@oh-my-pi/pi-ai 18.7.0 → 18.8.1

package/CHANGELOG.md

@@ -2,6 +2,39 @@
 
 ## [Unreleased]
 
+## [18.8.1] - 2026-10-07
+
+### Added
+
+- Added session restrictions for OAuth account pools via `AuthStorage.sessions.restrict`, limiting selection, fallback, rotation, and authentication to specified accounts until the returned lease is released with `sessions.unrestrict`. API keys and other accounts are not used when a session is restricted.
+- Exported `resolveCredentialIdentityKey` for determining the identity key used to match credentials with broker account pools and session restrictions.
+
+### Fixed
+
+- Fixed Codex Fast (`priority`) and Ultrafast usage being recorded, billed, and reported as Standard when the backend echoed a default service tier; the requested tier is now preserved in usage and performance records.
+
+## [18.8.0] - 2026-10-07
+
+### Breaking Changes
+
+- The environment API-key helpers (`getEnvApiKey`, `getEnvApiKeyName`, and `listProvidersWithEnvKey`) are no longer exported from `@oh-my-pi/pi-ai/stream`; import them from `@oh-my-pi/pi-ai` or `@oh-my-pi/pi-ai/env-api-key` instead.
+- `TranscriptionRequest.audio` now accepts `Uint8Array | Blob`. Consumers must handle `Blob` values when reading transcription requests.
+
+### Changed
+
+- Improved CPU and memory efficiency across streamed model responses, including Cursor, Devin, Codex, OpenAI Responses, and GitLab Duo Workflow.
+- Improved request and authentication performance, including account ranking, OAuth preflight, credential rate-limit checks, credential synchronization, and auth gateway requests.
+- Improved tool-call parsing performance for long calls and Apple Foundation Models requests.
+- Improved Cloudflare AI Gateway request performance and AWS credential-source detection.
+- Reduced memory usage when handling generated images and usage reports.
+
+### Fixed
+
+- Fixed false thinking-loop detections for Gemini, DeepSeek, and Grok when responses contain repetitive code or markup such as VRML, SVG, or JSON; valid output is no longer discarded and retried.
+- Fixed the Cursor provider retaining request resources after requests completed.
+- Fixed session-affinity pins growing without bound in long-lived gateways; pins are now capped at 256 sessions per provider.
+- Fixed Anthropic sessions failing every request with HTTP 400 ("role 'system' must precede an 'assistant' message") after a tool change coincided with compaction or an interrupted or failed reply; sessions already stuck this way recover on the next message ([#14746](https://github.com/can1357/oh-my-pi/issues/14746)).
+
 ## [18.7.0] - 2026-10-06
 
 ### Added

package/dist/types/auth/affinity.d.ts

@@ -1,4 +1,4 @@
-import type { AuthCredential, OAuthCredential, SessionsApi } from "./types.js";
+import type { AuthCredential, OAuthCredential, SessionRestrictionLease, SessionsApi } from "./types.js";
 import type { AuthCredentialStore } from "./store.js";
 import type { CredentialPool } from "./pool.js";
 import type { KeyOverrides } from "./cascade.js";
@@ -13,10 +13,30 @@ export type SessionCredential = {
     /** Set only by the public user-facing pin API; automatic warm affinity leaves it absent. */
     explicit?: true;
 };
+/** One installed restriction: the allowed OAuth identity keys and the lease that lifts it. */
+type SessionRestriction = {
+    readonly allowed: ReadonlySet<string>;
+    readonly lease: SessionRestrictionLease;
+};
+/**
+ * Provider → session id → installed restriction. Owned by `AuthStorage` so
+ * restrictions outlive store replacement, which rebuilds every store-bound
+ * module (pins included) around the same identities.
+ */
+export type SessionRestrictions = Map<string, Map<string, SessionRestriction>>;
 /** Session → credential affinity (pins), persisted in the store cache. */
 export declare class SessionAffinity implements SessionsApi {
     #private;
-    constructor(store: AuthCredentialStore, pool: CredentialPool, overrides: KeyOverrides);
+    constructor(store: AuthCredentialStore, pool: CredentialPool, overrides: KeyOverrides, restrictions: SessionRestrictions);
+    restrict(provider: string, sessionId: string, identityKeys: readonly string[]): SessionRestrictionLease;
+    unrestrict(provider: string, sessionId: string, lease: SessionRestrictionLease): void;
+    /** True when {@link restrict} limits `sessionId` for `provider`. */
+    isRestricted(provider: string, sessionId: string | undefined): boolean;
+    /**
+     * True when `credential` may serve `sessionId`: always for an unrestricted
+     * session, otherwise only an OAuth credential whose identity key is allowed.
+     */
+    allows(provider: string, sessionId: string | undefined, credential: AuthCredential): boolean;
     /** Drop every pin for a provider, both in memory and in the persisted cache. */
     clearProvider(provider: string): void;
     /** Drop only this in-memory session pin after OAuth selection falls through. */
@@ -33,7 +53,11 @@ export declare class SessionAffinity implements SessionsApi {
      * rewrites were pure database churn.
      */
     record(provider: string, sessionId: string | undefined, type: AuthCredential["type"], index: number, lastUsedAtMs?: number, explicit?: boolean): void;
-    /** Retrieves the last credential used by a session. */
+    /**
+     * Retrieves the last credential used by a session. A restricted session
+     * never sees a pin outside its allowlist — inherited, restored, or recorded
+     * before the restriction — so it re-ranks inside the allowlist instead.
+     */
     get(provider: string, sessionId: string | undefined): SessionCredential | undefined;
     /** Clears the last credential used by a session for a provider. */
     clear(provider: string, sessionId: string | undefined): void;
@@ -71,3 +95,4 @@ export declare class SessionAffinity implements SessionsApi {
      */
     release(provider: string, sessionId: string): boolean;
 }
+export {};

package/dist/types/auth/cascade.d.ts

@@ -8,6 +8,14 @@ export declare class KeyOverrides {
     #private;
     constructor(resolver?: (config: string) => Promise<string | undefined>);
     has(provider: string): boolean;
+    /**
+     * Whether an override replaces OAuth for a session. Any override does for an
+     * unrestricted session. A restricted session skips the runtime key, but a
+     * config key still blocks OAuth: it marks the provider's endpoint (often a
+     * proxy) as taking that key, so the session fails closed instead of sending
+     * a pooled OAuth token there (see `KeyCascade.get`).
+     */
+    suppressesOAuth(provider: string, restricted: boolean): boolean;
     runtimeKey(provider: string): string | undefined;
     configKey(provider: string): string | undefined;
     /** Config value consulted only after stored OAuth/login credentials. */
@@ -115,6 +123,10 @@ export declare class KeyCascade implements KeysApi {
      * Get API key for a provider.
      * Priority (first match wins): runtime override, config override, OAuth,
      * login API key, environment variable, then another stored API key.
+     * A session restricted by `sessions.restrict` resolves only its allowed
+     * OAuth accounts and throws {@link AIError.MissingApiKeyError} when none
+     * can serve or a config key (a models.yml `apiKey`, often for a proxy
+     * `baseUrl`) owns the provider, rather than using any other credential.
      */
     get(provider: string, sessionId?: string, options?: AuthApiKeyOptions, onCredentialId?: (id: number, identity?: OAuthRequestIdentity) => void): Promise<string | undefined>;
     /**

package/dist/types/auth/sqlite-credential-store.d.ts

@@ -18,6 +18,12 @@ type SerializedCredentialRecord = {
 };
 export { isSqliteBusyError, isSqliteCorruptionError };
 export declare function serializeCredential(provider: string, credential: AuthCredential): SerializedCredentialRecord | null;
+/**
+ * Identity key of a credential: the `identityKey` that broker snapshots carry
+ * and that broker account pools and `sessions.restrict` match, such as
+ * `email:<address>|org:<id>` for org-scoped providers. `null` for an API key or
+ * an OAuth credential without any account, email, project, or org identity.
+ */
 export declare function resolveCredentialIdentityKey(provider: string, credential: AuthCredential): string | null;
 /**
  * Default SQLite-backed implementation of {@link AuthCredentialStore}.
@@ -60,6 +66,7 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
     deleteCachePrefix(prefix: string): void;
     cleanExpiredCache(): void;
     getCredentialBlock(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    getCredentialBlockScopes(credentialId: number, providerKey: string): Map<string, number>;
     getCredentialBlockReconcileAfter(credentialId: number, providerKey: string, blockScope: string): number | undefined;
     upsertCredentialBlock(block: StoredCredentialBlock): void;
     deleteCredentialBlock(credentialId: number, providerKey: string, blockScope: string): void;

package/dist/types/auth/store.d.ts

@@ -71,6 +71,12 @@ export interface CredentialCacheStore {
 export interface CredentialBlockStore {
     /** Non-expired block for one (credential, providerKey, scope) key, or undefined. */
     getCredentialBlock(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    /**
+     * Non-expired blocks for one credential and providerKey, keyed by block
+     * scope (`""` is unscoped), in one read. Optional: selectors fall back to
+     * {@link CredentialBlockStore.getCredentialBlock} per scope when absent.
+     */
+    getCredentialBlockScopes?(credentialId: number, providerKey: string): ReadonlyMap<string, number>;
     /** Earliest time a shared-store block should be eligible for live-usage reconciliation. */
     getCredentialBlockReconcileAfter(credentialId: number, providerKey: string, blockScope: string): number | undefined;
     /** Upsert with MAX semantics: keep the later blockedUntilMs on conflict. */

package/dist/types/auth/types.d.ts

@@ -998,6 +998,11 @@ export interface OAuthApi {
      */
     refreshStored<T extends OAuthCredential = OAuthCredential>(provider: string, options: StoredOAuthRefreshOptions<T>): Promise<StoredOAuthRefreshResult<T>>;
 }
+/**
+ * Handle for one {@link SessionsApi.restrict} call. {@link SessionsApi.unrestrict}
+ * lifts a restriction only with the lease of the call that installed it.
+ */
+export type SessionRestrictionLease = symbol;
 /** Session credential affinity operations. */
 export interface SessionsApi {
     /**
@@ -1025,6 +1030,27 @@ export interface SessionsApi {
      * source session.
      */
     inherit(sourceSessionId: string, targetSessionId: string): number;
+    /**
+     * Restrict one session's credentials for `provider` to the OAuth accounts
+     * whose identity key (`email:<address>|org:<id>` for org-scoped providers;
+     * otherwise `account:`, `email:`, or `project:` — the keys broker account
+     * pools use) is listed. Selection, session pins, inherited affinity,
+     * fallback passes, and rotation never leave the list, and runtime, config,
+     * environment, and stored API keys are not used for that session; when no
+     * listed account can serve, key resolution fails instead of borrowing
+     * another account. An empty list allows no account. Replaces any earlier
+     * restriction for the same provider and session; {@link inherit} does not
+     * copy restrictions. Restrictions are never evicted, because that would
+     * widen a live session; the owner passes the returned lease to
+     * {@link unrestrict} when the session ends.
+     */
+    restrict(provider: string, sessionId: string, identityKeys: readonly string[]): SessionRestrictionLease;
+    /**
+     * Lift the restriction that `lease` installed. Once a later {@link restrict}
+     * call has replaced it for the same provider and session, this does nothing,
+     * so a stale owner never lifts the restriction a newer owner relies on.
+     */
+    unrestrict(provider: string, sessionId: string, lease: SessionRestrictionLease): void;
     /**
      * Release a session's sticky credential so its next {@link getApiKey} call
      * re-runs native pool ranking. This never blocks or penalizes the released

package/dist/types/auth-broker/remote-store.d.ts

@@ -73,6 +73,7 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     /** Broker-backed disabled tombstones; empty against brokers predating the endpoint. */
     listDisabledCredentials(provider?: string, signal?: AbortSignal): Promise<DisabledCredentialSummary[]>;
     getCredentialBlock(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    getCredentialBlockScopes(credentialId: number, providerKey: string): Map<string, number>;
     getCredentialBlockReconcileAfter(credentialId: number, providerKey: string, blockScope: string): number | undefined;
     listCredentialBlocks(credentialIds: readonly number[]): StoredCredentialBlock[];
     upsertCredentialBlock(block: StoredCredentialBlock): void;

package/dist/types/auth-broker/snapshot-cache.d.ts

@@ -15,3 +15,15 @@ export interface WriteAuthBrokerSnapshotCacheOptions {
 }
 export declare function readAuthBrokerSnapshotCache(opts: ReadAuthBrokerSnapshotCacheOptions): Promise<SnapshotResponse | null>;
 export declare function writeAuthBrokerSnapshotCache(opts: WriteAuthBrokerSnapshotCacheOptions): Promise<void>;
+/**
+ * Fire-and-forget cache write for snapshot callbacks. The first snapshot after
+ * a quiet period is written immediately; later ones within
+ * {@link WRITE_COALESCE_MS} collapse into a single trailing write of the
+ * newest. A snapshot whose generation and credential content match the last
+ * write is skipped (see {@link UNCHANGED_REWRITE_MS}). Pending writes are
+ * flushed on process shutdown and by {@link flushAuthBrokerSnapshotCacheWrites};
+ * failures are logged, never thrown.
+ */
+export declare function scheduleAuthBrokerSnapshotCacheWrite(opts: WriteAuthBrokerSnapshotCacheOptions): void;
+/** Write every pending scheduled snapshot now and wait for in-flight writes to settle. */
+export declare function flushAuthBrokerSnapshotCacheWrites(): Promise<void>;

package/dist/types/auth-gateway/session-state.d.ts

@@ -63,6 +63,12 @@ export interface AuthGatewaySessionStateRequest {
      * continues.
      */
     context: Context;
+    /**
+     * `JSON.stringify(context.tools)` when the caller already serialized it
+     * (the gateway derives its `sessionId` from the same string). Recomputed
+     * from `context` when absent.
+     */
+    toolsJson?: string;
     /**
      * Stable identity of the account this request's credential resolved to.
      * A change means the gateway switched the session to a sibling credential,

package/dist/types/auth-storage.d.ts

@@ -1,6 +1,6 @@
 import type { AuthCredentialStore } from "./auth/store.js";
 import type { AuthAccountPolicies, AuthApiKeyOptions, AuthStorageOptions, BlocksApi, CredentialsApi, HealthApi, KeysApi, LimitsApi, OAuthApi, ResetsApi, SessionsApi, UsageApi } from "./auth/types.js";
-export { isSqliteBusyError, isSqliteCorruptionError, SqliteAuthCredentialStore } from "./auth/sqlite-credential-store.js";
+export { isSqliteBusyError, isSqliteCorruptionError, resolveCredentialIdentityKey, SqliteAuthCredentialStore, } from "./auth/sqlite-credential-store.js";
 export * from "./auth/store.js";
 export * from "./auth/types.js";
 /**
@@ -46,9 +46,9 @@ export declare class AuthStorage {
      * Swap the backing credential store in place (live `auth.broker.url` change).
      * Loads `store` into fresh store-bound state — pins, blocks, and usage caches are
      * keyed by the old store's row ids — then closes the previous store. Runtime key
-     * overrides, account policies, usage-provider overrides, and credential event
-     * subscribers carry over. On a load failure `store` is closed and the current
-     * store stays active.
+     * overrides, account policies, session account restrictions, usage-provider
+     * overrides, and credential event subscribers carry over. On a load failure
+     * `store` is closed and the current store stays active.
      */
     replaceStore(store: AuthCredentialStore, options?: {
         sourceLabel?: string;

package/dist/types/dialect/terminator-wait.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Fast path for in-band scanners that sit inside a body waiting for one fixed
+ * terminator (a tool-call close tag) and emit nothing until it arrives.
+ *
+ * Appending each delta to the scanner's string buffer and calling `indexOf` on
+ * it flattens the growing rope on every delta, so a long in-band tool call cost
+ * O(n²) copying and scanning. While armed, deltas are set aside and only the new
+ * text plus the terminator-length overlap with what came before is searched;
+ * the buffer is rebuilt once, when the terminator shows up or the stream ends.
+ */
+export declare class TerminatorWait {
+    #private;
+    /** Start deferring; `buffered` is the scanner's pending body, known not to contain `terminator`. */
+    arm(terminator: string, buffered: string): void;
+    /** Take `text` while the terminator is still absent; false means the caller must {@link release} and scan. */
+    absorb(text: string): boolean;
+    /** Stop deferring and return `buffered` with every absorbed delta appended. */
+    release(buffered: string): string;
+}

package/dist/types/env-api-key.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Get API key for provider from known environment variables, e.g. OPENAI_API_KEY.
+ *
+ * Will not return API keys for providers that require OAuth tokens.
+ * Checks Bun.env, then cwd/.env, then ~/.env.
+ */
+export declare function getEnvApiKey(provider: string): string | undefined;
+/**
+ * Name of the environment variable that backs `getEnvApiKey` for a provider,
+ * when that provider maps to a single named variable (e.g. `github-copilot` →
+ * `COPILOT_GITHUB_TOKEN`). Returns undefined for providers whose env fallback
+ * is computed (multi-var pickers, Vertex ADC / Bedrock probes, …) since no
+ * single variable name describes the source.
+ */
+export declare function getEnvApiKeyName(provider: string): string | undefined;
+/**
+ * Enumerate every provider that has an env-var fallback for `getEnvApiKey`.
+ * Used by `omp auth-broker migrate --include-env` to discover env-sourced keys
+ * that should be uploaded to the broker.
+ */
+export declare function listProvidersWithEnvKey(): string[];

package/dist/types/images/shared.d.ts

@@ -32,6 +32,12 @@ export declare function decodeImageResponse(value: unknown, fetch: FetchImpl, si
     images: GeneratedImage[];
     usage: Usage;
 }>;
+/**
+ * Mime type of a base64 image, read from its header only. 64 base64 chars
+ * decode to 48 bytes, past every magic number `parseImageMetadata` checks, so
+ * multi-MB payloads are never fully decoded just to be labelled.
+ */
+export declare function sniffBase64ImageMimeType(base64: string): string | undefined;
 export declare function toDataUrl(image: GeneratedImage): string;
 export declare function resolveOpenAIImageSize(aspectRatio?: string, imageSize?: string): string | undefined;
 export {};

package/dist/types/index.d.ts

@@ -39,6 +39,7 @@ export type * from "./providers/openai-responses.js";
 export type * from "./providers/synthetic.js";
 export * from "./registry/index.js";
 export { resolveCacheRetention } from "./utils.js";
+export * from "./env-api-key.js";
 export * from "./stream.js";
 export * from "./types.js";
 export * from "./usage.js";

package/dist/types/providers/connect-frame.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Connect-protocol streaming envelope shared by the Cursor and Devin
+ * transports: 1 flag byte + 4-byte big-endian payload length + payload.
+ */
+/** Flag bit: payload is compressed with the negotiated encoding (gzip). */
+export declare const CONNECT_COMPRESSED_FLAG = 1;
+/** Flag bit: payload is the end-of-stream JSON trailer. */
+export declare const CONNECT_END_STREAM_FLAG = 2;
+/** Wrap one Connect-protocol message: 1 flag byte + 4-byte big-endian length + payload. */
+export declare function frameConnectMessage(data: Uint8Array, flags?: number): Buffer;
+/** One decoded Connect envelope. */
+export interface ConnectFrame {
+    flags: number;
+    payload: Buffer;
+}
+/** Options for {@link ConnectFrameDecoder}. */
+export interface ConnectFrameDecoderOptions {
+    /**
+     * Payload cap: a length prefix above `maxPayloadBytes` throws `error(length)`
+     * before any of that payload is buffered. Uncapped when omitted.
+     */
+    limit?: {
+        maxPayloadBytes: number;
+        error: (length: number) => Error;
+    };
+}
+/**
+ * Incremental Connect frame decoder. Incoming chunks are kept as-is and a frame
+ * spanning several chunks is joined once, when the length the header announced
+ * has fully arrived — re-concatenating the pending bytes on every chunk made a
+ * multi-MB frame cost O(size × chunks).
+ *
+ * Payloads alias the chunk they came from whenever a frame fits in one chunk,
+ * so callers must not reuse chunk buffers they hand in.
+ */
+export declare class ConnectFrameDecoder {
+    #private;
+    constructor(options?: ConnectFrameDecoderOptions);
+    /**
+     * Buffer `chunk` (if any) and yield every frame now complete, in wire order.
+     * An oversize length prefix throws after the frames that precede it.
+     */
+    decode(chunk?: Uint8Array): Generator<ConnectFrame, void, undefined>;
+}

package/dist/types/providers/cursor/interaction-query.d.ts

@@ -7,8 +7,6 @@ type ProtoUnknownField = {
 interface CursorInteractionWriter {
     write(frame: Uint8Array): void;
 }
-/** Wrap one Connect-protocol message: 1 flag byte + 4-byte big-endian length + payload. */
-export declare function frameConnectMessage(data: Uint8Array, flags?: number): Buffer;
 /** Well-formed protobuf-es `$unknown` entries on `message`; anything else on the bag is ignored. */
 export declare function protoUnknownFields(message: object): ProtoUnknownField[];
 /**

package/dist/types/stream.d.ts

@@ -31,27 +31,6 @@ export declare const __providerInFlightForTesting: {
     captureStaleLockRelease(provider: string): Promise<(() => Promise<void>) | null>;
     captureLockDirRelease(provider: string): Promise<(() => Promise<void>) | null>;
 };
-/**
- * Get API key for provider from known environment variables, e.g. OPENAI_API_KEY.
- *
- * Will not return API keys for providers that require OAuth tokens.
- * Checks Bun.env, then cwd/.env, then ~/.env.
- */
-export declare function getEnvApiKey(provider: string): string | undefined;
-/**
- * Name of the environment variable that backs `getEnvApiKey` for a provider,
- * when that provider maps to a single named variable (e.g. `github-copilot` →
- * `COPILOT_GITHUB_TOKEN`). Returns undefined for providers whose env fallback
- * is computed (multi-var pickers, Vertex ADC / Bedrock probes, …) since no
- * single variable name describes the source.
- */
-export declare function getEnvApiKeyName(provider: string): string | undefined;
-/**
- * Enumerate every provider that has an env-var fallback for `getEnvApiKey`.
- * Used by `omp auth-broker migrate --include-env` to discover env-sourced keys
- * that should be uploaded to the broker.
- */
-export declare function listProvidersWithEnvKey(): string[];
 export declare function stream<TApi extends Api>(model: Model<TApi>, context: Context, options?: OptionsForApi<TApi>): AssistantMessageEventStream;
 export declare function complete<TApi extends Api>(model: Model<TApi>, context: Context, options?: OptionsForApi<TApi>): Promise<AssistantMessage>;
 export declare function streamSimple<TApi extends Api>(model: Model<TApi>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream;

package/dist/types/transcription/types.d.ts

@@ -2,7 +2,8 @@ import type { Usage } from "@oh-my-pi/pi-catalog/types";
 export type TranscriptionResponseFormat = "json" | "verbose_json";
 export type TranscriptionTimestampGranularity = "word" | "segment";
 export interface TranscriptionRequest {
-    audio: Uint8Array;
+    /** Audio bytes. A `Blob`/`File` (e.g. a parsed multipart upload) is sent without copying. */
+    audio: Uint8Array | Blob;
     mimeType: string;
     fileName?: string;
     language?: string;

package/dist/types/utils/aws-profile.d.ts

@@ -9,6 +9,11 @@ export declare function resolveAwsProfile(profile?: string): string;
  * the AWS SDK's `AWS_SDK_LOAD_CONFIG` opt-in.
  */
 export declare function shouldLoadAwsSharedConfig(profile?: string): boolean;
+/** Shared credentials and config file locations, honoring their env overrides. */
+export declare function awsSharedFilePaths(): {
+    credentialsPath: string;
+    configPath: string;
+};
 export declare function resolveAwsProfileRegion(profile?: string): string | undefined;
 /** Region selected by the environment or active shared-config profile. */
 export declare function resolveAwsAmbientRegion(profile?: string): string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.7.0",
+	"version": "18.8.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.7.0",
-		"@oh-my-pi/pi-catalog": "18.7.0",
-		"@oh-my-pi/pi-natives": "18.7.0",
-		"@oh-my-pi/pi-utils": "18.7.0",
-		"@oh-my-pi/pi-wire": "18.7.0"
+		"@oh-my-pi/omptype": "18.8.1",
+		"@oh-my-pi/pi-catalog": "18.8.1",
+		"@oh-my-pi/pi-natives": "18.8.1",
+		"@oh-my-pi/pi-utils": "18.8.1",
+		"@oh-my-pi/pi-wire": "18.8.1"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"