@warmdrift/kgauto-compiler 2.0.0-alpha.83 → 2.0.0-alpha.85

package/dist/{ir-Cx9hJj0B.d.ts → ir-DfrM71pA.d.ts}

@@ -305,6 +305,17 @@ interface CompilePolicy {
      * Model IDs the consumer has gated. Compile() will never select these.
      * Use for: cost caps, account-level rate limits, "this model is broken
      * for our workload" decisions.
+     *
+     * Matching is by EXACT id after alias resolution (alpha.85): an alias
+     * and its canonical id are the same model, so blocking either blocks
+     * both (`deepseek-chat` ≡ `deepseek-v4-flash`). Matching does NOT widen
+     * to family siblings — blocking `deepseek-v4-flash` says nothing about
+     * `deepseek-v4-pro` — and a bare family key (`'deepseek'`,
+     * `'claude-sonnet'`) is INERT: it matches no model and no warning fires
+     * today. To gate a family, list its concrete ids. Beware roster
+     * retargets: when a family primary moves to a new id, a literal-id
+     * block does not follow it (tt-intel s113 built consumer-side family
+     * resolution for exactly this).
      */
     blockedModels?: string[];
     /**
@@ -1073,6 +1084,44 @@ interface ShadowProbeConfig {
     skipSlowTierInSync?: boolean;
 }
 interface CallOptions {
+    /**
+     * alpha.84 — fires once per FAILED attempt during the fallback walk, before
+     * the walk continues. IC-Cairn's filing, 2026-07-29.
+     *
+     * ## The gap this closes
+     *
+     * `call()` records exactly ONE outcome row per call. An attempt that fails
+     * and then walks to a successful fallback survives only as
+     * `fellOverFrom`/`fallbackReason` metadata ON the success row — so a
+     * `call()`-only consumer's corpus contains **no failure rows at all**, by
+     * construction, no matter how carefully they wired `record()`.
+     *
+     * That is not hypothetical. kgauto's own `corpus-implausible-success`
+     * detector fired on inspire-central and told them to "wire record() on the
+     * FAILURE path" — which they had already done, in five places. Measured:
+     * 89 rows, 0 failure rows, 2 fellover-bearing. **The detector demanded
+     * output the API could not produce.** Streaming consumers have had
+     * `onFailedAttempt` since alpha.48 via `streamWithFallover`; `call()`
+     * consumers had nothing. This restores parity.
+     *
+     * ## Contract
+     *
+     * Fires for every attempt whose `status` is `'retryable'` or `'terminal'`,
+     * including skipped ones (`*_inferred`, `aborted`) — a skip is a real
+     * datum about the chain, not an absence. Never fires for `'success'`.
+     *
+     * Called synchronously and **its throw is swallowed**: a consumer's
+     * telemetry bug must never take down the call it is observing. It is a
+     * notification, not a hook that can veto or alter the walk.
+     *
+     * Typical use — emit a failure row per attempt so the corpus can contain
+     * failures at all:
+     *
+     *   call(ir, { onFailedAttempt: (a) => void recordOutcome({
+     *     ...base, success: false, errorType: a.errorCode, model: a.model,
+     *   }) })
+     */
+    onFailedAttempt?: (attempt: CallAttempt) => void;
     /** Forwarded to compile(). */
     policy?: CompilePolicy;
     /**

package/dist/{ir-D4S9R816.d.mts → ir-JUoybVM-.d.mts}

@@ -305,6 +305,17 @@ interface CompilePolicy {
      * Model IDs the consumer has gated. Compile() will never select these.
      * Use for: cost caps, account-level rate limits, "this model is broken
      * for our workload" decisions.
+     *
+     * Matching is by EXACT id after alias resolution (alpha.85): an alias
+     * and its canonical id are the same model, so blocking either blocks
+     * both (`deepseek-chat` ≡ `deepseek-v4-flash`). Matching does NOT widen
+     * to family siblings — blocking `deepseek-v4-flash` says nothing about
+     * `deepseek-v4-pro` — and a bare family key (`'deepseek'`,
+     * `'claude-sonnet'`) is INERT: it matches no model and no warning fires
+     * today. To gate a family, list its concrete ids. Beware roster
+     * retargets: when a family primary moves to a new id, a literal-id
+     * block does not follow it (tt-intel s113 built consumer-side family
+     * resolution for exactly this).
      */
     blockedModels?: string[];
     /**
@@ -1073,6 +1084,44 @@ interface ShadowProbeConfig {
     skipSlowTierInSync?: boolean;
 }
 interface CallOptions {
+    /**
+     * alpha.84 — fires once per FAILED attempt during the fallback walk, before
+     * the walk continues. IC-Cairn's filing, 2026-07-29.
+     *
+     * ## The gap this closes
+     *
+     * `call()` records exactly ONE outcome row per call. An attempt that fails
+     * and then walks to a successful fallback survives only as
+     * `fellOverFrom`/`fallbackReason` metadata ON the success row — so a
+     * `call()`-only consumer's corpus contains **no failure rows at all**, by
+     * construction, no matter how carefully they wired `record()`.
+     *
+     * That is not hypothetical. kgauto's own `corpus-implausible-success`
+     * detector fired on inspire-central and told them to "wire record() on the
+     * FAILURE path" — which they had already done, in five places. Measured:
+     * 89 rows, 0 failure rows, 2 fellover-bearing. **The detector demanded
+     * output the API could not produce.** Streaming consumers have had
+     * `onFailedAttempt` since alpha.48 via `streamWithFallover`; `call()`
+     * consumers had nothing. This restores parity.
+     *
+     * ## Contract
+     *
+     * Fires for every attempt whose `status` is `'retryable'` or `'terminal'`,
+     * including skipped ones (`*_inferred`, `aborted`) — a skip is a real
+     * datum about the chain, not an absence. Never fires for `'success'`.
+     *
+     * Called synchronously and **its throw is swallowed**: a consumer's
+     * telemetry bug must never take down the call it is observing. It is a
+     * notification, not a hook that can veto or alter the walk.
+     *
+     * Typical use — emit a failure row per attempt so the corpus can contain
+     * failures at all:
+     *
+     *   call(ir, { onFailedAttempt: (a) => void recordOutcome({
+     *     ...base, success: false, errorType: a.errorCode, model: a.model,
+     *   }) })
+     */
+    onFailedAttempt?: (attempt: CallAttempt) => void;
     /** Forwarded to compile(). */
     policy?: CompilePolicy;
     /**

package/dist/key-health.js

@@ -28,7 +28,7 @@ __export(key_health_exports, {
 module.exports = __toCommonJS(key_health_exports);
 
 // src/version.ts
-var LIBRARY_VERSION = "2.0.0-alpha.83";
+var LIBRARY_VERSION = "2.0.0-alpha.85";
 
 // src/key-health.ts
 var JSON_HEADERS = { "Content-Type": "application/json" };

package/dist/key-health.mjs

@@ -3,7 +3,7 @@ import {
   KEY_FINGERPRINT_LENGTH,
   createKeyHealthRoute,
   keyFingerprint
-} from "./chunk-QEFIAAE7.mjs";
+} from "./chunk-WXN7FNXP.mjs";
 export {
   KEY_FINGERPRINT_DOMAIN,
   KEY_FINGERPRINT_LENGTH,

package/dist/profiles.d.mts

@@ -1,4 +1,4 @@
-import { k as Provider } from './ir-D4S9R816.mjs';
+import { k as Provider } from './ir-JUoybVM-.mjs';
 import { IntentArchetypeName } from './dialect.mjs';
 
 /**
@@ -291,6 +291,15 @@ interface ProfileBrainHook {
 }
 /** @internal — called by models-brain.ts at module load. */
 declare function _setProfileBrainHook(hook: ProfileBrainHook): void;
+/**
+ * Resolve a model id to its canonical form (alias → canonical, unknown ids
+ * returned unchanged). This is the same resolution `getProfile` applies, so
+ * any code comparing model ids against a policy list (blockedModels,
+ * preferredModels) must compare canonical forms on BOTH sides — an alias and
+ * its canonical are the same model, and a raw-string comparison lets one
+ * evade a policy naming the other (alpha.85, tt-intel s119 spend-gate leak).
+ */
+declare function resolveModelAlias(id: string): string;
 declare function getProfile(id: string): ModelProfile;
 declare function tryGetProfile(id: string): ModelProfile | undefined;
 declare function allProfiles(): readonly ModelProfile[];
@@ -299,4 +308,4 @@ declare function allProfiles(): readonly ModelProfile[];
 declare function allProfilesRaw(): readonly ModelProfile[];
 declare function profilesByProvider(provider: Provider): readonly ModelProfile[];
 
-export { ALIASES, type ArchetypeConvention, type CacheStrategy, type CliffRule, LATENCY_TIER_MS, type LatencyTier, type LoweringSpec, type ModelProfile, type RecoveryRule, type StructuredOutputCapability, type SystemPromptMode, _setProfileBrainHook, allProfiles, allProfilesRaw, getProfile, latencyTierOf, profilesByProvider, tryGetProfile };
+export { ALIASES, type ArchetypeConvention, type CacheStrategy, type CliffRule, LATENCY_TIER_MS, type LatencyTier, type LoweringSpec, type ModelProfile, type RecoveryRule, type StructuredOutputCapability, type SystemPromptMode, _setProfileBrainHook, allProfiles, allProfilesRaw, getProfile, latencyTierOf, profilesByProvider, resolveModelAlias, tryGetProfile };

package/dist/profiles.d.ts

@@ -1,4 +1,4 @@
-import { k as Provider } from './ir-Cx9hJj0B.js';
+import { k as Provider } from './ir-DfrM71pA.js';
 import { IntentArchetypeName } from './dialect.js';
 
 /**
@@ -291,6 +291,15 @@ interface ProfileBrainHook {
 }
 /** @internal — called by models-brain.ts at module load. */
 declare function _setProfileBrainHook(hook: ProfileBrainHook): void;
+/**
+ * Resolve a model id to its canonical form (alias → canonical, unknown ids
+ * returned unchanged). This is the same resolution `getProfile` applies, so
+ * any code comparing model ids against a policy list (blockedModels,
+ * preferredModels) must compare canonical forms on BOTH sides — an alias and
+ * its canonical are the same model, and a raw-string comparison lets one
+ * evade a policy naming the other (alpha.85, tt-intel s119 spend-gate leak).
+ */
+declare function resolveModelAlias(id: string): string;
 declare function getProfile(id: string): ModelProfile;
 declare function tryGetProfile(id: string): ModelProfile | undefined;
 declare function allProfiles(): readonly ModelProfile[];
@@ -299,4 +308,4 @@ declare function allProfiles(): readonly ModelProfile[];
 declare function allProfilesRaw(): readonly ModelProfile[];
 declare function profilesByProvider(provider: Provider): readonly ModelProfile[];
 
-export { ALIASES, type ArchetypeConvention, type CacheStrategy, type CliffRule, LATENCY_TIER_MS, type LatencyTier, type LoweringSpec, type ModelProfile, type RecoveryRule, type StructuredOutputCapability, type SystemPromptMode, _setProfileBrainHook, allProfiles, allProfilesRaw, getProfile, latencyTierOf, profilesByProvider, tryGetProfile };
+export { ALIASES, type ArchetypeConvention, type CacheStrategy, type CliffRule, LATENCY_TIER_MS, type LatencyTier, type LoweringSpec, type ModelProfile, type RecoveryRule, type StructuredOutputCapability, type SystemPromptMode, _setProfileBrainHook, allProfiles, allProfilesRaw, getProfile, latencyTierOf, profilesByProvider, resolveModelAlias, tryGetProfile };

package/dist/profiles.js

@@ -28,6 +28,7 @@ __export(profiles_exports, {
   getProfile: () => getProfile,
   latencyTierOf: () => latencyTierOf,
   profilesByProvider: () => profilesByProvider,
+  resolveModelAlias: () => resolveModelAlias,
   tryGetProfile: () => tryGetProfile
 });
 module.exports = __toCommonJS(profiles_exports);
@@ -1698,6 +1699,9 @@ function _setProfileBrainHook(hook) {
 function canonicalId(id) {
   return brainHook.resolveAlias?.(id) ?? ALIASES[id] ?? id;
 }
+function resolveModelAlias(id) {
+  return canonicalId(id);
+}
 var PROFILE_INDEX = new Map(
   PROFILES_RAW.map((p) => [p.id, p])
 );
@@ -1735,5 +1739,6 @@ function profilesByProvider(provider) {
   getProfile,
   latencyTierOf,
   profilesByProvider,
+  resolveModelAlias,
   tryGetProfile
 });

package/dist/profiles.mjs

@@ -7,8 +7,9 @@ import {
   getProfile,
   latencyTierOf,
   profilesByProvider,
+  resolveModelAlias,
   tryGetProfile
-} from "./chunk-VVRDFE6T.mjs";
+} from "./chunk-FD3NFXDC.mjs";
 export {
   ALIASES,
   LATENCY_TIER_MS,
@@ -18,5 +19,6 @@ export {
   getProfile,
   latencyTierOf,
   profilesByProvider,
+  resolveModelAlias,
   tryGetProfile
 };

package/dist/{types-DHi4FcUu.d.mts → types-BGH_KAHu.d.mts}

@@ -1,4 +1,4 @@
-import { i as Adapter, F as FallbackReason, x as SectionKind } from './ir-D4S9R816.mjs';
+import { i as Adapter, F as FallbackReason, x as SectionKind } from './ir-JUoybVM-.mjs';
 
 /**
  * Wire contract for the Glass-Box Chrome extension's brain-poll endpoint.

package/dist/{types-CAs9-0S4.d.ts → types-BqTKRECa.d.ts}

@@ -1,4 +1,4 @@
-import { s as MutationApplied, B as BestPracticeAdvisory, F as FallbackReason, m as CallAttempt } from './ir-Cx9hJj0B.js';
+import { s as MutationApplied, B as BestPracticeAdvisory, F as FallbackReason, m as CallAttempt } from './ir-DfrM71pA.js';
 
 /**
  * Glass-Box observability types (alpha.17).

package/dist/{types-Cvd6kRNv.d.ts → types-DLDJbCha.d.ts}

@@ -1,4 +1,4 @@
-import { i as Adapter, F as FallbackReason, x as SectionKind } from './ir-Cx9hJj0B.js';
+import { i as Adapter, F as FallbackReason, x as SectionKind } from './ir-DfrM71pA.js';
 
 /**
  * Wire contract for the Glass-Box Chrome extension's brain-poll endpoint.

package/dist/{types-CRXaR7nJ.d.mts → types-y42mwdvM.d.mts}

@@ -1,4 +1,4 @@
-import { s as MutationApplied, B as BestPracticeAdvisory, F as FallbackReason, m as CallAttempt } from './ir-D4S9R816.mjs';
+import { s as MutationApplied, B as BestPracticeAdvisory, F as FallbackReason, m as CallAttempt } from './ir-JUoybVM-.mjs';
 
 /**
  * Glass-Box observability types (alpha.17).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmdrift/kgauto-compiler",
-  "version": "2.0.0-alpha.83",
+  "version": "2.0.0-alpha.85",
   "description": "Prompt compiler with executable provider knowledge for multi-model AI apps: normalized multi-provider transport with fallback chains, compile-time cliff guards, a curated model registry, and a telemetry flight recorder. Swap models without rewriting prompts.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",