@namzu/zen 2.0.0 → 2.1.1

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # @namzu/zen
 
+## 2.1.1
+
+### Patch Changes
+
+- 8d5223b: Nothing a consumer installs or calls changes, and that is the whole of this
+  release. `vitest` moves from `^3.2.6` to `^4.1.11` in the `devDependencies` of
+  all nineteen packages that declared it, and `@vitest/coverage-v8` moves with it
+  in `@namzu/sdk`. Every occurrence is a devDependency — checked, not assumed —
+  so `dependencies`, `peerDependencies`, exports, types, defaults and the wire
+  shape are untouched, and the published tarballs differ from the previous
+  release only in `package.json#devDependencies`.
+
+  The reason is a security fix with no 3.x backport. `GHSA-82fw-gwwq-j7x9`
+  ("Path Traversal / Arbitrary File Read via `@vitest/mocker` Redirect Mock")
+  covers `vitest` and `@vitest/mocker` from `2.1.0` up to `4.1.11`, so `^3.2.6`
+  can only be resolved by leaving the 3.x line. `4.1.11` is the first patched
+  release and is what the lockfile now resolves for both.
+
+  What this costs anyone who works on the repository rather than with it: the
+  upgrade was not a version bump. Vitest 4 changed test discovery, coverage
+  configuration, mock construction and reporter output, and each of those broke
+  something here that had to be migrated rather than worked around. Those fixes
+  are all under `__tests__/`, `vitest.config.ts` files and `scripts/`, none of
+  which is published, which is why this is a patch and not a major.
+
+  You do not need to do anything. If you pin `vitest` yourself to run this
+  project's own suites, note that the config files it ships are now written for
+  `>= 4.1.11` and will not run under 3.x.
+
+## 2.1.0
+
+### Minor Changes
+
+- a38d843: The catalogue was refreshed from its sources. The roster is unchanged — 59 Zen
+  and 27 Go — so nothing a caller routes today stops resolving.
+
+  **`gpt-5.6-sol` is repriced**: input `2.0` → `4.0`, output `10.0` → `20.0` per
+  million tokens. The page had carried a 50% discount through 2026-09-18 and now
+  states the full tier. A consumer that estimates cost from the bundled prices
+  sees the increase here rather than at the invoice.
+
+  **Two omissions were retired.** `zen/union-alpha` and `go/union-alpha` were
+  recorded as omissions on 2026-09-18 after models.dev deleted their entry —
+  the catalogue derives limits, tool support and modalities from there and never
+  invents them. Hours later the service stopped serving the id and both pages
+  stopped routing it, so the omission no longer applied and the stale rule
+  dropped it. Neither id was ever carried, so this changes no caller's roster; it
+  is recorded because a decision in `models.review.json` is re-examined on every
+  run rather than left standing.
+
 ## 2.0.0
 
 ### Major Changes

package/dist/models.js

@@ -78,8 +78,8 @@ const ZEN_MODELS = freezeModels([
         contextWindow: 1050000,
         maxOutputTokens: 128000,
         inputModalities: ['text', 'image', 'document'],
-        inputPrice: 2.0,
-        outputPrice: 10.0,
+        inputPrice: 4.0,
+        outputPrice: 20.0,
         supportsToolUse: true,
         supportsStreaming: true,
         effortLevels: ['none', 'low', 'medium', 'high', 'xhigh', 'max'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/zen",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "description": "Zen and Go model provider for the Namzu agent kernel, with native protocol routing and conversation attribution.",
   "license": "FSL-1.1-MIT",
   "engines": {
@@ -64,9 +64,9 @@
     "@biomejs/biome": "^1.9.4",
     "@types/node": "^22.19.17",
     "typescript": "^5.5.0",
-    "vitest": "^3.2.6",
+    "vitest": "^4.1.11",
     "zod": "^3.23.0",
-    "@namzu/sdk": "^42.0.0"
+    "@namzu/sdk": "^42.0.2"
   },
   "scripts": {
     "build": "tsc --build",

package/src/models.review.json

@@ -10,7 +10,6 @@
 		"go/minimax-m2.5": "Superseded on Go by MiniMax M2.7 and M3, which are both carried. The page still lists it.",
 		"go/omen-alpha": "Served by Go and no longer routed by the Go page, which is why this release dropped it from the catalogue. No source states a wire for it any more, so a caller that needs it must name the protocol itself.",
 		"go/qwen3.5-plus": "Served by Go and absent from the Go page, which routes Qwen 3.6 Plus and later. The Zen page routes this id on Messages, and one service's route is not the other's, so none is taken from it.",
-		"go/union-alpha": "Still served by Go and still routed by the Go page, on the Messages wire. models.dev deleted its entry on 2026-09-18, so its limits, tool support and modalities are no longer derivable and are never invented; it returns to the catalogue when models.dev restores the entry, and a caller who needs it meanwhile states the wire itself (`protocol: 'messages'`).",
 		"zen/claude-sonnet-4": "Served by Zen and named by no route row on either page: the Zen page routes Claude Sonnet 4.5 and 4.6. models.dev states an npm package for it, and that field is deliberately not used as a route, so none is carried.",
 		"zen/deepseek-v4-flash-free": "Served by Zen and absent from the Zen page, which routes DeepSeek V4 Flash. models.dev states a name and limits for this free id and no wire, so none is carried.",
 		"zen/glm-5": "Superseded by GLM 5.1, 5.2 and 5.3, which are all carried. The page still lists it.",
@@ -23,7 +22,6 @@
 		"zen/minimax-m2.5": "Superseded by MiniMax M2.7 and M3, which are both carried.",
 		"zen/muse-spark-1.2-contributor-free": "Served by Zen under an id no page routes: the Zen page's free-model list names the 1.3 contributor model, and Go's 1.2 contributor row is a different id on the other service. models.dev states an npm package for it, and that field is deliberately not used as a route, so none is carried.",
 		"zen/qwen3.7-max": "models.dev carries no entry for it, so its context window, limits and tool support cannot be derived and are never invented.",
-		"zen/qwen3.7-plus": "models.dev carries no entry for it, so its context window, limits and tool support cannot be derived and are never invented.",
-		"zen/union-alpha": "Still served by Zen and still routed by the Zen page, on the Messages wire. models.dev deleted its entry on 2026-09-18, so its limits, tool support and modalities are no longer derivable and are never invented; it returns to the catalogue when models.dev restores the entry, and a caller who needs it meanwhile states the wire itself (`protocol: 'messages'`)."
+		"zen/qwen3.7-plus": "models.dev carries no entry for it, so its context window, limits and tool support cannot be derived and are never invented."
 	}
 }

package/src/models.ts

@@ -105,8 +105,8 @@ const ZEN_MODELS = freezeModels([
 		contextWindow: 1050000,
 		maxOutputTokens: 128000,
 		inputModalities: ['text', 'image', 'document'],
-		inputPrice: 2.0,
-		outputPrice: 10.0,
+		inputPrice: 4.0,
+		outputPrice: 20.0,
 		supportsToolUse: true,
 		supportsStreaming: true,
 		effortLevels: ['none', 'low', 'medium', 'high', 'xhigh', 'max'],