@warmdrift/kgauto-compiler 2.0.0-alpha.56 → 2.0.0-alpha.58

package/dist/chunk-B4INZ32V.mjs

@@ -0,0 +1,185 @@
+// src/key-health.ts
+var JSON_HEADERS = { "Content-Type": "application/json" };
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function bearerOf(req) {
+  const header = req.headers.get("Authorization") ?? "";
+  const match = /^Bearer\s+(.+)$/i.exec(header);
+  return match?.[1]?.trim() ?? "";
+}
+function requireString(name, value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`createKeyHealthRoute: ${name} is required`);
+  }
+  return value;
+}
+function envKey(env, name) {
+  const v = env[name];
+  if (typeof v !== "string") return void 0;
+  const trimmed = v.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+var PROBE_SPECS = [
+  {
+    provider: "anthropic",
+    canonicalEnvName: "ANTHROPIC_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.anthropic.com/v1/models?limit=1",
+      headers: { "x-api-key": key, "anthropic-version": "2023-06-01" }
+    })
+  },
+  {
+    provider: "deepseek",
+    canonicalEnvName: "DEEPSEEK_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.deepseek.com/user/balance",
+      headers: { Authorization: `Bearer ${key}` }
+    }),
+    parseBalanceUsd: (body) => {
+      const infos = body?.balance_infos;
+      if (!Array.isArray(infos) || infos.length === 0) return void 0;
+      const first = infos[0];
+      if (first?.currency !== "USD") return void 0;
+      const n = Number(first.total_balance);
+      return Number.isFinite(n) ? n : void 0;
+    }
+  },
+  {
+    provider: "google",
+    canonicalEnvName: "GEMINI_API_KEY",
+    buildRequest: (key) => ({
+      url: `https://generativelanguage.googleapis.com/v1beta/models?pageSize=1&key=${encodeURIComponent(key)}`,
+      headers: {}
+    })
+  },
+  {
+    provider: "openai",
+    canonicalEnvName: "OPENAI_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.openai.com/v1/models",
+      headers: { Authorization: `Bearer ${key}` }
+    })
+  }
+];
+function createKeyHealthRoute(config) {
+  const appId = requireString("appId", config.appId);
+  const ingestSecret = requireString("ingestSecret", config.ingestSecret);
+  const fetchFn = config.fetchImpl ?? fetch;
+  const timeoutMs = config.timeoutMs ?? 3e3;
+  async function probeProvider(spec, env) {
+    let key;
+    let envName = spec.canonicalEnvName;
+    if (spec.provider === "google") {
+      const gemini = envKey(env, "GEMINI_API_KEY");
+      const google = envKey(env, "GOOGLE_API_KEY");
+      const aiSdk = envKey(env, "GOOGLE_GENERATIVE_AI_API_KEY");
+      key = gemini ?? google ?? aiSdk;
+      envName = gemini ? "GEMINI_API_KEY" : google ? "GOOGLE_API_KEY" : aiSdk ? "GOOGLE_GENERATIVE_AI_API_KEY" : "GEMINI_API_KEY";
+    } else {
+      key = envKey(env, spec.canonicalEnvName);
+    }
+    if (!key) {
+      return {
+        provider: spec.provider,
+        env: envName,
+        present: false,
+        valid: null,
+        detail: "key_absent"
+      };
+    }
+    const base = {
+      provider: spec.provider,
+      env: envName,
+      present: true,
+      valid: null
+    };
+    const { url, headers } = spec.buildRequest(key);
+    const started = Date.now();
+    let res;
+    try {
+      res = await fetchFn(url, {
+        method: "GET",
+        headers,
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err) {
+      const isTimeout = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+      return {
+        ...base,
+        latency_ms: Date.now() - started,
+        // NEVER echo err.message — provider errors could theoretically carry
+        // request context; a fixed vocabulary keeps key material impossible.
+        detail: isTimeout ? "timeout" : "network_error"
+      };
+    }
+    const latencyMs = Date.now() - started;
+    if (res.ok) {
+      const result = {
+        ...base,
+        valid: true,
+        status: res.status,
+        latency_ms: latencyMs
+      };
+      if (spec.parseBalanceUsd) {
+        try {
+          const body = await res.json();
+          const balance = spec.parseBalanceUsd(body);
+          if (balance !== void 0) result.balance_usd = balance;
+        } catch {
+        }
+      }
+      return result;
+    }
+    if (res.status === 401 || res.status === 403) {
+      return { ...base, valid: false, status: res.status, latency_ms: latencyMs };
+    }
+    return {
+      ...base,
+      valid: null,
+      status: res.status,
+      latency_ms: latencyMs,
+      detail: `http_${res.status}`
+    };
+  }
+  async function handle(req) {
+    try {
+      if (req.method !== "GET") {
+        return jsonResponse(405, { error: "method_not_allowed" });
+      }
+      if (bearerOf(req) !== ingestSecret) {
+        return jsonResponse(401, { error: "unauthorized" });
+      }
+      const env = config.env ?? process.env;
+      const settled = await Promise.allSettled(
+        PROBE_SPECS.map((spec) => probeProvider(spec, env))
+      );
+      const keys = settled.map((s, i) => {
+        if (s.status === "fulfilled") return s.value;
+        const spec = PROBE_SPECS[i];
+        return {
+          provider: spec.provider,
+          env: spec.canonicalEnvName,
+          present: true,
+          valid: null,
+          detail: "probe_failed"
+        };
+      });
+      keys.sort((a, b) => a.provider.localeCompare(b.provider));
+      const body = {
+        app_id: appId,
+        checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+        keys
+      };
+      return jsonResponse(200, body);
+    } catch (err) {
+      void err;
+      return jsonResponse(500, { error: "key_health_internal_error" });
+    }
+  }
+  return { handle };
+}
+
+export {
+  createKeyHealthRoute
+};

package/dist/glassbox/index.d.mts

@@ -1,6 +1,6 @@
-import { G as GlassboxEvent } from '../types-C_dkNMA_.mjs';
-export { A as AdvisoryFiredData, C as CompileDoneData, a as CompileStartData, E as ExecuteAttemptData, b as ExecuteSuccessData, F as FallbackWalkedData, c as GLASSBOX_STREAM_TTL_MS, d as GlassboxEventKind, e as GlassboxPubSub } from '../types-C_dkNMA_.mjs';
-import '../ir-CAlLBu5d.mjs';
+import { G as GlassboxEvent } from '../types-CRy90cjp.mjs';
+export { A as AdvisoryFiredData, C as CompileDoneData, a as CompileStartData, E as ExecuteAttemptData, b as ExecuteSuccessData, F as FallbackWalkedData, c as GLASSBOX_STREAM_TTL_MS, d as GlassboxEventKind, e as GlassboxPubSub } from '../types-CRy90cjp.mjs';
+import '../ir-BC4uDL98.mjs';
 import '../dialect.mjs';
 
 /**

package/dist/glassbox/index.d.ts

@@ -1,6 +1,6 @@
-import { G as GlassboxEvent } from '../types-hEDGehpz.js';
-export { A as AdvisoryFiredData, C as CompileDoneData, a as CompileStartData, E as ExecuteAttemptData, b as ExecuteSuccessData, F as FallbackWalkedData, c as GLASSBOX_STREAM_TTL_MS, d as GlassboxEventKind, e as GlassboxPubSub } from '../types-hEDGehpz.js';
-import '../ir-BiXAMyji.js';
+import { G as GlassboxEvent } from '../types-CsB2YASc.js';
+export { A as AdvisoryFiredData, C as CompileDoneData, a as CompileStartData, E as ExecuteAttemptData, b as ExecuteSuccessData, F as FallbackWalkedData, c as GLASSBOX_STREAM_TTL_MS, d as GlassboxEventKind, e as GlassboxPubSub } from '../types-CsB2YASc.js';
+import '../ir-B2h0GAEL.js';
 import '../dialect.js';
 
 /**

package/dist/glassbox-routes/format.d.mts

@@ -1,5 +1,5 @@
-import { T as TraceHealth } from '../types-Dj5FLhBV.mjs';
-import '../ir-CAlLBu5d.mjs';
+import { T as TraceHealth } from '../types-B-pzBJKf.mjs';
+import '../ir-BC4uDL98.mjs';
 import '../dialect.mjs';
 
 /**

package/dist/glassbox-routes/format.d.ts

@@ -1,5 +1,5 @@
-import { T as TraceHealth } from '../types-DsA8JFOp.js';
-import '../ir-BiXAMyji.js';
+import { T as TraceHealth } from '../types-CKuu7Clz.js';
+import '../ir-B2h0GAEL.js';
 import '../dialect.js';
 
 /**

package/dist/glassbox-routes/index.d.mts

@@ -1,7 +1,7 @@
-import { G as GlassboxEvent } from '../types-C_dkNMA_.mjs';
-import { a as TraceDetail, b as TraceSummary, c as TraceCounterfactual } from '../types-Dj5FLhBV.mjs';
-export { A as AdvisoryRecord, T as TraceHealth, d as TraceSectionRewrite } from '../types-Dj5FLhBV.mjs';
-import '../ir-CAlLBu5d.mjs';
+import { G as GlassboxEvent } from '../types-CRy90cjp.mjs';
+import { a as TraceDetail, b as TraceSummary, c as TraceCounterfactual } from '../types-B-pzBJKf.mjs';
+export { A as AdvisoryRecord, T as TraceHealth, d as TraceSectionRewrite } from '../types-B-pzBJKf.mjs';
+import '../ir-BC4uDL98.mjs';
 import '../dialect.mjs';
 
 /**

package/dist/glassbox-routes/index.d.ts

@@ -1,7 +1,7 @@
-import { G as GlassboxEvent } from '../types-hEDGehpz.js';
-import { a as TraceDetail, b as TraceSummary, c as TraceCounterfactual } from '../types-DsA8JFOp.js';
-export { A as AdvisoryRecord, T as TraceHealth, d as TraceSectionRewrite } from '../types-DsA8JFOp.js';
-import '../ir-BiXAMyji.js';
+import { G as GlassboxEvent } from '../types-CsB2YASc.js';
+import { a as TraceDetail, b as TraceSummary, c as TraceCounterfactual } from '../types-CKuu7Clz.js';
+export { A as AdvisoryRecord, T as TraceHealth, d as TraceSectionRewrite } from '../types-CKuu7Clz.js';
+import '../ir-B2h0GAEL.js';
 import '../dialect.js';
 
 /**

package/dist/glassbox-routes/react/index.d.mts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { a as TraceDetail } from '../../types-Dj5FLhBV.mjs';
-import '../../ir-CAlLBu5d.mjs';
+import { a as TraceDetail } from '../../types-B-pzBJKf.mjs';
+import '../../ir-BC4uDL98.mjs';
 import '../../dialect.mjs';
 
 /**

package/dist/glassbox-routes/react/index.d.ts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { a as TraceDetail } from '../../types-DsA8JFOp.js';
-import '../../ir-BiXAMyji.js';
+import { a as TraceDetail } from '../../types-CKuu7Clz.js';
+import '../../ir-B2h0GAEL.js';
 import '../../dialect.js';
 
 /**

package/dist/index.d.mts

@@ -1,8 +1,9 @@
-import { C as CompilePolicy, N as NormalizedResponse, A as ApiKeys, P as ProviderOverrides, a as CompiledRequest, b as PromptIR, c as CallOptions, d as CallResult, S as SystemModelMessage, e as CompileResult, B as BestPracticeAdvisory, f as SectionRewrite, R as RecordInput, g as RecordOutcomeInput, O as OutcomeResult, h as OracleScore, i as Adapter, j as PerAxisMetrics, k as Provider, l as ChainEntry, G as Grounding } from './ir-CAlLBu5d.mjs';
-export { m as CallAttempt, n as CallError, o as ChainModelEntry, p as ChainWithGrounding, q as Constraints, F as FallbackReason, H as HistoryCachePolicy, I as IntentDeclaration, M as Message, r as MutationApplied, s as NormalizedTokens, t as OutcomeKind, u as PerAxisMetricsByModel, v as PromptSection, w as SectionKind, x as ShadowProbeConfig, T as ToolCall, y as ToolDefinition } from './ir-CAlLBu5d.mjs';
+import { C as CompilePolicy, N as NormalizedResponse, A as ApiKeys, P as ProviderOverrides, a as CompiledRequest, b as PromptIR, c as CallOptions, d as CallResult, S as SystemModelMessage, e as CompileResult, B as BestPracticeAdvisory, f as SectionRewrite, R as RecordInput, g as RecordOutcomeInput, O as OutcomeResult, h as OracleScore, i as Adapter, j as PerAxisMetrics, k as Provider, l as ChainEntry, G as Grounding } from './ir-BC4uDL98.mjs';
+export { m as CallAttempt, n as CallError, o as ChainModelEntry, p as ChainWithGrounding, q as Constraints, E as EffortLevel, F as FallbackReason, H as HistoryCachePolicy, I as IntentDeclaration, M as Message, r as MutationApplied, s as NormalizedTokens, t as OutcomeKind, u as PerAxisMetricsByModel, v as PromptSection, w as SectionKind, x as ShadowProbeConfig, T as ToolCall, y as ToolDefinition } from './ir-BC4uDL98.mjs';
 import { ModelProfile, ArchetypeConvention } from './profiles.mjs';
 export { ALIASES, CacheStrategy, CliffRule, LATENCY_TIER_MS, LatencyTier, LoweringSpec, RecoveryRule, StructuredOutputCapability, SystemPromptMode, allProfiles, getProfile, latencyTierOf, profilesByProvider, tryGetProfile } from './profiles.mjs';
 export { BrainForwardConfig, BrainForwardRoutes, createBrainForwardRoutes } from './brain-proxy.mjs';
+export { KeyHealthConfig, KeyHealthProvider, KeyHealthResponseBody, KeyHealthResult, KeyHealthRoute, createKeyHealthRoute } from './key-health.mjs';
 import { IntentArchetypeName } from './dialect.mjs';
 export { ALL_ARCHETYPES, ContextBucket, DIALECT_VERSION, HistoryDepth, INTENT_ARCHETYPES, OutputMode, ShapeSignature, ToolCountBucket, bucketContext, bucketHistory, bucketToolCount, hashShape, isArchetype, learningKey } from './dialect.mjs';
 
@@ -463,6 +464,7 @@ interface OutcomePayload {
     cost_usd_actual?: number;
     ttft_ms?: number;
     history_cacheable_tokens?: number;
+    effort?: string;
     history_tokens_at_compile?: number;
     /**
      * Mirrors `ir.constraints.toolOrchestration` from compile time. NULL when

package/dist/index.d.ts

@@ -1,8 +1,9 @@
-import { C as CompilePolicy, N as NormalizedResponse, A as ApiKeys, P as ProviderOverrides, a as CompiledRequest, b as PromptIR, c as CallOptions, d as CallResult, S as SystemModelMessage, e as CompileResult, B as BestPracticeAdvisory, f as SectionRewrite, R as RecordInput, g as RecordOutcomeInput, O as OutcomeResult, h as OracleScore, i as Adapter, j as PerAxisMetrics, k as Provider, l as ChainEntry, G as Grounding } from './ir-BiXAMyji.js';
-export { m as CallAttempt, n as CallError, o as ChainModelEntry, p as ChainWithGrounding, q as Constraints, F as FallbackReason, H as HistoryCachePolicy, I as IntentDeclaration, M as Message, r as MutationApplied, s as NormalizedTokens, t as OutcomeKind, u as PerAxisMetricsByModel, v as PromptSection, w as SectionKind, x as ShadowProbeConfig, T as ToolCall, y as ToolDefinition } from './ir-BiXAMyji.js';
+import { C as CompilePolicy, N as NormalizedResponse, A as ApiKeys, P as ProviderOverrides, a as CompiledRequest, b as PromptIR, c as CallOptions, d as CallResult, S as SystemModelMessage, e as CompileResult, B as BestPracticeAdvisory, f as SectionRewrite, R as RecordInput, g as RecordOutcomeInput, O as OutcomeResult, h as OracleScore, i as Adapter, j as PerAxisMetrics, k as Provider, l as ChainEntry, G as Grounding } from './ir-B2h0GAEL.js';
+export { m as CallAttempt, n as CallError, o as ChainModelEntry, p as ChainWithGrounding, q as Constraints, E as EffortLevel, F as FallbackReason, H as HistoryCachePolicy, I as IntentDeclaration, M as Message, r as MutationApplied, s as NormalizedTokens, t as OutcomeKind, u as PerAxisMetricsByModel, v as PromptSection, w as SectionKind, x as ShadowProbeConfig, T as ToolCall, y as ToolDefinition } from './ir-B2h0GAEL.js';
 import { ModelProfile, ArchetypeConvention } from './profiles.js';
 export { ALIASES, CacheStrategy, CliffRule, LATENCY_TIER_MS, LatencyTier, LoweringSpec, RecoveryRule, StructuredOutputCapability, SystemPromptMode, allProfiles, getProfile, latencyTierOf, profilesByProvider, tryGetProfile } from './profiles.js';
 export { BrainForwardConfig, BrainForwardRoutes, createBrainForwardRoutes } from './brain-proxy.js';
+export { KeyHealthConfig, KeyHealthProvider, KeyHealthResponseBody, KeyHealthResult, KeyHealthRoute, createKeyHealthRoute } from './key-health.js';
 import { IntentArchetypeName } from './dialect.js';
 export { ALL_ARCHETYPES, ContextBucket, DIALECT_VERSION, HistoryDepth, INTENT_ARCHETYPES, OutputMode, ShapeSignature, ToolCountBucket, bucketContext, bucketHistory, bucketToolCount, hashShape, isArchetype, learningKey } from './dialect.js';
 
@@ -463,6 +464,7 @@ interface OutcomePayload {
     cost_usd_actual?: number;
     ttft_ms?: number;
     history_cacheable_tokens?: number;
+    effort?: string;
     history_tokens_at_compile?: number;
     /**
      * Mirrors `ir.constraints.toolOrchestration` from compile time. NULL when

package/dist/index.js

@@ -52,6 +52,7 @@ __export(index_exports, {
   configureBrain: () => configureBrain,
   countTokens: () => countTokens,
   createBrainForwardRoutes: () => createBrainForwardRoutes,
+  createKeyHealthRoute: () => createKeyHealthRoute,
   deriveFamilyFromModelId: () => deriveFamilyFromModelId,
   deriveOwnership: () => deriveOwnership,
   execute: () => execute,
@@ -4509,7 +4510,9 @@ function registerCompile(appId, archetype, ir, result) {
     // alpha.29: translator activity — persisted on the brain row so
     // cross-app aggregates can answer "Sonnet narration rule fired N times,
     // outcome quality lifted to M."
-    sectionRewritesApplied: result.sectionRewritesApplied
+    sectionRewritesApplied: result.sectionRewritesApplied,
+    // alpha.57: cache the declared effort tier for record()'s auto-enrich.
+    effortFromCompile: ir.constraints?.effort
   });
 }
 function estimateSystemPromptChars(sections) {
@@ -4664,6 +4667,10 @@ function buildPayload(input, reg) {
     cost_usd_actual: costUsdActual,
     ttft_ms: input.ttftMs,
     history_cacheable_tokens: reg?.historyCacheableTokens,
+    // alpha.57 (data-first): input wins over compile-declared; undefined
+    // end-to-end -> key absent from the JSON body entirely (safe against
+    // brains that haven't applied migration 033 yet).
+    effort: input.effort ?? reg?.effortFromCompile,
     history_tokens_at_compile: reg?.historyTokensTotal,
     // alpha.20 E3: mirror consumer's declared tool-orchestration mode so
     // the brain can measure per-mode model perf separately (DeepSeek in
@@ -6929,6 +6936,188 @@ function createBrainForwardRoutes(config) {
   return { handle, segments: KNOWN_SEGMENTS };
 }
 
+// src/key-health.ts
+var JSON_HEADERS2 = { "Content-Type": "application/json" };
+function jsonResponse2(status, body) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS2 });
+}
+function bearerOf2(req) {
+  const header = req.headers.get("Authorization") ?? "";
+  const match = /^Bearer\s+(.+)$/i.exec(header);
+  return match?.[1]?.trim() ?? "";
+}
+function requireString2(name, value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`createKeyHealthRoute: ${name} is required`);
+  }
+  return value;
+}
+function envKey(env, name) {
+  const v = env[name];
+  if (typeof v !== "string") return void 0;
+  const trimmed = v.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+var PROBE_SPECS = [
+  {
+    provider: "anthropic",
+    canonicalEnvName: "ANTHROPIC_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.anthropic.com/v1/models?limit=1",
+      headers: { "x-api-key": key, "anthropic-version": "2023-06-01" }
+    })
+  },
+  {
+    provider: "deepseek",
+    canonicalEnvName: "DEEPSEEK_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.deepseek.com/user/balance",
+      headers: { Authorization: `Bearer ${key}` }
+    }),
+    parseBalanceUsd: (body) => {
+      const infos = body?.balance_infos;
+      if (!Array.isArray(infos) || infos.length === 0) return void 0;
+      const first = infos[0];
+      if (first?.currency !== "USD") return void 0;
+      const n = Number(first.total_balance);
+      return Number.isFinite(n) ? n : void 0;
+    }
+  },
+  {
+    provider: "google",
+    canonicalEnvName: "GEMINI_API_KEY",
+    buildRequest: (key) => ({
+      url: `https://generativelanguage.googleapis.com/v1beta/models?pageSize=1&key=${encodeURIComponent(key)}`,
+      headers: {}
+    })
+  },
+  {
+    provider: "openai",
+    canonicalEnvName: "OPENAI_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.openai.com/v1/models",
+      headers: { Authorization: `Bearer ${key}` }
+    })
+  }
+];
+function createKeyHealthRoute(config) {
+  const appId = requireString2("appId", config.appId);
+  const ingestSecret = requireString2("ingestSecret", config.ingestSecret);
+  const fetchFn = config.fetchImpl ?? fetch;
+  const timeoutMs = config.timeoutMs ?? 3e3;
+  async function probeProvider(spec, env) {
+    let key;
+    let envName = spec.canonicalEnvName;
+    if (spec.provider === "google") {
+      const gemini = envKey(env, "GEMINI_API_KEY");
+      const google = envKey(env, "GOOGLE_API_KEY");
+      const aiSdk = envKey(env, "GOOGLE_GENERATIVE_AI_API_KEY");
+      key = gemini ?? google ?? aiSdk;
+      envName = gemini ? "GEMINI_API_KEY" : google ? "GOOGLE_API_KEY" : aiSdk ? "GOOGLE_GENERATIVE_AI_API_KEY" : "GEMINI_API_KEY";
+    } else {
+      key = envKey(env, spec.canonicalEnvName);
+    }
+    if (!key) {
+      return {
+        provider: spec.provider,
+        env: envName,
+        present: false,
+        valid: null,
+        detail: "key_absent"
+      };
+    }
+    const base = {
+      provider: spec.provider,
+      env: envName,
+      present: true,
+      valid: null
+    };
+    const { url, headers } = spec.buildRequest(key);
+    const started = Date.now();
+    let res;
+    try {
+      res = await fetchFn(url, {
+        method: "GET",
+        headers,
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err) {
+      const isTimeout = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+      return {
+        ...base,
+        latency_ms: Date.now() - started,
+        // NEVER echo err.message — provider errors could theoretically carry
+        // request context; a fixed vocabulary keeps key material impossible.
+        detail: isTimeout ? "timeout" : "network_error"
+      };
+    }
+    const latencyMs = Date.now() - started;
+    if (res.ok) {
+      const result = {
+        ...base,
+        valid: true,
+        status: res.status,
+        latency_ms: latencyMs
+      };
+      if (spec.parseBalanceUsd) {
+        try {
+          const body = await res.json();
+          const balance = spec.parseBalanceUsd(body);
+          if (balance !== void 0) result.balance_usd = balance;
+        } catch {
+        }
+      }
+      return result;
+    }
+    if (res.status === 401 || res.status === 403) {
+      return { ...base, valid: false, status: res.status, latency_ms: latencyMs };
+    }
+    return {
+      ...base,
+      valid: null,
+      status: res.status,
+      latency_ms: latencyMs,
+      detail: `http_${res.status}`
+    };
+  }
+  async function handle(req) {
+    try {
+      if (req.method !== "GET") {
+        return jsonResponse2(405, { error: "method_not_allowed" });
+      }
+      if (bearerOf2(req) !== ingestSecret) {
+        return jsonResponse2(401, { error: "unauthorized" });
+      }
+      const env = config.env ?? process.env;
+      const settled = await Promise.allSettled(
+        PROBE_SPECS.map((spec) => probeProvider(spec, env))
+      );
+      const keys = settled.map((s, i) => {
+        if (s.status === "fulfilled") return s.value;
+        const spec = PROBE_SPECS[i];
+        return {
+          provider: spec.provider,
+          env: spec.canonicalEnvName,
+          present: true,
+          valid: null,
+          detail: "probe_failed"
+        };
+      });
+      keys.sort((a, b) => a.provider.localeCompare(b.provider));
+      const body = {
+        app_id: appId,
+        checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+        keys
+      };
+      return jsonResponse2(200, body);
+    } catch (err) {
+      void err;
+      return jsonResponse2(500, { error: "key_health_internal_error" });
+    }
+  }
+  return { handle };
+}
+
 // src/oracle.ts
 var DEFAULT_DIMENSIONS = ["correctness", "completeness", "conciseness", "format"];
 var judgeCallTimes = [];
@@ -7389,6 +7578,7 @@ function compile2(ir, opts) {
   configureBrain,
   countTokens,
   createBrainForwardRoutes,
+  createKeyHealthRoute,
   deriveFamilyFromModelId,
   deriveOwnership,
   execute,

package/dist/index.mjs

@@ -12,6 +12,9 @@ import {
   isArchetype,
   learningKey
 } from "./chunk-5TI6PNSK.mjs";
+import {
+  createKeyHealthRoute
+} from "./chunk-B4INZ32V.mjs";
 import {
   ABSOLUTE_FLOOR,
   ARCHETYPE_FLOOR_DEFAULT,
@@ -2665,7 +2668,9 @@ function registerCompile(appId, archetype, ir, result) {
     // alpha.29: translator activity — persisted on the brain row so
     // cross-app aggregates can answer "Sonnet narration rule fired N times,
     // outcome quality lifted to M."
-    sectionRewritesApplied: result.sectionRewritesApplied
+    sectionRewritesApplied: result.sectionRewritesApplied,
+    // alpha.57: cache the declared effort tier for record()'s auto-enrich.
+    effortFromCompile: ir.constraints?.effort
   });
 }
 function estimateSystemPromptChars(sections) {
@@ -2820,6 +2825,10 @@ function buildPayload(input, reg) {
     cost_usd_actual: costUsdActual,
     ttft_ms: input.ttftMs,
     history_cacheable_tokens: reg?.historyCacheableTokens,
+    // alpha.57 (data-first): input wins over compile-declared; undefined
+    // end-to-end -> key absent from the JSON body entirely (safe against
+    // brains that haven't applied migration 033 yet).
+    effort: input.effort ?? reg?.effortFromCompile,
     history_tokens_at_compile: reg?.historyTokensTotal,
     // alpha.20 E3: mirror consumer's declared tool-orchestration mode so
     // the brain can measure per-mode model perf separately (DeepSeek in
@@ -4667,6 +4676,7 @@ export {
   configureBrain,
   countTokens,
   createBrainForwardRoutes,
+  createKeyHealthRoute,
   deriveFamilyFromModelId,
   deriveOwnership,
   execute,

package/dist/{ir-BiXAMyji.d.ts → ir-B2h0GAEL.d.ts}

@@ -111,11 +111,34 @@ interface IntentDeclaration {
     /** Canonical dialect-v1 archetype. Required for cross-app learning. */
     archetype: IntentArchetypeName;
 }
+/**
+ * alpha.57 — dialect-level reasoning-effort tier (data-first).
+ *
+ * Vocabulary is a portfolio-level tier ladder (low → max), NOT any provider's
+ * wire value — mapping to `reasoning_effort` (OpenAI) / thinking budgets
+ * (Anthropic) / `thinkingConfig` (Gemini) stays consumer-side until
+ * routing-on-effort ships. Declaring it records the tier on the brain row
+ * (`compile_outcomes.effort`, migration 033) so effort×archetype quality
+ * evidence accumulates BEFORE any routing logic exists — same data-first
+ * sequencing as `tool_orchestration` (alpha.20).
+ */
+type EffortLevel = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
 interface Constraints {
     /** Hard latency ceiling — compiler will down-rank slow models. Advisory. */
     maxLatencyMs?: number;
     /** Hard cost ceiling per call (USD). Advisory. */
     maxCostUsd?: number;
+    /**
+     * alpha.57 (data-first): the reasoning-effort tier the consumer ran (or
+     * intends to run) this call at. RECORDED, NOT APPLIED — the compiler does
+     * not emit provider thinking/effort params from this field and does not
+     * route on it yet; it flows to `compile_outcomes.effort` via record()'s
+     * registry auto-enrich (same pattern as `mutationsApplied`/advisories).
+     * Declare it truthfully: this is consumer-reported ground truth, like
+     * `tokensIn`/`latencyMs`. Does NOT enter the shape key (no learning-key
+     * fragmentation).
+     */
+    effort?: EffortLevel;
     /** Caller wants structured (JSON) output. */
     structuredOutput?: boolean;
     /** Hint: caller expects a short response (used to disable thinking on Gemini). */
@@ -1145,6 +1168,15 @@ interface RecordInput {
      * surfaces it. Distinct from `latencyMs` (end-to-end wall clock).
      */
     ttftMs?: number;
+    /**
+     * alpha.57 (data-first) — the reasoning-effort tier this call actually ran
+     * at. Overrides the compile-declared `constraints.effort` when both are
+     * present (input wins — same precedence as `mutationsApplied`/`advisories`).
+     * When omitted, record() auto-enriches from the registry-cached compile
+     * declaration. Undefined end-to-end → the `effort` key is absent from the
+     * outcome payload entirely (safe against pre-migration-033 brains).
+     */
+    effort?: EffortLevel;
     /**
      * alpha.20 — advisories fired at compile() time. Persisted to the brain's
      * `compile_outcome_advisories` sibling table via a second POST that fires
@@ -1343,4 +1375,4 @@ interface PerAxisMetrics {
 /** Per-axis metrics keyed by model — used for chain-comparison views. */
 type PerAxisMetricsByModel = Record<string, PerAxisMetrics>;
 
-export { type ApiKeys as A, type BestPracticeAdvisory as B, type CompilePolicy as C, type FallbackReason as F, type Grounding as G, type HistoryCachePolicy as H, type IntentDeclaration as I, type Message as M, type NormalizedResponse as N, type OutcomeResult as O, type ProviderOverrides as P, type RecordInput as R, type SystemModelMessage as S, type ToolCall as T, type CompiledRequest as a, type PromptIR as b, type CallOptions as c, type CallResult as d, type CompileResult as e, type SectionRewrite as f, type RecordOutcomeInput as g, type OracleScore as h, type Adapter as i, type PerAxisMetrics as j, type Provider as k, type ChainEntry as l, type CallAttempt as m, CallError as n, type ChainModelEntry as o, type ChainWithGrounding as p, type Constraints as q, type MutationApplied as r, type NormalizedTokens as s, type OutcomeKind as t, type PerAxisMetricsByModel as u, type PromptSection as v, type SectionKind as w, type ShadowProbeConfig as x, type ToolDefinition as y };
+export { type ApiKeys as A, type BestPracticeAdvisory as B, type CompilePolicy as C, type EffortLevel as E, type FallbackReason as F, type Grounding as G, type HistoryCachePolicy as H, type IntentDeclaration as I, type Message as M, type NormalizedResponse as N, type OutcomeResult as O, type ProviderOverrides as P, type RecordInput as R, type SystemModelMessage as S, type ToolCall as T, type CompiledRequest as a, type PromptIR as b, type CallOptions as c, type CallResult as d, type CompileResult as e, type SectionRewrite as f, type RecordOutcomeInput as g, type OracleScore as h, type Adapter as i, type PerAxisMetrics as j, type Provider as k, type ChainEntry as l, type CallAttempt as m, CallError as n, type ChainModelEntry as o, type ChainWithGrounding as p, type Constraints as q, type MutationApplied as r, type NormalizedTokens as s, type OutcomeKind as t, type PerAxisMetricsByModel as u, type PromptSection as v, type SectionKind as w, type ShadowProbeConfig as x, type ToolDefinition as y };

package/dist/{ir-CAlLBu5d.d.mts → ir-BC4uDL98.d.mts}

@@ -111,11 +111,34 @@ interface IntentDeclaration {
     /** Canonical dialect-v1 archetype. Required for cross-app learning. */
     archetype: IntentArchetypeName;
 }
+/**
+ * alpha.57 — dialect-level reasoning-effort tier (data-first).
+ *
+ * Vocabulary is a portfolio-level tier ladder (low → max), NOT any provider's
+ * wire value — mapping to `reasoning_effort` (OpenAI) / thinking budgets
+ * (Anthropic) / `thinkingConfig` (Gemini) stays consumer-side until
+ * routing-on-effort ships. Declaring it records the tier on the brain row
+ * (`compile_outcomes.effort`, migration 033) so effort×archetype quality
+ * evidence accumulates BEFORE any routing logic exists — same data-first
+ * sequencing as `tool_orchestration` (alpha.20).
+ */
+type EffortLevel = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
 interface Constraints {
     /** Hard latency ceiling — compiler will down-rank slow models. Advisory. */
     maxLatencyMs?: number;
     /** Hard cost ceiling per call (USD). Advisory. */
     maxCostUsd?: number;
+    /**
+     * alpha.57 (data-first): the reasoning-effort tier the consumer ran (or
+     * intends to run) this call at. RECORDED, NOT APPLIED — the compiler does
+     * not emit provider thinking/effort params from this field and does not
+     * route on it yet; it flows to `compile_outcomes.effort` via record()'s
+     * registry auto-enrich (same pattern as `mutationsApplied`/advisories).
+     * Declare it truthfully: this is consumer-reported ground truth, like
+     * `tokensIn`/`latencyMs`. Does NOT enter the shape key (no learning-key
+     * fragmentation).
+     */
+    effort?: EffortLevel;
     /** Caller wants structured (JSON) output. */
     structuredOutput?: boolean;
     /** Hint: caller expects a short response (used to disable thinking on Gemini). */
@@ -1145,6 +1168,15 @@ interface RecordInput {
      * surfaces it. Distinct from `latencyMs` (end-to-end wall clock).
      */
     ttftMs?: number;
+    /**
+     * alpha.57 (data-first) — the reasoning-effort tier this call actually ran
+     * at. Overrides the compile-declared `constraints.effort` when both are
+     * present (input wins — same precedence as `mutationsApplied`/`advisories`).
+     * When omitted, record() auto-enriches from the registry-cached compile
+     * declaration. Undefined end-to-end → the `effort` key is absent from the
+     * outcome payload entirely (safe against pre-migration-033 brains).
+     */
+    effort?: EffortLevel;
     /**
      * alpha.20 — advisories fired at compile() time. Persisted to the brain's
      * `compile_outcome_advisories` sibling table via a second POST that fires
@@ -1343,4 +1375,4 @@ interface PerAxisMetrics {
 /** Per-axis metrics keyed by model — used for chain-comparison views. */
 type PerAxisMetricsByModel = Record<string, PerAxisMetrics>;
 
-export { type ApiKeys as A, type BestPracticeAdvisory as B, type CompilePolicy as C, type FallbackReason as F, type Grounding as G, type HistoryCachePolicy as H, type IntentDeclaration as I, type Message as M, type NormalizedResponse as N, type OutcomeResult as O, type ProviderOverrides as P, type RecordInput as R, type SystemModelMessage as S, type ToolCall as T, type CompiledRequest as a, type PromptIR as b, type CallOptions as c, type CallResult as d, type CompileResult as e, type SectionRewrite as f, type RecordOutcomeInput as g, type OracleScore as h, type Adapter as i, type PerAxisMetrics as j, type Provider as k, type ChainEntry as l, type CallAttempt as m, CallError as n, type ChainModelEntry as o, type ChainWithGrounding as p, type Constraints as q, type MutationApplied as r, type NormalizedTokens as s, type OutcomeKind as t, type PerAxisMetricsByModel as u, type PromptSection as v, type SectionKind as w, type ShadowProbeConfig as x, type ToolDefinition as y };
+export { type ApiKeys as A, type BestPracticeAdvisory as B, type CompilePolicy as C, type EffortLevel as E, type FallbackReason as F, type Grounding as G, type HistoryCachePolicy as H, type IntentDeclaration as I, type Message as M, type NormalizedResponse as N, type OutcomeResult as O, type ProviderOverrides as P, type RecordInput as R, type SystemModelMessage as S, type ToolCall as T, type CompiledRequest as a, type PromptIR as b, type CallOptions as c, type CallResult as d, type CompileResult as e, type SectionRewrite as f, type RecordOutcomeInput as g, type OracleScore as h, type Adapter as i, type PerAxisMetrics as j, type Provider as k, type ChainEntry as l, type CallAttempt as m, CallError as n, type ChainModelEntry as o, type ChainWithGrounding as p, type Constraints as q, type MutationApplied as r, type NormalizedTokens as s, type OutcomeKind as t, type PerAxisMetricsByModel as u, type PromptSection as v, type SectionKind as w, type ShadowProbeConfig as x, type ToolDefinition as y };

package/dist/key-health.d.mts

@@ -0,0 +1,121 @@
+/**
+ * `@warmdrift/kgauto-compiler/key-health` — per-consumer provider-key health
+ * endpoint factory (alpha.58, KG-fleet-v1 phase 1).
+ *
+ * ## Why this exists
+ *
+ * Consumers (playbacksam, inspire-central, tt-intelligence, global-expansion)
+ * hold their own provider API keys in their own Vercel envs — the library
+ * never sees keys centrally, by design. That means the operator dashboard has
+ * no way to answer "is PB's DeepSeek key still valid?" without a per-consumer
+ * probe surface. This factory is that surface: the consumer mounts ONE route,
+ * the dashboard polls it with the consumer's existing `KGAUTO_INGEST_SECRET`
+ * bearer, and gets back a validity grid for every canonical provider key.
+ *
+ * Probes are the cheapest authenticated GETs each provider offers (model
+ * listings; DeepSeek's balance endpoint) — never a completion call, zero
+ * token cost. Keys themselves NEVER appear in any response: only presence,
+ * validity, HTTP status, latency, and (DeepSeek only) account balance.
+ *
+ * Same design contract as `createBrainForwardRoutes` (brain-proxy.ts):
+ * web-standard Request→Response, never throws (every path returns a
+ * `Response`), bearer gate, runs on Edge/Workers/Node.
+ *
+ * ## Mounting recipes
+ *
+ * ### (a) Next.js app-router route handler — ONE file
+ *
+ *   // app/api/kgauto/v2/keyhealth/route.ts
+ *   import { createKeyHealthRoute } from '@warmdrift/kgauto-compiler/key-health';
+ *   const routes = createKeyHealthRoute({
+ *     appId: 'playbacksam',
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *   });
+ *   export const GET = (req: Request) => routes.handle(req);
+ *
+ *   // middleware.ts — if the app gates routes behind auth middleware, the
+ *   // existing brain-proxy public-path prefix ('/api/kgauto/v2/') already
+ *   // covers this route. If the allowlist is per-path, add
+ *   // '/api/kgauto/v2/keyhealth' or server-to-server GETs 307 to /login
+ *   // (the tt-intel middleware-drift shape — see brain-proxy.ts).
+ *
+ * ### (b) Plain per-file Vercel function
+ *
+ *   // api/kgauto/keyhealth.ts
+ *   export const config = { runtime: 'edge' };
+ *   import { createKeyHealthRoute } from '@warmdrift/kgauto-compiler/key-health';
+ *   const routes = createKeyHealthRoute({
+ *     appId: 'inspire-central',
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *   });
+ *   export default (req: Request) => routes.handle(req);
+ *
+ * ## Wire shape (LOCKED CONTRACT with the operator dashboard — do not rename)
+ *
+ *   200 {
+ *     app_id: string,
+ *     checked_at: string,          // ISO timestamp
+ *     keys: [                      // sorted by provider name
+ *       {
+ *         provider: 'anthropic' | 'deepseek' | 'google' | 'openai',
+ *         env: string,             // canonical env var name probed
+ *         present: boolean,        // key present (non-empty after trim)
+ *         valid: boolean | null,   // true 2xx / false 401·403 / null unknown
+ *         status?: number,         // probe HTTP status when a response landed
+ *         latency_ms?: number,     // probe round-trip
+ *         balance_usd?: number,    // DeepSeek only, when currency is USD
+ *         detail?: string,         // e.g. 'timeout', 'http_500', 'key_absent'
+ *       }
+ *     ]
+ *   }
+ */
+type KeyHealthProvider = 'anthropic' | 'deepseek' | 'google' | 'openai';
+interface KeyHealthConfig {
+    /** Consumer app id echoed as `app_id` in the response (e.g. 'playbacksam'). */
+    appId: string;
+    /** Bearer token the poller must present (consumer's existing KGAUTO_INGEST_SECRET). */
+    ingestSecret: string;
+    /** Optional fetch impl for tests. */
+    fetchImpl?: typeof fetch;
+    /** Env source; defaults to process.env. Test injection point. */
+    env?: Record<string, string | undefined>;
+    /** Per-provider probe timeout in ms. Default 3000. */
+    timeoutMs?: number;
+}
+interface KeyHealthResult {
+    provider: KeyHealthProvider;
+    /** Canonical env var name probed (the resolved one for Google). */
+    env: string;
+    /** Key present (non-empty after trim) in env. */
+    present: boolean;
+    /** true = provider accepted the key (2xx); false = rejected (401/403); null = unknown (absent / timeout / 5xx / 429 / network). */
+    valid: boolean | null;
+    /** HTTP status of the probe, when a response landed. */
+    status?: number;
+    /** Probe round-trip in ms, when a probe ran. */
+    latency_ms?: number;
+    /** DeepSeek only: account balance in USD when the balance API reports USD. */
+    balance_usd?: number;
+    /** Failure class when valid is null with a probe attempted (e.g. 'timeout', 'http_500') or 'key_absent'. */
+    detail?: string;
+}
+interface KeyHealthResponseBody {
+    app_id: string;
+    checked_at: string;
+    keys: KeyHealthResult[];
+}
+interface KeyHealthRoute {
+    /**
+     * Web-standard handler. GET only. Never throws — every error path returns
+     * a `Response`.
+     */
+    handle(req: Request): Promise<Response>;
+}
+/**
+ * Create the per-consumer key-health route. See module docstring for the
+ * mounting recipes ((a) Next.js route handler, (b) per-file Vercel function)
+ * and the locked wire shape.
+ */
+declare function createKeyHealthRoute(config: KeyHealthConfig): KeyHealthRoute;
+
+export { type KeyHealthConfig, type KeyHealthProvider, type KeyHealthResponseBody, type KeyHealthResult, type KeyHealthRoute, createKeyHealthRoute };

package/dist/key-health.d.ts

@@ -0,0 +1,121 @@
+/**
+ * `@warmdrift/kgauto-compiler/key-health` — per-consumer provider-key health
+ * endpoint factory (alpha.58, KG-fleet-v1 phase 1).
+ *
+ * ## Why this exists
+ *
+ * Consumers (playbacksam, inspire-central, tt-intelligence, global-expansion)
+ * hold their own provider API keys in their own Vercel envs — the library
+ * never sees keys centrally, by design. That means the operator dashboard has
+ * no way to answer "is PB's DeepSeek key still valid?" without a per-consumer
+ * probe surface. This factory is that surface: the consumer mounts ONE route,
+ * the dashboard polls it with the consumer's existing `KGAUTO_INGEST_SECRET`
+ * bearer, and gets back a validity grid for every canonical provider key.
+ *
+ * Probes are the cheapest authenticated GETs each provider offers (model
+ * listings; DeepSeek's balance endpoint) — never a completion call, zero
+ * token cost. Keys themselves NEVER appear in any response: only presence,
+ * validity, HTTP status, latency, and (DeepSeek only) account balance.
+ *
+ * Same design contract as `createBrainForwardRoutes` (brain-proxy.ts):
+ * web-standard Request→Response, never throws (every path returns a
+ * `Response`), bearer gate, runs on Edge/Workers/Node.
+ *
+ * ## Mounting recipes
+ *
+ * ### (a) Next.js app-router route handler — ONE file
+ *
+ *   // app/api/kgauto/v2/keyhealth/route.ts
+ *   import { createKeyHealthRoute } from '@warmdrift/kgauto-compiler/key-health';
+ *   const routes = createKeyHealthRoute({
+ *     appId: 'playbacksam',
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *   });
+ *   export const GET = (req: Request) => routes.handle(req);
+ *
+ *   // middleware.ts — if the app gates routes behind auth middleware, the
+ *   // existing brain-proxy public-path prefix ('/api/kgauto/v2/') already
+ *   // covers this route. If the allowlist is per-path, add
+ *   // '/api/kgauto/v2/keyhealth' or server-to-server GETs 307 to /login
+ *   // (the tt-intel middleware-drift shape — see brain-proxy.ts).
+ *
+ * ### (b) Plain per-file Vercel function
+ *
+ *   // api/kgauto/keyhealth.ts
+ *   export const config = { runtime: 'edge' };
+ *   import { createKeyHealthRoute } from '@warmdrift/kgauto-compiler/key-health';
+ *   const routes = createKeyHealthRoute({
+ *     appId: 'inspire-central',
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *   });
+ *   export default (req: Request) => routes.handle(req);
+ *
+ * ## Wire shape (LOCKED CONTRACT with the operator dashboard — do not rename)
+ *
+ *   200 {
+ *     app_id: string,
+ *     checked_at: string,          // ISO timestamp
+ *     keys: [                      // sorted by provider name
+ *       {
+ *         provider: 'anthropic' | 'deepseek' | 'google' | 'openai',
+ *         env: string,             // canonical env var name probed
+ *         present: boolean,        // key present (non-empty after trim)
+ *         valid: boolean | null,   // true 2xx / false 401·403 / null unknown
+ *         status?: number,         // probe HTTP status when a response landed
+ *         latency_ms?: number,     // probe round-trip
+ *         balance_usd?: number,    // DeepSeek only, when currency is USD
+ *         detail?: string,         // e.g. 'timeout', 'http_500', 'key_absent'
+ *       }
+ *     ]
+ *   }
+ */
+type KeyHealthProvider = 'anthropic' | 'deepseek' | 'google' | 'openai';
+interface KeyHealthConfig {
+    /** Consumer app id echoed as `app_id` in the response (e.g. 'playbacksam'). */
+    appId: string;
+    /** Bearer token the poller must present (consumer's existing KGAUTO_INGEST_SECRET). */
+    ingestSecret: string;
+    /** Optional fetch impl for tests. */
+    fetchImpl?: typeof fetch;
+    /** Env source; defaults to process.env. Test injection point. */
+    env?: Record<string, string | undefined>;
+    /** Per-provider probe timeout in ms. Default 3000. */
+    timeoutMs?: number;
+}
+interface KeyHealthResult {
+    provider: KeyHealthProvider;
+    /** Canonical env var name probed (the resolved one for Google). */
+    env: string;
+    /** Key present (non-empty after trim) in env. */
+    present: boolean;
+    /** true = provider accepted the key (2xx); false = rejected (401/403); null = unknown (absent / timeout / 5xx / 429 / network). */
+    valid: boolean | null;
+    /** HTTP status of the probe, when a response landed. */
+    status?: number;
+    /** Probe round-trip in ms, when a probe ran. */
+    latency_ms?: number;
+    /** DeepSeek only: account balance in USD when the balance API reports USD. */
+    balance_usd?: number;
+    /** Failure class when valid is null with a probe attempted (e.g. 'timeout', 'http_500') or 'key_absent'. */
+    detail?: string;
+}
+interface KeyHealthResponseBody {
+    app_id: string;
+    checked_at: string;
+    keys: KeyHealthResult[];
+}
+interface KeyHealthRoute {
+    /**
+     * Web-standard handler. GET only. Never throws — every error path returns
+     * a `Response`.
+     */
+    handle(req: Request): Promise<Response>;
+}
+/**
+ * Create the per-consumer key-health route. See module docstring for the
+ * mounting recipes ((a) Next.js route handler, (b) per-file Vercel function)
+ * and the locked wire shape.
+ */
+declare function createKeyHealthRoute(config: KeyHealthConfig): KeyHealthRoute;
+
+export { type KeyHealthConfig, type KeyHealthProvider, type KeyHealthResponseBody, type KeyHealthResult, type KeyHealthRoute, createKeyHealthRoute };

package/dist/key-health.js

@@ -0,0 +1,209 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/key-health.ts
+var key_health_exports = {};
+__export(key_health_exports, {
+  createKeyHealthRoute: () => createKeyHealthRoute
+});
+module.exports = __toCommonJS(key_health_exports);
+var JSON_HEADERS = { "Content-Type": "application/json" };
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function bearerOf(req) {
+  const header = req.headers.get("Authorization") ?? "";
+  const match = /^Bearer\s+(.+)$/i.exec(header);
+  return match?.[1]?.trim() ?? "";
+}
+function requireString(name, value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`createKeyHealthRoute: ${name} is required`);
+  }
+  return value;
+}
+function envKey(env, name) {
+  const v = env[name];
+  if (typeof v !== "string") return void 0;
+  const trimmed = v.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+var PROBE_SPECS = [
+  {
+    provider: "anthropic",
+    canonicalEnvName: "ANTHROPIC_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.anthropic.com/v1/models?limit=1",
+      headers: { "x-api-key": key, "anthropic-version": "2023-06-01" }
+    })
+  },
+  {
+    provider: "deepseek",
+    canonicalEnvName: "DEEPSEEK_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.deepseek.com/user/balance",
+      headers: { Authorization: `Bearer ${key}` }
+    }),
+    parseBalanceUsd: (body) => {
+      const infos = body?.balance_infos;
+      if (!Array.isArray(infos) || infos.length === 0) return void 0;
+      const first = infos[0];
+      if (first?.currency !== "USD") return void 0;
+      const n = Number(first.total_balance);
+      return Number.isFinite(n) ? n : void 0;
+    }
+  },
+  {
+    provider: "google",
+    canonicalEnvName: "GEMINI_API_KEY",
+    buildRequest: (key) => ({
+      url: `https://generativelanguage.googleapis.com/v1beta/models?pageSize=1&key=${encodeURIComponent(key)}`,
+      headers: {}
+    })
+  },
+  {
+    provider: "openai",
+    canonicalEnvName: "OPENAI_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.openai.com/v1/models",
+      headers: { Authorization: `Bearer ${key}` }
+    })
+  }
+];
+function createKeyHealthRoute(config) {
+  const appId = requireString("appId", config.appId);
+  const ingestSecret = requireString("ingestSecret", config.ingestSecret);
+  const fetchFn = config.fetchImpl ?? fetch;
+  const timeoutMs = config.timeoutMs ?? 3e3;
+  async function probeProvider(spec, env) {
+    let key;
+    let envName = spec.canonicalEnvName;
+    if (spec.provider === "google") {
+      const gemini = envKey(env, "GEMINI_API_KEY");
+      const google = envKey(env, "GOOGLE_API_KEY");
+      const aiSdk = envKey(env, "GOOGLE_GENERATIVE_AI_API_KEY");
+      key = gemini ?? google ?? aiSdk;
+      envName = gemini ? "GEMINI_API_KEY" : google ? "GOOGLE_API_KEY" : aiSdk ? "GOOGLE_GENERATIVE_AI_API_KEY" : "GEMINI_API_KEY";
+    } else {
+      key = envKey(env, spec.canonicalEnvName);
+    }
+    if (!key) {
+      return {
+        provider: spec.provider,
+        env: envName,
+        present: false,
+        valid: null,
+        detail: "key_absent"
+      };
+    }
+    const base = {
+      provider: spec.provider,
+      env: envName,
+      present: true,
+      valid: null
+    };
+    const { url, headers } = spec.buildRequest(key);
+    const started = Date.now();
+    let res;
+    try {
+      res = await fetchFn(url, {
+        method: "GET",
+        headers,
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err) {
+      const isTimeout = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+      return {
+        ...base,
+        latency_ms: Date.now() - started,
+        // NEVER echo err.message — provider errors could theoretically carry
+        // request context; a fixed vocabulary keeps key material impossible.
+        detail: isTimeout ? "timeout" : "network_error"
+      };
+    }
+    const latencyMs = Date.now() - started;
+    if (res.ok) {
+      const result = {
+        ...base,
+        valid: true,
+        status: res.status,
+        latency_ms: latencyMs
+      };
+      if (spec.parseBalanceUsd) {
+        try {
+          const body = await res.json();
+          const balance = spec.parseBalanceUsd(body);
+          if (balance !== void 0) result.balance_usd = balance;
+        } catch {
+        }
+      }
+      return result;
+    }
+    if (res.status === 401 || res.status === 403) {
+      return { ...base, valid: false, status: res.status, latency_ms: latencyMs };
+    }
+    return {
+      ...base,
+      valid: null,
+      status: res.status,
+      latency_ms: latencyMs,
+      detail: `http_${res.status}`
+    };
+  }
+  async function handle(req) {
+    try {
+      if (req.method !== "GET") {
+        return jsonResponse(405, { error: "method_not_allowed" });
+      }
+      if (bearerOf(req) !== ingestSecret) {
+        return jsonResponse(401, { error: "unauthorized" });
+      }
+      const env = config.env ?? process.env;
+      const settled = await Promise.allSettled(
+        PROBE_SPECS.map((spec) => probeProvider(spec, env))
+      );
+      const keys = settled.map((s, i) => {
+        if (s.status === "fulfilled") return s.value;
+        const spec = PROBE_SPECS[i];
+        return {
+          provider: spec.provider,
+          env: spec.canonicalEnvName,
+          present: true,
+          valid: null,
+          detail: "probe_failed"
+        };
+      });
+      keys.sort((a, b) => a.provider.localeCompare(b.provider));
+      const body = {
+        app_id: appId,
+        checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+        keys
+      };
+      return jsonResponse(200, body);
+    } catch (err) {
+      void err;
+      return jsonResponse(500, { error: "key_health_internal_error" });
+    }
+  }
+  return { handle };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createKeyHealthRoute
+});

package/dist/key-health.mjs

@@ -0,0 +1,6 @@
+import {
+  createKeyHealthRoute
+} from "./chunk-B4INZ32V.mjs";
+export {
+  createKeyHealthRoute
+};

package/dist/profiles.d.mts

@@ -1,4 +1,4 @@
-import { k as Provider } from './ir-CAlLBu5d.mjs';
+import { k as Provider } from './ir-BC4uDL98.mjs';
 import { IntentArchetypeName } from './dialect.mjs';
 
 /**

package/dist/profiles.d.ts

@@ -1,4 +1,4 @@
-import { k as Provider } from './ir-BiXAMyji.js';
+import { k as Provider } from './ir-B2h0GAEL.js';
 import { IntentArchetypeName } from './dialect.js';
 
 /**

package/dist/{types-Dj5FLhBV.d.mts → types-B-pzBJKf.d.mts}

@@ -1,4 +1,4 @@
-import { i as Adapter, w as SectionKind } from './ir-CAlLBu5d.mjs';
+import { i as Adapter, w as SectionKind } from './ir-BC4uDL98.mjs';
 
 /**
  * Internal config + hook types for createGlassboxRoutes().

package/dist/{types-DsA8JFOp.d.ts → types-CKuu7Clz.d.ts}

@@ -1,4 +1,4 @@
-import { i as Adapter, w as SectionKind } from './ir-BiXAMyji.js';
+import { i as Adapter, w as SectionKind } from './ir-B2h0GAEL.js';
 
 /**
  * Internal config + hook types for createGlassboxRoutes().

package/dist/{types-C_dkNMA_.d.mts → types-CRy90cjp.d.mts}

@@ -1,4 +1,4 @@
-import { r as MutationApplied, B as BestPracticeAdvisory, F as FallbackReason, m as CallAttempt } from './ir-CAlLBu5d.mjs';
+import { r as MutationApplied, B as BestPracticeAdvisory, F as FallbackReason, m as CallAttempt } from './ir-BC4uDL98.mjs';
 
 /**
  * Glass-Box observability types (alpha.17).

package/dist/{types-hEDGehpz.d.ts → types-CsB2YASc.d.ts}

@@ -1,4 +1,4 @@
-import { r as MutationApplied, B as BestPracticeAdvisory, F as FallbackReason, m as CallAttempt } from './ir-BiXAMyji.js';
+import { r as MutationApplied, B as BestPracticeAdvisory, F as FallbackReason, m as CallAttempt } from './ir-B2h0GAEL.js';
 
 /**
  * Glass-Box observability types (alpha.17).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmdrift/kgauto-compiler",
-  "version": "2.0.0-alpha.56",
+  "version": "2.0.0-alpha.58",
   "description": "Prompt compiler + central learning brain for multi-model AI apps. Swap models without rewriting prompts.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -26,6 +26,11 @@
       "import": "./dist/brain-proxy.mjs",
       "require": "./dist/brain-proxy.js"
     },
+    "./key-health": {
+      "types": "./dist/key-health.d.ts",
+      "import": "./dist/key-health.mjs",
+      "require": "./dist/key-health.js"
+    },
     "./glassbox": {
       "types": "./dist/glassbox/index.d.ts",
       "import": "./dist/glassbox/index.mjs",
@@ -52,7 +57,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsup src/index.ts src/dialect.ts src/profiles.ts src/brain-proxy.ts src/glassbox/index.ts src/glassbox-routes/index.ts src/glassbox-routes/format.ts src/glassbox-routes/react/index.ts --format cjs,esm --dts --clean --external react --external react-dom",
+    "build": "tsup src/index.ts src/dialect.ts src/profiles.ts src/brain-proxy.ts src/key-health.ts src/glassbox/index.ts src/glassbox-routes/index.ts src/glassbox-routes/format.ts src/glassbox-routes/react/index.ts --format cjs,esm --dts --clean --external react --external react-dom",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",