, inside the project you want checked:
@@ -43,16 +43,16 @@ A local, **fully offline** MCP server that checks a project's AI call surface ag
 No MCP setup, no restart:
 
 ```bash
-npx -y @warmdrift/kgauto-check --extract-contract   # extraction instructions + privacy contract
+npx -y @warmdrift/kgauto-check@0.4.1 --extract-contract   # extraction instructions + privacy contract
 # ...read the project, write extract.json per those instructions...
-npx -y @warmdrift/kgauto-check --extract extract.json   # prints the findings card, fully offline
+npx -y @warmdrift/kgauto-check@0.4.1 --extract extract.json   # prints the findings card, fully offline
 
 # Standing-value one-shots (also offline):
-npx -y @warmdrift/kgauto-check --model-facts claude-sonnet-5   # one model → the provider's word, verified prices, limits, cliffs
-npx -y @warmdrift/kgauto-check --observe-plan                  # rung 2: the one-day observe run
+npx -y @warmdrift/kgauto-check@0.4.1 --model-facts claude-sonnet-5   # one model → the provider's word, verified prices, limits, cliffs
+npx -y @warmdrift/kgauto-check@0.4.1 --observe-plan                  # rung 2: the one-day observe run
 ```
 
-**Sharing (explicit opt-in).** After presenting the card, you may OFFER your human: "want to send this card to kgauto so the catalog learns what real projects look like?" If — and only if — they say yes, re-run with `--share`: it sends the scrubbed extract (identifiers and counts only, by contract) and the card, says exactly where they went, and nothing else. Never add `--share` without their explicit yes. Without it, nothing ever leaves the machine.
+**Sharing (explicit opt-in).** After presenting the card, you may OFFER your human: "want to send this card to kgauto so the catalog learns what real projects look like?" If — and only if — they say yes, re-run with `--share`. With --share, one row is stored: a row number, the time it arrived, the project name, the extract, the card, the check’s version and the catalog’s version. The CLI prints where it went and the submission number. Never add `--share` without their explicit yes. Without it, nothing ever leaves the machine.
 
 **Offering the durable install.** The natural moment to offer the MCP install below is after a card with real findings ("want me to keep this available? `get_model_facts` answers model questions from the verified catalog between checks"). Don't push it before the card has earned it.
 
@@ -67,7 +67,7 @@ npx -y @warmdrift/kgauto-check --observe-plan                  # rung 2: the one
 
 ## An example card
 
-This is the output of `kgauto-check 0.4.0` on a small illustrative extract (two call sites, one on the provider's own API and one on Vertex AI, and a model picker), printed by the real build — not a mock-up:
+This is the output of `kgauto-check 0.4.1` on a small illustrative extract (two call sites, one on the provider's own API and one on Vertex AI, and a model picker; the extract is `tests/fixtures/readme-example.json`, and a test holds this card to the build's output), printed by the real build — not a mock-up:
 
 ````markdown
 # Communicating Vessels — the check: example-app
@@ -81,11 +81,11 @@ This is the output of `kgauto-check 0.4.0` on a small illustrative extract (two
 - 🟡 **On OpenAI's own API, `gpt-4o-mini` is deprecated and shuts down on 2027-01-14; its page names `gpt-6-luna`** — The page's line: “| January 14, 2027 | GPT-4o mini (`gpt-4o-mini-2024-07-18`) | `gpt-6-luna` |”. The catalog has no entry for it, so its limits and price were not checked.
   <sub>components/ModelPicker.tsx:12 · basis: OpenAI's page, read 2026-11-12: https://developers.openai.com/api/docs/deprecations.md (and https://developers.openai.com/api/docs/models/gpt-4o-mini.md)</sub>
 
-## Likely — priced from your estimates, or a catalog value no provider page is cited for
+## Likely — priced from your estimates or a catalog value no provider page is cited for; a provider’s word where the call may not use its own API; no retry or fallback found in the code
 
 - 🟡 **On Google's own API, `gemini-2.5-flash` is deprecated; from 2026-12-01 its requests route to `gemini-3.5-flash-lite`** — The page's line: “`gemini-2.5-flash` | June 17, 2025 | December 1, 2026 | `gemini-3.5-flash-lite` (`gemini-2.5-flash` is no longer available in Google AI Studio; effective December 1, 2026, API requests to `gemini-2.5-flash` will automatically route to `gemi”. This site runs on Vertex AI, and Vertex AI runs its own schedule (its page: https://cloud.google.com/vertex-ai/generative-ai/docs/learn/model-versions).
   <sub>lib/summarize.ts:18 · basis: Google's page, read 2026-11-12: https://aistudio.google.com/docs/deprecations; Vertex AI: https://cloud.google.com/vertex-ai/generative-ai/docs/learn/model-versions</sub>
-- ℹ️ **~$0.0046/call on `gemini-2.5-flash`** — From your token estimates and doc-verified prices ($0.3/M in, $2.5/M out, verified 2026-08-14).
+- ℹ️ **~$0.0046/call on `gemini-2.5-flash`** — From your token estimates and doc-verified prices ($0.3/M in, $2.5/M out, verified 2026-08-14). This site runs on Vertex AI: the figure is from Google's own API, and Vertex AI may set its own.
   <sub>lib/summarize.ts:18 · basis: arithmetic on your estimates × verified catalog prices</sub>
 - 🟡 **97% of this site's tokens are input** — Above ~85% input share, spend is dominated by context rather than answers — the single strongest signal of a leaking prompt. What's actually IN that context, and how much of it each call needed, is measurable, not guessable.
   <sub>lib/summarize.ts:18 · basis: your token estimates; the >85% threshold is a measured portfolio heuristic</sub>
@@ -99,13 +99,13 @@ This is the output of `kgauto-check 0.4.0` on a small illustrative extract (two
 
 ---
 *This check ran on your machine, against the catalog bundled with it and the providers’ deprecation pages it was built with. Nothing was uploaded; no rows were written anywhere.*
-<sub>@warmdrift/kgauto-check 0.4.0 · catalog @warmdrift/kgauto-compiler 2.0.0-alpha.132 · deprecation pages read 2026-11-12</sub>
+<sub>@warmdrift/kgauto-check 0.4.1 · catalog @warmdrift/kgauto-compiler 2.0.0-alpha.133 · deprecation pages read 2026-11-12</sub>
 ````
 
 ## The confidence tiers (why the card is grouped)
 
 - **certain** — the provider's own page (with its URL and the day it was read), or a fact from your code. Stated flatly.
-- **likely** — priced from your token estimates against verified prices, or a catalog value no provider page is cited for.
+- **likely** — priced from your token estimates against verified prices, or a catalog value no provider page is cited for (a cliff rule says its reason, what the compiler does about it, and the evidence behind it); a provider's word where the call may not use the provider's own API (a cloud platform, a gateway such as `openrouter/…`, or a platform the extract does not state); no retry or fallback found in the code.
 - **measurable-only** — honestly unknowable from a code read: actual failure rates, actual input-waste, spend distribution, quality-at-cheaper-price. Each of these is exactly what the one-day observe run answers.
 
 **The provider's word first (0.4.0).** A model id is matched as you wrote it (`openai/gpt-5`, `openrouter/anthropic/…`, a dated snapshot, a Bedrock or Vertex form) and looked up in a lifecycle ledger read from the four providers' own deprecation pages (Anthropic, OpenAI, Google, DeepSeek) before the catalog. A retired, shut-down, deprecated or legacy id says so, with the date, the replacement the page names, and the page's URL.
@@ -116,14 +116,14 @@ kgauto refuses to fabricate verdicts: unknown models get an honest "no measured
 
 ```bash
 # Claude Code
-claude mcp add kgauto-check -- npx -y @warmdrift/kgauto-check
+claude mcp add kgauto-check -- npx -y @warmdrift/kgauto-check@0.4.1
 ```
 
 ```json
 // Cursor / generic mcpServers config
 {
   "mcpServers": {
-    "kgauto-check": { "command": "npx", "args": ["-y", "@warmdrift/kgauto-check"] }
+    "kgauto-check": { "command": "npx", "args": ["-y", "@warmdrift/kgauto-check@0.4.1"] }
   }
 }
 ```

package/dist/bin.js

@@ -3,26 +3,20 @@ import {
   CHECK_VERSION,
   ExtractSchema,
   OBSERVE_DAY_PLAN,
+  SHARE_ENDPOINT_DEFAULT,
   START_CHECK_INSTRUCTIONS,
+  USAGE,
+  postShare,
   renderModelFacts,
   runCheck,
+  shareConfirmation,
+  shareFailure,
   startStdio
-} from "./chunk-XWIGHIJP.js";
+} from "./chunk-6ZBEABKR.js";
 
 // src/bin.ts
 import { readFileSync } from "fs";
-var SHARE_ENDPOINT = process.env.KGAUTO_SHARE_ENDPOINT_OVERRIDE || "https://kgauto-dashboard.vercel.app/api/check-submission";
-var USAGE = `kgauto-check ${CHECK_VERSION}
-
-usage:
-  npx -y @warmdrift/kgauto-check --extract-contract
-  npx -y @warmdrift/kgauto-check --extract <extract.json> [--share]
-  npx -y @warmdrift/kgauto-check --model-facts <model-id>
-  npx -y @warmdrift/kgauto-check --observe-plan
-  npx -y @warmdrift/kgauto-check            # no args: stdio MCP server
-
-The check runs fully offline. --share is the one explicit exception: it sends
-the scrubbed extract (identifiers and counts only) + the card to kgauto.`;
+var SHARE_ENDPOINT = process.env.KGAUTO_SHARE_ENDPOINT_OVERRIDE || SHARE_ENDPOINT_DEFAULT;
 var args = process.argv.slice(2);
 var flagValue = (name) => {
   const i = args.indexOf(name);
@@ -71,34 +65,21 @@ async function main() {
       process.exitCode = 1;
       return;
     }
-    const result = runCheck(parsed.data);
+    const result = runCheck(parsed.data, { share: args.includes("--share") });
     console.log(result.card);
     if (args.includes("--share")) {
-      try {
-        const res = await fetch(SHARE_ENDPOINT, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({
-            extract: parsed.data,
-            card: result.card,
-            check_version: CHECK_VERSION,
-            catalog_version: result.catalogVersion
-          })
-        });
-        const body = await res.json().catch(() => ({}));
-        if (res.ok && body.id !== void 0) {
-          console.log(
-            `
-[--share] Sent to kgauto (submission ${String(body.id)}): the extract above (identifiers and counts only) and this card \u2014 nothing else. Destination: ${SHARE_ENDPOINT}`
-          );
-        } else {
-          console.error(`
-[--share] FAILED (${res.status}${body.error ? `: ${String(body.error)}` : ""}) \u2014 nothing was recorded. The check itself is unaffected.`);
-          process.exitCode = 1;
-        }
-      } catch (err) {
+      const out = await postShare(SHARE_ENDPOINT, {
+        extract: parsed.data,
+        card: result.card,
+        check_version: CHECK_VERSION,
+        catalog_version: result.catalogVersion
+      });
+      if (out.ok) {
+        console.log(`
+${shareConfirmation(SHARE_ENDPOINT, out.id)}`);
+      } else {
         console.error(`
-[--share] FAILED (${err instanceof Error ? err.message : String(err)}) \u2014 nothing was recorded. The check itself is unaffected.`);
+${shareFailure(out.reason)}`);
         process.exitCode = 1;
       }
     }

package/dist/{chunk-XWIGHIJP.js → chunk-6ZBEABKR.js}

@@ -3680,8 +3680,9 @@ var LEDGER = [
 
 // src/lifecycle.ts
 import { allProfiles, tryGetProfile } from "@warmdrift/kgauto-compiler";
+var GATEWAYS = /* @__PURE__ */ new Set(["openrouter"]);
 var PREFIXES = {
-  openrouter: null,
+  openrouter: "openrouter",
   openai: null,
   anthropic: null,
   google: null,
@@ -3799,8 +3800,14 @@ var DEFINITION_PAGE = {
   google: "https://aistudio.google.com/docs/deprecations",
   deepseek: "https://api-docs.deepseek.com/updates"
 };
-var PARTNER_NAME = { vertex: "Vertex AI", bedrock: "Amazon Bedrock", azure: "Azure" };
+var PARTNER_NAME = {
+  vertex: "Vertex AI",
+  bedrock: "Amazon Bedrock",
+  azure: "Azure",
+  openrouter: "OpenRouter"
+};
 function partnerPage(partner, provider) {
+  if (partner === "openrouter") return "https://openrouter.ai/docs/guides/overview/models";
   if (partner === "vertex" && provider === "google") return "https://cloud.google.com/vertex-ai/generative-ai/docs/learn/model-versions";
   if (partner === "vertex" && provider === "anthropic")
     return "https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/google-managed";
@@ -3820,15 +3827,16 @@ function siteState(site, res) {
   const stated = site.platform;
   if (res.partner) {
     const conflict = stated === "provider-api" || (stated === "vertex" || stated === "bedrock" || stated === "azure") && stated !== res.partner ? `the extract says ${stated === "provider-api" ? "the provider's own API" : PARTNER_NAME[stated]}, but the id's form is ${PARTNER_NAME[res.partner]}'s` : void 0;
-    return { partner: res.partner, providerApi: false, ...conflict ? { conflict } : {} };
+    return { partner: res.partner, providerApi: false, source: "id", ...conflict ? { conflict } : {} };
   }
-  if (stated === "vertex" || stated === "bedrock" || stated === "azure") return { partner: stated, providerApi: false };
+  if (stated === "vertex" || stated === "bedrock" || stated === "azure") return { partner: stated, providerApi: false, source: "stated" };
   const words = wordPartner(site);
   if (stated === "provider-api") {
-    if (words) return { partner: words, providerApi: false, conflict: `the extract says the provider's own API, but its notes or path name ${PARTNER_NAME[words]}` };
+    if (words)
+      return { partner: words, providerApi: false, source: "words", conflict: `the extract says the provider's own API, but its notes or path name ${PARTNER_NAME[words]}` };
     return { providerApi: true };
   }
-  return { ...words ? { partner: words } : {}, providerApi: false };
+  return { ...words ? { partner: words, source: "words" } : {}, providerApi: false };
 }
 function coveredBy(provider, partner) {
   if (provider === "anthropic" && partner === "azure") return "Microsoft Foundry";
@@ -3872,10 +3880,13 @@ import {
   tryGetProfile as tryGetProfile2,
   resolveModelAlias,
   isArchetype,
-  LIBRARY_VERSION
+  LIBRARY_VERSION,
+  hasConfirmedEvidence,
+  isCapabilityReducing
 } from "@warmdrift/kgauto-compiler";
-import { retirementFloorClause } from "@warmdrift/kgauto-compiler/profiles";
+import { retirementFloorClause, deriveCliffEvidenceClass } from "@warmdrift/kgauto-compiler/profiles";
 var DESTINATION_SENTENCE = "This check ran on your machine, against the catalog bundled with it and the providers\u2019 deprecation pages it was built with. Nothing was uploaded; no rows were written anywhere.";
+var SHARE_DESTINATION_SENTENCE = "This check ran on your machine, against the catalog bundled with it and the providers\u2019 deprecation pages it was built with. Because you ran it with --share, this card and the extract are sent after it is printed.";
 var defaultResolve = (id) => ({ canonical: resolveModelAlias(id), profile: tryGetProfile2(id) });
 function perCallCostUsd(p, inTok, outTok) {
   return inTok / 1e6 * p.costInputPer1m + outTok / 1e6 * p.costOutputPer1m;
@@ -3894,8 +3905,9 @@ function placeLine(line, provider, st) {
       parts.push(`${P}'s deprecations page says its dates apply on ${covered}, so they hold on this site's platform too.`);
     } else {
       const page = partnerPage(st.partner, provider);
+      const where = page ? ` (its page: ${page}).` : " (no page of its own for this model was read).";
       parts.push(
-        `This site runs on ${N}, and ${N} runs its own schedule` + (page ? ` (its page: ${page}).` : " (no page of its own for this model was read).")
+        GATEWAYS.has(st.partner) ? `This id is written for ${N}, a gateway, and ${N} may keep its own schedule for the model${where}` : `This site runs on ${N}, and ${N} runs its own schedule${where}`
       );
       if (page) basis = `${basis}; ${N}: ${page}`;
     }
@@ -3919,7 +3931,7 @@ function ledgerLine(a) {
       title = date ? `${on} was retired on ${date}` : `${on} was retired${row.announced ? ` (change log, ${row.announced})` : ""}`;
       break;
     case "shut down":
-      title = date ? `${on} was shut down on ${date}` : `${on} has been shut down (the page's date: not before ${floor})`;
+      title = date ? `${on} was shut down on ${date}` : floor ? `${on} has been shut down (the earliest shutdown date the page gave was ${floor})` : `${on} has been shut down`;
       break;
     case "legacy":
       title = `${on} is a legacy name ${P} said it would discontinue on ${date}${past ? ", a date before this read; the page states nothing later" : ""}`;
@@ -3979,6 +3991,103 @@ function providerLifecycleLine(shown, p) {
     basis: `catalog providerLifecycle, read ${pl.readOn}: ${pl.url}`
   };
 }
+var ACTION_WORDS = {
+  downgrade_quality_warning: "attaches a warning to the compiled request and leaves the request as it is",
+  quality_gate_structured: "ranks the model lower for a request that asks for structured output at this size",
+  force_thinking_budget_zero: "turns the model's thinking off for the request",
+  force_terse_output: "asks the model for a short answer",
+  drop_to_top_relevant: "sends only the most relevant tools",
+  strip_tools: "sends the request without its tools",
+  escalate_target: "moves the request to a stronger model"
+};
+var ACTION_WOULD = {
+  force_thinking_budget_zero: "turn the model's thinking off for the request",
+  force_terse_output: "ask the model for a short answer",
+  drop_to_top_relevant: "send only the most relevant tools",
+  strip_tools: "send the request without its tools"
+};
+var QUALITY_ACTIONS = /* @__PURE__ */ new Set(["downgrade_quality_warning", "quality_gate_structured"]);
+function actionSentence(c) {
+  if (isCapabilityReducing(c.action) && !hasConfirmedEvidence(c)) {
+    return `What the compiler does about it: it would ${ACTION_WOULD[c.action] ?? c.action.replaceAll("_", " ")}, but holds that back until a probe confirms the cliff.`;
+  }
+  if (c.action === "quality_gate_structured") {
+    return `What the compiler does about it: it stops trusting this model's structured output at or above this size${c.whenIntent ? ` on ${c.whenIntent} work` : ""}, and ranks the model lower for such a request.`;
+  }
+  const w = ACTION_WORDS[c.action];
+  return w ? `What the compiler does about it: it ${w}.` : `What the compiler does about it: its action is "${c.action.replaceAll("_", " ")}".`;
+}
+function evidenceSentence(c) {
+  const ev = c.evidence;
+  const n = /\bn=(\d+)\b/.exec(c.reason)?.[1];
+  const count = n ? `, on ${n} ${n === "1" ? "call" : "calls"} (the count its reason gives)` : "";
+  if (!ev) {
+    const derived = deriveCliffEvidenceClass(c);
+    if (derived === "observed") return "Evidence: no evidence record; the catalog's note describes a measured incident.";
+    if (derived === "assumed") return "Evidence: the rule carries no evidence record; its reason says it is carried over, not measured on this model.";
+    return "Evidence: the rule carries no evidence record.";
+  }
+  const when = ev.lastProbed ? `, last ${ev.class === "observed" ? "seen" : "run"} ${ev.lastProbed}` : "";
+  switch (ev.class) {
+    case "probed": {
+      const v = ev.verdict === "confirmed" ? "a probe reproduced it" : ev.verdict === "knee-moved" ? "a probe moved its threshold and the rule was re-pinned" : ev.verdict === "flagged" ? "a probe did not reproduce it" : "a probe ran; its verdict is not recorded";
+      return `Evidence: ${v}${when}${count}.`;
+    }
+    case "observed":
+      return `Evidence: observed in real calls${when}${count}.`;
+    case "assumed":
+      return "Evidence: carried over from a similar model, not measured on this one.";
+    default:
+      return "Evidence: stated in the catalog without a measurement.";
+  }
+}
+function scopeSentence(reason) {
+  const endpoint = /(\/v\d+[a-z]*\/[a-z0-9_/.:-]*[a-z0-9_])/i.exec(reason)?.[1];
+  if (endpoint) return `It is about one endpoint, \`${endpoint}\`: it says nothing about the model reached another way.`;
+  const wire = /\bon (?:the |kgauto's )?([A-Za-z][\w .-]*?) wire\b/.exec(reason)?.[1];
+  if (wire) return `It is about one wire, ${wire}: it says nothing about the model reached another way.`;
+  return "";
+}
+var INTERNAL_APPS = [
+  "playbacksam",
+  "tt-intel",
+  "tt-intelligence",
+  "inspire-central",
+  "global-expansion",
+  "lovable-intelligence",
+  "incantato",
+  "ivypass"
+];
+var namesInternalApp = (text2) => INTERNAL_APPS.some((n) => text2.toLowerCase().includes(n));
+function cliffLine(canonical, c, metricValue) {
+  const parts = [];
+  const onWork = c.whenIntent ? ` on ${c.whenIntent} work` : "";
+  const recorded = c.evidence?.class === "observed" || hasConfirmedEvidence(c);
+  if (QUALITY_ACTIONS.has(c.action) && recorded) {
+    parts.push(`Above this threshold${onWork}, quality degrades in a measured, repeatable way.`);
+  }
+  parts.push(
+    namesInternalApp(c.reason) ? "The catalog's note for this rule is written for our own records and is not quoted." : `The catalog's reason${c.whenIntent ? ` (for ${c.whenIntent} work)` : ""}: \u201C${c.reason.trim().replace(/\.$/, "")}\u201D.`
+  );
+  const scope = scopeSentence(c.reason);
+  if (scope) parts.push(scope);
+  parts.push(actionSentence(c));
+  parts.push(evidenceSentence(c));
+  const where = metricValue === c.threshold ? "at the line" : "over the line";
+  parts.push(
+    c.metric === "tool_count" ? `This site offers ${metricValue.toLocaleString()} ${metricValue === 1 ? "tool" : "tools"}, ${where}.` : `Your estimate of ${metricValue.toLocaleString()} sits ${where}.`
+  );
+  const ev = c.evidence;
+  const tag = ev ? `evidence: ${[ev.class, ev.verdict, ev.lastProbed].filter(Boolean).join(", ")}` : "no evidence record";
+  return {
+    severity: "yellow",
+    confidence: "likely",
+    // Amendment D2: the title agrees with the sentence — "reaches" at equality, "crosses" above.
+    title: `\`${canonical}\` has a known ${c.metric.replaceAll("_", " ")} cliff at ${c.threshold.toLocaleString()} \u2014 this site ${metricValue === c.threshold ? "reaches" : "crosses"} it`,
+    detail: parts.join(" "),
+    basis: `the catalog's cliff rule (${tag}) vs ${c.metric === "tool_count" ? "this site's tool count" : "your estimate"}`
+  };
+}
 function analyseModel(configured, opts = {}, site = {}) {
   const resolveCat = opts.resolve ?? defaultResolve;
   const roster = opts.roster ?? allProfiles2;
@@ -4013,7 +4122,7 @@ function analyseModel(configured, opts = {}, site = {}) {
       basis: "catalog lookup and the providers\u2019 deprecation lists"
     });
   }
-  return { res, shown: shownId, row, via: hit.via, profile, canonical: profile ? canonical : res.base, lines, partner };
+  return { res, shown: shownId, row, via: hit.via, profile, canonical: profile ? canonical : res.base, lines, partner, state: st };
 }
 function runCheck(extract, opts = {}) {
   const roster = opts.roster ?? allProfiles2;
@@ -4026,7 +4135,7 @@ function runCheck(extract, opts = {}) {
   const bySite = /* @__PURE__ */ new Map();
   const analyse = (m, site) => {
     const st = siteState(site, resolveId(m));
-    const key = `${m}|${st.partner ?? ""}|${st.providerApi}|${st.conflict ?? ""}`;
+    const key = `${m}|${st.partner ?? ""}|${st.providerApi}|${st.conflict ?? ""}|${st.source ?? ""}`;
     let a = bySite.get(key);
     if (!a) {
       a = analyseModel(m, opts, site);
@@ -4042,15 +4151,19 @@ function runCheck(extract, opts = {}) {
     const profile = a.profile;
     if (!profile) continue;
     const canonical = a.canonical;
-    const docTier = profile.verifiedAgainstDocs ? "certain" : "likely";
+    const offApi = a.partner;
+    const docTier = profile.verifiedAgainstDocs && !offApi ? "certain" : "likely";
     const docBasis = profile.verifiedAgainstDocs ? `catalog, verified against the provider's page ${profile.verifiedAgainstDocs}` : "catalog value, not dated against a provider page";
+    const PP = PROVIDER_NAME[profile.provider] ?? profile.provider;
+    const NP = offApi ? PARTNER_NAME[offApi] : "";
+    const whose = offApi ? (GATEWAYS.has(offApi) ? ` This id is written for ${NP}, a gateway: the figure is from ${PP}'s own API, and ${NP} may set its own.` : a.state?.source === "words" ? ` This site's path or notes name ${NP}; if it runs there, the figure is from ${PP}'s own API and ${NP} may set its own.` : ` This site runs on ${NP}: the figure is from ${PP}'s own API, and ${NP} may set its own.`) + (a.state?.conflict ? ` The extract and the code disagree: ${a.state.conflict}.` : "") : "";
     const worstIn = site.maxInputTokens ?? site.estInputTokens;
     if (worstIn !== void 0 && worstIn > profile.maxContextTokens) {
       add({
         severity: "red",
         confidence: site.maxInputTokens !== void 0 ? docTier : "likely",
         title: `input can exceed \`${canonical}\`'s context window`,
-        detail: `Your ${site.maxInputTokens !== void 0 ? "worst-case" : "typical"} input estimate (${worstIn.toLocaleString()} tokens) exceeds the model's ${profile.maxContextTokens.toLocaleString()}-token window. Those calls fail outright or silently truncate, depending on the provider.`,
+        detail: `Your ${site.maxInputTokens !== void 0 ? "worst-case" : "typical"} input estimate (${worstIn.toLocaleString()} tokens) exceeds the model's ${profile.maxContextTokens.toLocaleString()}-token window. Those calls fail outright or silently truncate, depending on the provider.${whose}`,
         basis: `your estimate vs ${docBasis}: maxContextTokens=${profile.maxContextTokens}`,
         callSites: at
       });
@@ -4060,7 +4173,7 @@ function runCheck(extract, opts = {}) {
         severity: "red",
         confidence: "likely",
         title: `expected output exceeds \`${canonical}\`'s output cap`,
-        detail: `You expect ~${site.estOutputTokens.toLocaleString()} output tokens; the model caps at ${profile.maxOutputTokens.toLocaleString()}. Responses will be cut mid-generation \u2014 on JSON output this is the classic unparseable-tail failure.`,
+        detail: `You expect ~${site.estOutputTokens.toLocaleString()} output tokens; the model caps at ${profile.maxOutputTokens.toLocaleString()}. Responses will be cut mid-generation \u2014 on JSON output this is the classic unparseable-tail failure.${whose}`,
         basis: `your estimate vs ${docBasis}: maxOutputTokens=${profile.maxOutputTokens}`,
         callSites: at
       });
@@ -4080,7 +4193,7 @@ function runCheck(extract, opts = {}) {
         severity: "red",
         confidence: docTier,
         title: `\`${canonical}\` has no structured-output support, but this site parses JSON`,
-        detail: `Output-shape failures here land on your parser as intermittent exceptions. Models with native or grammar-constrained output move that failure from runtime to the request.`,
+        detail: `Output-shape failures here land on your parser as intermittent exceptions. Models with native or grammar-constrained output move that failure from runtime to the request.${whose}`,
         basis: `${docBasis}: structuredOutput=none`,
         callSites: at
       });
@@ -4090,14 +4203,8 @@ function runCheck(extract, opts = {}) {
       if (cliff.whenIntent && cliff.whenIntent !== archetype) continue;
       const metricValue = cliff.metric === "input_tokens" ? worstIn : cliff.metric === "tool_count" ? site.toolCount : void 0;
       if (metricValue === void 0 || metricValue < cliff.threshold) continue;
-      add({
-        severity: "yellow",
-        confidence: "likely",
-        title: `\`${canonical}\` has a known ${cliff.metric.replaceAll("_", " ")} cliff at ${cliff.threshold.toLocaleString()} \u2014 this site crosses it`,
-        detail: `Above this threshold${cliff.whenIntent ? ` on ${cliff.whenIntent} work` : ""}, quality degrades in a measured, repeatable way (the catalog's compiler action: ${cliff.action.replaceAll("_", " ")}). Your estimate of ${metricValue.toLocaleString()} sits over the line.`,
-        basis: `the catalog's cliff rule vs your estimate`,
-        callSites: at
-      });
+      if (cliff.action === "quality_gate_structured" && !site.expectsStructuredOutput) continue;
+      add({ ...cliffLine(canonical, cliff, metricValue), callSites: at });
     }
     if (site.retry === "none") {
       const PN = PROVIDER_NAME[profile.provider] ?? profile.provider;
@@ -4118,7 +4225,7 @@ function runCheck(extract, opts = {}) {
         severity: "info",
         confidence: "likely",
         title: `~$${perCall.toFixed(4)}/call on \`${canonical}\`${monthly !== void 0 ? ` (~$${monthly.toFixed(2)}/month at your volume)` : ""}`,
-        detail: `From your token estimates and doc-verified prices ($${profile.costInputPer1m}/M in, $${profile.costOutputPer1m}/M out${profile.verifiedAgainstDocs ? `, verified ${profile.verifiedAgainstDocs}` : ""}).`,
+        detail: `From your token estimates and doc-verified prices ($${profile.costInputPer1m}/M in, $${profile.costOutputPer1m}/M out${profile.verifiedAgainstDocs ? `, verified ${profile.verifiedAgainstDocs}` : ""}).${whose}`,
         basis: "arithmetic on your estimates \xD7 verified catalog prices",
         callSites: at
       });
@@ -4184,18 +4291,20 @@ function runCheck(extract, opts = {}) {
   }
   return {
     findings: merged,
-    card: renderCard(extract, merged, analyses),
+    card: renderCard(extract, merged, analyses, opts.share === true),
     catalogVersion: LIBRARY_VERSION
   };
 }
 var TIER_ORDER = ["certain", "likely", "measurable-only"];
 var TIER_HEADING = {
   certain: "Certain \u2014 read from the providers\u2019 pages and your code",
-  likely: "Likely \u2014 priced from your estimates, or a catalog value no provider page is cited for",
+  // 0.4.1 (R5): since 0.4.0 this tier also holds a provider's word on a call that may not use the provider's own
+  // API (a partner, a gateway, an unstated platform) and the no-fallback line; the heading names all three.
+  likely: "Likely \u2014 priced from your estimates or a catalog value no provider page is cited for; a provider\u2019s word where the call may not use its own API; no retry or fallback found in the code",
   "measurable-only": "Only measurable \u2014 what the observe day answers"
 };
 var SEV_MARK = { red: "\u{1F534}", yellow: "\u{1F7E1}", info: "\u2139\uFE0F" };
-function renderCard(extract, findings, analyses = /* @__PURE__ */ new Map()) {
+function renderCard(extract, findings, analyses = /* @__PURE__ */ new Map(), share = false) {
   const lines = [];
   lines.push(`# Communicating Vessels \u2014 the check: ${extract.project.name}`);
   lines.push("");
@@ -4243,14 +4352,50 @@ function renderCard(extract, findings, analyses = /* @__PURE__ */ new Map()) {
   }
   lines.push("");
   lines.push("---");
-  lines.push(`*${DESTINATION_SENTENCE}*`);
+  lines.push(`*${share ? SHARE_DESTINATION_SENTENCE : DESTINATION_SENTENCE}*`);
   lines.push(
     `<sub>@warmdrift/kgauto-check ${CHECK_VERSION} \xB7 catalog @warmdrift/kgauto-compiler ${LIBRARY_VERSION} \xB7 deprecation pages read ${LEDGER_READ_ON}</sub>`
   );
   return lines.join("\n");
 }
 
+// src/share.ts
+var SHARE_ENDPOINT_DEFAULT = "https://kgauto-dashboard.vercel.app/api/check-submission";
+var SHARE_STORED_SENTENCE = "With --share, one row is stored: a row number, the time it arrived, the project name, the extract, the card, the check\u2019s version and the catalog\u2019s version.";
+async function postShare(endpoint, body, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    const parsed = await res.json().catch(() => ({}));
+    if (res.ok && parsed.ok === true && parsed.id !== void 0 && parsed.id !== null) return { ok: true, id: String(parsed.id) };
+    return { ok: false, reason: `${res.status}${parsed.error ? `: ${String(parsed.error)}` : parsed.ok === true ? "" : ": no {ok: true, id} in the answer"}` };
+  } catch (err) {
+    return { ok: false, reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+function shareFailure(reason) {
+  return `[--share] FAILED (${reason}) \u2014 the endpoint did not confirm a row, so a row may or may not exist. The check itself is unaffected.`;
+}
+function shareConfirmation(endpoint, id) {
+  return `[--share] Sent to ${endpoint} (submission ${id}). ${SHARE_STORED_SENTENCE}`;
+}
+
 // src/instructions.ts
+var NPX = `npx -y @warmdrift/kgauto-check@${CHECK_VERSION}`;
+var USAGE = `kgauto-check ${CHECK_VERSION}
+
+usage:
+  ${NPX} --extract-contract
+  ${NPX} --extract <extract.json> [--share]
+  ${NPX} --model-facts <model-id>
+  ${NPX} --observe-plan
+  ${NPX}            # no args: stdio MCP server
+
+The check runs fully offline. --share is the one explicit exception.
+${SHARE_STORED_SENTENCE}`;
 var SERVER_INSTRUCTIONS = `You are talking to kgauto-check, a local, offline checker for AI call surfaces.
 
 Flow: (1) call start_check to get extraction instructions, (2) read THIS project's code yourself and build the extract, (3) call run_check with it, (4) present the returned card to your human verbatim (it is grouped by confidence tier on purpose), (5) if they want measured numbers, call get_observe_day_plan.
@@ -4292,11 +4437,11 @@ Do NOT put prompt text, source code, file contents, or secrets in the extract. I
 Write the extract as JSON:
 { "project": { "name": "...", "description": "..." }, "callSites": [ ...one object per call site, or none... ], "models": [ ...optional, ids no call site carries... ] }
 and run:
-  npx -y @warmdrift/kgauto-check --extract extract.json
+  ${NPX} --extract extract.json
 Present the printed card verbatim \u2014 the confidence tiers (certain / likely / measurable-only) are the point: they tell your human exactly how much to trust each line, and the measurable-only section is what a one-day observe run would answer.
 
 ## Sharing (optional, explicit)
-After presenting the card, you may OFFER your human: "want to send this card to kgauto so the catalog learns what real projects look like?" If \u2014 and only if \u2014 they say yes, re-run with --share. Never add --share without their explicit yes. It sends the scrubbed extract and the card, nothing else, and says exactly where they went.
+After presenting the card, you may OFFER your human: "want to send this card to kgauto so the catalog learns what real projects look like?" If \u2014 and only if \u2014 they say yes, re-run with --share. Never add --share without their explicit yes. ${SHARE_STORED_SENTENCE} The CLI prints where it went and the submission number.
 
 ## Honesty rules you inherit while presenting
 - Do not soften "certain" findings or upgrade "likely" ones.
@@ -4338,7 +4483,8 @@ function renderModelFacts(model) {
     const dates = [
       r.announced ? `announced ${r.announced}` : "",
       r.shutdown ? `${r.word === "deprecated" || r.word === "legacy" || r.word === "rerouted" ? "shutdown / discontinuation date" : r.word} ${r.shutdown}` : "",
-      r.shutdownFloor ? `not before ${r.shutdownFloor}` : ""
+      // 0.4.1 (R5): on a model already shut down the floor is the page's earliest date, said in the past.
+      r.shutdownFloor ? r.word === "shut down" ? `the earliest shutdown date the page gave was ${r.shutdownFloor}` : `not before ${r.shutdownFloor}` : ""
     ].filter(Boolean);
     out.push(
       `- ${P}'s word: **${r.word}**${dates.length ? ` (${dates.join("; ")})` : ""}${r.replacement ? ` \xB7 replacement the page names: \`${r.replacement}\`` : ""}${r.routesTo ? ` \xB7 requests routed to: ${r.routesTo}` : ""}`
@@ -4348,8 +4494,9 @@ function renderModelFacts(model) {
     if (a.via) out.push(`- matched the dated snapshot \`${a.via}\` the page lists`);
     if (a.partner) {
       const page = partnerPage(a.partner, r.provider);
+      const N = PARTNER_NAME[a.partner];
       out.push(
-        `- this id form is ${PARTNER_NAME[a.partner]}'s: ${P}'s word above is for ${P}'s own API, and ${PARTNER_NAME[a.partner]} runs its own schedule${page ? ` (${page})` : ""}`
+        GATEWAYS.has(a.partner) ? `- this id form is ${N}'s, a gateway: ${P}'s word above is for ${P}'s own API, and ${N} may keep its own schedule${page ? ` (${page})` : ""}` : `- this id form is ${N}'s: ${P}'s word above is for ${P}'s own API, and ${N} runs its own schedule${page ? ` (${page})` : ""}`
       );
     }
   }
@@ -4475,6 +4622,11 @@ export {
   analyseModel,
   runCheck,
   renderCard,
+  SHARE_ENDPOINT_DEFAULT,
+  postShare,
+  shareFailure,
+  shareConfirmation,
+  USAGE,
   SERVER_INSTRUCTIONS,
   START_CHECK_INSTRUCTIONS,
   OBSERVE_DAY_PLAN,

package/dist/index.d.ts

@@ -368,8 +368,11 @@ interface Resolution {
     /** Set when the id is a partner platform's form: its lifecycle dates may differ from the provider's own API. */
     partner?: Partner;
 }
-/** A cloud platform that serves a provider's models on its own lifecycle schedule. */
-type Partner = 'vertex' | 'bedrock' | 'azure';
+/**
+ * A cloud platform that serves a provider's models on its own lifecycle schedule, or (0.4.1, R3)
+ * a gateway the id is explicitly written for: neither is the provider's own API.
+ */
+type Partner = 'vertex' | 'bedrock' | 'azure' | 'openrouter';
 /**
  * The prefix, Bedrock and Vertex forms are rewritten to the provider's own
  * id. A dated snapshot is NOT stripped here — the lookup tries the dated id
@@ -384,6 +387,16 @@ interface LedgerHit {
     catalogId: string;
 }
 declare function lookupLedger(res: Resolution): LedgerHit;
+interface SiteState {
+    /** The partner platform the site runs on, if anything says so. */
+    partner?: Partner;
+    /** The extract stated the provider's own API and nothing contradicts it: the only certain case. */
+    providerApi: boolean;
+    /** The extract's stated platform and the id's form or the site's notes disagree. */
+    conflict?: string;
+    /** Amendment D1: where the partner came from — the id's own form, the extract's stated platform, or only words in the path or notes. */
+    source?: 'id' | 'stated' | 'words';
+}
 
 /**
  * The deterministic check engine. Every finding carries a confidence tier —
@@ -392,7 +405,9 @@ declare function lookupLedger(res: Resolution): LedgerHit;
  *   certain          — the provider's own page, or a fact read from the
  *                      developer's code; stated flatly.
  *   likely           — priced/inferred from the agent's own estimates, or a
- *                      kgauto catalog value no provider page is cited for.
+ *                      kgauto catalog value no provider page is cited for; a
+ *                      provider's word where the call may not use the
+ *                      provider's own API; no retry or fallback in the code.
  *   measurable-only  — honestly unknowable from a code read; each one is
  *                      exactly what the observe day exists to measure.
  *
@@ -432,6 +447,8 @@ interface EngineOptions {
     };
     /** Test seam: full roster override (for cheaper-candidate scans and the family sort). */
     roster?: () => ModelProfile[];
+    /** Amendment B3: the user ran the CLI with --share, so the footer must not say nothing is uploaded. */
+    share?: boolean;
 }
 declare const DESTINATION_SENTENCE: string;
 type Line = Omit<Finding, 'id' | 'callSites'>;
@@ -450,6 +467,8 @@ interface ModelAnalysis {
     lines: Line[];
     /** The partner platform the site runs on, when the extract shows one. */
     partner?: Partner;
+    /** Amendment D1: the site's state, so a line can say where its partner came from. */
+    state?: SiteState;
 }
 declare function analyseModel(configured: string, opts?: EngineOptions, site?: {
     id?: string;
@@ -458,7 +477,7 @@ declare function analyseModel(configured: string, opts?: EngineOptions, site?: {
     platform?: string;
 }): ModelAnalysis;
 declare function runCheck(extract: Extract, opts?: EngineOptions): CheckResult;
-declare function renderCard(extract: Extract, findings: Finding[], analyses?: ReadonlyMap<string, ModelAnalysis>): string;
+declare function renderCard(extract: Extract, findings: Finding[], analyses?: ReadonlyMap<string, ModelAnalysis>, share?: boolean): string;
 
 /**
  * GENERATED by scripts/build-ledger.mjs from the providers' own deprecation
@@ -476,7 +495,7 @@ declare const LEDGER: readonly LedgerRow[];
 declare function buildServer(): McpServer;
 
 declare const SERVER_INSTRUCTIONS = "You are talking to kgauto-check, a local, offline checker for AI call surfaces.\n\nFlow: (1) call start_check to get extraction instructions, (2) read THIS project's code yourself and build the extract, (3) call run_check with it, (4) present the returned card to your human verbatim (it is grouped by confidence tier on purpose), (5) if they want measured numbers, call get_observe_day_plan.\n\nPrivacy contract, which you should relay to your human: the extract contains identifiers and counts only \u2014 never prompt text, never source code, never secrets. This check ran on your machine, against the catalog bundled with it and the providers\u2019 deprecation pages it was built with. Nothing was uploaded; no rows were written anywhere.\n\nget_model_facts answers one-off questions about any model id \u2014 what its provider's deprecation page says, then the verified catalog \u2014 and is what makes keeping this server installed useful between checks.";
-declare const START_CHECK_INSTRUCTIONS = "# kgauto check \u2014 extraction instructions (for you, the agent)\n\nYour job: read this project's code and build an extract of its AI call surface. You have repo access; kgauto does not, by design.\n\n## What to find\nScan for LLM API usage: provider SDK imports (anthropic, openai, @google/generative-ai / @google/genai, ai-sdk, litellm, langchain, ...), raw HTTPS calls to provider endpoints, and any internal wrapper around them. Each distinct place the project sends a prompt to a model is one call site.\n\n## What to collect per call site (identifiers and counts ONLY)\n- id: a stable label you choose, e.g. \"api/summarize.ts:42\"\n- model: the model id exactly as configured (a provider or gateway prefix such as openai/ or openrouter/anthropic/ is fine; the check says what it looked the id up as)\n- modelSelection: hardcoded | config | env | dynamic\n- platform: state it for EVERY call site \u2014 where the request is served: provider-api (the provider's own API), vertex, bedrock, azure, or other (a gateway or another host). Tell it from the SDK imported (e.g. @anthropic-ai/sdk vs @anthropic-ai/vertex-sdk or @aws-sdk/client-bedrock-runtime; google-genai vs google.cloud.aiplatform / @google-cloud/aiplatform), the base URL (api.openai.com vs *.openai.azure.com; generativelanguage.googleapis.com vs *-aiplatform.googleapis.com), and the credentials used (a provider API key vs cloud credentials, a project and location). A lifecycle line is stated as certain only for provider-api; a cloud platform keeps its own schedule. If you truly cannot tell, write other and say why in notes.\n- archetype: your best guess at the work's intent \u2014 one of: ask, classify, critique, extract, generate, hunt, plan, summarize, transform\n- estInputTokens / maxInputTokens / estOutputTokens: estimate from the code (what gets concatenated into the prompt; ~4 chars per token). Worst case matters \u2014 find the biggest thing that can flow in.\n- toolCount, usesParallelToolCalls: from the tools array and how results are consumed\n- expectsStructuredOutput: true if the response is JSON.parse'd or schema-validated\n- streaming, retry (none | same-model | fallback-chain | unknown), fallbackModels\n- estCallsPerMonth: only if genuinely inferable (cron cadence, obvious traffic); omit rather than invent\n\n## Model ids with no call site\nIf the project holds model ids that no call site above carries \u2014 a model picker, a config or environment default, a list of supported models \u2014 list each once under \"models\" (identifiers only):\n- model: the id exactly as written\n- where: file:line where it is written\n- modelSelection: hardcoded | config | env | dynamic (optional)\n- platform: provider-api | vertex | bedrock | azure | other (as above)\nIf you find no call site at all (the project spawns a CLI, or takes the model as a run-time argument), \"callSites\" may be an empty array: the check still prints a card, about the ids in \"models\", and says no call site was found to check a request shape against. Never invent a model id to fill a call site.\n\n## Privacy contract (relay this to your human)\nDo NOT put prompt text, source code, file contents, or secrets in the extract. Identifiers and counts only. This check ran on your machine, against the catalog bundled with it and the providers\u2019 deprecation pages it was built with. Nothing was uploaded; no rows were written anywhere.\n\n## Then\nWrite the extract as JSON:\n{ \"project\": { \"name\": \"...\", \"description\": \"...\" }, \"callSites\": [ ...one object per call site, or none... ], \"models\": [ ...optional, ids no call site carries... ] }\nand run:\n  npx -y @warmdrift/kgauto-check --extract extract.json\nPresent the printed card verbatim \u2014 the confidence tiers (certain / likely / measurable-only) are the point: they tell your human exactly how much to trust each line, and the measurable-only section is what a one-day observe run would answer.\n\n## Sharing (optional, explicit)\nAfter presenting the card, you may OFFER your human: \"want to send this card to kgauto so the catalog learns what real projects look like?\" If \u2014 and only if \u2014 they say yes, re-run with --share. Never add --share without their explicit yes. It sends the scrubbed extract and the card, nothing else, and says exactly where they went.\n\n## Honesty rules you inherit while presenting\n- Do not soften \"certain\" findings or upgrade \"likely\" ones.\n- If a model was unknown to the catalog, say so \u2014 kgauto refuses to fabricate verdicts, and so should you.\n- A line that names a provider's word (retired, shut down, deprecated, legacy) carries the page it was read on: quote it as written.\n- Estimates you made are estimates: if a finding hinges on your token guess, say it can be firmed up by measuring.";
+declare const START_CHECK_INSTRUCTIONS: string;
 
 /**
  * Rung 2 of the ladder: the one-day observe run. v1 of this tool hands the

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   renderModelFacts,
   resolveId,
   runCheck
-} from "./chunk-XWIGHIJP.js";
+} from "./chunk-6ZBEABKR.js";
 export {
   CHECK_VERSION,
   CallSiteSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmdrift/kgauto-check",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Point your AI at your project — kgauto's local check, as a pure CLI for coding agents. Your agent extracts the project's AI surface (identifiers and counts, never code) and this tool checks it against kgauto's verified model catalog: statuses, prices, cliffs, capability mismatches, resilience. Fully offline; --share is the one explicit opt-in exception.",
   "type": "module",
   "bin": {
@@ -10,7 +10,8 @@
   "types": "dist/index.d.ts",
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "engines": {
     "node": ">=18"
@@ -31,7 +32,7 @@
     "ai-cost",
     "prompt-compiler"
   ],
-  "license": "UNLICENSED",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stue/kgauto.git",
@@ -39,7 +40,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@warmdrift/kgauto-compiler": "^2.0.0-alpha.132",
+    "@warmdrift/kgauto-compiler": "2.0.0-alpha.133",
     "zod": "^3.23.0"
   },
   "devDependencies": {