@theokit/sdk 4.53.0 → 4.53.1

package/dist/internal/memory/adapters/index.js

@@ -1,12 +1,12 @@
-export { createOpenAiCompatibleRuntime } from '../../../chunk-EFXJ5C7X.js';
-import '../../../chunk-OZXPA3ME.js';
+export { createOpenAiCompatibleRuntime } from '../../../chunk-KSWHTR54.js';
+import '../../../chunk-FFM3SJTQ.js';
 export { LruEmbeddingCache, globalEmbeddingCache } from '../../../chunk-OXNYIMZZ.js';
 import '../../../chunk-FD2UT76F.js';
-import '../../../chunk-ITQ4NO4P.js';
-import '../../../chunk-ZSJPRPN7.js';
-import '../../../chunk-XWCTBGYK.js';
+import '../../../chunk-3WVMJY7F.js';
+import '../../../chunk-R5YZACGK.js';
+import '../../../chunk-SK4QLUBK.js';
 import '../../../chunk-RIAM53CP.js';
-import '../../../chunk-HI4ZW62S.js';
-import '../../../chunk-4X3SBHPK.js';
+import '../../../chunk-U4UJHOSH.js';
+import '../../../chunk-5F5NWKPN.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/internal/persistence/atomic-write.d.cts

@@ -1,3 +1,27 @@
+/**
+ * M107 — temp-file creation control, shared by `replaceFileAtomic`,
+ * `atomicWriteJson` e `atomicWriteText`.
+ *
+ * Both fields are OPTIONAL and the default is byte-identical to the behavior
+ * before M107. See `replaceFileAtomic` for why the mode reassertion
+ * is conditional.
+ *
+ */
+export interface AtomicWriteFileOptions {
+    /**
+     * Permission bits of the created file. Default: `0o600`, the previous fixed
+     * literal — filtered by the `umask`, as it always was. When provided, the mode is
+     * reasserted on the descriptor, so the `umask` cannot silently
+     * clearing bits the caller asked for.
+     */
+    mode?: number;
+    /**
+     * Create the temp file with `wx` (exclusive creation) instead of `w`. Default:
+     * `false` — the previous flag. With `true`, a pre-existing temp file becomes
+     * `EEXIST` instead of being truncated.
+     */
+    exclusive?: boolean;
+}
 /**
  * U-9 — the file a leftover temp was replacing, or `undefined` if this is not one of ours.
  *
@@ -12,3 +36,72 @@
  * deleting them.
  */
 export declare function atomicWriteTempTarget(name: string): string | undefined;
+/**
+ * Atomic file replacement: write content to a per-call unique tmp path,
+ * fsync, then rename over the target. Crash mid-write leaves either the old
+ * file intact or the new file complete — never a half-written file.
+ *
+ * The tmp suffix is `<pid>.<rand>.tmp` so parallel processes (and concurrent
+ * burst writes within one process) never collide on the same tmp path — a
+ * race that would manifest as `ENOENT` on `rename` after the rival process
+ * already moved its tmp into place.
+ *
+ * Mirrors peer-project's `replaceFileAtomic` from
+ * `reference/peer-project/packages/memory-host-sdk/src/host/fs-utils.ts` with
+ * the multi-writer robustness fix.
+ *
+ * ## M107 — `options` is optional, and the default is byte-identical
+ *
+ * The third parameter is additive: every earlier caller still compiles and
+ * writing exactly the same bytes, with the same mode, to the same path.
+ *
+ * The mode reassertion (`handle.chmod`) is **conditional on `mode !== undefined`**,
+ * and that is not cosmetic. `open`'s mode argument is filtered by the `umask`,
+ * which only CLEARS bits — measured in this codebase before the change:
+ *
+ * ```
+ * umask 0o002  ->  0o600      umask 0o022  ->  0o600      umask 0o200  ->  0o400
+ * ```
+ *
+ * An unconditional `chmod` would take the third case from `0o400` to `0o600` — a
+ * an on-disk change for every caller that asked for nothing, including external
+ * consumers. When the caller DOES ask for a mode, however, letting the `umask` decide
+ * silently is the defect this parameter exists to close; hence the reassertion.
+ *
+ * It goes on the DESCRIPTOR, before the `rename`, never after: chmod-ing the final
+ * final one would leave a window where it carries the `umask`'s mode — a known anti-pattern.
+ * The chosen shape passes the mode as an `open` argument.
+ *
+ */
+export declare function replaceFileAtomic(filePath: string, content: string, options?: AtomicWriteFileOptions): Promise<void>;
+/**
+ * Options for `atomicWriteJson`.
+ *
+ */
+export interface AtomicWriteJsonOptions extends AtomicWriteFileOptions {
+    /** Indent passed to `JSON.stringify`. Default: 2. */
+    indent?: number;
+    /** Whether to append a trailing newline (POSIX convention). Default: true. */
+    trailingNewline?: boolean;
+}
+/**
+ * Typed JSON atomic write helper.
+ *
+ * Serializes `data` to JSON, then delegates to `replaceFileAtomic`. The
+ * parent directory is auto-created (recursive `mkdir`) to make this helper
+ * safe for callers who haven't ensured the directory exists (EC-4 in the
+ * persistence-state-hardening plan).
+ *
+ * Throws `TypeError` on circular refs or `undefined` data (propagates from
+ * `JSON.stringify`).
+ *
+ */
+export declare function atomicWriteJson<T>(filePath: string, data: T, options?: AtomicWriteJsonOptions): Promise<void>;
+/**
+ * Atomic text write. Same crash-safety guarantees as `replaceFileAtomic` +
+ * auto-mkdir of the parent directory. Used by `theokit-migrate-config`
+ * (T4.1, EC-2 MUST FIX) so a crash mid-migration leaves previous MD files
+ * intact rather than corrupting them.
+ *
+ */
+export declare function atomicWriteText(filePath: string, content: string): Promise<void>;

package/dist/internal/persistence/atomic-write.d.ts

@@ -1,3 +1,27 @@
+/**
+ * M107 — temp-file creation control, shared by `replaceFileAtomic`,
+ * `atomicWriteJson` e `atomicWriteText`.
+ *
+ * Both fields are OPTIONAL and the default is byte-identical to the behavior
+ * before M107. See `replaceFileAtomic` for why the mode reassertion
+ * is conditional.
+ *
+ */
+export interface AtomicWriteFileOptions {
+    /**
+     * Permission bits of the created file. Default: `0o600`, the previous fixed
+     * literal — filtered by the `umask`, as it always was. When provided, the mode is
+     * reasserted on the descriptor, so the `umask` cannot silently
+     * clearing bits the caller asked for.
+     */
+    mode?: number;
+    /**
+     * Create the temp file with `wx` (exclusive creation) instead of `w`. Default:
+     * `false` — the previous flag. With `true`, a pre-existing temp file becomes
+     * `EEXIST` instead of being truncated.
+     */
+    exclusive?: boolean;
+}
 /**
  * U-9 — the file a leftover temp was replacing, or `undefined` if this is not one of ours.
  *
@@ -12,3 +36,72 @@
  * deleting them.
  */
 export declare function atomicWriteTempTarget(name: string): string | undefined;
+/**
+ * Atomic file replacement: write content to a per-call unique tmp path,
+ * fsync, then rename over the target. Crash mid-write leaves either the old
+ * file intact or the new file complete — never a half-written file.
+ *
+ * The tmp suffix is `<pid>.<rand>.tmp` so parallel processes (and concurrent
+ * burst writes within one process) never collide on the same tmp path — a
+ * race that would manifest as `ENOENT` on `rename` after the rival process
+ * already moved its tmp into place.
+ *
+ * Mirrors peer-project's `replaceFileAtomic` from
+ * `reference/peer-project/packages/memory-host-sdk/src/host/fs-utils.ts` with
+ * the multi-writer robustness fix.
+ *
+ * ## M107 — `options` is optional, and the default is byte-identical
+ *
+ * The third parameter is additive: every earlier caller still compiles and
+ * writing exactly the same bytes, with the same mode, to the same path.
+ *
+ * The mode reassertion (`handle.chmod`) is **conditional on `mode !== undefined`**,
+ * and that is not cosmetic. `open`'s mode argument is filtered by the `umask`,
+ * which only CLEARS bits — measured in this codebase before the change:
+ *
+ * ```
+ * umask 0o002  ->  0o600      umask 0o022  ->  0o600      umask 0o200  ->  0o400
+ * ```
+ *
+ * An unconditional `chmod` would take the third case from `0o400` to `0o600` — a
+ * an on-disk change for every caller that asked for nothing, including external
+ * consumers. When the caller DOES ask for a mode, however, letting the `umask` decide
+ * silently is the defect this parameter exists to close; hence the reassertion.
+ *
+ * It goes on the DESCRIPTOR, before the `rename`, never after: chmod-ing the final
+ * final one would leave a window where it carries the `umask`'s mode — a known anti-pattern.
+ * The chosen shape passes the mode as an `open` argument.
+ *
+ */
+export declare function replaceFileAtomic(filePath: string, content: string, options?: AtomicWriteFileOptions): Promise<void>;
+/**
+ * Options for `atomicWriteJson`.
+ *
+ */
+export interface AtomicWriteJsonOptions extends AtomicWriteFileOptions {
+    /** Indent passed to `JSON.stringify`. Default: 2. */
+    indent?: number;
+    /** Whether to append a trailing newline (POSIX convention). Default: true. */
+    trailingNewline?: boolean;
+}
+/**
+ * Typed JSON atomic write helper.
+ *
+ * Serializes `data` to JSON, then delegates to `replaceFileAtomic`. The
+ * parent directory is auto-created (recursive `mkdir`) to make this helper
+ * safe for callers who haven't ensured the directory exists (EC-4 in the
+ * persistence-state-hardening plan).
+ *
+ * Throws `TypeError` on circular refs or `undefined` data (propagates from
+ * `JSON.stringify`).
+ *
+ */
+export declare function atomicWriteJson<T>(filePath: string, data: T, options?: AtomicWriteJsonOptions): Promise<void>;
+/**
+ * Atomic text write. Same crash-safety guarantees as `replaceFileAtomic` +
+ * auto-mkdir of the parent directory. Used by `theokit-migrate-config`
+ * (T4.1, EC-2 MUST FIX) so a crash mid-migration leaves previous MD files
+ * intact rather than corrupting them.
+ *
+ */
+export declare function atomicWriteText(filePath: string, content: string): Promise<void>;

package/dist/internal/persistence/file-lock.d.cts

@@ -11,4 +11,16 @@
  *
  * @internal
  */
-export {};
+/**
+ * Run `fn` while holding an OS-level cross-process lock on `path`.
+ *
+ * If `proper-lockfile` is installed, uses it with a companion `<path>.lock`
+ * file (`realpath: false`, so target file does NOT need to exist yet).
+ * Otherwise falls back to in-process `withCwdMutex` and prints a one-shot
+ * stderr warning telling the user to install `proper-lockfile` for
+ * cross-process safety.
+ *
+ * The lock is released even when `fn` throws.
+ *
+ */
+export declare function withFileLock<T>(path: string, fn: () => Promise<T>, options?: FileLockOptions): Promise<T>;

package/dist/internal/persistence/file-lock.d.ts

@@ -11,4 +11,16 @@
  *
  * @internal
  */
-export {};
+/**
+ * Run `fn` while holding an OS-level cross-process lock on `path`.
+ *
+ * If `proper-lockfile` is installed, uses it with a companion `<path>.lock`
+ * file (`realpath: false`, so target file does NOT need to exist yet).
+ * Otherwise falls back to in-process `withCwdMutex` and prints a one-shot
+ * stderr warning telling the user to install `proper-lockfile` for
+ * cross-process safety.
+ *
+ * The lock is released even when `fn` throws.
+ *
+ */
+export declare function withFileLock<T>(path: string, fn: () => Promise<T>, options?: FileLockOptions): Promise<T>;

package/dist/internal/persistence/fts5-sanitize.d.cts

@@ -13,4 +13,12 @@
  *
  * @internal
  */
-export {};
+/**
+ * Six-step FTS5 query sanitizer. Returns a query string safe for passing
+ * to `WHERE <fts5_table> MATCH ?` as a parameter.
+ *
+ * Returns empty string when the input contains only specials (caller MUST
+ * short-circuit to avoid runtime SQL error — EC-3).
+ *
+ */
+export declare function sanitizeFts5Query(query: string): string;

package/dist/internal/persistence/fts5-sanitize.d.ts

@@ -13,4 +13,12 @@
  *
  * @internal
  */
-export {};
+/**
+ * Six-step FTS5 query sanitizer. Returns a query string safe for passing
+ * to `WHERE <fts5_table> MATCH ?` as a parameter.
+ *
+ * Returns empty string when the input contains only specials (caller MUST
+ * short-circuit to avoid runtime SQL error — EC-3).
+ *
+ */
+export declare function sanitizeFts5Query(query: string): string;

package/dist/internal/persistence/index.cjs

@@ -1,13 +1,13 @@
 'use strict';
 
 var chunkPNVDQL5Y_cjs = require('../../chunk-PNVDQL5Y.cjs');
-var chunkCZHPR2G7_cjs = require('../../chunk-CZHPR2G7.cjs');
-var chunkTR4V2LHV_cjs = require('../../chunk-TR4V2LHV.cjs');
-var chunkQLAWEGTZ_cjs = require('../../chunk-QLAWEGTZ.cjs');
+var chunkHAWE74GQ_cjs = require('../../chunk-HAWE74GQ.cjs');
+var chunkTTJ54H3E_cjs = require('../../chunk-TTJ54H3E.cjs');
+var chunkJIQRXKTA_cjs = require('../../chunk-JIQRXKTA.cjs');
 var chunkYLQQX5W2_cjs = require('../../chunk-YLQQX5W2.cjs');
-var chunk2CFEET3Y_cjs = require('../../chunk-2CFEET3Y.cjs');
-require('../../chunk-2YGIBOUH.cjs');
-require('../../chunk-SXSPMRSV.cjs');
+var chunkC4H6PB5J_cjs = require('../../chunk-C4H6PB5J.cjs');
+require('../../chunk-LPVIRJVF.cjs');
+require('../../chunk-BM6N4KHO.cjs');
 var promises = require('fs/promises');
 
 async function createExclusive(path, data, options) {
@@ -41,67 +41,67 @@ Object.defineProperty(exports, "PersistenceSchema", {
 });
 Object.defineProperty(exports, "displayTheokitHome", {
   enumerable: true,
-  get: function () { return chunkCZHPR2G7_cjs.displayTheokitHome; }
+  get: function () { return chunkHAWE74GQ_cjs.displayTheokitHome; }
 });
 Object.defineProperty(exports, "getProfilesRoot", {
   enumerable: true,
-  get: function () { return chunkCZHPR2G7_cjs.getProfilesRoot; }
+  get: function () { return chunkHAWE74GQ_cjs.getProfilesRoot; }
 });
 Object.defineProperty(exports, "getTheokitHome", {
   enumerable: true,
-  get: function () { return chunkCZHPR2G7_cjs.getTheokitHome; }
+  get: function () { return chunkHAWE74GQ_cjs.getTheokitHome; }
 });
 Object.defineProperty(exports, "migrateSchema", {
   enumerable: true,
-  get: function () { return chunkCZHPR2G7_cjs.migrateSchema; }
+  get: function () { return chunkHAWE74GQ_cjs.migrateSchema; }
 });
 Object.defineProperty(exports, "readVersionedJson", {
   enumerable: true,
-  get: function () { return chunkCZHPR2G7_cjs.readVersionedJson; }
+  get: function () { return chunkHAWE74GQ_cjs.readVersionedJson; }
 });
 Object.defineProperty(exports, "writeVersionedJson", {
   enumerable: true,
-  get: function () { return chunkCZHPR2G7_cjs.writeVersionedJson; }
+  get: function () { return chunkHAWE74GQ_cjs.writeVersionedJson; }
 });
 Object.defineProperty(exports, "JsonlParseError", {
   enumerable: true,
-  get: function () { return chunkTR4V2LHV_cjs.JsonlParseError; }
+  get: function () { return chunkTTJ54H3E_cjs.JsonlParseError; }
 });
 Object.defineProperty(exports, "appendJsonl", {
   enumerable: true,
-  get: function () { return chunkTR4V2LHV_cjs.appendJsonl; }
+  get: function () { return chunkTTJ54H3E_cjs.appendJsonl; }
 });
 Object.defineProperty(exports, "loadJsonl", {
   enumerable: true,
-  get: function () { return chunkTR4V2LHV_cjs.loadJsonl; }
+  get: function () { return chunkTTJ54H3E_cjs.loadJsonl; }
 });
 Object.defineProperty(exports, "readJsonlIds", {
   enumerable: true,
-  get: function () { return chunkTR4V2LHV_cjs.readJsonlIds; }
+  get: function () { return chunkTTJ54H3E_cjs.readJsonlIds; }
 });
 Object.defineProperty(exports, "withFileLock", {
   enumerable: true,
-  get: function () { return chunkTR4V2LHV_cjs.withFileLock; }
+  get: function () { return chunkTTJ54H3E_cjs.withFileLock; }
 });
 Object.defineProperty(exports, "applyWalWithFallback", {
   enumerable: true,
-  get: function () { return chunkQLAWEGTZ_cjs.applyWalWithFallback; }
+  get: function () { return chunkJIQRXKTA_cjs.applyWalWithFallback; }
 });
 Object.defineProperty(exports, "containsCjk", {
   enumerable: true,
-  get: function () { return chunkQLAWEGTZ_cjs.containsCjk; }
+  get: function () { return chunkJIQRXKTA_cjs.containsCjk; }
 });
 Object.defineProperty(exports, "isCorruptionError", {
   enumerable: true,
-  get: function () { return chunkQLAWEGTZ_cjs.isCorruptionError; }
+  get: function () { return chunkJIQRXKTA_cjs.isCorruptionError; }
 });
 Object.defineProperty(exports, "openSqliteResilient", {
   enumerable: true,
-  get: function () { return chunkQLAWEGTZ_cjs.openSqliteResilient; }
+  get: function () { return chunkJIQRXKTA_cjs.openSqliteResilient; }
 });
 Object.defineProperty(exports, "sanitizeFts5Query", {
   enumerable: true,
-  get: function () { return chunkQLAWEGTZ_cjs.sanitizeFts5Query; }
+  get: function () { return chunkJIQRXKTA_cjs.sanitizeFts5Query; }
 });
 Object.defineProperty(exports, "withCwdMutex", {
   enumerable: true,
@@ -109,15 +109,15 @@ Object.defineProperty(exports, "withCwdMutex", {
 });
 Object.defineProperty(exports, "atomicWriteJson", {
   enumerable: true,
-  get: function () { return chunk2CFEET3Y_cjs.atomicWriteJson; }
+  get: function () { return chunkC4H6PB5J_cjs.atomicWriteJson; }
 });
 Object.defineProperty(exports, "atomicWriteText", {
   enumerable: true,
-  get: function () { return chunk2CFEET3Y_cjs.atomicWriteText; }
+  get: function () { return chunkC4H6PB5J_cjs.atomicWriteText; }
 });
 Object.defineProperty(exports, "replaceFileAtomic", {
   enumerable: true,
-  get: function () { return chunk2CFEET3Y_cjs.replaceFileAtomic; }
+  get: function () { return chunkC4H6PB5J_cjs.replaceFileAtomic; }
 });
 exports.casUpdate = casUpdate;
 exports.createExclusive = createExclusive;

package/dist/internal/persistence/index.js

@@ -1,11 +1,11 @@
 export { PersistenceSchema } from '../../chunk-CAH3G4IS.js';
-export { displayTheokitHome, getProfilesRoot, getTheokitHome, migrateSchema, readVersionedJson, writeVersionedJson } from '../../chunk-L7EGRCKJ.js';
-export { JsonlParseError, appendJsonl, loadJsonl, readJsonlIds, withFileLock } from '../../chunk-HTK54K2J.js';
-export { applyWalWithFallback, containsCjk, isCorruptionError, openSqliteResilient, sanitizeFts5Query } from '../../chunk-W4FV7JBH.js';
+export { displayTheokitHome, getProfilesRoot, getTheokitHome, migrateSchema, readVersionedJson, writeVersionedJson } from '../../chunk-PBZ7HMBP.js';
+export { JsonlParseError, appendJsonl, loadJsonl, readJsonlIds, withFileLock } from '../../chunk-NZL4BNFQ.js';
+export { applyWalWithFallback, containsCjk, isCorruptionError, openSqliteResilient, sanitizeFts5Query } from '../../chunk-MSFLYJDY.js';
 export { withCwdMutex } from '../../chunk-2XLKLVVR.js';
-export { atomicWriteJson, atomicWriteText, replaceFileAtomic } from '../../chunk-CHVSMEKM.js';
-import '../../chunk-HI4ZW62S.js';
-import '../../chunk-4X3SBHPK.js';
+export { atomicWriteJson, atomicWriteText, replaceFileAtomic } from '../../chunk-6AZDM6LK.js';
+import '../../chunk-U4UJHOSH.js';
+import '../../chunk-5F5NWKPN.js';
 import { open } from 'fs/promises';
 
 async function createExclusive(path, data, options) {

package/dist/internal/persistence/session-dir.d.cts

@@ -0,0 +1 @@
+export {};

package/dist/internal/persistence/session-dir.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal/persistence/session-writer.d.cts

@@ -88,4 +88,17 @@ export interface SessionWriterLease {
  * detect. Tying the renewal to a real write means the record tracks **progress**, not mere existence.
  */
 export declare const HEARTBEAT_WINDOW_MS = 30000;
+/**
+ * Does the session have a writer **right now**? A query that does NOT take the lease.
+ *
+ * M95 — it exists because asking by taking creates the very contention it meant to detect: two
+ * processes querying a **free** session at the same time made one of them lose, and the consumer
+ * forked for no reason. Measured in adversarial review: `RACE: spurious forks = 1`.
+ *
+ * It is a snapshot, not a guarantee: between the query and the real acquisition someone may take
+ * the session. Callers needing the guarantee use {@link acquireSessionWriter}; callers needing to
+ * **decide an id before opening anything** use this, and handle the race where it shows up.
+ *
+ */
+export declare function sessionHasWriter(sessionPath: string): boolean;
 export declare function acquireSessionWriter(sessionPath: string): Promise<SessionWriterLease>;

package/dist/internal/persistence/session-writer.d.ts

@@ -88,4 +88,17 @@ export interface SessionWriterLease {
  * detect. Tying the renewal to a real write means the record tracks **progress**, not mere existence.
  */
 export declare const HEARTBEAT_WINDOW_MS = 30000;
+/**
+ * Does the session have a writer **right now**? A query that does NOT take the lease.
+ *
+ * M95 — it exists because asking by taking creates the very contention it meant to detect: two
+ * processes querying a **free** session at the same time made one of them lose, and the consumer
+ * forked for no reason. Measured in adversarial review: `RACE: spurious forks = 1`.
+ *
+ * It is a snapshot, not a guarantee: between the query and the real acquisition someone may take
+ * the session. Callers needing the guarantee use {@link acquireSessionWriter}; callers needing to
+ * **decide an id before opening anything** use this, and handle the race where it shows up.
+ *
+ */
+export declare function sessionHasWriter(sessionPath: string): boolean;
 export declare function acquireSessionWriter(sessionPath: string): Promise<SessionWriterLease>;

package/dist/internal/persistence/sqlite-wal.d.cts

@@ -1 +1,9 @@
-export {};
+/**
+ * Apply WAL mode with DELETE fallback. Idempotent — safe to call multiple
+ * times on the same connection.
+ *
+ * @param db   any `pragma()`-capable SQLite handle (e.g., `better-sqlite3`)
+ * @param label short identifier used in the warning (e.g., "memory-index")
+ *
+ */
+export declare function applyWalWithFallback(db: PragmaCapable, label: string): WalApplyResult;

package/dist/internal/persistence/sqlite-wal.d.ts

@@ -1 +1,9 @@
-export {};
+/**
+ * Apply WAL mode with DELETE fallback. Idempotent — safe to call multiple
+ * times on the same connection.
+ *
+ * @param db   any `pragma()`-capable SQLite handle (e.g., `better-sqlite3`)
+ * @param label short identifier used in the warning (e.g., "memory-index")
+ *
+ */
+export declare function applyWalWithFallback(db: PragmaCapable, label: string): WalApplyResult;

package/dist/internal/providers/builtin/cerebras.d.ts

@@ -1,5 +1,5 @@
 /**
- * M45 — Cerebras. Integration header adapted from OpenCode's `cerebras.ts` (MIT — value changed to
- * `theokit`, never `opencode`: the header attributes TRAFFIC). Models per models.dev (2026-07 snapshot).
+ * M45 — Cerebras. The integration header value is theokit's own: the header attributes TRAFFIC.
+ * Models per models.dev (2026-07 snapshot).
  */
 export declare const CEREBRAS: import("../types.js").ProviderProfile;

package/dist/internal/providers/builtin/deepinfra.d.ts

@@ -1,2 +1,2 @@
-/** M45 — DeepInfra. OpenAI-compat surface under /v1/openai (models.dev `deepinfra`, OpenCode profile map). */
+/** M45 — DeepInfra. OpenAI-compat surface under /v1/openai (models.dev `deepinfra`). */
 export declare const DEEPINFRA: import("../types.js").ProviderProfile;

package/dist/internal/providers/catalog-source-models-dev.d.ts

@@ -16,7 +16,7 @@ export interface RefreshModelCatalogResult {
     /** How many models were patched into the index. */
     models: number;
 }
-/** The cache file for a source URL (custom URLs get a hash-suffixed name, mirroring OpenCode). */
+/** The cache file for a source URL (custom URLs get a hash-suffixed name). */
 export declare function cachePathFor(url: string): string;
 /**
  * Load an existing disk cache into the index (called by refresh when fresh, or opportunistically by a

package/dist/internal/runtime/lifecycle/env-policy.d.ts

@@ -3,9 +3,7 @@
  *
  * Every subprocess the SDK spawns previously inherited the FULL `process.env`,
  * so API keys, tokens and passwords leaked into hook scripts and shell tools.
- * `resolveChildEnv` computes the env a child receives under an explicit policy,
- * modeled on codex's `ShellEnvironmentPolicy`
- * (reference: codex/codex-rs/protocol/src/shell_environment.rs).
+ * `resolveChildEnv` computes the env a child receives under an explicit policy.
  *
  * Modes:
  *  - `inherit-scrubbed` (DEFAULT) — inherit all parent vars EXCEPT secret-like

package/dist/internal/security/index.cjs

@@ -1,52 +1,52 @@
 'use strict';
 
 require('../../chunk-MUUQ2WFJ.cjs');
-var chunkYTO5BRBD_cjs = require('../../chunk-YTO5BRBD.cjs');
+var chunkZT57WTUJ_cjs = require('../../chunk-ZT57WTUJ.cjs');
 require('../../chunk-VKJ7V7EB.cjs');
-require('../../chunk-2YGIBOUH.cjs');
-var chunkSXSPMRSV_cjs = require('../../chunk-SXSPMRSV.cjs');
+require('../../chunk-LPVIRJVF.cjs');
+var chunkBM6N4KHO_cjs = require('../../chunk-BM6N4KHO.cjs');
 
 
 
 Object.defineProperty(exports, "ForbiddenPathError", {
   enumerable: true,
-  get: function () { return chunkYTO5BRBD_cjs.ForbiddenPathError; }
+  get: function () { return chunkZT57WTUJ_cjs.ForbiddenPathError; }
 });
 Object.defineProperty(exports, "PathTraversalError", {
   enumerable: true,
-  get: function () { return chunkYTO5BRBD_cjs.PathTraversalError; }
+  get: function () { return chunkZT57WTUJ_cjs.PathTraversalError; }
 });
 Object.defineProperty(exports, "assertNoSymlinkEscape", {
   enumerable: true,
-  get: function () { return chunkYTO5BRBD_cjs.assertNoSymlinkEscape; }
+  get: function () { return chunkZT57WTUJ_cjs.assertNoSymlinkEscape; }
 });
 Object.defineProperty(exports, "isForbiddenPath", {
   enumerable: true,
-  get: function () { return chunkYTO5BRBD_cjs.isForbiddenPath; }
+  get: function () { return chunkZT57WTUJ_cjs.isForbiddenPath; }
 });
 Object.defineProperty(exports, "safePathJoin", {
   enumerable: true,
-  get: function () { return chunkYTO5BRBD_cjs.safePathJoin; }
+  get: function () { return chunkZT57WTUJ_cjs.safePathJoin; }
 });
 Object.defineProperty(exports, "sanitizeIdentifier", {
   enumerable: true,
-  get: function () { return chunkYTO5BRBD_cjs.sanitizeIdentifier; }
+  get: function () { return chunkZT57WTUJ_cjs.sanitizeIdentifier; }
 });
 Object.defineProperty(exports, "validateArtifactPath", {
   enumerable: true,
-  get: function () { return chunkYTO5BRBD_cjs.validateArtifactPath; }
+  get: function () { return chunkZT57WTUJ_cjs.validateArtifactPath; }
 });
 Object.defineProperty(exports, "addPattern", {
   enumerable: true,
-  get: function () { return chunkSXSPMRSV_cjs.addPattern; }
+  get: function () { return chunkBM6N4KHO_cjs.addPattern; }
 });
 Object.defineProperty(exports, "maskToken", {
   enumerable: true,
-  get: function () { return chunkSXSPMRSV_cjs.maskToken; }
+  get: function () { return chunkBM6N4KHO_cjs.maskToken; }
 });
 Object.defineProperty(exports, "redactSecrets", {
   enumerable: true,
-  get: function () { return chunkSXSPMRSV_cjs.redactSecrets; }
+  get: function () { return chunkBM6N4KHO_cjs.redactSecrets; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/internal/security/index.js

@@ -1,7 +1,7 @@
 import '../../chunk-FD2UT76F.js';
-export { ForbiddenPathError, PathTraversalError, assertNoSymlinkEscape, isForbiddenPath, safePathJoin, sanitizeIdentifier, validateArtifactPath } from '../../chunk-XWCTBGYK.js';
+export { ForbiddenPathError, PathTraversalError, assertNoSymlinkEscape, isForbiddenPath, safePathJoin, sanitizeIdentifier, validateArtifactPath } from '../../chunk-SK4QLUBK.js';
 import '../../chunk-RIAM53CP.js';
-import '../../chunk-HI4ZW62S.js';
-export { addPattern, maskToken, redactSecrets } from '../../chunk-4X3SBHPK.js';
+import '../../chunk-U4UJHOSH.js';
+export { addPattern, maskToken, redactSecrets } from '../../chunk-5F5NWKPN.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map