@theokit/sdk 5.9.2 → 5.11.0

package/dist/internal/persistence/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/internal/persistence/exclusive-create.ts","../../../src/internal/persistence/sqlite-cas.ts"],"names":["open"],"mappings":";;;;;;;;;;;;;;AAwDA,eAAsB,eAAA,CACpB,IAAA,EACA,IAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,IAAQ,GAAA;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAMA,aAAA,CAAK,IAAA,EAAM,MAAM,IAAI,CAAA;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,UAAU,IAAI,CAAA;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,MAAM,OAAO,KAAA,EAAM;AAAA,IACrB;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACpD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;;;ACdO,SAAS,SAAA,CACd,EAAA,EACA,GAAA,EACA,MAAA,EACA,kBAA0B,CAAA,EACjB;AACT,EAAA,MAAM,IAAA,GAAO,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,GAAI,MAAoB,CAAA;AAChD,EAAA,OAAO,OAAO,OAAA,KAAY,eAAA;AAC5B","file":"index.cjs","sourcesContent":["/**\n * O_EXCL exclusive file creation (ADR D82).\n *\n * `createExclusive(path, data, { mode })` creates a file in a single\n * syscall (`open(path, \"wx\", mode)`). Returns `true` if created, `false`\n * if it already existed (EEXIST swallowed — caller decides). All other\n * errors propagate.\n *\n * Default mode is 0o600 (owner-only) — EC-2 fix from edge-case review:\n * token files, lockfiles, and PID files MUST NOT default to world-\n * readable 0o644 under typical umask 022. Callers writing non-sensitive\n * files can pass `mode: 0o644` explicitly.\n *\n * NFS not honoring O_EXCL is documented (D61 — same stance as\n * `withFileLock`); the SDK target is ext4/APFS/NTFS.\n *\n * @internal\n */\n\nimport { open } from \"node:fs/promises\";\n\nexport interface CreateExclusiveOptions {\n  /** Unix mode for the new file (default 0o600 — owner-only). */\n  mode?: number;\n}\n\n/**\n * Create `path` holding `data`, but only if it does not exist yet. Returns `true` when this call\n * created it, `false` when it was already there.\n *\n * The check and the create are one `open(path, \"wx\")` syscall, so of N processes racing to create\n * the same path exactly one gets `true` — no window between testing and writing. The content is\n * written after the create, so the `false` branch tells you the file exists, not that another\n * writer has finished filling it.\n *\n * Only `EEXIST` becomes `false`. Every other error propagates: a missing parent directory is\n * `ENOENT`, an unwritable one `EACCES`. This never creates directories.\n *\n * The file is created with mode 0600 unless `options.mode` says otherwise, and the mode is\n * subject to the process umask. That default is deliberate — the callers are token files,\n * lockfiles and PID files, and 0644 under a typical umask would make them world-readable.\n *\n * **Choosing between this and the locks.** `createExclusive` claims a NAME once and is the right\n * tool for first-writer-wins: seeding a config, electing a single owner, writing a credential\n * exactly once. It cannot guard repeated updates, because a file that already exists always loses.\n * For read-modify-write on a path several writers touch, take a lock instead —\n * {@link withFileLock} across processes, `withCwdMutex` when the writers are all in this one. For\n * an in-place update guarded by a version column in SQLite, `casUpdate` is the equivalent\n * primitive.\n *\n * Atomicity is the filesystem's `O_EXCL`, which NFS does not reliably honor; the SDK targets\n * ext4, APFS and NTFS.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport async function createExclusive(\n  path: string,\n  data: string | Uint8Array,\n  options?: CreateExclusiveOptions,\n): Promise<boolean> {\n  const mode = options?.mode ?? 0o600;\n  try {\n    const handle = await open(path, \"wx\", mode);\n    try {\n      await handle.writeFile(data);\n      return true;\n    } finally {\n      await handle.close();\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EEXIST\") {\n      return false;\n    }\n    throw err;\n  }\n}\n","/**\n * SQLite optimistic compare-and-swap (ADR D83).\n *\n * `casUpdate(db, sql, params, expectedChanges)` executes a prepared\n * UPDATE and returns true if `result.changes === expectedChanges`.\n * Caller provides the full SQL (including `WHERE version = ?` predicate);\n * helper does NOT generate SQL — DRY at the level of \"wrap the\n * convention\", not \"build queries\".\n *\n * Use case canonical (Hermes `kanban_db.py:1922-1934`):\n *\n *   const won = casUpdate(\n *     db,\n *     \"UPDATE registry SET status = ?, version = version + 1 WHERE id = ? AND version = ?\",\n *     [\"running\", \"agent-foo\", 3],\n *   );\n *   if (!won) { ... re-read and retry ... }\n *\n * Helper does NOT retry — caller responsible for backoff (avoids hidden\n * loops). Helper does NOT cache prepared statements — `better-sqlite3`\n * caches internally; SDK use is one-shot per mutation, not hot loops.\n *\n * NOTE — no internal-visibility tag in this block. `tsconfig.base.json` sets `stripInternal: true`,\n * and TypeScript scans EVERY leading comment range of the declaration that follows, including the\n * import right below this one. The tag that used to sit here deleted that import from the emitted\n * `.d.ts`, leaving the types it binds unresolvable for any consumer running type-aware lint\n * (usetheodev/theokit-sdk#283 records the same trap on a declaration).\n */\n\nimport type Database from \"better-sqlite3\";\n\ntype DatabaseInstance = InstanceType<typeof Database>;\n\n/**\n * Run an UPDATE and report whether it changed exactly the number of rows you expected — the\n * optimistic-concurrency equivalent of taking a lock.\n *\n * `sql` is yours, in full, including the guard that makes it a compare-and-swap: the\n * `WHERE ... AND version = ?` predicate and the `SET version = version + 1` that closes it. This\n * function generates nothing. It prepares the statement, runs it with `params`, and compares\n * `changes` against `expectedChanges` (default 1).\n *\n * `false` means the guard did not match — someone else moved the row first, or the id does not\n * exist. Those two are indistinguishable here; if you need to tell them apart, re-read the row.\n * A `false` return means NOTHING was written, so the caller owns the re-read-and-retry, with\n * whatever backoff it wants. There is no retry loop hidden in here, by design.\n *\n * SQL errors propagate — bad syntax, a closed database, a constraint violation, a busy writer.\n * Only the row-count mismatch is reported as `false`.\n *\n * Runs as a single implicit transaction, so no explicit BEGIN is needed for one statement. Wrap\n * the call yourself when the swap has to commit together with other writes.\n *\n * **Choosing between this and the locks.** `casUpdate` never blocks and never waits: the loser\n * finds out immediately and decides what to do. Prefer it when the contended state is already a\n * row with a version column. When the contended state is a FILE, there is no version column to\n * swap on — use `withFileLock` across processes, or `withCwdMutex` within one. When the goal is\n * to create something exactly once rather than update it, `createExclusive` is the primitive.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function casUpdate(\n  db: DatabaseInstance,\n  sql: string,\n  params: ReadonlyArray<unknown>,\n  expectedChanges: number = 1,\n): boolean {\n  const stmt = db.prepare(sql);\n  const result = stmt.run(...(params as unknown[]));\n  return result.changes === expectedChanges;\n}\n"]}
+{"version":3,"sources":["../../../src/internal/persistence/exclusive-create.ts","../../../src/internal/persistence/sqlite-cas.ts"],"names":["open"],"mappings":";;;;;;;;;;;;;;;AAwDA,eAAsB,eAAA,CACpB,IAAA,EACA,IAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,IAAQ,GAAA;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAMA,aAAA,CAAK,IAAA,EAAM,MAAM,IAAI,CAAA;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,UAAU,IAAI,CAAA;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,MAAM,OAAO,KAAA,EAAM;AAAA,IACrB;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACpD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;;;ACdO,SAAS,SAAA,CACd,EAAA,EACA,GAAA,EACA,MAAA,EACA,kBAA0B,CAAA,EACjB;AACT,EAAA,MAAM,IAAA,GAAO,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,GAAI,MAAoB,CAAA;AAChD,EAAA,OAAO,OAAO,OAAA,KAAY,eAAA;AAC5B","file":"index.cjs","sourcesContent":["/**\n * O_EXCL exclusive file creation (ADR D82).\n *\n * `createExclusive(path, data, { mode })` creates a file in a single\n * syscall (`open(path, \"wx\", mode)`). Returns `true` if created, `false`\n * if it already existed (EEXIST swallowed — caller decides). All other\n * errors propagate.\n *\n * Default mode is 0o600 (owner-only) — EC-2 fix from edge-case review:\n * token files, lockfiles, and PID files MUST NOT default to world-\n * readable 0o644 under typical umask 022. Callers writing non-sensitive\n * files can pass `mode: 0o644` explicitly.\n *\n * NFS not honoring O_EXCL is documented (D61 — same stance as\n * `withFileLock`); the SDK target is ext4/APFS/NTFS.\n *\n * @internal\n */\n\nimport { open } from \"node:fs/promises\";\n\nexport interface CreateExclusiveOptions {\n  /** Unix mode for the new file (default 0o600 — owner-only). */\n  mode?: number;\n}\n\n/**\n * Create `path` holding `data`, but only if it does not exist yet. Returns `true` when this call\n * created it, `false` when it was already there.\n *\n * The check and the create are one `open(path, \"wx\")` syscall, so of N processes racing to create\n * the same path exactly one gets `true` — no window between testing and writing. The content is\n * written after the create, so the `false` branch tells you the file exists, not that another\n * writer has finished filling it.\n *\n * Only `EEXIST` becomes `false`. Every other error propagates: a missing parent directory is\n * `ENOENT`, an unwritable one `EACCES`. This never creates directories.\n *\n * The file is created with mode 0600 unless `options.mode` says otherwise, and the mode is\n * subject to the process umask. That default is deliberate — the callers are token files,\n * lockfiles and PID files, and 0644 under a typical umask would make them world-readable.\n *\n * **Choosing between this and the locks.** `createExclusive` claims a NAME once and is the right\n * tool for first-writer-wins: seeding a config, electing a single owner, writing a credential\n * exactly once. It cannot guard repeated updates, because a file that already exists always loses.\n * For read-modify-write on a path several writers touch, take a lock instead —\n * {@link withFileLock} across processes, `withCwdMutex` when the writers are all in this one. For\n * an in-place update guarded by a version column in SQLite, `casUpdate` is the equivalent\n * primitive.\n *\n * Atomicity is the filesystem's `O_EXCL`, which NFS does not reliably honor; the SDK targets\n * ext4, APFS and NTFS.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport async function createExclusive(\n  path: string,\n  data: string | Uint8Array,\n  options?: CreateExclusiveOptions,\n): Promise<boolean> {\n  const mode = options?.mode ?? 0o600;\n  try {\n    const handle = await open(path, \"wx\", mode);\n    try {\n      await handle.writeFile(data);\n      return true;\n    } finally {\n      await handle.close();\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EEXIST\") {\n      return false;\n    }\n    throw err;\n  }\n}\n","/**\n * SQLite optimistic compare-and-swap (ADR D83).\n *\n * `casUpdate(db, sql, params, expectedChanges)` executes a prepared\n * UPDATE and returns true if `result.changes === expectedChanges`.\n * Caller provides the full SQL (including `WHERE version = ?` predicate);\n * helper does NOT generate SQL — DRY at the level of \"wrap the\n * convention\", not \"build queries\".\n *\n * Use case canonical (Hermes `kanban_db.py:1922-1934`):\n *\n *   const won = casUpdate(\n *     db,\n *     \"UPDATE registry SET status = ?, version = version + 1 WHERE id = ? AND version = ?\",\n *     [\"running\", \"agent-foo\", 3],\n *   );\n *   if (!won) { ... re-read and retry ... }\n *\n * Helper does NOT retry — caller responsible for backoff (avoids hidden\n * loops). Helper does NOT cache prepared statements — `better-sqlite3`\n * caches internally; SDK use is one-shot per mutation, not hot loops.\n *\n * NOTE — no internal-visibility tag in this block. `tsconfig.base.json` sets `stripInternal: true`,\n * and TypeScript scans EVERY leading comment range of the declaration that follows, including the\n * import right below this one. The tag that used to sit here deleted that import from the emitted\n * `.d.ts`, leaving the types it binds unresolvable for any consumer running type-aware lint\n * (usetheodev/theokit-sdk#283 records the same trap on a declaration).\n */\n\nimport type Database from \"better-sqlite3\";\n\ntype DatabaseInstance = InstanceType<typeof Database>;\n\n/**\n * Run an UPDATE and report whether it changed exactly the number of rows you expected — the\n * optimistic-concurrency equivalent of taking a lock.\n *\n * `sql` is yours, in full, including the guard that makes it a compare-and-swap: the\n * `WHERE ... AND version = ?` predicate and the `SET version = version + 1` that closes it. This\n * function generates nothing. It prepares the statement, runs it with `params`, and compares\n * `changes` against `expectedChanges` (default 1).\n *\n * `false` means the guard did not match — someone else moved the row first, or the id does not\n * exist. Those two are indistinguishable here; if you need to tell them apart, re-read the row.\n * A `false` return means NOTHING was written, so the caller owns the re-read-and-retry, with\n * whatever backoff it wants. There is no retry loop hidden in here, by design.\n *\n * SQL errors propagate — bad syntax, a closed database, a constraint violation, a busy writer.\n * Only the row-count mismatch is reported as `false`.\n *\n * Runs as a single implicit transaction, so no explicit BEGIN is needed for one statement. Wrap\n * the call yourself when the swap has to commit together with other writes.\n *\n * **Choosing between this and the locks.** `casUpdate` never blocks and never waits: the loser\n * finds out immediately and decides what to do. Prefer it when the contended state is already a\n * row with a version column. When the contended state is a FILE, there is no version column to\n * swap on — use `withFileLock` across processes, or `withCwdMutex` within one. When the goal is\n * to create something exactly once rather than update it, `createExclusive` is the primitive.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function casUpdate(\n  db: DatabaseInstance,\n  sql: string,\n  params: ReadonlyArray<unknown>,\n  expectedChanges: number = 1,\n): boolean {\n  const stmt = db.prepare(sql);\n  const result = stmt.run(...(params as unknown[]));\n  return result.changes === expectedChanges;\n}\n"]}

package/dist/internal/persistence/index.js

@@ -2,7 +2,8 @@ export { PersistenceSchema } from '../../chunk-HY66GLM6.js';
 export { migrateSchema, readVersionedJson, writeVersionedJson } from '../../chunk-SVQIW5RJ.js';
 export { containsCjk, sanitizeFts5Query } from '../../chunk-WE22OXQA.js';
 export { applyWalWithFallback, isCorruptionError, openSqliteResilient } from '../../chunk-XZHJYSPB.js';
-export { JsonlParseError, appendJsonl, loadJsonl, readJsonlIds, withFileLock } from '../../chunk-BKMDRBJ7.js';
+export { JsonlParseError, appendJsonl, loadJsonl, readJsonlIds } from '../../chunk-7KIN3L2S.js';
+export { withFileLock } from '../../chunk-RGQICWFU.js';
 export { withCwdMutex } from '../../chunk-Q5EWJPRY.js';
 export { atomicWriteJson, atomicWriteText, replaceFileAtomic } from '../../chunk-3JHIFQ4I.js';
 export { displayTheokitHome, getProfilesRoot, getTheokitHome } from '../../chunk-X7EUUHXU.js';

package/dist/internal/persistence/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/internal/persistence/exclusive-create.ts","../../../src/internal/persistence/sqlite-cas.ts"],"names":[],"mappings":";;;;;;;;;;;;AAwDA,eAAsB,eAAA,CACpB,IAAA,EACA,IAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,IAAQ,GAAA;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,CAAA;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,UAAU,IAAI,CAAA;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,MAAM,OAAO,KAAA,EAAM;AAAA,IACrB;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACpD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;;;ACdO,SAAS,SAAA,CACd,EAAA,EACA,GAAA,EACA,MAAA,EACA,kBAA0B,CAAA,EACjB;AACT,EAAA,MAAM,IAAA,GAAO,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,GAAI,MAAoB,CAAA;AAChD,EAAA,OAAO,OAAO,OAAA,KAAY,eAAA;AAC5B","file":"index.js","sourcesContent":["/**\n * O_EXCL exclusive file creation (ADR D82).\n *\n * `createExclusive(path, data, { mode })` creates a file in a single\n * syscall (`open(path, \"wx\", mode)`). Returns `true` if created, `false`\n * if it already existed (EEXIST swallowed — caller decides). All other\n * errors propagate.\n *\n * Default mode is 0o600 (owner-only) — EC-2 fix from edge-case review:\n * token files, lockfiles, and PID files MUST NOT default to world-\n * readable 0o644 under typical umask 022. Callers writing non-sensitive\n * files can pass `mode: 0o644` explicitly.\n *\n * NFS not honoring O_EXCL is documented (D61 — same stance as\n * `withFileLock`); the SDK target is ext4/APFS/NTFS.\n *\n * @internal\n */\n\nimport { open } from \"node:fs/promises\";\n\nexport interface CreateExclusiveOptions {\n  /** Unix mode for the new file (default 0o600 — owner-only). */\n  mode?: number;\n}\n\n/**\n * Create `path` holding `data`, but only if it does not exist yet. Returns `true` when this call\n * created it, `false` when it was already there.\n *\n * The check and the create are one `open(path, \"wx\")` syscall, so of N processes racing to create\n * the same path exactly one gets `true` — no window between testing and writing. The content is\n * written after the create, so the `false` branch tells you the file exists, not that another\n * writer has finished filling it.\n *\n * Only `EEXIST` becomes `false`. Every other error propagates: a missing parent directory is\n * `ENOENT`, an unwritable one `EACCES`. This never creates directories.\n *\n * The file is created with mode 0600 unless `options.mode` says otherwise, and the mode is\n * subject to the process umask. That default is deliberate — the callers are token files,\n * lockfiles and PID files, and 0644 under a typical umask would make them world-readable.\n *\n * **Choosing between this and the locks.** `createExclusive` claims a NAME once and is the right\n * tool for first-writer-wins: seeding a config, electing a single owner, writing a credential\n * exactly once. It cannot guard repeated updates, because a file that already exists always loses.\n * For read-modify-write on a path several writers touch, take a lock instead —\n * {@link withFileLock} across processes, `withCwdMutex` when the writers are all in this one. For\n * an in-place update guarded by a version column in SQLite, `casUpdate` is the equivalent\n * primitive.\n *\n * Atomicity is the filesystem's `O_EXCL`, which NFS does not reliably honor; the SDK targets\n * ext4, APFS and NTFS.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport async function createExclusive(\n  path: string,\n  data: string | Uint8Array,\n  options?: CreateExclusiveOptions,\n): Promise<boolean> {\n  const mode = options?.mode ?? 0o600;\n  try {\n    const handle = await open(path, \"wx\", mode);\n    try {\n      await handle.writeFile(data);\n      return true;\n    } finally {\n      await handle.close();\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EEXIST\") {\n      return false;\n    }\n    throw err;\n  }\n}\n","/**\n * SQLite optimistic compare-and-swap (ADR D83).\n *\n * `casUpdate(db, sql, params, expectedChanges)` executes a prepared\n * UPDATE and returns true if `result.changes === expectedChanges`.\n * Caller provides the full SQL (including `WHERE version = ?` predicate);\n * helper does NOT generate SQL — DRY at the level of \"wrap the\n * convention\", not \"build queries\".\n *\n * Use case canonical (Hermes `kanban_db.py:1922-1934`):\n *\n *   const won = casUpdate(\n *     db,\n *     \"UPDATE registry SET status = ?, version = version + 1 WHERE id = ? AND version = ?\",\n *     [\"running\", \"agent-foo\", 3],\n *   );\n *   if (!won) { ... re-read and retry ... }\n *\n * Helper does NOT retry — caller responsible for backoff (avoids hidden\n * loops). Helper does NOT cache prepared statements — `better-sqlite3`\n * caches internally; SDK use is one-shot per mutation, not hot loops.\n *\n * NOTE — no internal-visibility tag in this block. `tsconfig.base.json` sets `stripInternal: true`,\n * and TypeScript scans EVERY leading comment range of the declaration that follows, including the\n * import right below this one. The tag that used to sit here deleted that import from the emitted\n * `.d.ts`, leaving the types it binds unresolvable for any consumer running type-aware lint\n * (usetheodev/theokit-sdk#283 records the same trap on a declaration).\n */\n\nimport type Database from \"better-sqlite3\";\n\ntype DatabaseInstance = InstanceType<typeof Database>;\n\n/**\n * Run an UPDATE and report whether it changed exactly the number of rows you expected — the\n * optimistic-concurrency equivalent of taking a lock.\n *\n * `sql` is yours, in full, including the guard that makes it a compare-and-swap: the\n * `WHERE ... AND version = ?` predicate and the `SET version = version + 1` that closes it. This\n * function generates nothing. It prepares the statement, runs it with `params`, and compares\n * `changes` against `expectedChanges` (default 1).\n *\n * `false` means the guard did not match — someone else moved the row first, or the id does not\n * exist. Those two are indistinguishable here; if you need to tell them apart, re-read the row.\n * A `false` return means NOTHING was written, so the caller owns the re-read-and-retry, with\n * whatever backoff it wants. There is no retry loop hidden in here, by design.\n *\n * SQL errors propagate — bad syntax, a closed database, a constraint violation, a busy writer.\n * Only the row-count mismatch is reported as `false`.\n *\n * Runs as a single implicit transaction, so no explicit BEGIN is needed for one statement. Wrap\n * the call yourself when the swap has to commit together with other writes.\n *\n * **Choosing between this and the locks.** `casUpdate` never blocks and never waits: the loser\n * finds out immediately and decides what to do. Prefer it when the contended state is already a\n * row with a version column. When the contended state is a FILE, there is no version column to\n * swap on — use `withFileLock` across processes, or `withCwdMutex` within one. When the goal is\n * to create something exactly once rather than update it, `createExclusive` is the primitive.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function casUpdate(\n  db: DatabaseInstance,\n  sql: string,\n  params: ReadonlyArray<unknown>,\n  expectedChanges: number = 1,\n): boolean {\n  const stmt = db.prepare(sql);\n  const result = stmt.run(...(params as unknown[]));\n  return result.changes === expectedChanges;\n}\n"]}
+{"version":3,"sources":["../../../src/internal/persistence/exclusive-create.ts","../../../src/internal/persistence/sqlite-cas.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAwDA,eAAsB,eAAA,CACpB,IAAA,EACA,IAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,IAAQ,GAAA;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,CAAA;AAC1C,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,UAAU,IAAI,CAAA;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,MAAM,OAAO,KAAA,EAAM;AAAA,IACrB;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,SAAS,QAAA,EAAU;AACpD,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;;;ACdO,SAAS,SAAA,CACd,EAAA,EACA,GAAA,EACA,MAAA,EACA,kBAA0B,CAAA,EACjB;AACT,EAAA,MAAM,IAAA,GAAO,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,CAAI,GAAI,MAAoB,CAAA;AAChD,EAAA,OAAO,OAAO,OAAA,KAAY,eAAA;AAC5B","file":"index.js","sourcesContent":["/**\n * O_EXCL exclusive file creation (ADR D82).\n *\n * `createExclusive(path, data, { mode })` creates a file in a single\n * syscall (`open(path, \"wx\", mode)`). Returns `true` if created, `false`\n * if it already existed (EEXIST swallowed — caller decides). All other\n * errors propagate.\n *\n * Default mode is 0o600 (owner-only) — EC-2 fix from edge-case review:\n * token files, lockfiles, and PID files MUST NOT default to world-\n * readable 0o644 under typical umask 022. Callers writing non-sensitive\n * files can pass `mode: 0o644` explicitly.\n *\n * NFS not honoring O_EXCL is documented (D61 — same stance as\n * `withFileLock`); the SDK target is ext4/APFS/NTFS.\n *\n * @internal\n */\n\nimport { open } from \"node:fs/promises\";\n\nexport interface CreateExclusiveOptions {\n  /** Unix mode for the new file (default 0o600 — owner-only). */\n  mode?: number;\n}\n\n/**\n * Create `path` holding `data`, but only if it does not exist yet. Returns `true` when this call\n * created it, `false` when it was already there.\n *\n * The check and the create are one `open(path, \"wx\")` syscall, so of N processes racing to create\n * the same path exactly one gets `true` — no window between testing and writing. The content is\n * written after the create, so the `false` branch tells you the file exists, not that another\n * writer has finished filling it.\n *\n * Only `EEXIST` becomes `false`. Every other error propagates: a missing parent directory is\n * `ENOENT`, an unwritable one `EACCES`. This never creates directories.\n *\n * The file is created with mode 0600 unless `options.mode` says otherwise, and the mode is\n * subject to the process umask. That default is deliberate — the callers are token files,\n * lockfiles and PID files, and 0644 under a typical umask would make them world-readable.\n *\n * **Choosing between this and the locks.** `createExclusive` claims a NAME once and is the right\n * tool for first-writer-wins: seeding a config, electing a single owner, writing a credential\n * exactly once. It cannot guard repeated updates, because a file that already exists always loses.\n * For read-modify-write on a path several writers touch, take a lock instead —\n * {@link withFileLock} across processes, `withCwdMutex` when the writers are all in this one. For\n * an in-place update guarded by a version column in SQLite, `casUpdate` is the equivalent\n * primitive.\n *\n * Atomicity is the filesystem's `O_EXCL`, which NFS does not reliably honor; the SDK targets\n * ext4, APFS and NTFS.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport async function createExclusive(\n  path: string,\n  data: string | Uint8Array,\n  options?: CreateExclusiveOptions,\n): Promise<boolean> {\n  const mode = options?.mode ?? 0o600;\n  try {\n    const handle = await open(path, \"wx\", mode);\n    try {\n      await handle.writeFile(data);\n      return true;\n    } finally {\n      await handle.close();\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EEXIST\") {\n      return false;\n    }\n    throw err;\n  }\n}\n","/**\n * SQLite optimistic compare-and-swap (ADR D83).\n *\n * `casUpdate(db, sql, params, expectedChanges)` executes a prepared\n * UPDATE and returns true if `result.changes === expectedChanges`.\n * Caller provides the full SQL (including `WHERE version = ?` predicate);\n * helper does NOT generate SQL — DRY at the level of \"wrap the\n * convention\", not \"build queries\".\n *\n * Use case canonical (Hermes `kanban_db.py:1922-1934`):\n *\n *   const won = casUpdate(\n *     db,\n *     \"UPDATE registry SET status = ?, version = version + 1 WHERE id = ? AND version = ?\",\n *     [\"running\", \"agent-foo\", 3],\n *   );\n *   if (!won) { ... re-read and retry ... }\n *\n * Helper does NOT retry — caller responsible for backoff (avoids hidden\n * loops). Helper does NOT cache prepared statements — `better-sqlite3`\n * caches internally; SDK use is one-shot per mutation, not hot loops.\n *\n * NOTE — no internal-visibility tag in this block. `tsconfig.base.json` sets `stripInternal: true`,\n * and TypeScript scans EVERY leading comment range of the declaration that follows, including the\n * import right below this one. The tag that used to sit here deleted that import from the emitted\n * `.d.ts`, leaving the types it binds unresolvable for any consumer running type-aware lint\n * (usetheodev/theokit-sdk#283 records the same trap on a declaration).\n */\n\nimport type Database from \"better-sqlite3\";\n\ntype DatabaseInstance = InstanceType<typeof Database>;\n\n/**\n * Run an UPDATE and report whether it changed exactly the number of rows you expected — the\n * optimistic-concurrency equivalent of taking a lock.\n *\n * `sql` is yours, in full, including the guard that makes it a compare-and-swap: the\n * `WHERE ... AND version = ?` predicate and the `SET version = version + 1` that closes it. This\n * function generates nothing. It prepares the statement, runs it with `params`, and compares\n * `changes` against `expectedChanges` (default 1).\n *\n * `false` means the guard did not match — someone else moved the row first, or the id does not\n * exist. Those two are indistinguishable here; if you need to tell them apart, re-read the row.\n * A `false` return means NOTHING was written, so the caller owns the re-read-and-retry, with\n * whatever backoff it wants. There is no retry loop hidden in here, by design.\n *\n * SQL errors propagate — bad syntax, a closed database, a constraint violation, a busy writer.\n * Only the row-count mismatch is reported as `false`.\n *\n * Runs as a single implicit transaction, so no explicit BEGIN is needed for one statement. Wrap\n * the call yourself when the swap has to commit together with other writes.\n *\n * **Choosing between this and the locks.** `casUpdate` never blocks and never waits: the loser\n * finds out immediately and decides what to do. Prefer it when the contended state is already a\n * row with a version column. When the contended state is a FILE, there is no version column to\n * swap on — use `withFileLock` across processes, or `withCwdMutex` within one. When the goal is\n * to create something exactly once rather than update it, `createExclusive` is the primitive.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function casUpdate(\n  db: DatabaseInstance,\n  sql: string,\n  params: ReadonlyArray<unknown>,\n  expectedChanges: number = 1,\n): boolean {\n  const stmt = db.prepare(sql);\n  const result = stmt.run(...(params as unknown[]));\n  return result.changes === expectedChanges;\n}\n"]}

package/dist/internal/runtime/registry/agent-registry-store.d.ts

@@ -46,6 +46,8 @@ export interface SerializedAgentOptions {
             };
         };
         activeRecall?: Record<string, unknown>;
+        maxFacts?: number;
+        directory?: string;
     };
     skills?: {
         enabled?: ReadonlyArray<string>;

package/dist/models.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 var chunk72CPLZPC_cjs = require('./chunk-72CPLZPC.cjs');
+var chunkNWS2CS3Y_cjs = require('./chunk-NWS2CS3Y.cjs');
 var chunk3EE6LVWT_cjs = require('./chunk-3EE6LVWT.cjs');
 var chunkHU666T3Q_cjs = require('./chunk-HU666T3Q.cjs');
 require('./chunk-NVXXWAU7.cjs');
@@ -15,55 +16,6 @@ var fs = require('fs');
 var os = require('os');
 var path = require('path');
 
-// src/internal/llm/model-capabilities.ts
-var CONSERVATIVE_DEFAULTS = {
-  supportsVision: false,
-  supportsStructuredOutput: false,
-  supportsToolUse: false,
-  supportsCacheControl: false,
-  maxContextTokens: 4096,
-  maxOutputTokens: 4096
-};
-var ROUTING_PREFIXES = ["openrouter/", "vertex/", "bedrock/"];
-function capsFromCatalog(m) {
-  return {
-    supportsVision: m.modalities?.input?.includes("image") ?? m.attachment ?? false,
-    supportsStructuredOutput: m.structured_output ?? false,
-    supportsToolUse: m.tool_call ?? false,
-    supportsCacheControl: m.cache_control ?? false,
-    maxContextTokens: m.limit?.context ?? CONSERVATIVE_DEFAULTS.maxContextTokens,
-    maxOutputTokens: m.limit?.output ?? CONSERVATIVE_DEFAULTS.maxOutputTokens
-  };
-}
-function resolveModelCapabilities(modelId) {
-  const bare = stripVariantSuffix(stripRoutingPrefix(modelId));
-  const fromIndex = chunkHU666T3Q_cjs.getCatalogModelInfo(bare);
-  if (fromIndex !== void 0) return capsFromCatalog(fromIndex);
-  const withVendor = inferVendorPrefix(bare);
-  if (withVendor !== bare) {
-    const vendored = chunkHU666T3Q_cjs.getCatalogModelInfo(withVendor);
-    if (vendored !== void 0) return capsFromCatalog(vendored);
-  }
-  return CONSERVATIVE_DEFAULTS;
-}
-function stripRoutingPrefix(modelId) {
-  for (const prefix of ROUTING_PREFIXES) {
-    if (modelId.startsWith(prefix)) return modelId.slice(prefix.length);
-  }
-  return modelId;
-}
-function stripVariantSuffix(modelId) {
-  const i = modelId.indexOf(":");
-  return i >= 0 ? modelId.slice(0, i) : modelId;
-}
-function inferVendorPrefix(bare) {
-  if (bare.startsWith("claude")) return `anthropic/${bare}`;
-  if (bare.startsWith("gpt-") || bare.startsWith("o1") || bare.startsWith("o3"))
-    return `openai/${bare}`;
-  if (bare.startsWith("gemini")) return `google/${bare}`;
-  return bare;
-}
-
 // src/internal/llm/model-option.ts
 var ACRONYMS = /* @__PURE__ */ new Set(["gpt", "ai", "hd", "ui", "api", "sdk", "llm", "xl"]);
 function prettyToken(token) {
@@ -283,6 +235,10 @@ function getModelInfo(modelId) {
   return chunkHU666T3Q_cjs.getCatalogModelInfo(modelId);
 }
 
+Object.defineProperty(exports, "resolveModelCapabilities", {
+  enumerable: true,
+  get: function () { return chunkNWS2CS3Y_cjs.resolveModelCapabilities; }
+});
 Object.defineProperty(exports, "parseModelId", {
   enumerable: true,
   get: function () { return chunk3EE6LVWT_cjs.parseModelId; }
@@ -290,7 +246,6 @@ Object.defineProperty(exports, "parseModelId", {
 exports.getModelInfo = getModelInfo;
 exports.humanizeModelName = humanizeModelName;
 exports.refreshModelCatalog = refreshModelCatalog;
-exports.resolveModelCapabilities = resolveModelCapabilities;
 exports.toModelOption = toModelOption;
 //# sourceMappingURL=models.cjs.map
 //# sourceMappingURL=models.cjs.map

package/dist/models.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/llm/model-capabilities.ts","../src/internal/llm/model-option.ts","../src/internal/providers/catalog-source-models-dev.ts"],"names":["getCatalogModelInfo","parseModelId","join","homedir","createHash","path","mkdirSync","dirname","randomBytes","writeFileSync","renameSync","unlinkSync","loadProviderCatalog","getProviderProfile","catalogModelSchema","patchModelInfo","diag","readFileSync","statSync","Retry","registerBuiltins","boundFetch"],"mappings":";;;;;;;;;;;;;;;;;;AAgCA,IAAM,qBAAA,GAA2C;AAAA,EAC/C,cAAA,EAAgB,KAAA;AAAA,EAChB,wBAAA,EAA0B,KAAA;AAAA,EAC1B,eAAA,EAAiB,KAAA;AAAA,EACjB,oBAAA,EAAsB,KAAA;AAAA,EACtB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAGA,IAAM,gBAAA,GAAmB,CAAC,aAAA,EAAe,SAAA,EAAW,UAAU,CAAA;AAM9D,SAAS,gBAAgB,CAAA,EAAoC;AAC3D,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,EAAE,UAAA,EAAY,KAAA,EAAO,SAAS,OAAO,CAAA,IAAK,EAAE,UAAA,IAAc,KAAA;AAAA,IAC1E,wBAAA,EAA0B,EAAE,iBAAA,IAAqB,KAAA;AAAA,IACjD,eAAA,EAAiB,EAAE,SAAA,IAAa,KAAA;AAAA,IAChC,oBAAA,EAAuB,EAAkC,aAAA,IAAiB,KAAA;AAAA,IAC1E,gBAAA,EAAkB,CAAA,CAAE,KAAA,EAAO,OAAA,IAAW,qBAAA,CAAsB,gBAAA;AAAA,IAC5D,eAAA,EAAiB,CAAA,CAAE,KAAA,EAAO,MAAA,IAAU,qBAAA,CAAsB;AAAA,GAC5D;AACF;AAWO,SAAS,yBAAyB,OAAA,EAAoC;AAC3E,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAG3D,EAAA,MAAM,SAAA,GAAYA,sCAAoB,IAAI,CAAA;AAC1C,EAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAO,eAAA,CAAgB,SAAS,CAAA;AAG7D,EAAA,MAAM,UAAA,GAAa,kBAAkB,IAAI,CAAA;AACzC,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAM,QAAA,GAAWA,sCAAoB,UAAU,CAAA;AAC/C,IAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,eAAA,CAAgB,QAAQ,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,qBAAA;AACT;AAEA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,KAAA,MAAW,UAAU,gBAAA,EAAkB;AACrC,IAAA,IAAI,OAAA,CAAQ,WAAW,MAAM,CAAA,SAAU,OAAA,CAAQ,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,OAAA;AACT;AAOA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,OAAO,KAAK,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,GAAI,OAAA;AACxC;AAGA,SAAS,kBAAkB,IAAA,EAAsB;AAC/C,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,aAAa,IAAI,CAAA,CAAA;AACvD,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,IAAK,IAAA,CAAK,WAAW,IAAI,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAC1E,IAAA,OAAO,UAAU,IAAI,CAAA,CAAA;AACvB,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,UAAU,IAAI,CAAA,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;;;ACzFA,IAAM,QAAA,mBAAW,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,IAAI,CAAC,CAAA;AAE7E,SAAS,YAAY,KAAA,EAAuB;AAC1C,EAAA,IAAI,QAAA,CAAS,IAAI,KAAA,CAAM,WAAA,EAAa,CAAA,EAAG,OAAO,MAAM,WAAA,EAAY;AAChE,EAAA,OAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,aAAY,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AACtD;AAeO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAIC,8BAAA,CAAa,OAAO,CAAA;AACrC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAU9B,EAAA,MAAM,IAAA,GAAO,oBAAoB,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,IAAI,CAAA;AACzE,EAAA,MAAM,UAAU,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,GAAI,EAAA;AACrD,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,MAAM,OAAO,SAAA,IAAa,CAAA,GAAI,KAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA,GAAI,IAAA;AAC1D,EAAA,MAAM,QAAQ,IAAA,CACX,KAAA,CAAM,UAAU,CAAA,CAChB,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,CAC1B,GAAA,CAAI,WAAW,CAAA,CACf,KAAK,GAAG,CAAA;AACX,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,QAAQ,MAAA,GAAS,CAAA,GAAI,GAAG,KAAK,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,CAAA,GAAM,KAAA;AACxD;AAUO,SAAS,cAAc,OAAA,EAA8B;AAC1D,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,OAAA;AAAA,IACP,KAAA,EAAO,kBAAkB,OAAO,CAAA;AAAA,IAChC,QAAA,EAAUA,8BAAA,CAAa,OAAO,CAAA,CAAE;AAAA,GAClC;AACF;AAEA,IAAM,UAAA,GAAa,EAAA;AAGnB,SAAS,oBAAoB,KAAA,EAAuB;AAClD,EAAA,IAAI,MAAM,KAAA,CAAM,MAAA;AAChB,EAAA,OAAO,MAAM,CAAA,IAAK,KAAA,CAAM,WAAW,GAAA,GAAM,CAAC,MAAM,UAAA,EAAY,GAAA,EAAA;AAC5D,EAAA,OAAO,QAAQ,KAAA,CAAM,MAAA,GAAS,QAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,GAAG,CAAA;AAC1D;AC7DA,IAAM,WAAA,GAAc,6BAAA;AAcpB,IAAM,iBAAA,GAAoB,KAAK,IAAA,GAAO,IAAA;AACtC,IAAM,MAAA,GAAS,KAAK,EAAA,GAAK,GAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AAuDlB,SAAS,aAAa,GAAA,EAAqB;AAEhD,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,YAAA,EAAc,MAAK,IAAKC,SAAA,CAAKC,UAAA,EAAQ,EAAG,UAAU,CAAA;AAC3E,EAAA,MAAM,GAAA,GAAMD,SAAA,CAAK,IAAA,EAAM,OAAA,EAAS,YAAY,CAAA;AAC5C,EAAA,IAAI,GAAA,KAAQ,WAAA,EAAa,OAAOA,SAAA,CAAK,KAAK,UAAU,CAAA;AACpD,EAAA,MAAM,IAAA,GAAOE,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACvE,EAAA,OAAOF,SAAA,CAAK,GAAA,EAAK,CAAA,IAAA,EAAO,IAAI,CAAA,KAAA,CAAO,CAAA;AACrC;AAGA,SAAS,gBAAA,CAAiBG,QAAc,IAAA,EAAoB;AAC1D,EAAAC,YAAA,CAAUC,aAAQF,MAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,GAAGA,MAAI,CAAA,KAAA,EAAQG,mBAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AACzD,EAAA,IAAI;AACF,IAAAC,gBAAA,CAAc,KAAK,IAAI,CAAA;AACvB,IAAAC,aAAA,CAAW,KAAKL,MAAI,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAAM,aAAA,CAAW,GAAG,CAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAQA,IAAM,iBAAA,GAA4C;AAAA,EAChD,MAAA,EAAQ,eAAA;AAAA,EACR,GAAA,EAAK,OAAA;AAAA,EACL,UAAA,EAAY,UAAA;AAAA,EACZ,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB,SAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAEA,IAAI,eAAA;AAEJ,SAAS,cAAA,GAAkD;AACzD,EAAA,IAAI,eAAA,KAAoB,QAAW,OAAO,eAAA;AAC1C,EAAA,eAAA,uBAAsB,GAAA,EAAI;AAC1B,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAOC,qCAAA,EAAqB,CAAA,EAAG;AACxD,MAAA,MAAM,IAAA,GAAO,CAAC,KAAA,CAAM,EAAA,EAAI,GAAI,KAAA,CAAM,OAAA,IAAW,EAAG,CAAA;AAChD,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,IAAI,CAAC,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,kBAAmB,GAAA,CAAI,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,eAAA;AACT;AAEA,SAAS,iBAAiB,UAAA,EAA0C;AAClE,EAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA;AAChD,EAAA,MAAM,WAAA,GAAc,cAAA,EAAe,CAAE,GAAA,CAAI,MAAM,CAAA;AAC/C,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,OAAO,WAAA,CAAY,IAAA;AAClD,EAAA,MAAM,OAAA,GAAUC,qCAAmB,MAAM,CAAA;AACzC,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,OAAO,CAAC,OAAA,CAAQ,MAAM,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAG,CAAA;AAC3E,EAAA,OAAO,MAAA;AACT;AAQA,SAAS,sBAAsB,GAAA,EAAsB;AACnD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,CAAA;AACpD,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,CAAC,UAAA,EAAY,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,GAA8B,CAAA,EAAG;AACnF,IAAA,MAAM,SAAU,QAAA,EAAmD,MAAA;AACnE,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,OAAO,MAAA,KAAW,QAAA,EAAU;AAGxD,IAAA,MAAM,IAAA,GAAO,iBAAiB,UAAU,CAAA;AACxC,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,KAAK,UAAU,CAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACxD,MAAA,MAAM,MAAA,GAASC,oCAAA,CAAmB,SAAA,CAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAMC,gCAAA,CAAe,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA;AACvE,MAAA,OAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAAC,sBAAA;AAAA,MACE,CAAA,+CAAA,EAAkD,OAAA,CAAQ,MAAM,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA;AAAA,KAC9H;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,kBAAA,CAAmB,MAAc,WAAA,EAAqB;AACpE,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAOC,eAAA,CAAa,MAAM,OAAO,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAGN,IAAA,IAAI;AACF,MAAAN,aAAA,CAAW,IAAI,CAAA;AAAA,IACjB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAAK,sBAAA,CAAK,yDAAyD,IAAI,CAAA;AAAA,CAAK,CAAA;AACvE,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,sBAAsB,MAAM,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AACtF,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAQA,SAAS,kBAAA,GAA8B;AACrC,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,4BAAA;AACzB,EAAA,OAAO,IAAA,KAAS,UAAa,IAAA,KAAS,EAAA,IAAM,SAAS,GAAA,IAAO,IAAA,CAAK,aAAY,KAAM,OAAA;AACrF;AASA,SAAS,oBAAA,CACP,GAAA,EACA,IAAA,EACA,GAAA,EACuC;AACvC,EAAA,IAAI;AACF,IAAA,IAAI,KAAI,GAAIE,WAAA,CAAS,IAAI,CAAA,CAAE,OAAA,IAAW,QAAQ,OAAO,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAC5D;AAWA,eAAe,gBAAA,CAAiB,KAAa,SAAA,EAAsD;AACjG,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAMC,uBAAA,CAAM,GAAA;AAAA,MACtB,YAAY;AACV,QAAA,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,gBAAgB,CAAA,EAAG,CAAA;AAChF,QAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,QAAA,OAAO,CAAA;AAAA,MACT,CAAA;AAAA;AAAA;AAAA,MAGA,EAAE,OAAA,EAAS,CAAA,EAAG,aAAa,MAAM,IAAA,EAAM,gBAAgB,GAAA;AAAI,KAC7D;AACA,IAAA,MAAM,cAAA,GAAiB,OAAO,GAAA,CAAI,OAAA,CAAQ,IAAI,gBAAgB,CAAA,IAAK,OAAO,GAAG,CAAA;AAC7E,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,cAAc,CAAA,IAAK,iBAAiB,iBAAA,EAAmB;AACzE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,cAAc,CAAA,eAAA,CAAiB,CAAA;AAAA,IACvE;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAI5B,IAAA,IAAI,IAAA,CAAK,SAAS,iBAAA,EAAmB;AACnC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAA,CAAK,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,IACpE;AACA,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AACf,IAAA,OAAO,IAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAAH,sBAAA;AAAA,MACE,CAAA,+CAAA,EAAmD,IAAc,OAAO,CAAA;AAAA;AAAA,KAC1E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAUA,SAAS,eAAA,CAAgB,MAAc,IAAA,EAAyC;AAC9E,EAAA,IAAI;AACF,IAAA,gBAAA,CAAiB,MAAM,IAAI,CAAA;AAAA,EAC7B,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AAAA,EACxF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAA,EAAQ,sBAAsB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,EAAE;AAAA,EAC9E,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA;AAAA,MACE,CAAA,6CAAA,EAAiD,IAAc,OAAO,CAAA;AAAA;AAAA,KACxE;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA,EAAE;AAAA,EACtC;AACF;AAkBA,eAAsB,mBAAA,CACpB,IAAA,GAAmC,EAAC,EACA;AAGpC,EAAAI,kCAAA,EAAiB;AACjB,EAAA,IAAI,oBAAmB,EAAG,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA,EAAE;AAEhE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,IAAI,kBAAA,IAAsB,WAAA;AAC1D,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAM,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAE9C,EAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,GAAA,EAAK,IAAA,EAAM,GAAG,CAAA;AAClD,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAAA,EACnC;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,CAAiB,GAAA,EAAKC,6BAAW,IAAA,CAAK,IAAA,EAAM,KAAK,CAAC,CAAA;AAErE,EAAA,IAAI,IAAA,KAAS,QAAW,OAAO,EAAE,QAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAElF,EAAA,OAAO,eAAA,CAAgB,MAAM,IAAI,CAAA;AACnC;AAGO,SAAS,aAAa,OAAA,EAAyD;AACpF,EAAA,OAAOrB,sCAAoB,OAAO,CAAA;AACpC","file":"models.cjs","sourcesContent":["/**\n * T3.10c — Model capability registry (DR3 #17).\n *\n * Typed per-model flags that let the SDK gate features at the boundary\n * (before hitting the provider) instead of letting opaque 400s surface.\n *\n * Resolution algorithm:\n *   1. Strip routing prefixes (openrouter/, vertex/, bedrock/) AND the\n *      OpenRouter `:variant` suffix (:free/:nitro/…) to find the bare vendor id.\n *   2. Exact match in the `EXACT` catalog → return entry.\n *   3. Vendor inference (e.g., `claude-*` → `anthropic/claude-*`) → return entry.\n *   4. No match → conservative defaults (all false, minimum tokens).\n *\n * Module is internal, but `ModelCapabilities` + `resolveModelCapabilities` are\n * re-exported publicly via the `@theokit/sdk/models` subpath (see their @public tags).\n */\n\n/**\n * Per-model capability shape. Consumers use this to gate features at\n * the SDK boundary (before request construction, not after 400).\n *\n * @public\n */\nexport interface ModelCapabilities {\n  supportsVision: boolean;\n  supportsStructuredOutput: boolean;\n  supportsToolUse: boolean;\n  supportsCacheControl: boolean;\n  maxContextTokens: number;\n  maxOutputTokens: number;\n}\n\nconst CONSERVATIVE_DEFAULTS: ModelCapabilities = {\n  supportsVision: false,\n  supportsStructuredOutput: false,\n  supportsToolUse: false,\n  supportsCacheControl: false,\n  maxContextTokens: 4096,\n  maxOutputTokens: 4096,\n};\n\n/** Routing prefixes to strip to find the underlying vendor model. */\nconst ROUTING_PREFIXES = [\"openrouter/\", \"vertex/\", \"bedrock/\"] as const;\n\nimport { getCatalogModelInfo } from \"../providers/catalog-loader.js\";\nimport type { CatalogModel } from \"../providers/catalog-schema.js\";\n\n/** Map a catalog model block (models.dev shape) to the SDK's ModelCapabilities (M44 — catalog-backed). */\nfunction capsFromCatalog(m: CatalogModel): ModelCapabilities {\n  return {\n    supportsVision: m.modalities?.input?.includes(\"image\") ?? m.attachment ?? false,\n    supportsStructuredOutput: m.structured_output ?? false,\n    supportsToolUse: m.tool_call ?? false,\n    supportsCacheControl: (m as { cache_control?: boolean }).cache_control ?? false,\n    maxContextTokens: m.limit?.context ?? CONSERVATIVE_DEFAULTS.maxContextTokens,\n    maxOutputTokens: m.limit?.output ?? CONSERVATIVE_DEFAULTS.maxOutputTokens,\n  };\n}\n\n/**\n * Resolve per-model capability flags (vision/structured-output/tool-use/cache +\n * `maxContextTokens`/`maxOutputTokens`) for a model id. Pure, sync, offline (a\n * static catalog — no network). Strips routing prefixes (`openrouter/`/`vertex/`/\n * `bedrock/`) and OpenRouter `:variant` suffixes before lookup; unknown models get\n * conservative defaults. Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function resolveModelCapabilities(modelId: string): ModelCapabilities {\n  const bare = stripVariantSuffix(stripRoutingPrefix(modelId));\n  // M44 — the catalog model-info index replaced the hand-curated EXACT map (single source of truth; the\n  // vendored provider-catalog.json carries the migrated data — parity-tested against the old map snapshot).\n  const fromIndex = getCatalogModelInfo(bare);\n  if (fromIndex !== undefined) return capsFromCatalog(fromIndex);\n  // Routing-prefixed models (vertex/claude-3-5-sonnet) strip to bare\n  // model name without vendor. Try inferring the vendor from the name.\n  const withVendor = inferVendorPrefix(bare);\n  if (withVendor !== bare) {\n    const vendored = getCatalogModelInfo(withVendor);\n    if (vendored !== undefined) return capsFromCatalog(vendored);\n  }\n  return CONSERVATIVE_DEFAULTS;\n}\n\nfunction stripRoutingPrefix(modelId: string): string {\n  for (const prefix of ROUTING_PREFIXES) {\n    if (modelId.startsWith(prefix)) return modelId.slice(prefix.length);\n  }\n  return modelId;\n}\n\n/**\n * Strip an OpenRouter variant suffix (`:free`/`:nitro`/`:floor`/`:beta`/…) so the\n * catalog lookup hits the underlying model. Model slugs contain no `:` except the\n * variant separator, so cutting at the first `:` is safe.\n */\nfunction stripVariantSuffix(modelId: string): string {\n  const i = modelId.indexOf(\":\");\n  return i >= 0 ? modelId.slice(0, i) : modelId;\n}\n\n/** Infer vendor prefix from bare model name for routing-prefixed lookups. */\nfunction inferVendorPrefix(bare: string): string {\n  if (bare.startsWith(\"claude\")) return `anthropic/${bare}`;\n  if (bare.startsWith(\"gpt-\") || bare.startsWith(\"o1\") || bare.startsWith(\"o3\"))\n    return `openai/${bare}`;\n  if (bare.startsWith(\"gemini\")) return `google/${bare}`;\n  return bare;\n}\n","import { parseModelId } from \"./model-identifier.js\";\n\n/**\n * A UI-friendly model option — the shape a `<select>`/dropdown consumes.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport interface ModelOption {\n  /** The original model id (what you pass back to the SDK). */\n  value: string;\n  /** Best-effort human label (see {@link humanizeModelName}). */\n  label: string;\n  /** Provider from the slug prefix, or `undefined` when none. */\n  provider: string | undefined;\n}\n\n/** Tokens rendered upper-case rather than title-case. */\nconst ACRONYMS = new Set([\"gpt\", \"ai\", \"hd\", \"ui\", \"api\", \"sdk\", \"llm\", \"xl\"]);\n\nfunction prettyToken(token: string): string {\n  if (ACRONYMS.has(token.toLowerCase())) return token.toUpperCase();\n  return token.charAt(0).toUpperCase() + token.slice(1);\n}\n\n/**\n * Turn a model id into a best-effort human label: strip the routing/vendor\n * prefix to the core model segment, split on `-`/`_`/`.`/whitespace, title-case\n * each token (known acronyms upper-cased), and append an OpenRouter `:variant`\n * in parentheses. Deterministic, pure, dependency-free.\n *\n * Best-effort, NOT vendor-canonical: `\"anthropic/claude-3-5-sonnet\"` →\n * `\"Claude 3 5 Sonnet\"`. A UI wanting exact marketing names overrides per id.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function humanizeModelName(modelId: string): string {\n  const { name } = parseModelId(modelId);\n  if (name.length === 0) return \"\";\n  const colon = name.indexOf(\":\");\n  // Strip a trailing slash so a typo'd `gpt-4o/` keeps its name (not lost to an\n  // empty last segment).\n  //\n  // Done by index rather than with `/\\/+$/`, and the difference is not stylistic: that pattern\n  // consumes slashes to the end of the string at every start position and then backtracks\n  // looking for an end-anchor that is not there (CodeQL js/polynomial-redos #6). This function\n  // is `@public` and takes a caller-supplied model id. Measured on a run of slashes followed by\n  // one other character: 25_000 took 496 ms, 100_000 took 31_305 ms — half a minute of pinned\n  // CPU to render a label. Walking back from the end is linear and cannot backtrack.\n  const base = trimTrailingSlashes(colon >= 0 ? name.slice(0, colon) : name);\n  const variant = colon >= 0 ? name.slice(colon + 1) : \"\";\n  const lastSlash = base.lastIndexOf(\"/\");\n  const core = lastSlash >= 0 ? base.slice(lastSlash + 1) : base;\n  const label = core\n    .split(/[-_.\\s]+/)\n    .filter((t) => t.length > 0)\n    .map(prettyToken)\n    .join(\" \");\n  if (label.length === 0) return variant; // no base label (e.g. \":free\") → bare variant\n  return variant.length > 0 ? `${label} (${variant})` : label;\n}\n\n/**\n * Build a {@link ModelOption} (`{ value, label, provider }`) for a model id —\n * a dropdown-ready entry composing {@link humanizeModelName} + `parseModelId`.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function toModelOption(modelId: string): ModelOption {\n  return {\n    value: modelId,\n    label: humanizeModelName(modelId),\n    provider: parseModelId(modelId).provider,\n  };\n}\n\nconst SLASH_CODE = 47; // \"/\"\n\n/** Removes trailing `/` characters in one linear pass. See the call site for why not a regex. */\nfunction trimTrailingSlashes(value: string): string {\n  let end = value.length;\n  while (end > 0 && value.charCodeAt(end - 1) === SLASH_CODE) end--;\n  return end === value.length ? value : value.slice(0, end);\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { Retry } from \"../../retry.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { boundFetch } from \"../runtime-fetch.js\";\nimport { registerBuiltins } from \"./builtin/index.js\";\nimport { getCatalogModelInfo, loadProviderCatalog, patchModelInfo } from \"./catalog-loader.js\";\nimport { catalogModelSchema } from \"./catalog-schema.js\";\nimport { getProviderProfile } from \"./registry.js\";\n\n/**\n * M44 — the OPTIONAL models.dev catalog source. Explicit opt-in ONLY (`refreshModelCatalog()`): the SDK\n * NEVER fetches at startup or per-request — the vendored catalog + any existing disk cache are the offline\n * base, and every failure mode fails CLOSED back to them (ROADMAP constraint: no runtime hard network dep).\n *\n * The models.dev consumption mechanism:\n * disk cache with mtime TTL, atomic tempfile+rename write, corrupt-cache delete-and-fall-through, kill-switch\n * env. Library adaptations: NO background refresh loop (a consumer composes refresh with the SDK's cron);\n * TTL 1h (not 5min — no background refresher to keep it warm); no cross-process flock v1 (atomic rename +\n * idempotent upstream content — at most one wasted fetch).\n *\n * @internal (the public surface is `refreshModelCatalog` re-exported via `@theokit/sdk/models`)\n */\n\nconst DEFAULT_URL = \"https://models.dev/api.json\";\n\n/**\n * Ceiling on a fetched catalog, before it is parsed or written to the cache.\n *\n * The response body was read with `res.text()` and persisted with no bound, so a host serving a\n * multi-gigabyte document would have been materialised in memory and then written to disk. The\n * default URL is trusted, but `THEOKIT_MODELS_URL` lets an operator point this anywhere, and a\n * limit is the difference between \"we only fetch from a host we trust\" and \"we cannot be hurt by\n * one we do not\".\n *\n * 32 MiB is roughly 40x the real catalog (~800 KiB in 2026-08), so it bounds the failure without\n * being a number anyone has to tune when models.dev grows.\n */\nconst MAX_CATALOG_BYTES = 32 * 1024 * 1024;\nconst TTL_MS = 60 * 60 * 1000; // 1 hour\nconst FETCH_TIMEOUT_MS = 10_000;\n\n/**\n * Arguments to `refreshModelCatalog`, the SDK's only network trigger for model metadata.\n *\n * `url` wins over the `THEOKIT_MODELS_URL` environment variable, which in turn wins over\n * `https://models.dev/api.json`. A non-default URL gets its own cache file, named by a hash of\n * the URL, so switching sources never reads another source's cache.\n *\n * `force` skips only the freshness check — it does not skip the kill switch. When\n * `THEOKIT_DISABLE_MODELS_FETCH` is set to anything other than an empty string, `\"0\"` or\n * `\"false\"`, the call returns `source: \"skipped\"` with no fetch and no cache read, whatever\n * `force` says.\n *\n * Without `force`, a cache file whose mtime is under an hour old is served directly and no\n * request is made.\n *\n * `deps` exists so tests can drive the fetch and the clock; production leaves it unset.\n */\nexport interface RefreshModelCatalogOptions {\n  /** Override the source URL (`THEOKIT_MODELS_URL` env also honored). */\n  url?: string;\n  /** Bypass the TTL freshness gate. */\n  force?: boolean;\n  /** Injected for tests. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\n/**\n * What `refreshModelCatalog` did. It never throws on a failed refresh, so this is the only place\n * the outcome is reported.\n *\n * `source` is `\"network\"` only when a request succeeded, its body parsed as JSON, and the models\n * were patched in. Every failure path — kill switch aside — returns `\"cache\"`: an HTTP error\n * after retries, a timeout, an unparseable body, or a patch that threw. `\"cache\"` therefore means\n * \"serving what was already there\", which may be a fresh cache, a stale one, or nothing but the\n * vendored catalog. Read `models` to tell those apart. `\"skipped\"` means the kill switch was set.\n *\n * `models` counts the models patched into the index during this call, not the catalog's size. It\n * counts each model once even when the provider has aliases and the model is written under several\n * index keys, and it excludes models whose payload failed schema validation and models under\n * providers the SDK does not know. It is 0 whenever there was no cache to fall back on, and 0 for\n * `\"skipped\"`.\n *\n * A cache write that fails is logged and otherwise ignored: the result can still say `\"network\"`\n * with the data live in memory and nothing on disk.\n */\nexport interface RefreshModelCatalogResult {\n  /** Where the data came from: a fresh network fetch, the still-fresh disk cache, or skipped entirely. */\n  source: \"network\" | \"cache\" | \"skipped\";\n  /** How many models were patched into the index. */\n  models: number;\n}\n\n/** The cache file for a source URL (custom URLs get a hash-suffixed name). */\nexport function cachePathFor(url: string): string {\n  // M44 L8 fix — honor the SDK home override so tests and multi-home setups never touch the real ~/.theokit.\n  const base = process.env.THEOKIT_HOME?.trim() || join(homedir(), \".theokit\");\n  const dir = join(base, \"cache\", \"models-dev\");\n  if (url === DEFAULT_URL) return join(dir, \"api.json\");\n  const hash = createHash(\"sha256\").update(url).digest(\"hex\").slice(0, 12);\n  return join(dir, `api-${hash}.json`);\n}\n\n/** Atomic write: temp file + rename (crash mid-write never leaves a partial cache). */\nfunction writeCacheAtomic(path: string, body: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const tmp = `${path}.tmp-${randomBytes(6).toString(\"hex\")}`;\n  try {\n    writeFileSync(tmp, body);\n    renameSync(tmp, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmp);\n    } catch {\n      // best effort\n    }\n    throw err;\n  }\n}\n\n/**\n * M44 H3 fix — models.dev provider ids ≠ theokit ids (google↔google-gemini, zai↔zhipu, togetherai↔together,\n * fireworks-ai↔fireworks, amazon-bedrock↔bedrock, google-vertex↔vertex). The RUNTIME mapping mirrors the\n * maintenance script's table; targets resolve against the CATALOG entries (id + aliases — the same namespace\n * the vendored index uses) first, then the registry.\n */\nconst MODELS_DEV_ID_MAP: Record<string, string> = {\n  google: \"google-gemini\",\n  zai: \"zhipu\",\n  togetherai: \"together\",\n  \"fireworks-ai\": \"fireworks\",\n  \"amazon-bedrock\": \"bedrock\",\n  \"google-vertex\": \"vertex\",\n};\n\nlet _catalogTargets: Map<string, { keys: string[] }> | undefined;\n/** external-id → the index keys (entry id + aliases) its models patch under. Lazy; catalog-first. */\nfunction catalogTargets(): Map<string, { keys: string[] }> {\n  if (_catalogTargets !== undefined) return _catalogTargets;\n  _catalogTargets = new Map();\n  try {\n    for (const entry of Object.values(loadProviderCatalog())) {\n      const keys = [entry.id, ...(entry.aliases ?? [])];\n      for (const k of keys) {\n        if (!_catalogTargets.has(k)) _catalogTargets.set(k, { keys });\n      }\n    }\n  } catch {\n    // catalog unavailable — registry fallback below still works\n  }\n  return _catalogTargets;\n}\n\nfunction resolvePatchKeys(externalId: string): string[] | undefined {\n  const mapped = MODELS_DEV_ID_MAP[externalId] ?? externalId;\n  const fromCatalog = catalogTargets().get(mapped);\n  if (fromCatalog !== undefined) return fromCatalog.keys;\n  const profile = getProviderProfile(mapped);\n  if (profile !== undefined) return [profile.name, ...(profile.aliases ?? [])];\n  return undefined;\n}\n\n/** Parse + patch the index from an api.json payload. Unknown providers are skipped with WARN (once each). */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: validates and merges an UNTRUSTED upstream payload (models.dev api.json) shape by shape, dropping a single bad model rather than the file. Each branch is a distinct malformed input; merging them loses which one was seen.\nfunction patchIndexFromApiJson(raw: unknown): number {\n  if (typeof raw !== \"object\" || raw === null) return 0;\n  let patched = 0;\n  const skipped: string[] = [];\n  for (const [providerId, provider] of Object.entries(raw as Record<string, unknown>)) {\n    const models = (provider as { models?: Record<string, unknown> })?.models;\n    if (models === undefined || typeof models !== \"object\") continue;\n    // Enrich ONLY providers the SDK knows — models.dev's npm/api fields cannot be mapped to a theokit\n    // apiMode/authType safely, so unknown providers are data we cannot route.\n    const keys = resolvePatchKeys(providerId);\n    if (keys === undefined) {\n      skipped.push(providerId);\n      continue;\n    }\n    for (const [modelId, rawModel] of Object.entries(models)) {\n      const parsed = catalogModelSchema.safeParse(rawModel);\n      if (!parsed.success) continue; // malformed model — drop silently (live data, additive drift expected)\n      for (const key of keys) patchModelInfo(`${key}/${modelId}`, parsed.data);\n      patched++;\n    }\n  }\n  if (skipped.length > 0) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh skipped ${skipped.length} unknown provider(s) (e.g. ${skipped.slice(0, 3).join(\", \")})\\n`,\n    );\n  }\n  return patched;\n}\n\n/**\n * Load an existing disk cache into the index (called by refresh when fresh, or opportunistically by a\n * consumer at startup — NEVER fetches). Corrupt cache → delete + fall through to vendored data.\n */\nexport function loadCacheIntoIndex(url: string = DEFAULT_URL): number {\n  const path = cachePathFor(url);\n  let body: string;\n  try {\n    body = readFileSync(path, \"utf-8\");\n  } catch {\n    return 0; // no cache — vendored data only\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(body);\n  } catch {\n    // corrupt cache: delete and fall through to the vendored catalog.\n    // M44 L9 fix — only a PARSE failure is cache corruption; a patch error must never delete a valid cache.\n    try {\n      unlinkSync(path);\n    } catch {\n      // best effort\n    }\n    diag(`[theokit-sdk] WARN: corrupt models-dev cache deleted (${path})\\n`);\n    return 0;\n  }\n  try {\n    return patchIndexFromApiJson(parsed);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache patch failed (${(err as Error).message})\\n`);\n    return 0;\n  }\n}\n\n/**\n * The kill switch, read from the environment.\n *\n * Truthy-only by design (M44 L11): a presence check would treat `THEOKIT_DISABLE_MODELS_FETCH=0`\n * and `=false` as \"disabled\", which is the opposite of what anyone writing them means.\n */\nfunction fetchDisabledByEnv(): boolean {\n  const kill = process.env.THEOKIT_DISABLE_MODELS_FETCH;\n  return kill !== undefined && kill !== \"\" && kill !== \"0\" && kill.toLowerCase() !== \"false\";\n}\n\n/**\n * The TTL gate: a cache file younger than {@link TTL_MS} serves without touching the network.\n *\n * Returns `undefined` when there is no usable cache — including when `statSync` throws, which is\n * how \"no cache file\" arrives. That is the ONE failure this step owns, and its fallback is simply\n * to let the caller proceed to the fetch.\n */\nfunction servedFromFreshCache(\n  url: string,\n  path: string,\n  now: () => number,\n): RefreshModelCatalogResult | undefined {\n  try {\n    if (now() - statSync(path).mtimeMs >= TTL_MS) return undefined;\n  } catch {\n    return undefined; // no cache — proceed to fetch\n  }\n  return { source: \"cache\", models: loadCacheIntoIndex(url) };\n}\n\n/**\n * Fetch the catalog, bound its size, and prove it parses before anyone persists it.\n *\n * Returns `undefined` after logging when ANY of that fails — timeout, non-2xx, oversize, unparseable\n * body. The fallback this step owns is \"serve what we already have\", and the caller applies it.\n * Splitting the step from its fallback was the objection recorded in the suppression this replaces;\n * the fallback is not separated, it is named — `undefined` means \"this step could not produce a\n * body\", and there is exactly one thing to do about that.\n */\nasync function fetchCatalogBody(url: string, fetchImpl: typeof fetch): Promise<string | undefined> {\n  try {\n    const res = await Retry.run(\n      async () => {\n        const r = await fetchImpl(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });\n        if (!r.ok) throw new Error(`HTTP ${r.status}`);\n        return r;\n      },\n      // 2 transient retries with backoff; every error here is worth one more try —\n      // the whole call is already fail-closed at the caller.\n      { retries: 2, isRetryable: () => true, initialDelayMs: 200 },\n    );\n    const declaredLength = Number(res.headers.get(\"content-length\") ?? Number.NaN);\n    if (Number.isFinite(declaredLength) && declaredLength > MAX_CATALOG_BYTES) {\n      throw new Error(`catalog too large: ${declaredLength} bytes declared`);\n    }\n    const body = await res.text();\n    // Checked again after reading: `content-length` is the server's claim, and a server that\n    // omits it or lies about it is exactly the one worth bounding. Both checks are cheap and\n    // neither alone is sufficient.\n    if (body.length > MAX_CATALOG_BYTES) {\n      throw new Error(`catalog too large: ${body.length} bytes received`);\n    }\n    JSON.parse(body); // validate before persisting — never cache garbage\n    return body;\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return undefined;\n  }\n}\n\n/**\n * Persist the fetched body and patch it into the index.\n *\n * Two independent failures with two different consequences, which is why they are two try blocks\n * and not one: a cache write that fails costs the NEXT process a fetch and nothing more, so the run\n * continues; a patch that fails means this body never reached the index, so the index is whatever it\n * was and the result says `cache`.\n */\nfunction persistAndPatch(path: string, body: string): RefreshModelCatalogResult {\n  try {\n    writeCacheAtomic(path, body);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache write failed (${(err as Error).message})\\n`);\n  }\n  try {\n    return { source: \"network\", models: patchIndexFromApiJson(JSON.parse(body)) };\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev patch failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return { source: \"cache\", models: 0 };\n  }\n}\n\n/**\n * Explicitly refresh the model catalog from models.dev (the ONLY network trigger in the subsystem).\n * Fail-closed: any failure keeps serving the current index (cache or vendored). Kill-switch:\n * `THEOKIT_DISABLE_MODELS_FETCH`.\n *\n * The sequence carried a cognitive-complexity suppression whose reason said splitting it would\n * \"separate a step from the fallback it owns\". The four helpers above each KEEP their fallback: the\n * TTL gate owns \"no cache\", the fetch owns every network and validation failure, the persist owns\n * the write and the patch. What is left here is the order they run in, which is what this function\n * was always for.\n *\n * Still true, and NOT fixed by the split: three of the paths return `{ source: \"cache\" }`, so a\n * caller cannot tell a timeout from an unparseable body from a patch failure. Distinguishing them\n * means adding a field to the PUBLIC `RefreshModelCatalogResult`, which is a release decision rather\n * than a refactor. The `diag` line already names the cause for an operator.\n */\nexport async function refreshModelCatalog(\n  opts: RefreshModelCatalogOptions = {},\n): Promise<RefreshModelCatalogResult> {\n  // M44 M4 fix — self-initialize provider registration so the `@theokit/sdk/models` subpath works\n  // standalone (without the consumer having built an Agent first).\n  registerBuiltins();\n  if (fetchDisabledByEnv()) return { source: \"skipped\", models: 0 };\n\n  const url = opts.url ?? process.env.THEOKIT_MODELS_URL ?? DEFAULT_URL;\n  const path = cachePathFor(url);\n  const now = opts.deps?.now ?? (() => Date.now());\n\n  if (opts.force !== true) {\n    const cached = servedFromFreshCache(url, path, now);\n    if (cached !== undefined) return cached;\n  }\n\n  const body = await fetchCatalogBody(url, boundFetch(opts.deps?.fetch));\n  // fail-closed: serve whatever we already have (stale cache if present, else vendored)\n  if (body === undefined) return { source: \"cache\", models: loadCacheIntoIndex(url) };\n\n  return persistAndPatch(path, body);\n}\n\n/** The enriched per-model view (public via `@theokit/sdk/models`): index lookup by (possibly prefixed) id. */\nexport function getModelInfo(modelId: string): ReturnType<typeof getCatalogModelInfo> {\n  return getCatalogModelInfo(modelId);\n}\n"]}
+{"version":3,"sources":["../src/internal/llm/model-option.ts","../src/internal/providers/catalog-source-models-dev.ts"],"names":["parseModelId","join","homedir","createHash","path","mkdirSync","dirname","randomBytes","writeFileSync","renameSync","unlinkSync","loadProviderCatalog","getProviderProfile","catalogModelSchema","patchModelInfo","diag","readFileSync","statSync","Retry","registerBuiltins","boundFetch","getCatalogModelInfo"],"mappings":";;;;;;;;;;;;;;;;;;;AAmBA,IAAM,QAAA,mBAAW,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,IAAI,CAAC,CAAA;AAE7E,SAAS,YAAY,KAAA,EAAuB;AAC1C,EAAA,IAAI,QAAA,CAAS,IAAI,KAAA,CAAM,WAAA,EAAa,CAAA,EAAG,OAAO,MAAM,WAAA,EAAY;AAChE,EAAA,OAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,aAAY,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AACtD;AAeO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAIA,8BAAA,CAAa,OAAO,CAAA;AACrC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAU9B,EAAA,MAAM,IAAA,GAAO,oBAAoB,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,IAAI,CAAA;AACzE,EAAA,MAAM,UAAU,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,GAAI,EAAA;AACrD,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,MAAM,OAAO,SAAA,IAAa,CAAA,GAAI,KAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA,GAAI,IAAA;AAC1D,EAAA,MAAM,QAAQ,IAAA,CACX,KAAA,CAAM,UAAU,CAAA,CAChB,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,CAC1B,GAAA,CAAI,WAAW,CAAA,CACf,KAAK,GAAG,CAAA;AACX,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,QAAQ,MAAA,GAAS,CAAA,GAAI,GAAG,KAAK,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,CAAA,GAAM,KAAA;AACxD;AAUO,SAAS,cAAc,OAAA,EAA8B;AAC1D,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,OAAA;AAAA,IACP,KAAA,EAAO,kBAAkB,OAAO,CAAA;AAAA,IAChC,QAAA,EAAUA,8BAAA,CAAa,OAAO,CAAA,CAAE;AAAA,GAClC;AACF;AAEA,IAAM,UAAA,GAAa,EAAA;AAGnB,SAAS,oBAAoB,KAAA,EAAuB;AAClD,EAAA,IAAI,MAAM,KAAA,CAAM,MAAA;AAChB,EAAA,OAAO,MAAM,CAAA,IAAK,KAAA,CAAM,WAAW,GAAA,GAAM,CAAC,MAAM,UAAA,EAAY,GAAA,EAAA;AAC5D,EAAA,OAAO,QAAQ,KAAA,CAAM,MAAA,GAAS,QAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,GAAG,CAAA;AAC1D;AC7DA,IAAM,WAAA,GAAc,6BAAA;AAcpB,IAAM,iBAAA,GAAoB,KAAK,IAAA,GAAO,IAAA;AACtC,IAAM,MAAA,GAAS,KAAK,EAAA,GAAK,GAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AAuDlB,SAAS,aAAa,GAAA,EAAqB;AAEhD,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,YAAA,EAAc,MAAK,IAAKC,SAAA,CAAKC,UAAA,EAAQ,EAAG,UAAU,CAAA;AAC3E,EAAA,MAAM,GAAA,GAAMD,SAAA,CAAK,IAAA,EAAM,OAAA,EAAS,YAAY,CAAA;AAC5C,EAAA,IAAI,GAAA,KAAQ,WAAA,EAAa,OAAOA,SAAA,CAAK,KAAK,UAAU,CAAA;AACpD,EAAA,MAAM,IAAA,GAAOE,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACvE,EAAA,OAAOF,SAAA,CAAK,GAAA,EAAK,CAAA,IAAA,EAAO,IAAI,CAAA,KAAA,CAAO,CAAA;AACrC;AAGA,SAAS,gBAAA,CAAiBG,QAAc,IAAA,EAAoB;AAC1D,EAAAC,YAAA,CAAUC,aAAQF,MAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,GAAGA,MAAI,CAAA,KAAA,EAAQG,mBAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AACzD,EAAA,IAAI;AACF,IAAAC,gBAAA,CAAc,KAAK,IAAI,CAAA;AACvB,IAAAC,aAAA,CAAW,KAAKL,MAAI,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAAM,aAAA,CAAW,GAAG,CAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAQA,IAAM,iBAAA,GAA4C;AAAA,EAChD,MAAA,EAAQ,eAAA;AAAA,EACR,GAAA,EAAK,OAAA;AAAA,EACL,UAAA,EAAY,UAAA;AAAA,EACZ,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB,SAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAEA,IAAI,eAAA;AAEJ,SAAS,cAAA,GAAkD;AACzD,EAAA,IAAI,eAAA,KAAoB,QAAW,OAAO,eAAA;AAC1C,EAAA,eAAA,uBAAsB,GAAA,EAAI;AAC1B,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAOC,qCAAA,EAAqB,CAAA,EAAG;AACxD,MAAA,MAAM,IAAA,GAAO,CAAC,KAAA,CAAM,EAAA,EAAI,GAAI,KAAA,CAAM,OAAA,IAAW,EAAG,CAAA;AAChD,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,IAAI,CAAC,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,kBAAmB,GAAA,CAAI,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,eAAA;AACT;AAEA,SAAS,iBAAiB,UAAA,EAA0C;AAClE,EAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA;AAChD,EAAA,MAAM,WAAA,GAAc,cAAA,EAAe,CAAE,GAAA,CAAI,MAAM,CAAA;AAC/C,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,OAAO,WAAA,CAAY,IAAA;AAClD,EAAA,MAAM,OAAA,GAAUC,qCAAmB,MAAM,CAAA;AACzC,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,OAAO,CAAC,OAAA,CAAQ,MAAM,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAG,CAAA;AAC3E,EAAA,OAAO,MAAA;AACT;AAQA,SAAS,sBAAsB,GAAA,EAAsB;AACnD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,CAAA;AACpD,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,CAAC,UAAA,EAAY,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,GAA8B,CAAA,EAAG;AACnF,IAAA,MAAM,SAAU,QAAA,EAAmD,MAAA;AACnE,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,OAAO,MAAA,KAAW,QAAA,EAAU;AAGxD,IAAA,MAAM,IAAA,GAAO,iBAAiB,UAAU,CAAA;AACxC,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,KAAK,UAAU,CAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACxD,MAAA,MAAM,MAAA,GAASC,oCAAA,CAAmB,SAAA,CAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAMC,gCAAA,CAAe,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA;AACvE,MAAA,OAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAAC,sBAAA;AAAA,MACE,CAAA,+CAAA,EAAkD,OAAA,CAAQ,MAAM,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA;AAAA,KAC9H;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,kBAAA,CAAmB,MAAc,WAAA,EAAqB;AACpE,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAOC,eAAA,CAAa,MAAM,OAAO,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAGN,IAAA,IAAI;AACF,MAAAN,aAAA,CAAW,IAAI,CAAA;AAAA,IACjB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAAK,sBAAA,CAAK,yDAAyD,IAAI,CAAA;AAAA,CAAK,CAAA;AACvE,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,sBAAsB,MAAM,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AACtF,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAQA,SAAS,kBAAA,GAA8B;AACrC,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,4BAAA;AACzB,EAAA,OAAO,IAAA,KAAS,UAAa,IAAA,KAAS,EAAA,IAAM,SAAS,GAAA,IAAO,IAAA,CAAK,aAAY,KAAM,OAAA;AACrF;AASA,SAAS,oBAAA,CACP,GAAA,EACA,IAAA,EACA,GAAA,EACuC;AACvC,EAAA,IAAI;AACF,IAAA,IAAI,KAAI,GAAIE,WAAA,CAAS,IAAI,CAAA,CAAE,OAAA,IAAW,QAAQ,OAAO,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAC5D;AAWA,eAAe,gBAAA,CAAiB,KAAa,SAAA,EAAsD;AACjG,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAMC,uBAAA,CAAM,GAAA;AAAA,MACtB,YAAY;AACV,QAAA,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,gBAAgB,CAAA,EAAG,CAAA;AAChF,QAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,QAAA,OAAO,CAAA;AAAA,MACT,CAAA;AAAA;AAAA;AAAA,MAGA,EAAE,OAAA,EAAS,CAAA,EAAG,aAAa,MAAM,IAAA,EAAM,gBAAgB,GAAA;AAAI,KAC7D;AACA,IAAA,MAAM,cAAA,GAAiB,OAAO,GAAA,CAAI,OAAA,CAAQ,IAAI,gBAAgB,CAAA,IAAK,OAAO,GAAG,CAAA;AAC7E,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,cAAc,CAAA,IAAK,iBAAiB,iBAAA,EAAmB;AACzE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,cAAc,CAAA,eAAA,CAAiB,CAAA;AAAA,IACvE;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAI5B,IAAA,IAAI,IAAA,CAAK,SAAS,iBAAA,EAAmB;AACnC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAA,CAAK,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,IACpE;AACA,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AACf,IAAA,OAAO,IAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAAH,sBAAA;AAAA,MACE,CAAA,+CAAA,EAAmD,IAAc,OAAO,CAAA;AAAA;AAAA,KAC1E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAUA,SAAS,eAAA,CAAgB,MAAc,IAAA,EAAyC;AAC9E,EAAA,IAAI;AACF,IAAA,gBAAA,CAAiB,MAAM,IAAI,CAAA;AAAA,EAC7B,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AAAA,EACxF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAA,EAAQ,sBAAsB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,EAAE;AAAA,EAC9E,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA;AAAA,MACE,CAAA,6CAAA,EAAiD,IAAc,OAAO,CAAA;AAAA;AAAA,KACxE;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA,EAAE;AAAA,EACtC;AACF;AAkBA,eAAsB,mBAAA,CACpB,IAAA,GAAmC,EAAC,EACA;AAGpC,EAAAI,kCAAA,EAAiB;AACjB,EAAA,IAAI,oBAAmB,EAAG,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA,EAAE;AAEhE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,IAAI,kBAAA,IAAsB,WAAA;AAC1D,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAM,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAE9C,EAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,GAAA,EAAK,IAAA,EAAM,GAAG,CAAA;AAClD,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAAA,EACnC;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,CAAiB,GAAA,EAAKC,6BAAW,IAAA,CAAK,IAAA,EAAM,KAAK,CAAC,CAAA;AAErE,EAAA,IAAI,IAAA,KAAS,QAAW,OAAO,EAAE,QAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAElF,EAAA,OAAO,eAAA,CAAgB,MAAM,IAAI,CAAA;AACnC;AAGO,SAAS,aAAa,OAAA,EAAyD;AACpF,EAAA,OAAOC,sCAAoB,OAAO,CAAA;AACpC","file":"models.cjs","sourcesContent":["import { parseModelId } from \"./model-identifier.js\";\n\n/**\n * A UI-friendly model option — the shape a `<select>`/dropdown consumes.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport interface ModelOption {\n  /** The original model id (what you pass back to the SDK). */\n  value: string;\n  /** Best-effort human label (see {@link humanizeModelName}). */\n  label: string;\n  /** Provider from the slug prefix, or `undefined` when none. */\n  provider: string | undefined;\n}\n\n/** Tokens rendered upper-case rather than title-case. */\nconst ACRONYMS = new Set([\"gpt\", \"ai\", \"hd\", \"ui\", \"api\", \"sdk\", \"llm\", \"xl\"]);\n\nfunction prettyToken(token: string): string {\n  if (ACRONYMS.has(token.toLowerCase())) return token.toUpperCase();\n  return token.charAt(0).toUpperCase() + token.slice(1);\n}\n\n/**\n * Turn a model id into a best-effort human label: strip the routing/vendor\n * prefix to the core model segment, split on `-`/`_`/`.`/whitespace, title-case\n * each token (known acronyms upper-cased), and append an OpenRouter `:variant`\n * in parentheses. Deterministic, pure, dependency-free.\n *\n * Best-effort, NOT vendor-canonical: `\"anthropic/claude-3-5-sonnet\"` →\n * `\"Claude 3 5 Sonnet\"`. A UI wanting exact marketing names overrides per id.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function humanizeModelName(modelId: string): string {\n  const { name } = parseModelId(modelId);\n  if (name.length === 0) return \"\";\n  const colon = name.indexOf(\":\");\n  // Strip a trailing slash so a typo'd `gpt-4o/` keeps its name (not lost to an\n  // empty last segment).\n  //\n  // Done by index rather than with `/\\/+$/`, and the difference is not stylistic: that pattern\n  // consumes slashes to the end of the string at every start position and then backtracks\n  // looking for an end-anchor that is not there (CodeQL js/polynomial-redos #6). This function\n  // is `@public` and takes a caller-supplied model id. Measured on a run of slashes followed by\n  // one other character: 25_000 took 496 ms, 100_000 took 31_305 ms — half a minute of pinned\n  // CPU to render a label. Walking back from the end is linear and cannot backtrack.\n  const base = trimTrailingSlashes(colon >= 0 ? name.slice(0, colon) : name);\n  const variant = colon >= 0 ? name.slice(colon + 1) : \"\";\n  const lastSlash = base.lastIndexOf(\"/\");\n  const core = lastSlash >= 0 ? base.slice(lastSlash + 1) : base;\n  const label = core\n    .split(/[-_.\\s]+/)\n    .filter((t) => t.length > 0)\n    .map(prettyToken)\n    .join(\" \");\n  if (label.length === 0) return variant; // no base label (e.g. \":free\") → bare variant\n  return variant.length > 0 ? `${label} (${variant})` : label;\n}\n\n/**\n * Build a {@link ModelOption} (`{ value, label, provider }`) for a model id —\n * a dropdown-ready entry composing {@link humanizeModelName} + `parseModelId`.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function toModelOption(modelId: string): ModelOption {\n  return {\n    value: modelId,\n    label: humanizeModelName(modelId),\n    provider: parseModelId(modelId).provider,\n  };\n}\n\nconst SLASH_CODE = 47; // \"/\"\n\n/** Removes trailing `/` characters in one linear pass. See the call site for why not a regex. */\nfunction trimTrailingSlashes(value: string): string {\n  let end = value.length;\n  while (end > 0 && value.charCodeAt(end - 1) === SLASH_CODE) end--;\n  return end === value.length ? value : value.slice(0, end);\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { Retry } from \"../../retry.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { boundFetch } from \"../runtime-fetch.js\";\nimport { registerBuiltins } from \"./builtin/index.js\";\nimport { getCatalogModelInfo, loadProviderCatalog, patchModelInfo } from \"./catalog-loader.js\";\nimport { catalogModelSchema } from \"./catalog-schema.js\";\nimport { getProviderProfile } from \"./registry.js\";\n\n/**\n * M44 — the OPTIONAL models.dev catalog source. Explicit opt-in ONLY (`refreshModelCatalog()`): the SDK\n * NEVER fetches at startup or per-request — the vendored catalog + any existing disk cache are the offline\n * base, and every failure mode fails CLOSED back to them (ROADMAP constraint: no runtime hard network dep).\n *\n * The models.dev consumption mechanism:\n * disk cache with mtime TTL, atomic tempfile+rename write, corrupt-cache delete-and-fall-through, kill-switch\n * env. Library adaptations: NO background refresh loop (a consumer composes refresh with the SDK's cron);\n * TTL 1h (not 5min — no background refresher to keep it warm); no cross-process flock v1 (atomic rename +\n * idempotent upstream content — at most one wasted fetch).\n *\n * @internal (the public surface is `refreshModelCatalog` re-exported via `@theokit/sdk/models`)\n */\n\nconst DEFAULT_URL = \"https://models.dev/api.json\";\n\n/**\n * Ceiling on a fetched catalog, before it is parsed or written to the cache.\n *\n * The response body was read with `res.text()` and persisted with no bound, so a host serving a\n * multi-gigabyte document would have been materialised in memory and then written to disk. The\n * default URL is trusted, but `THEOKIT_MODELS_URL` lets an operator point this anywhere, and a\n * limit is the difference between \"we only fetch from a host we trust\" and \"we cannot be hurt by\n * one we do not\".\n *\n * 32 MiB is roughly 40x the real catalog (~800 KiB in 2026-08), so it bounds the failure without\n * being a number anyone has to tune when models.dev grows.\n */\nconst MAX_CATALOG_BYTES = 32 * 1024 * 1024;\nconst TTL_MS = 60 * 60 * 1000; // 1 hour\nconst FETCH_TIMEOUT_MS = 10_000;\n\n/**\n * Arguments to `refreshModelCatalog`, the SDK's only network trigger for model metadata.\n *\n * `url` wins over the `THEOKIT_MODELS_URL` environment variable, which in turn wins over\n * `https://models.dev/api.json`. A non-default URL gets its own cache file, named by a hash of\n * the URL, so switching sources never reads another source's cache.\n *\n * `force` skips only the freshness check — it does not skip the kill switch. When\n * `THEOKIT_DISABLE_MODELS_FETCH` is set to anything other than an empty string, `\"0\"` or\n * `\"false\"`, the call returns `source: \"skipped\"` with no fetch and no cache read, whatever\n * `force` says.\n *\n * Without `force`, a cache file whose mtime is under an hour old is served directly and no\n * request is made.\n *\n * `deps` exists so tests can drive the fetch and the clock; production leaves it unset.\n */\nexport interface RefreshModelCatalogOptions {\n  /** Override the source URL (`THEOKIT_MODELS_URL` env also honored). */\n  url?: string;\n  /** Bypass the TTL freshness gate. */\n  force?: boolean;\n  /** Injected for tests. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\n/**\n * What `refreshModelCatalog` did. It never throws on a failed refresh, so this is the only place\n * the outcome is reported.\n *\n * `source` is `\"network\"` only when a request succeeded, its body parsed as JSON, and the models\n * were patched in. Every failure path — kill switch aside — returns `\"cache\"`: an HTTP error\n * after retries, a timeout, an unparseable body, or a patch that threw. `\"cache\"` therefore means\n * \"serving what was already there\", which may be a fresh cache, a stale one, or nothing but the\n * vendored catalog. Read `models` to tell those apart. `\"skipped\"` means the kill switch was set.\n *\n * `models` counts the models patched into the index during this call, not the catalog's size. It\n * counts each model once even when the provider has aliases and the model is written under several\n * index keys, and it excludes models whose payload failed schema validation and models under\n * providers the SDK does not know. It is 0 whenever there was no cache to fall back on, and 0 for\n * `\"skipped\"`.\n *\n * A cache write that fails is logged and otherwise ignored: the result can still say `\"network\"`\n * with the data live in memory and nothing on disk.\n */\nexport interface RefreshModelCatalogResult {\n  /** Where the data came from: a fresh network fetch, the still-fresh disk cache, or skipped entirely. */\n  source: \"network\" | \"cache\" | \"skipped\";\n  /** How many models were patched into the index. */\n  models: number;\n}\n\n/** The cache file for a source URL (custom URLs get a hash-suffixed name). */\nexport function cachePathFor(url: string): string {\n  // M44 L8 fix — honor the SDK home override so tests and multi-home setups never touch the real ~/.theokit.\n  const base = process.env.THEOKIT_HOME?.trim() || join(homedir(), \".theokit\");\n  const dir = join(base, \"cache\", \"models-dev\");\n  if (url === DEFAULT_URL) return join(dir, \"api.json\");\n  const hash = createHash(\"sha256\").update(url).digest(\"hex\").slice(0, 12);\n  return join(dir, `api-${hash}.json`);\n}\n\n/** Atomic write: temp file + rename (crash mid-write never leaves a partial cache). */\nfunction writeCacheAtomic(path: string, body: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const tmp = `${path}.tmp-${randomBytes(6).toString(\"hex\")}`;\n  try {\n    writeFileSync(tmp, body);\n    renameSync(tmp, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmp);\n    } catch {\n      // best effort\n    }\n    throw err;\n  }\n}\n\n/**\n * M44 H3 fix — models.dev provider ids ≠ theokit ids (google↔google-gemini, zai↔zhipu, togetherai↔together,\n * fireworks-ai↔fireworks, amazon-bedrock↔bedrock, google-vertex↔vertex). The RUNTIME mapping mirrors the\n * maintenance script's table; targets resolve against the CATALOG entries (id + aliases — the same namespace\n * the vendored index uses) first, then the registry.\n */\nconst MODELS_DEV_ID_MAP: Record<string, string> = {\n  google: \"google-gemini\",\n  zai: \"zhipu\",\n  togetherai: \"together\",\n  \"fireworks-ai\": \"fireworks\",\n  \"amazon-bedrock\": \"bedrock\",\n  \"google-vertex\": \"vertex\",\n};\n\nlet _catalogTargets: Map<string, { keys: string[] }> | undefined;\n/** external-id → the index keys (entry id + aliases) its models patch under. Lazy; catalog-first. */\nfunction catalogTargets(): Map<string, { keys: string[] }> {\n  if (_catalogTargets !== undefined) return _catalogTargets;\n  _catalogTargets = new Map();\n  try {\n    for (const entry of Object.values(loadProviderCatalog())) {\n      const keys = [entry.id, ...(entry.aliases ?? [])];\n      for (const k of keys) {\n        if (!_catalogTargets.has(k)) _catalogTargets.set(k, { keys });\n      }\n    }\n  } catch {\n    // catalog unavailable — registry fallback below still works\n  }\n  return _catalogTargets;\n}\n\nfunction resolvePatchKeys(externalId: string): string[] | undefined {\n  const mapped = MODELS_DEV_ID_MAP[externalId] ?? externalId;\n  const fromCatalog = catalogTargets().get(mapped);\n  if (fromCatalog !== undefined) return fromCatalog.keys;\n  const profile = getProviderProfile(mapped);\n  if (profile !== undefined) return [profile.name, ...(profile.aliases ?? [])];\n  return undefined;\n}\n\n/** Parse + patch the index from an api.json payload. Unknown providers are skipped with WARN (once each). */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: validates and merges an UNTRUSTED upstream payload (models.dev api.json) shape by shape, dropping a single bad model rather than the file. Each branch is a distinct malformed input; merging them loses which one was seen.\nfunction patchIndexFromApiJson(raw: unknown): number {\n  if (typeof raw !== \"object\" || raw === null) return 0;\n  let patched = 0;\n  const skipped: string[] = [];\n  for (const [providerId, provider] of Object.entries(raw as Record<string, unknown>)) {\n    const models = (provider as { models?: Record<string, unknown> })?.models;\n    if (models === undefined || typeof models !== \"object\") continue;\n    // Enrich ONLY providers the SDK knows — models.dev's npm/api fields cannot be mapped to a theokit\n    // apiMode/authType safely, so unknown providers are data we cannot route.\n    const keys = resolvePatchKeys(providerId);\n    if (keys === undefined) {\n      skipped.push(providerId);\n      continue;\n    }\n    for (const [modelId, rawModel] of Object.entries(models)) {\n      const parsed = catalogModelSchema.safeParse(rawModel);\n      if (!parsed.success) continue; // malformed model — drop silently (live data, additive drift expected)\n      for (const key of keys) patchModelInfo(`${key}/${modelId}`, parsed.data);\n      patched++;\n    }\n  }\n  if (skipped.length > 0) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh skipped ${skipped.length} unknown provider(s) (e.g. ${skipped.slice(0, 3).join(\", \")})\\n`,\n    );\n  }\n  return patched;\n}\n\n/**\n * Load an existing disk cache into the index (called by refresh when fresh, or opportunistically by a\n * consumer at startup — NEVER fetches). Corrupt cache → delete + fall through to vendored data.\n */\nexport function loadCacheIntoIndex(url: string = DEFAULT_URL): number {\n  const path = cachePathFor(url);\n  let body: string;\n  try {\n    body = readFileSync(path, \"utf-8\");\n  } catch {\n    return 0; // no cache — vendored data only\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(body);\n  } catch {\n    // corrupt cache: delete and fall through to the vendored catalog.\n    // M44 L9 fix — only a PARSE failure is cache corruption; a patch error must never delete a valid cache.\n    try {\n      unlinkSync(path);\n    } catch {\n      // best effort\n    }\n    diag(`[theokit-sdk] WARN: corrupt models-dev cache deleted (${path})\\n`);\n    return 0;\n  }\n  try {\n    return patchIndexFromApiJson(parsed);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache patch failed (${(err as Error).message})\\n`);\n    return 0;\n  }\n}\n\n/**\n * The kill switch, read from the environment.\n *\n * Truthy-only by design (M44 L11): a presence check would treat `THEOKIT_DISABLE_MODELS_FETCH=0`\n * and `=false` as \"disabled\", which is the opposite of what anyone writing them means.\n */\nfunction fetchDisabledByEnv(): boolean {\n  const kill = process.env.THEOKIT_DISABLE_MODELS_FETCH;\n  return kill !== undefined && kill !== \"\" && kill !== \"0\" && kill.toLowerCase() !== \"false\";\n}\n\n/**\n * The TTL gate: a cache file younger than {@link TTL_MS} serves without touching the network.\n *\n * Returns `undefined` when there is no usable cache — including when `statSync` throws, which is\n * how \"no cache file\" arrives. That is the ONE failure this step owns, and its fallback is simply\n * to let the caller proceed to the fetch.\n */\nfunction servedFromFreshCache(\n  url: string,\n  path: string,\n  now: () => number,\n): RefreshModelCatalogResult | undefined {\n  try {\n    if (now() - statSync(path).mtimeMs >= TTL_MS) return undefined;\n  } catch {\n    return undefined; // no cache — proceed to fetch\n  }\n  return { source: \"cache\", models: loadCacheIntoIndex(url) };\n}\n\n/**\n * Fetch the catalog, bound its size, and prove it parses before anyone persists it.\n *\n * Returns `undefined` after logging when ANY of that fails — timeout, non-2xx, oversize, unparseable\n * body. The fallback this step owns is \"serve what we already have\", and the caller applies it.\n * Splitting the step from its fallback was the objection recorded in the suppression this replaces;\n * the fallback is not separated, it is named — `undefined` means \"this step could not produce a\n * body\", and there is exactly one thing to do about that.\n */\nasync function fetchCatalogBody(url: string, fetchImpl: typeof fetch): Promise<string | undefined> {\n  try {\n    const res = await Retry.run(\n      async () => {\n        const r = await fetchImpl(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });\n        if (!r.ok) throw new Error(`HTTP ${r.status}`);\n        return r;\n      },\n      // 2 transient retries with backoff; every error here is worth one more try —\n      // the whole call is already fail-closed at the caller.\n      { retries: 2, isRetryable: () => true, initialDelayMs: 200 },\n    );\n    const declaredLength = Number(res.headers.get(\"content-length\") ?? Number.NaN);\n    if (Number.isFinite(declaredLength) && declaredLength > MAX_CATALOG_BYTES) {\n      throw new Error(`catalog too large: ${declaredLength} bytes declared`);\n    }\n    const body = await res.text();\n    // Checked again after reading: `content-length` is the server's claim, and a server that\n    // omits it or lies about it is exactly the one worth bounding. Both checks are cheap and\n    // neither alone is sufficient.\n    if (body.length > MAX_CATALOG_BYTES) {\n      throw new Error(`catalog too large: ${body.length} bytes received`);\n    }\n    JSON.parse(body); // validate before persisting — never cache garbage\n    return body;\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return undefined;\n  }\n}\n\n/**\n * Persist the fetched body and patch it into the index.\n *\n * Two independent failures with two different consequences, which is why they are two try blocks\n * and not one: a cache write that fails costs the NEXT process a fetch and nothing more, so the run\n * continues; a patch that fails means this body never reached the index, so the index is whatever it\n * was and the result says `cache`.\n */\nfunction persistAndPatch(path: string, body: string): RefreshModelCatalogResult {\n  try {\n    writeCacheAtomic(path, body);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache write failed (${(err as Error).message})\\n`);\n  }\n  try {\n    return { source: \"network\", models: patchIndexFromApiJson(JSON.parse(body)) };\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev patch failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return { source: \"cache\", models: 0 };\n  }\n}\n\n/**\n * Explicitly refresh the model catalog from models.dev (the ONLY network trigger in the subsystem).\n * Fail-closed: any failure keeps serving the current index (cache or vendored). Kill-switch:\n * `THEOKIT_DISABLE_MODELS_FETCH`.\n *\n * The sequence carried a cognitive-complexity suppression whose reason said splitting it would\n * \"separate a step from the fallback it owns\". The four helpers above each KEEP their fallback: the\n * TTL gate owns \"no cache\", the fetch owns every network and validation failure, the persist owns\n * the write and the patch. What is left here is the order they run in, which is what this function\n * was always for.\n *\n * Still true, and NOT fixed by the split: three of the paths return `{ source: \"cache\" }`, so a\n * caller cannot tell a timeout from an unparseable body from a patch failure. Distinguishing them\n * means adding a field to the PUBLIC `RefreshModelCatalogResult`, which is a release decision rather\n * than a refactor. The `diag` line already names the cause for an operator.\n */\nexport async function refreshModelCatalog(\n  opts: RefreshModelCatalogOptions = {},\n): Promise<RefreshModelCatalogResult> {\n  // M44 M4 fix — self-initialize provider registration so the `@theokit/sdk/models` subpath works\n  // standalone (without the consumer having built an Agent first).\n  registerBuiltins();\n  if (fetchDisabledByEnv()) return { source: \"skipped\", models: 0 };\n\n  const url = opts.url ?? process.env.THEOKIT_MODELS_URL ?? DEFAULT_URL;\n  const path = cachePathFor(url);\n  const now = opts.deps?.now ?? (() => Date.now());\n\n  if (opts.force !== true) {\n    const cached = servedFromFreshCache(url, path, now);\n    if (cached !== undefined) return cached;\n  }\n\n  const body = await fetchCatalogBody(url, boundFetch(opts.deps?.fetch));\n  // fail-closed: serve whatever we already have (stale cache if present, else vendored)\n  if (body === undefined) return { source: \"cache\", models: loadCacheIntoIndex(url) };\n\n  return persistAndPatch(path, body);\n}\n\n/** The enriched per-model view (public via `@theokit/sdk/models`): index lookup by (possibly prefixed) id. */\nexport function getModelInfo(modelId: string): ReturnType<typeof getCatalogModelInfo> {\n  return getCatalogModelInfo(modelId);\n}\n"]}

package/dist/models.js

@@ -1,7 +1,8 @@
 import { Retry } from './chunk-7F7XE6CM.js';
+export { resolveModelCapabilities } from './chunk-LZJXEPEQ.js';
 import { parseModelId } from './chunk-R7WIIPUR.js';
 export { parseModelId } from './chunk-R7WIIPUR.js';
-import { getCatalogModelInfo, registerBuiltins, catalogModelSchema, patchModelInfo, getProviderProfile, loadProviderCatalog } from './chunk-SVCPJRUB.js';
+import { registerBuiltins, getCatalogModelInfo, catalogModelSchema, patchModelInfo, getProviderProfile, loadProviderCatalog } from './chunk-SVCPJRUB.js';
 import './chunk-AGACYRJ2.js';
 import './chunk-TX56N7FR.js';
 import './chunk-5Q4RTLMP.js';
@@ -14,55 +15,6 @@ import { statSync, readFileSync, unlinkSync, mkdirSync, writeFileSync, renameSyn
 import { homedir } from 'os';
 import { join, dirname } from 'path';
 
-// src/internal/llm/model-capabilities.ts
-var CONSERVATIVE_DEFAULTS = {
-  supportsVision: false,
-  supportsStructuredOutput: false,
-  supportsToolUse: false,
-  supportsCacheControl: false,
-  maxContextTokens: 4096,
-  maxOutputTokens: 4096
-};
-var ROUTING_PREFIXES = ["openrouter/", "vertex/", "bedrock/"];
-function capsFromCatalog(m) {
-  return {
-    supportsVision: m.modalities?.input?.includes("image") ?? m.attachment ?? false,
-    supportsStructuredOutput: m.structured_output ?? false,
-    supportsToolUse: m.tool_call ?? false,
-    supportsCacheControl: m.cache_control ?? false,
-    maxContextTokens: m.limit?.context ?? CONSERVATIVE_DEFAULTS.maxContextTokens,
-    maxOutputTokens: m.limit?.output ?? CONSERVATIVE_DEFAULTS.maxOutputTokens
-  };
-}
-function resolveModelCapabilities(modelId) {
-  const bare = stripVariantSuffix(stripRoutingPrefix(modelId));
-  const fromIndex = getCatalogModelInfo(bare);
-  if (fromIndex !== void 0) return capsFromCatalog(fromIndex);
-  const withVendor = inferVendorPrefix(bare);
-  if (withVendor !== bare) {
-    const vendored = getCatalogModelInfo(withVendor);
-    if (vendored !== void 0) return capsFromCatalog(vendored);
-  }
-  return CONSERVATIVE_DEFAULTS;
-}
-function stripRoutingPrefix(modelId) {
-  for (const prefix of ROUTING_PREFIXES) {
-    if (modelId.startsWith(prefix)) return modelId.slice(prefix.length);
-  }
-  return modelId;
-}
-function stripVariantSuffix(modelId) {
-  const i = modelId.indexOf(":");
-  return i >= 0 ? modelId.slice(0, i) : modelId;
-}
-function inferVendorPrefix(bare) {
-  if (bare.startsWith("claude")) return `anthropic/${bare}`;
-  if (bare.startsWith("gpt-") || bare.startsWith("o1") || bare.startsWith("o3"))
-    return `openai/${bare}`;
-  if (bare.startsWith("gemini")) return `google/${bare}`;
-  return bare;
-}
-
 // src/internal/llm/model-option.ts
 var ACRONYMS = /* @__PURE__ */ new Set(["gpt", "ai", "hd", "ui", "api", "sdk", "llm", "xl"]);
 function prettyToken(token) {
@@ -282,6 +234,6 @@ function getModelInfo(modelId) {
   return getCatalogModelInfo(modelId);
 }
 
-export { getModelInfo, humanizeModelName, refreshModelCatalog, resolveModelCapabilities, toModelOption };
+export { getModelInfo, humanizeModelName, refreshModelCatalog, toModelOption };
 //# sourceMappingURL=models.js.map
 //# sourceMappingURL=models.js.map

package/dist/models.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/llm/model-capabilities.ts","../src/internal/llm/model-option.ts","../src/internal/providers/catalog-source-models-dev.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAgCA,IAAM,qBAAA,GAA2C;AAAA,EAC/C,cAAA,EAAgB,KAAA;AAAA,EAChB,wBAAA,EAA0B,KAAA;AAAA,EAC1B,eAAA,EAAiB,KAAA;AAAA,EACjB,oBAAA,EAAsB,KAAA;AAAA,EACtB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAGA,IAAM,gBAAA,GAAmB,CAAC,aAAA,EAAe,SAAA,EAAW,UAAU,CAAA;AAM9D,SAAS,gBAAgB,CAAA,EAAoC;AAC3D,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,EAAE,UAAA,EAAY,KAAA,EAAO,SAAS,OAAO,CAAA,IAAK,EAAE,UAAA,IAAc,KAAA;AAAA,IAC1E,wBAAA,EAA0B,EAAE,iBAAA,IAAqB,KAAA;AAAA,IACjD,eAAA,EAAiB,EAAE,SAAA,IAAa,KAAA;AAAA,IAChC,oBAAA,EAAuB,EAAkC,aAAA,IAAiB,KAAA;AAAA,IAC1E,gBAAA,EAAkB,CAAA,CAAE,KAAA,EAAO,OAAA,IAAW,qBAAA,CAAsB,gBAAA;AAAA,IAC5D,eAAA,EAAiB,CAAA,CAAE,KAAA,EAAO,MAAA,IAAU,qBAAA,CAAsB;AAAA,GAC5D;AACF;AAWO,SAAS,yBAAyB,OAAA,EAAoC;AAC3E,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAG3D,EAAA,MAAM,SAAA,GAAY,oBAAoB,IAAI,CAAA;AAC1C,EAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAO,eAAA,CAAgB,SAAS,CAAA;AAG7D,EAAA,MAAM,UAAA,GAAa,kBAAkB,IAAI,CAAA;AACzC,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAM,QAAA,GAAW,oBAAoB,UAAU,CAAA;AAC/C,IAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,eAAA,CAAgB,QAAQ,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,qBAAA;AACT;AAEA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,KAAA,MAAW,UAAU,gBAAA,EAAkB;AACrC,IAAA,IAAI,OAAA,CAAQ,WAAW,MAAM,CAAA,SAAU,OAAA,CAAQ,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,OAAA;AACT;AAOA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,OAAO,KAAK,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,GAAI,OAAA;AACxC;AAGA,SAAS,kBAAkB,IAAA,EAAsB;AAC/C,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,aAAa,IAAI,CAAA,CAAA;AACvD,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,IAAK,IAAA,CAAK,WAAW,IAAI,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAC1E,IAAA,OAAO,UAAU,IAAI,CAAA,CAAA;AACvB,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,UAAU,IAAI,CAAA,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;;;ACzFA,IAAM,QAAA,mBAAW,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,IAAI,CAAC,CAAA;AAE7E,SAAS,YAAY,KAAA,EAAuB;AAC1C,EAAA,IAAI,QAAA,CAAS,IAAI,KAAA,CAAM,WAAA,EAAa,CAAA,EAAG,OAAO,MAAM,WAAA,EAAY;AAChE,EAAA,OAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,aAAY,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AACtD;AAeO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,YAAA,CAAa,OAAO,CAAA;AACrC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAU9B,EAAA,MAAM,IAAA,GAAO,oBAAoB,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,IAAI,CAAA;AACzE,EAAA,MAAM,UAAU,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,GAAI,EAAA;AACrD,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,MAAM,OAAO,SAAA,IAAa,CAAA,GAAI,KAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA,GAAI,IAAA;AAC1D,EAAA,MAAM,QAAQ,IAAA,CACX,KAAA,CAAM,UAAU,CAAA,CAChB,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,CAC1B,GAAA,CAAI,WAAW,CAAA,CACf,KAAK,GAAG,CAAA;AACX,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,QAAQ,MAAA,GAAS,CAAA,GAAI,GAAG,KAAK,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,CAAA,GAAM,KAAA;AACxD;AAUO,SAAS,cAAc,OAAA,EAA8B;AAC1D,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,OAAA;AAAA,IACP,KAAA,EAAO,kBAAkB,OAAO,CAAA;AAAA,IAChC,QAAA,EAAU,YAAA,CAAa,OAAO,CAAA,CAAE;AAAA,GAClC;AACF;AAEA,IAAM,UAAA,GAAa,EAAA;AAGnB,SAAS,oBAAoB,KAAA,EAAuB;AAClD,EAAA,IAAI,MAAM,KAAA,CAAM,MAAA;AAChB,EAAA,OAAO,MAAM,CAAA,IAAK,KAAA,CAAM,WAAW,GAAA,GAAM,CAAC,MAAM,UAAA,EAAY,GAAA,EAAA;AAC5D,EAAA,OAAO,QAAQ,KAAA,CAAM,MAAA,GAAS,QAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,GAAG,CAAA;AAC1D;AC7DA,IAAM,WAAA,GAAc,6BAAA;AAcpB,IAAM,iBAAA,GAAoB,KAAK,IAAA,GAAO,IAAA;AACtC,IAAM,MAAA,GAAS,KAAK,EAAA,GAAK,GAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AAuDlB,SAAS,aAAa,GAAA,EAAqB;AAEhD,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,YAAA,EAAc,MAAK,IAAK,IAAA,CAAK,OAAA,EAAQ,EAAG,UAAU,CAAA;AAC3E,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAM,OAAA,EAAS,YAAY,CAAA;AAC5C,EAAA,IAAI,GAAA,KAAQ,WAAA,EAAa,OAAO,IAAA,CAAK,KAAK,UAAU,CAAA;AACpD,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACvE,EAAA,OAAO,IAAA,CAAK,GAAA,EAAK,CAAA,IAAA,EAAO,IAAI,CAAA,KAAA,CAAO,CAAA;AACrC;AAGA,SAAS,gBAAA,CAAiB,MAAc,IAAA,EAAoB;AAC1D,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,GAAG,IAAI,CAAA,KAAA,EAAQ,YAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AACzD,EAAA,IAAI;AACF,IAAA,aAAA,CAAc,KAAK,IAAI,CAAA;AACvB,IAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAA,UAAA,CAAW,GAAG,CAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAQA,IAAM,iBAAA,GAA4C;AAAA,EAChD,MAAA,EAAQ,eAAA;AAAA,EACR,GAAA,EAAK,OAAA;AAAA,EACL,UAAA,EAAY,UAAA;AAAA,EACZ,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB,SAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAEA,IAAI,eAAA;AAEJ,SAAS,cAAA,GAAkD;AACzD,EAAA,IAAI,eAAA,KAAoB,QAAW,OAAO,eAAA;AAC1C,EAAA,eAAA,uBAAsB,GAAA,EAAI;AAC1B,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB,CAAA,EAAG;AACxD,MAAA,MAAM,IAAA,GAAO,CAAC,KAAA,CAAM,EAAA,EAAI,GAAI,KAAA,CAAM,OAAA,IAAW,EAAG,CAAA;AAChD,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,IAAI,CAAC,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,kBAAmB,GAAA,CAAI,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,eAAA;AACT;AAEA,SAAS,iBAAiB,UAAA,EAA0C;AAClE,EAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA;AAChD,EAAA,MAAM,WAAA,GAAc,cAAA,EAAe,CAAE,GAAA,CAAI,MAAM,CAAA;AAC/C,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,OAAO,WAAA,CAAY,IAAA;AAClD,EAAA,MAAM,OAAA,GAAU,mBAAmB,MAAM,CAAA;AACzC,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,OAAO,CAAC,OAAA,CAAQ,MAAM,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAG,CAAA;AAC3E,EAAA,OAAO,MAAA;AACT;AAQA,SAAS,sBAAsB,GAAA,EAAsB;AACnD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,CAAA;AACpD,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,CAAC,UAAA,EAAY,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,GAA8B,CAAA,EAAG;AACnF,IAAA,MAAM,SAAU,QAAA,EAAmD,MAAA;AACnE,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,OAAO,MAAA,KAAW,QAAA,EAAU;AAGxD,IAAA,MAAM,IAAA,GAAO,iBAAiB,UAAU,CAAA;AACxC,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,KAAK,UAAU,CAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACxD,MAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,SAAA,CAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAM,cAAA,CAAe,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA;AACvE,MAAA,OAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,IAAA;AAAA,MACE,CAAA,+CAAA,EAAkD,OAAA,CAAQ,MAAM,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA;AAAA,KAC9H;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,kBAAA,CAAmB,MAAc,WAAA,EAAqB;AACpE,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,YAAA,CAAa,MAAM,OAAO,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAGN,IAAA,IAAI;AACF,MAAA,UAAA,CAAW,IAAI,CAAA;AAAA,IACjB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,yDAAyD,IAAI,CAAA;AAAA,CAAK,CAAA;AACvE,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,sBAAsB,MAAM,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AACtF,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAQA,SAAS,kBAAA,GAA8B;AACrC,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,4BAAA;AACzB,EAAA,OAAO,IAAA,KAAS,UAAa,IAAA,KAAS,EAAA,IAAM,SAAS,GAAA,IAAO,IAAA,CAAK,aAAY,KAAM,OAAA;AACrF;AASA,SAAS,oBAAA,CACP,GAAA,EACA,IAAA,EACA,GAAA,EACuC;AACvC,EAAA,IAAI;AACF,IAAA,IAAI,KAAI,GAAI,QAAA,CAAS,IAAI,CAAA,CAAE,OAAA,IAAW,QAAQ,OAAO,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAC5D;AAWA,eAAe,gBAAA,CAAiB,KAAa,SAAA,EAAsD;AACjG,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA;AAAA,MACtB,YAAY;AACV,QAAA,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,gBAAgB,CAAA,EAAG,CAAA;AAChF,QAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,QAAA,OAAO,CAAA;AAAA,MACT,CAAA;AAAA;AAAA;AAAA,MAGA,EAAE,OAAA,EAAS,CAAA,EAAG,aAAa,MAAM,IAAA,EAAM,gBAAgB,GAAA;AAAI,KAC7D;AACA,IAAA,MAAM,cAAA,GAAiB,OAAO,GAAA,CAAI,OAAA,CAAQ,IAAI,gBAAgB,CAAA,IAAK,OAAO,GAAG,CAAA;AAC7E,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,cAAc,CAAA,IAAK,iBAAiB,iBAAA,EAAmB;AACzE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,cAAc,CAAA,eAAA,CAAiB,CAAA;AAAA,IACvE;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAI5B,IAAA,IAAI,IAAA,CAAK,SAAS,iBAAA,EAAmB;AACnC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAA,CAAK,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,IACpE;AACA,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AACf,IAAA,OAAO,IAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,CAAA,+CAAA,EAAmD,IAAc,OAAO,CAAA;AAAA;AAAA,KAC1E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAUA,SAAS,eAAA,CAAgB,MAAc,IAAA,EAAyC;AAC9E,EAAA,IAAI;AACF,IAAA,gBAAA,CAAiB,MAAM,IAAI,CAAA;AAAA,EAC7B,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AAAA,EACxF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAA,EAAQ,sBAAsB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,EAAE;AAAA,EAC9E,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,CAAA,6CAAA,EAAiD,IAAc,OAAO,CAAA;AAAA;AAAA,KACxE;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA,EAAE;AAAA,EACtC;AACF;AAkBA,eAAsB,mBAAA,CACpB,IAAA,GAAmC,EAAC,EACA;AAGpC,EAAA,gBAAA,EAAiB;AACjB,EAAA,IAAI,oBAAmB,EAAG,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA,EAAE;AAEhE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,IAAI,kBAAA,IAAsB,WAAA;AAC1D,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAM,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAE9C,EAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,GAAA,EAAK,IAAA,EAAM,GAAG,CAAA;AAClD,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAAA,EACnC;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,CAAiB,GAAA,EAAK,WAAW,IAAA,CAAK,IAAA,EAAM,KAAK,CAAC,CAAA;AAErE,EAAA,IAAI,IAAA,KAAS,QAAW,OAAO,EAAE,QAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAElF,EAAA,OAAO,eAAA,CAAgB,MAAM,IAAI,CAAA;AACnC;AAGO,SAAS,aAAa,OAAA,EAAyD;AACpF,EAAA,OAAO,oBAAoB,OAAO,CAAA;AACpC","file":"models.js","sourcesContent":["/**\n * T3.10c — Model capability registry (DR3 #17).\n *\n * Typed per-model flags that let the SDK gate features at the boundary\n * (before hitting the provider) instead of letting opaque 400s surface.\n *\n * Resolution algorithm:\n *   1. Strip routing prefixes (openrouter/, vertex/, bedrock/) AND the\n *      OpenRouter `:variant` suffix (:free/:nitro/…) to find the bare vendor id.\n *   2. Exact match in the `EXACT` catalog → return entry.\n *   3. Vendor inference (e.g., `claude-*` → `anthropic/claude-*`) → return entry.\n *   4. No match → conservative defaults (all false, minimum tokens).\n *\n * Module is internal, but `ModelCapabilities` + `resolveModelCapabilities` are\n * re-exported publicly via the `@theokit/sdk/models` subpath (see their @public tags).\n */\n\n/**\n * Per-model capability shape. Consumers use this to gate features at\n * the SDK boundary (before request construction, not after 400).\n *\n * @public\n */\nexport interface ModelCapabilities {\n  supportsVision: boolean;\n  supportsStructuredOutput: boolean;\n  supportsToolUse: boolean;\n  supportsCacheControl: boolean;\n  maxContextTokens: number;\n  maxOutputTokens: number;\n}\n\nconst CONSERVATIVE_DEFAULTS: ModelCapabilities = {\n  supportsVision: false,\n  supportsStructuredOutput: false,\n  supportsToolUse: false,\n  supportsCacheControl: false,\n  maxContextTokens: 4096,\n  maxOutputTokens: 4096,\n};\n\n/** Routing prefixes to strip to find the underlying vendor model. */\nconst ROUTING_PREFIXES = [\"openrouter/\", \"vertex/\", \"bedrock/\"] as const;\n\nimport { getCatalogModelInfo } from \"../providers/catalog-loader.js\";\nimport type { CatalogModel } from \"../providers/catalog-schema.js\";\n\n/** Map a catalog model block (models.dev shape) to the SDK's ModelCapabilities (M44 — catalog-backed). */\nfunction capsFromCatalog(m: CatalogModel): ModelCapabilities {\n  return {\n    supportsVision: m.modalities?.input?.includes(\"image\") ?? m.attachment ?? false,\n    supportsStructuredOutput: m.structured_output ?? false,\n    supportsToolUse: m.tool_call ?? false,\n    supportsCacheControl: (m as { cache_control?: boolean }).cache_control ?? false,\n    maxContextTokens: m.limit?.context ?? CONSERVATIVE_DEFAULTS.maxContextTokens,\n    maxOutputTokens: m.limit?.output ?? CONSERVATIVE_DEFAULTS.maxOutputTokens,\n  };\n}\n\n/**\n * Resolve per-model capability flags (vision/structured-output/tool-use/cache +\n * `maxContextTokens`/`maxOutputTokens`) for a model id. Pure, sync, offline (a\n * static catalog — no network). Strips routing prefixes (`openrouter/`/`vertex/`/\n * `bedrock/`) and OpenRouter `:variant` suffixes before lookup; unknown models get\n * conservative defaults. Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function resolveModelCapabilities(modelId: string): ModelCapabilities {\n  const bare = stripVariantSuffix(stripRoutingPrefix(modelId));\n  // M44 — the catalog model-info index replaced the hand-curated EXACT map (single source of truth; the\n  // vendored provider-catalog.json carries the migrated data — parity-tested against the old map snapshot).\n  const fromIndex = getCatalogModelInfo(bare);\n  if (fromIndex !== undefined) return capsFromCatalog(fromIndex);\n  // Routing-prefixed models (vertex/claude-3-5-sonnet) strip to bare\n  // model name without vendor. Try inferring the vendor from the name.\n  const withVendor = inferVendorPrefix(bare);\n  if (withVendor !== bare) {\n    const vendored = getCatalogModelInfo(withVendor);\n    if (vendored !== undefined) return capsFromCatalog(vendored);\n  }\n  return CONSERVATIVE_DEFAULTS;\n}\n\nfunction stripRoutingPrefix(modelId: string): string {\n  for (const prefix of ROUTING_PREFIXES) {\n    if (modelId.startsWith(prefix)) return modelId.slice(prefix.length);\n  }\n  return modelId;\n}\n\n/**\n * Strip an OpenRouter variant suffix (`:free`/`:nitro`/`:floor`/`:beta`/…) so the\n * catalog lookup hits the underlying model. Model slugs contain no `:` except the\n * variant separator, so cutting at the first `:` is safe.\n */\nfunction stripVariantSuffix(modelId: string): string {\n  const i = modelId.indexOf(\":\");\n  return i >= 0 ? modelId.slice(0, i) : modelId;\n}\n\n/** Infer vendor prefix from bare model name for routing-prefixed lookups. */\nfunction inferVendorPrefix(bare: string): string {\n  if (bare.startsWith(\"claude\")) return `anthropic/${bare}`;\n  if (bare.startsWith(\"gpt-\") || bare.startsWith(\"o1\") || bare.startsWith(\"o3\"))\n    return `openai/${bare}`;\n  if (bare.startsWith(\"gemini\")) return `google/${bare}`;\n  return bare;\n}\n","import { parseModelId } from \"./model-identifier.js\";\n\n/**\n * A UI-friendly model option — the shape a `<select>`/dropdown consumes.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport interface ModelOption {\n  /** The original model id (what you pass back to the SDK). */\n  value: string;\n  /** Best-effort human label (see {@link humanizeModelName}). */\n  label: string;\n  /** Provider from the slug prefix, or `undefined` when none. */\n  provider: string | undefined;\n}\n\n/** Tokens rendered upper-case rather than title-case. */\nconst ACRONYMS = new Set([\"gpt\", \"ai\", \"hd\", \"ui\", \"api\", \"sdk\", \"llm\", \"xl\"]);\n\nfunction prettyToken(token: string): string {\n  if (ACRONYMS.has(token.toLowerCase())) return token.toUpperCase();\n  return token.charAt(0).toUpperCase() + token.slice(1);\n}\n\n/**\n * Turn a model id into a best-effort human label: strip the routing/vendor\n * prefix to the core model segment, split on `-`/`_`/`.`/whitespace, title-case\n * each token (known acronyms upper-cased), and append an OpenRouter `:variant`\n * in parentheses. Deterministic, pure, dependency-free.\n *\n * Best-effort, NOT vendor-canonical: `\"anthropic/claude-3-5-sonnet\"` →\n * `\"Claude 3 5 Sonnet\"`. A UI wanting exact marketing names overrides per id.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function humanizeModelName(modelId: string): string {\n  const { name } = parseModelId(modelId);\n  if (name.length === 0) return \"\";\n  const colon = name.indexOf(\":\");\n  // Strip a trailing slash so a typo'd `gpt-4o/` keeps its name (not lost to an\n  // empty last segment).\n  //\n  // Done by index rather than with `/\\/+$/`, and the difference is not stylistic: that pattern\n  // consumes slashes to the end of the string at every start position and then backtracks\n  // looking for an end-anchor that is not there (CodeQL js/polynomial-redos #6). This function\n  // is `@public` and takes a caller-supplied model id. Measured on a run of slashes followed by\n  // one other character: 25_000 took 496 ms, 100_000 took 31_305 ms — half a minute of pinned\n  // CPU to render a label. Walking back from the end is linear and cannot backtrack.\n  const base = trimTrailingSlashes(colon >= 0 ? name.slice(0, colon) : name);\n  const variant = colon >= 0 ? name.slice(colon + 1) : \"\";\n  const lastSlash = base.lastIndexOf(\"/\");\n  const core = lastSlash >= 0 ? base.slice(lastSlash + 1) : base;\n  const label = core\n    .split(/[-_.\\s]+/)\n    .filter((t) => t.length > 0)\n    .map(prettyToken)\n    .join(\" \");\n  if (label.length === 0) return variant; // no base label (e.g. \":free\") → bare variant\n  return variant.length > 0 ? `${label} (${variant})` : label;\n}\n\n/**\n * Build a {@link ModelOption} (`{ value, label, provider }`) for a model id —\n * a dropdown-ready entry composing {@link humanizeModelName} + `parseModelId`.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function toModelOption(modelId: string): ModelOption {\n  return {\n    value: modelId,\n    label: humanizeModelName(modelId),\n    provider: parseModelId(modelId).provider,\n  };\n}\n\nconst SLASH_CODE = 47; // \"/\"\n\n/** Removes trailing `/` characters in one linear pass. See the call site for why not a regex. */\nfunction trimTrailingSlashes(value: string): string {\n  let end = value.length;\n  while (end > 0 && value.charCodeAt(end - 1) === SLASH_CODE) end--;\n  return end === value.length ? value : value.slice(0, end);\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { Retry } from \"../../retry.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { boundFetch } from \"../runtime-fetch.js\";\nimport { registerBuiltins } from \"./builtin/index.js\";\nimport { getCatalogModelInfo, loadProviderCatalog, patchModelInfo } from \"./catalog-loader.js\";\nimport { catalogModelSchema } from \"./catalog-schema.js\";\nimport { getProviderProfile } from \"./registry.js\";\n\n/**\n * M44 — the OPTIONAL models.dev catalog source. Explicit opt-in ONLY (`refreshModelCatalog()`): the SDK\n * NEVER fetches at startup or per-request — the vendored catalog + any existing disk cache are the offline\n * base, and every failure mode fails CLOSED back to them (ROADMAP constraint: no runtime hard network dep).\n *\n * The models.dev consumption mechanism:\n * disk cache with mtime TTL, atomic tempfile+rename write, corrupt-cache delete-and-fall-through, kill-switch\n * env. Library adaptations: NO background refresh loop (a consumer composes refresh with the SDK's cron);\n * TTL 1h (not 5min — no background refresher to keep it warm); no cross-process flock v1 (atomic rename +\n * idempotent upstream content — at most one wasted fetch).\n *\n * @internal (the public surface is `refreshModelCatalog` re-exported via `@theokit/sdk/models`)\n */\n\nconst DEFAULT_URL = \"https://models.dev/api.json\";\n\n/**\n * Ceiling on a fetched catalog, before it is parsed or written to the cache.\n *\n * The response body was read with `res.text()` and persisted with no bound, so a host serving a\n * multi-gigabyte document would have been materialised in memory and then written to disk. The\n * default URL is trusted, but `THEOKIT_MODELS_URL` lets an operator point this anywhere, and a\n * limit is the difference between \"we only fetch from a host we trust\" and \"we cannot be hurt by\n * one we do not\".\n *\n * 32 MiB is roughly 40x the real catalog (~800 KiB in 2026-08), so it bounds the failure without\n * being a number anyone has to tune when models.dev grows.\n */\nconst MAX_CATALOG_BYTES = 32 * 1024 * 1024;\nconst TTL_MS = 60 * 60 * 1000; // 1 hour\nconst FETCH_TIMEOUT_MS = 10_000;\n\n/**\n * Arguments to `refreshModelCatalog`, the SDK's only network trigger for model metadata.\n *\n * `url` wins over the `THEOKIT_MODELS_URL` environment variable, which in turn wins over\n * `https://models.dev/api.json`. A non-default URL gets its own cache file, named by a hash of\n * the URL, so switching sources never reads another source's cache.\n *\n * `force` skips only the freshness check — it does not skip the kill switch. When\n * `THEOKIT_DISABLE_MODELS_FETCH` is set to anything other than an empty string, `\"0\"` or\n * `\"false\"`, the call returns `source: \"skipped\"` with no fetch and no cache read, whatever\n * `force` says.\n *\n * Without `force`, a cache file whose mtime is under an hour old is served directly and no\n * request is made.\n *\n * `deps` exists so tests can drive the fetch and the clock; production leaves it unset.\n */\nexport interface RefreshModelCatalogOptions {\n  /** Override the source URL (`THEOKIT_MODELS_URL` env also honored). */\n  url?: string;\n  /** Bypass the TTL freshness gate. */\n  force?: boolean;\n  /** Injected for tests. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\n/**\n * What `refreshModelCatalog` did. It never throws on a failed refresh, so this is the only place\n * the outcome is reported.\n *\n * `source` is `\"network\"` only when a request succeeded, its body parsed as JSON, and the models\n * were patched in. Every failure path — kill switch aside — returns `\"cache\"`: an HTTP error\n * after retries, a timeout, an unparseable body, or a patch that threw. `\"cache\"` therefore means\n * \"serving what was already there\", which may be a fresh cache, a stale one, or nothing but the\n * vendored catalog. Read `models` to tell those apart. `\"skipped\"` means the kill switch was set.\n *\n * `models` counts the models patched into the index during this call, not the catalog's size. It\n * counts each model once even when the provider has aliases and the model is written under several\n * index keys, and it excludes models whose payload failed schema validation and models under\n * providers the SDK does not know. It is 0 whenever there was no cache to fall back on, and 0 for\n * `\"skipped\"`.\n *\n * A cache write that fails is logged and otherwise ignored: the result can still say `\"network\"`\n * with the data live in memory and nothing on disk.\n */\nexport interface RefreshModelCatalogResult {\n  /** Where the data came from: a fresh network fetch, the still-fresh disk cache, or skipped entirely. */\n  source: \"network\" | \"cache\" | \"skipped\";\n  /** How many models were patched into the index. */\n  models: number;\n}\n\n/** The cache file for a source URL (custom URLs get a hash-suffixed name). */\nexport function cachePathFor(url: string): string {\n  // M44 L8 fix — honor the SDK home override so tests and multi-home setups never touch the real ~/.theokit.\n  const base = process.env.THEOKIT_HOME?.trim() || join(homedir(), \".theokit\");\n  const dir = join(base, \"cache\", \"models-dev\");\n  if (url === DEFAULT_URL) return join(dir, \"api.json\");\n  const hash = createHash(\"sha256\").update(url).digest(\"hex\").slice(0, 12);\n  return join(dir, `api-${hash}.json`);\n}\n\n/** Atomic write: temp file + rename (crash mid-write never leaves a partial cache). */\nfunction writeCacheAtomic(path: string, body: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const tmp = `${path}.tmp-${randomBytes(6).toString(\"hex\")}`;\n  try {\n    writeFileSync(tmp, body);\n    renameSync(tmp, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmp);\n    } catch {\n      // best effort\n    }\n    throw err;\n  }\n}\n\n/**\n * M44 H3 fix — models.dev provider ids ≠ theokit ids (google↔google-gemini, zai↔zhipu, togetherai↔together,\n * fireworks-ai↔fireworks, amazon-bedrock↔bedrock, google-vertex↔vertex). The RUNTIME mapping mirrors the\n * maintenance script's table; targets resolve against the CATALOG entries (id + aliases — the same namespace\n * the vendored index uses) first, then the registry.\n */\nconst MODELS_DEV_ID_MAP: Record<string, string> = {\n  google: \"google-gemini\",\n  zai: \"zhipu\",\n  togetherai: \"together\",\n  \"fireworks-ai\": \"fireworks\",\n  \"amazon-bedrock\": \"bedrock\",\n  \"google-vertex\": \"vertex\",\n};\n\nlet _catalogTargets: Map<string, { keys: string[] }> | undefined;\n/** external-id → the index keys (entry id + aliases) its models patch under. Lazy; catalog-first. */\nfunction catalogTargets(): Map<string, { keys: string[] }> {\n  if (_catalogTargets !== undefined) return _catalogTargets;\n  _catalogTargets = new Map();\n  try {\n    for (const entry of Object.values(loadProviderCatalog())) {\n      const keys = [entry.id, ...(entry.aliases ?? [])];\n      for (const k of keys) {\n        if (!_catalogTargets.has(k)) _catalogTargets.set(k, { keys });\n      }\n    }\n  } catch {\n    // catalog unavailable — registry fallback below still works\n  }\n  return _catalogTargets;\n}\n\nfunction resolvePatchKeys(externalId: string): string[] | undefined {\n  const mapped = MODELS_DEV_ID_MAP[externalId] ?? externalId;\n  const fromCatalog = catalogTargets().get(mapped);\n  if (fromCatalog !== undefined) return fromCatalog.keys;\n  const profile = getProviderProfile(mapped);\n  if (profile !== undefined) return [profile.name, ...(profile.aliases ?? [])];\n  return undefined;\n}\n\n/** Parse + patch the index from an api.json payload. Unknown providers are skipped with WARN (once each). */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: validates and merges an UNTRUSTED upstream payload (models.dev api.json) shape by shape, dropping a single bad model rather than the file. Each branch is a distinct malformed input; merging them loses which one was seen.\nfunction patchIndexFromApiJson(raw: unknown): number {\n  if (typeof raw !== \"object\" || raw === null) return 0;\n  let patched = 0;\n  const skipped: string[] = [];\n  for (const [providerId, provider] of Object.entries(raw as Record<string, unknown>)) {\n    const models = (provider as { models?: Record<string, unknown> })?.models;\n    if (models === undefined || typeof models !== \"object\") continue;\n    // Enrich ONLY providers the SDK knows — models.dev's npm/api fields cannot be mapped to a theokit\n    // apiMode/authType safely, so unknown providers are data we cannot route.\n    const keys = resolvePatchKeys(providerId);\n    if (keys === undefined) {\n      skipped.push(providerId);\n      continue;\n    }\n    for (const [modelId, rawModel] of Object.entries(models)) {\n      const parsed = catalogModelSchema.safeParse(rawModel);\n      if (!parsed.success) continue; // malformed model — drop silently (live data, additive drift expected)\n      for (const key of keys) patchModelInfo(`${key}/${modelId}`, parsed.data);\n      patched++;\n    }\n  }\n  if (skipped.length > 0) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh skipped ${skipped.length} unknown provider(s) (e.g. ${skipped.slice(0, 3).join(\", \")})\\n`,\n    );\n  }\n  return patched;\n}\n\n/**\n * Load an existing disk cache into the index (called by refresh when fresh, or opportunistically by a\n * consumer at startup — NEVER fetches). Corrupt cache → delete + fall through to vendored data.\n */\nexport function loadCacheIntoIndex(url: string = DEFAULT_URL): number {\n  const path = cachePathFor(url);\n  let body: string;\n  try {\n    body = readFileSync(path, \"utf-8\");\n  } catch {\n    return 0; // no cache — vendored data only\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(body);\n  } catch {\n    // corrupt cache: delete and fall through to the vendored catalog.\n    // M44 L9 fix — only a PARSE failure is cache corruption; a patch error must never delete a valid cache.\n    try {\n      unlinkSync(path);\n    } catch {\n      // best effort\n    }\n    diag(`[theokit-sdk] WARN: corrupt models-dev cache deleted (${path})\\n`);\n    return 0;\n  }\n  try {\n    return patchIndexFromApiJson(parsed);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache patch failed (${(err as Error).message})\\n`);\n    return 0;\n  }\n}\n\n/**\n * The kill switch, read from the environment.\n *\n * Truthy-only by design (M44 L11): a presence check would treat `THEOKIT_DISABLE_MODELS_FETCH=0`\n * and `=false` as \"disabled\", which is the opposite of what anyone writing them means.\n */\nfunction fetchDisabledByEnv(): boolean {\n  const kill = process.env.THEOKIT_DISABLE_MODELS_FETCH;\n  return kill !== undefined && kill !== \"\" && kill !== \"0\" && kill.toLowerCase() !== \"false\";\n}\n\n/**\n * The TTL gate: a cache file younger than {@link TTL_MS} serves without touching the network.\n *\n * Returns `undefined` when there is no usable cache — including when `statSync` throws, which is\n * how \"no cache file\" arrives. That is the ONE failure this step owns, and its fallback is simply\n * to let the caller proceed to the fetch.\n */\nfunction servedFromFreshCache(\n  url: string,\n  path: string,\n  now: () => number,\n): RefreshModelCatalogResult | undefined {\n  try {\n    if (now() - statSync(path).mtimeMs >= TTL_MS) return undefined;\n  } catch {\n    return undefined; // no cache — proceed to fetch\n  }\n  return { source: \"cache\", models: loadCacheIntoIndex(url) };\n}\n\n/**\n * Fetch the catalog, bound its size, and prove it parses before anyone persists it.\n *\n * Returns `undefined` after logging when ANY of that fails — timeout, non-2xx, oversize, unparseable\n * body. The fallback this step owns is \"serve what we already have\", and the caller applies it.\n * Splitting the step from its fallback was the objection recorded in the suppression this replaces;\n * the fallback is not separated, it is named — `undefined` means \"this step could not produce a\n * body\", and there is exactly one thing to do about that.\n */\nasync function fetchCatalogBody(url: string, fetchImpl: typeof fetch): Promise<string | undefined> {\n  try {\n    const res = await Retry.run(\n      async () => {\n        const r = await fetchImpl(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });\n        if (!r.ok) throw new Error(`HTTP ${r.status}`);\n        return r;\n      },\n      // 2 transient retries with backoff; every error here is worth one more try —\n      // the whole call is already fail-closed at the caller.\n      { retries: 2, isRetryable: () => true, initialDelayMs: 200 },\n    );\n    const declaredLength = Number(res.headers.get(\"content-length\") ?? Number.NaN);\n    if (Number.isFinite(declaredLength) && declaredLength > MAX_CATALOG_BYTES) {\n      throw new Error(`catalog too large: ${declaredLength} bytes declared`);\n    }\n    const body = await res.text();\n    // Checked again after reading: `content-length` is the server's claim, and a server that\n    // omits it or lies about it is exactly the one worth bounding. Both checks are cheap and\n    // neither alone is sufficient.\n    if (body.length > MAX_CATALOG_BYTES) {\n      throw new Error(`catalog too large: ${body.length} bytes received`);\n    }\n    JSON.parse(body); // validate before persisting — never cache garbage\n    return body;\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return undefined;\n  }\n}\n\n/**\n * Persist the fetched body and patch it into the index.\n *\n * Two independent failures with two different consequences, which is why they are two try blocks\n * and not one: a cache write that fails costs the NEXT process a fetch and nothing more, so the run\n * continues; a patch that fails means this body never reached the index, so the index is whatever it\n * was and the result says `cache`.\n */\nfunction persistAndPatch(path: string, body: string): RefreshModelCatalogResult {\n  try {\n    writeCacheAtomic(path, body);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache write failed (${(err as Error).message})\\n`);\n  }\n  try {\n    return { source: \"network\", models: patchIndexFromApiJson(JSON.parse(body)) };\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev patch failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return { source: \"cache\", models: 0 };\n  }\n}\n\n/**\n * Explicitly refresh the model catalog from models.dev (the ONLY network trigger in the subsystem).\n * Fail-closed: any failure keeps serving the current index (cache or vendored). Kill-switch:\n * `THEOKIT_DISABLE_MODELS_FETCH`.\n *\n * The sequence carried a cognitive-complexity suppression whose reason said splitting it would\n * \"separate a step from the fallback it owns\". The four helpers above each KEEP their fallback: the\n * TTL gate owns \"no cache\", the fetch owns every network and validation failure, the persist owns\n * the write and the patch. What is left here is the order they run in, which is what this function\n * was always for.\n *\n * Still true, and NOT fixed by the split: three of the paths return `{ source: \"cache\" }`, so a\n * caller cannot tell a timeout from an unparseable body from a patch failure. Distinguishing them\n * means adding a field to the PUBLIC `RefreshModelCatalogResult`, which is a release decision rather\n * than a refactor. The `diag` line already names the cause for an operator.\n */\nexport async function refreshModelCatalog(\n  opts: RefreshModelCatalogOptions = {},\n): Promise<RefreshModelCatalogResult> {\n  // M44 M4 fix — self-initialize provider registration so the `@theokit/sdk/models` subpath works\n  // standalone (without the consumer having built an Agent first).\n  registerBuiltins();\n  if (fetchDisabledByEnv()) return { source: \"skipped\", models: 0 };\n\n  const url = opts.url ?? process.env.THEOKIT_MODELS_URL ?? DEFAULT_URL;\n  const path = cachePathFor(url);\n  const now = opts.deps?.now ?? (() => Date.now());\n\n  if (opts.force !== true) {\n    const cached = servedFromFreshCache(url, path, now);\n    if (cached !== undefined) return cached;\n  }\n\n  const body = await fetchCatalogBody(url, boundFetch(opts.deps?.fetch));\n  // fail-closed: serve whatever we already have (stale cache if present, else vendored)\n  if (body === undefined) return { source: \"cache\", models: loadCacheIntoIndex(url) };\n\n  return persistAndPatch(path, body);\n}\n\n/** The enriched per-model view (public via `@theokit/sdk/models`): index lookup by (possibly prefixed) id. */\nexport function getModelInfo(modelId: string): ReturnType<typeof getCatalogModelInfo> {\n  return getCatalogModelInfo(modelId);\n}\n"]}
+{"version":3,"sources":["../src/internal/llm/model-option.ts","../src/internal/providers/catalog-source-models-dev.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,IAAM,QAAA,mBAAW,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,IAAI,CAAC,CAAA;AAE7E,SAAS,YAAY,KAAA,EAAuB;AAC1C,EAAA,IAAI,QAAA,CAAS,IAAI,KAAA,CAAM,WAAA,EAAa,CAAA,EAAG,OAAO,MAAM,WAAA,EAAY;AAChE,EAAA,OAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,aAAY,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AACtD;AAeO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,YAAA,CAAa,OAAO,CAAA;AACrC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAU9B,EAAA,MAAM,IAAA,GAAO,oBAAoB,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,IAAI,CAAA;AACzE,EAAA,MAAM,UAAU,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,GAAI,EAAA;AACrD,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,MAAM,OAAO,SAAA,IAAa,CAAA,GAAI,KAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA,GAAI,IAAA;AAC1D,EAAA,MAAM,QAAQ,IAAA,CACX,KAAA,CAAM,UAAU,CAAA,CAChB,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,CAC1B,GAAA,CAAI,WAAW,CAAA,CACf,KAAK,GAAG,CAAA;AACX,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,QAAQ,MAAA,GAAS,CAAA,GAAI,GAAG,KAAK,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,CAAA,GAAM,KAAA;AACxD;AAUO,SAAS,cAAc,OAAA,EAA8B;AAC1D,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,OAAA;AAAA,IACP,KAAA,EAAO,kBAAkB,OAAO,CAAA;AAAA,IAChC,QAAA,EAAU,YAAA,CAAa,OAAO,CAAA,CAAE;AAAA,GAClC;AACF;AAEA,IAAM,UAAA,GAAa,EAAA;AAGnB,SAAS,oBAAoB,KAAA,EAAuB;AAClD,EAAA,IAAI,MAAM,KAAA,CAAM,MAAA;AAChB,EAAA,OAAO,MAAM,CAAA,IAAK,KAAA,CAAM,WAAW,GAAA,GAAM,CAAC,MAAM,UAAA,EAAY,GAAA,EAAA;AAC5D,EAAA,OAAO,QAAQ,KAAA,CAAM,MAAA,GAAS,QAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,GAAG,CAAA;AAC1D;AC7DA,IAAM,WAAA,GAAc,6BAAA;AAcpB,IAAM,iBAAA,GAAoB,KAAK,IAAA,GAAO,IAAA;AACtC,IAAM,MAAA,GAAS,KAAK,EAAA,GAAK,GAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AAuDlB,SAAS,aAAa,GAAA,EAAqB;AAEhD,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,YAAA,EAAc,MAAK,IAAK,IAAA,CAAK,OAAA,EAAQ,EAAG,UAAU,CAAA;AAC3E,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,EAAM,OAAA,EAAS,YAAY,CAAA;AAC5C,EAAA,IAAI,GAAA,KAAQ,WAAA,EAAa,OAAO,IAAA,CAAK,KAAK,UAAU,CAAA;AACpD,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACvE,EAAA,OAAO,IAAA,CAAK,GAAA,EAAK,CAAA,IAAA,EAAO,IAAI,CAAA,KAAA,CAAO,CAAA;AACrC;AAGA,SAAS,gBAAA,CAAiB,MAAc,IAAA,EAAoB;AAC1D,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,GAAG,IAAI,CAAA,KAAA,EAAQ,YAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AACzD,EAAA,IAAI;AACF,IAAA,aAAA,CAAc,KAAK,IAAI,CAAA;AACvB,IAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAA,UAAA,CAAW,GAAG,CAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAQA,IAAM,iBAAA,GAA4C;AAAA,EAChD,MAAA,EAAQ,eAAA;AAAA,EACR,GAAA,EAAK,OAAA;AAAA,EACL,UAAA,EAAY,UAAA;AAAA,EACZ,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB,SAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAEA,IAAI,eAAA;AAEJ,SAAS,cAAA,GAAkD;AACzD,EAAA,IAAI,eAAA,KAAoB,QAAW,OAAO,eAAA;AAC1C,EAAA,eAAA,uBAAsB,GAAA,EAAI;AAC1B,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB,CAAA,EAAG;AACxD,MAAA,MAAM,IAAA,GAAO,CAAC,KAAA,CAAM,EAAA,EAAI,GAAI,KAAA,CAAM,OAAA,IAAW,EAAG,CAAA;AAChD,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,IAAI,CAAC,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,kBAAmB,GAAA,CAAI,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,eAAA;AACT;AAEA,SAAS,iBAAiB,UAAA,EAA0C;AAClE,EAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA;AAChD,EAAA,MAAM,WAAA,GAAc,cAAA,EAAe,CAAE,GAAA,CAAI,MAAM,CAAA;AAC/C,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,OAAO,WAAA,CAAY,IAAA;AAClD,EAAA,MAAM,OAAA,GAAU,mBAAmB,MAAM,CAAA;AACzC,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,OAAO,CAAC,OAAA,CAAQ,MAAM,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAG,CAAA;AAC3E,EAAA,OAAO,MAAA;AACT;AAQA,SAAS,sBAAsB,GAAA,EAAsB;AACnD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,CAAA;AACpD,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,CAAC,UAAA,EAAY,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,GAA8B,CAAA,EAAG;AACnF,IAAA,MAAM,SAAU,QAAA,EAAmD,MAAA;AACnE,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,OAAO,MAAA,KAAW,QAAA,EAAU;AAGxD,IAAA,MAAM,IAAA,GAAO,iBAAiB,UAAU,CAAA;AACxC,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,KAAK,UAAU,CAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACxD,MAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,SAAA,CAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAM,cAAA,CAAe,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA;AACvE,MAAA,OAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,IAAA;AAAA,MACE,CAAA,+CAAA,EAAkD,OAAA,CAAQ,MAAM,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA;AAAA,KAC9H;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,kBAAA,CAAmB,MAAc,WAAA,EAAqB;AACpE,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,YAAA,CAAa,MAAM,OAAO,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAGN,IAAA,IAAI;AACF,MAAA,UAAA,CAAW,IAAI,CAAA;AAAA,IACjB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,yDAAyD,IAAI,CAAA;AAAA,CAAK,CAAA;AACvE,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,sBAAsB,MAAM,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AACtF,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAQA,SAAS,kBAAA,GAA8B;AACrC,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,4BAAA;AACzB,EAAA,OAAO,IAAA,KAAS,UAAa,IAAA,KAAS,EAAA,IAAM,SAAS,GAAA,IAAO,IAAA,CAAK,aAAY,KAAM,OAAA;AACrF;AASA,SAAS,oBAAA,CACP,GAAA,EACA,IAAA,EACA,GAAA,EACuC;AACvC,EAAA,IAAI;AACF,IAAA,IAAI,KAAI,GAAI,QAAA,CAAS,IAAI,CAAA,CAAE,OAAA,IAAW,QAAQ,OAAO,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAC5D;AAWA,eAAe,gBAAA,CAAiB,KAAa,SAAA,EAAsD;AACjG,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA;AAAA,MACtB,YAAY;AACV,QAAA,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,gBAAgB,CAAA,EAAG,CAAA;AAChF,QAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,QAAA,OAAO,CAAA;AAAA,MACT,CAAA;AAAA;AAAA;AAAA,MAGA,EAAE,OAAA,EAAS,CAAA,EAAG,aAAa,MAAM,IAAA,EAAM,gBAAgB,GAAA;AAAI,KAC7D;AACA,IAAA,MAAM,cAAA,GAAiB,OAAO,GAAA,CAAI,OAAA,CAAQ,IAAI,gBAAgB,CAAA,IAAK,OAAO,GAAG,CAAA;AAC7E,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,cAAc,CAAA,IAAK,iBAAiB,iBAAA,EAAmB;AACzE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,cAAc,CAAA,eAAA,CAAiB,CAAA;AAAA,IACvE;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAI5B,IAAA,IAAI,IAAA,CAAK,SAAS,iBAAA,EAAmB;AACnC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAA,CAAK,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,IACpE;AACA,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AACf,IAAA,OAAO,IAAA;AAAA,EACT,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,CAAA,+CAAA,EAAmD,IAAc,OAAO,CAAA;AAAA;AAAA,KAC1E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAUA,SAAS,eAAA,CAAgB,MAAc,IAAA,EAAyC;AAC9E,EAAA,IAAI;AACF,IAAA,gBAAA,CAAiB,MAAM,IAAI,CAAA;AAAA,EAC7B,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AAAA,EACxF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAA,EAAQ,sBAAsB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,EAAE;AAAA,EAC9E,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,CAAA,6CAAA,EAAiD,IAAc,OAAO,CAAA;AAAA;AAAA,KACxE;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA,EAAE;AAAA,EACtC;AACF;AAkBA,eAAsB,mBAAA,CACpB,IAAA,GAAmC,EAAC,EACA;AAGpC,EAAA,gBAAA,EAAiB;AACjB,EAAA,IAAI,oBAAmB,EAAG,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA,EAAE;AAEhE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,IAAI,kBAAA,IAAsB,WAAA;AAC1D,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAM,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAE9C,EAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,IAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,GAAA,EAAK,IAAA,EAAM,GAAG,CAAA;AAClD,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAAA,EACnC;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,CAAiB,GAAA,EAAK,WAAW,IAAA,CAAK,IAAA,EAAM,KAAK,CAAC,CAAA;AAErE,EAAA,IAAI,IAAA,KAAS,QAAW,OAAO,EAAE,QAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAElF,EAAA,OAAO,eAAA,CAAgB,MAAM,IAAI,CAAA;AACnC;AAGO,SAAS,aAAa,OAAA,EAAyD;AACpF,EAAA,OAAO,oBAAoB,OAAO,CAAA;AACpC","file":"models.js","sourcesContent":["import { parseModelId } from \"./model-identifier.js\";\n\n/**\n * A UI-friendly model option — the shape a `<select>`/dropdown consumes.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport interface ModelOption {\n  /** The original model id (what you pass back to the SDK). */\n  value: string;\n  /** Best-effort human label (see {@link humanizeModelName}). */\n  label: string;\n  /** Provider from the slug prefix, or `undefined` when none. */\n  provider: string | undefined;\n}\n\n/** Tokens rendered upper-case rather than title-case. */\nconst ACRONYMS = new Set([\"gpt\", \"ai\", \"hd\", \"ui\", \"api\", \"sdk\", \"llm\", \"xl\"]);\n\nfunction prettyToken(token: string): string {\n  if (ACRONYMS.has(token.toLowerCase())) return token.toUpperCase();\n  return token.charAt(0).toUpperCase() + token.slice(1);\n}\n\n/**\n * Turn a model id into a best-effort human label: strip the routing/vendor\n * prefix to the core model segment, split on `-`/`_`/`.`/whitespace, title-case\n * each token (known acronyms upper-cased), and append an OpenRouter `:variant`\n * in parentheses. Deterministic, pure, dependency-free.\n *\n * Best-effort, NOT vendor-canonical: `\"anthropic/claude-3-5-sonnet\"` →\n * `\"Claude 3 5 Sonnet\"`. A UI wanting exact marketing names overrides per id.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function humanizeModelName(modelId: string): string {\n  const { name } = parseModelId(modelId);\n  if (name.length === 0) return \"\";\n  const colon = name.indexOf(\":\");\n  // Strip a trailing slash so a typo'd `gpt-4o/` keeps its name (not lost to an\n  // empty last segment).\n  //\n  // Done by index rather than with `/\\/+$/`, and the difference is not stylistic: that pattern\n  // consumes slashes to the end of the string at every start position and then backtracks\n  // looking for an end-anchor that is not there (CodeQL js/polynomial-redos #6). This function\n  // is `@public` and takes a caller-supplied model id. Measured on a run of slashes followed by\n  // one other character: 25_000 took 496 ms, 100_000 took 31_305 ms — half a minute of pinned\n  // CPU to render a label. Walking back from the end is linear and cannot backtrack.\n  const base = trimTrailingSlashes(colon >= 0 ? name.slice(0, colon) : name);\n  const variant = colon >= 0 ? name.slice(colon + 1) : \"\";\n  const lastSlash = base.lastIndexOf(\"/\");\n  const core = lastSlash >= 0 ? base.slice(lastSlash + 1) : base;\n  const label = core\n    .split(/[-_.\\s]+/)\n    .filter((t) => t.length > 0)\n    .map(prettyToken)\n    .join(\" \");\n  if (label.length === 0) return variant; // no base label (e.g. \":free\") → bare variant\n  return variant.length > 0 ? `${label} (${variant})` : label;\n}\n\n/**\n * Build a {@link ModelOption} (`{ value, label, provider }`) for a model id —\n * a dropdown-ready entry composing {@link humanizeModelName} + `parseModelId`.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function toModelOption(modelId: string): ModelOption {\n  return {\n    value: modelId,\n    label: humanizeModelName(modelId),\n    provider: parseModelId(modelId).provider,\n  };\n}\n\nconst SLASH_CODE = 47; // \"/\"\n\n/** Removes trailing `/` characters in one linear pass. See the call site for why not a regex. */\nfunction trimTrailingSlashes(value: string): string {\n  let end = value.length;\n  while (end > 0 && value.charCodeAt(end - 1) === SLASH_CODE) end--;\n  return end === value.length ? value : value.slice(0, end);\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { Retry } from \"../../retry.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { boundFetch } from \"../runtime-fetch.js\";\nimport { registerBuiltins } from \"./builtin/index.js\";\nimport { getCatalogModelInfo, loadProviderCatalog, patchModelInfo } from \"./catalog-loader.js\";\nimport { catalogModelSchema } from \"./catalog-schema.js\";\nimport { getProviderProfile } from \"./registry.js\";\n\n/**\n * M44 — the OPTIONAL models.dev catalog source. Explicit opt-in ONLY (`refreshModelCatalog()`): the SDK\n * NEVER fetches at startup or per-request — the vendored catalog + any existing disk cache are the offline\n * base, and every failure mode fails CLOSED back to them (ROADMAP constraint: no runtime hard network dep).\n *\n * The models.dev consumption mechanism:\n * disk cache with mtime TTL, atomic tempfile+rename write, corrupt-cache delete-and-fall-through, kill-switch\n * env. Library adaptations: NO background refresh loop (a consumer composes refresh with the SDK's cron);\n * TTL 1h (not 5min — no background refresher to keep it warm); no cross-process flock v1 (atomic rename +\n * idempotent upstream content — at most one wasted fetch).\n *\n * @internal (the public surface is `refreshModelCatalog` re-exported via `@theokit/sdk/models`)\n */\n\nconst DEFAULT_URL = \"https://models.dev/api.json\";\n\n/**\n * Ceiling on a fetched catalog, before it is parsed or written to the cache.\n *\n * The response body was read with `res.text()` and persisted with no bound, so a host serving a\n * multi-gigabyte document would have been materialised in memory and then written to disk. The\n * default URL is trusted, but `THEOKIT_MODELS_URL` lets an operator point this anywhere, and a\n * limit is the difference between \"we only fetch from a host we trust\" and \"we cannot be hurt by\n * one we do not\".\n *\n * 32 MiB is roughly 40x the real catalog (~800 KiB in 2026-08), so it bounds the failure without\n * being a number anyone has to tune when models.dev grows.\n */\nconst MAX_CATALOG_BYTES = 32 * 1024 * 1024;\nconst TTL_MS = 60 * 60 * 1000; // 1 hour\nconst FETCH_TIMEOUT_MS = 10_000;\n\n/**\n * Arguments to `refreshModelCatalog`, the SDK's only network trigger for model metadata.\n *\n * `url` wins over the `THEOKIT_MODELS_URL` environment variable, which in turn wins over\n * `https://models.dev/api.json`. A non-default URL gets its own cache file, named by a hash of\n * the URL, so switching sources never reads another source's cache.\n *\n * `force` skips only the freshness check — it does not skip the kill switch. When\n * `THEOKIT_DISABLE_MODELS_FETCH` is set to anything other than an empty string, `\"0\"` or\n * `\"false\"`, the call returns `source: \"skipped\"` with no fetch and no cache read, whatever\n * `force` says.\n *\n * Without `force`, a cache file whose mtime is under an hour old is served directly and no\n * request is made.\n *\n * `deps` exists so tests can drive the fetch and the clock; production leaves it unset.\n */\nexport interface RefreshModelCatalogOptions {\n  /** Override the source URL (`THEOKIT_MODELS_URL` env also honored). */\n  url?: string;\n  /** Bypass the TTL freshness gate. */\n  force?: boolean;\n  /** Injected for tests. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\n/**\n * What `refreshModelCatalog` did. It never throws on a failed refresh, so this is the only place\n * the outcome is reported.\n *\n * `source` is `\"network\"` only when a request succeeded, its body parsed as JSON, and the models\n * were patched in. Every failure path — kill switch aside — returns `\"cache\"`: an HTTP error\n * after retries, a timeout, an unparseable body, or a patch that threw. `\"cache\"` therefore means\n * \"serving what was already there\", which may be a fresh cache, a stale one, or nothing but the\n * vendored catalog. Read `models` to tell those apart. `\"skipped\"` means the kill switch was set.\n *\n * `models` counts the models patched into the index during this call, not the catalog's size. It\n * counts each model once even when the provider has aliases and the model is written under several\n * index keys, and it excludes models whose payload failed schema validation and models under\n * providers the SDK does not know. It is 0 whenever there was no cache to fall back on, and 0 for\n * `\"skipped\"`.\n *\n * A cache write that fails is logged and otherwise ignored: the result can still say `\"network\"`\n * with the data live in memory and nothing on disk.\n */\nexport interface RefreshModelCatalogResult {\n  /** Where the data came from: a fresh network fetch, the still-fresh disk cache, or skipped entirely. */\n  source: \"network\" | \"cache\" | \"skipped\";\n  /** How many models were patched into the index. */\n  models: number;\n}\n\n/** The cache file for a source URL (custom URLs get a hash-suffixed name). */\nexport function cachePathFor(url: string): string {\n  // M44 L8 fix — honor the SDK home override so tests and multi-home setups never touch the real ~/.theokit.\n  const base = process.env.THEOKIT_HOME?.trim() || join(homedir(), \".theokit\");\n  const dir = join(base, \"cache\", \"models-dev\");\n  if (url === DEFAULT_URL) return join(dir, \"api.json\");\n  const hash = createHash(\"sha256\").update(url).digest(\"hex\").slice(0, 12);\n  return join(dir, `api-${hash}.json`);\n}\n\n/** Atomic write: temp file + rename (crash mid-write never leaves a partial cache). */\nfunction writeCacheAtomic(path: string, body: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const tmp = `${path}.tmp-${randomBytes(6).toString(\"hex\")}`;\n  try {\n    writeFileSync(tmp, body);\n    renameSync(tmp, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmp);\n    } catch {\n      // best effort\n    }\n    throw err;\n  }\n}\n\n/**\n * M44 H3 fix — models.dev provider ids ≠ theokit ids (google↔google-gemini, zai↔zhipu, togetherai↔together,\n * fireworks-ai↔fireworks, amazon-bedrock↔bedrock, google-vertex↔vertex). The RUNTIME mapping mirrors the\n * maintenance script's table; targets resolve against the CATALOG entries (id + aliases — the same namespace\n * the vendored index uses) first, then the registry.\n */\nconst MODELS_DEV_ID_MAP: Record<string, string> = {\n  google: \"google-gemini\",\n  zai: \"zhipu\",\n  togetherai: \"together\",\n  \"fireworks-ai\": \"fireworks\",\n  \"amazon-bedrock\": \"bedrock\",\n  \"google-vertex\": \"vertex\",\n};\n\nlet _catalogTargets: Map<string, { keys: string[] }> | undefined;\n/** external-id → the index keys (entry id + aliases) its models patch under. Lazy; catalog-first. */\nfunction catalogTargets(): Map<string, { keys: string[] }> {\n  if (_catalogTargets !== undefined) return _catalogTargets;\n  _catalogTargets = new Map();\n  try {\n    for (const entry of Object.values(loadProviderCatalog())) {\n      const keys = [entry.id, ...(entry.aliases ?? [])];\n      for (const k of keys) {\n        if (!_catalogTargets.has(k)) _catalogTargets.set(k, { keys });\n      }\n    }\n  } catch {\n    // catalog unavailable — registry fallback below still works\n  }\n  return _catalogTargets;\n}\n\nfunction resolvePatchKeys(externalId: string): string[] | undefined {\n  const mapped = MODELS_DEV_ID_MAP[externalId] ?? externalId;\n  const fromCatalog = catalogTargets().get(mapped);\n  if (fromCatalog !== undefined) return fromCatalog.keys;\n  const profile = getProviderProfile(mapped);\n  if (profile !== undefined) return [profile.name, ...(profile.aliases ?? [])];\n  return undefined;\n}\n\n/** Parse + patch the index from an api.json payload. Unknown providers are skipped with WARN (once each). */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: validates and merges an UNTRUSTED upstream payload (models.dev api.json) shape by shape, dropping a single bad model rather than the file. Each branch is a distinct malformed input; merging them loses which one was seen.\nfunction patchIndexFromApiJson(raw: unknown): number {\n  if (typeof raw !== \"object\" || raw === null) return 0;\n  let patched = 0;\n  const skipped: string[] = [];\n  for (const [providerId, provider] of Object.entries(raw as Record<string, unknown>)) {\n    const models = (provider as { models?: Record<string, unknown> })?.models;\n    if (models === undefined || typeof models !== \"object\") continue;\n    // Enrich ONLY providers the SDK knows — models.dev's npm/api fields cannot be mapped to a theokit\n    // apiMode/authType safely, so unknown providers are data we cannot route.\n    const keys = resolvePatchKeys(providerId);\n    if (keys === undefined) {\n      skipped.push(providerId);\n      continue;\n    }\n    for (const [modelId, rawModel] of Object.entries(models)) {\n      const parsed = catalogModelSchema.safeParse(rawModel);\n      if (!parsed.success) continue; // malformed model — drop silently (live data, additive drift expected)\n      for (const key of keys) patchModelInfo(`${key}/${modelId}`, parsed.data);\n      patched++;\n    }\n  }\n  if (skipped.length > 0) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh skipped ${skipped.length} unknown provider(s) (e.g. ${skipped.slice(0, 3).join(\", \")})\\n`,\n    );\n  }\n  return patched;\n}\n\n/**\n * Load an existing disk cache into the index (called by refresh when fresh, or opportunistically by a\n * consumer at startup — NEVER fetches). Corrupt cache → delete + fall through to vendored data.\n */\nexport function loadCacheIntoIndex(url: string = DEFAULT_URL): number {\n  const path = cachePathFor(url);\n  let body: string;\n  try {\n    body = readFileSync(path, \"utf-8\");\n  } catch {\n    return 0; // no cache — vendored data only\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(body);\n  } catch {\n    // corrupt cache: delete and fall through to the vendored catalog.\n    // M44 L9 fix — only a PARSE failure is cache corruption; a patch error must never delete a valid cache.\n    try {\n      unlinkSync(path);\n    } catch {\n      // best effort\n    }\n    diag(`[theokit-sdk] WARN: corrupt models-dev cache deleted (${path})\\n`);\n    return 0;\n  }\n  try {\n    return patchIndexFromApiJson(parsed);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache patch failed (${(err as Error).message})\\n`);\n    return 0;\n  }\n}\n\n/**\n * The kill switch, read from the environment.\n *\n * Truthy-only by design (M44 L11): a presence check would treat `THEOKIT_DISABLE_MODELS_FETCH=0`\n * and `=false` as \"disabled\", which is the opposite of what anyone writing them means.\n */\nfunction fetchDisabledByEnv(): boolean {\n  const kill = process.env.THEOKIT_DISABLE_MODELS_FETCH;\n  return kill !== undefined && kill !== \"\" && kill !== \"0\" && kill.toLowerCase() !== \"false\";\n}\n\n/**\n * The TTL gate: a cache file younger than {@link TTL_MS} serves without touching the network.\n *\n * Returns `undefined` when there is no usable cache — including when `statSync` throws, which is\n * how \"no cache file\" arrives. That is the ONE failure this step owns, and its fallback is simply\n * to let the caller proceed to the fetch.\n */\nfunction servedFromFreshCache(\n  url: string,\n  path: string,\n  now: () => number,\n): RefreshModelCatalogResult | undefined {\n  try {\n    if (now() - statSync(path).mtimeMs >= TTL_MS) return undefined;\n  } catch {\n    return undefined; // no cache — proceed to fetch\n  }\n  return { source: \"cache\", models: loadCacheIntoIndex(url) };\n}\n\n/**\n * Fetch the catalog, bound its size, and prove it parses before anyone persists it.\n *\n * Returns `undefined` after logging when ANY of that fails — timeout, non-2xx, oversize, unparseable\n * body. The fallback this step owns is \"serve what we already have\", and the caller applies it.\n * Splitting the step from its fallback was the objection recorded in the suppression this replaces;\n * the fallback is not separated, it is named — `undefined` means \"this step could not produce a\n * body\", and there is exactly one thing to do about that.\n */\nasync function fetchCatalogBody(url: string, fetchImpl: typeof fetch): Promise<string | undefined> {\n  try {\n    const res = await Retry.run(\n      async () => {\n        const r = await fetchImpl(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });\n        if (!r.ok) throw new Error(`HTTP ${r.status}`);\n        return r;\n      },\n      // 2 transient retries with backoff; every error here is worth one more try —\n      // the whole call is already fail-closed at the caller.\n      { retries: 2, isRetryable: () => true, initialDelayMs: 200 },\n    );\n    const declaredLength = Number(res.headers.get(\"content-length\") ?? Number.NaN);\n    if (Number.isFinite(declaredLength) && declaredLength > MAX_CATALOG_BYTES) {\n      throw new Error(`catalog too large: ${declaredLength} bytes declared`);\n    }\n    const body = await res.text();\n    // Checked again after reading: `content-length` is the server's claim, and a server that\n    // omits it or lies about it is exactly the one worth bounding. Both checks are cheap and\n    // neither alone is sufficient.\n    if (body.length > MAX_CATALOG_BYTES) {\n      throw new Error(`catalog too large: ${body.length} bytes received`);\n    }\n    JSON.parse(body); // validate before persisting — never cache garbage\n    return body;\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return undefined;\n  }\n}\n\n/**\n * Persist the fetched body and patch it into the index.\n *\n * Two independent failures with two different consequences, which is why they are two try blocks\n * and not one: a cache write that fails costs the NEXT process a fetch and nothing more, so the run\n * continues; a patch that fails means this body never reached the index, so the index is whatever it\n * was and the result says `cache`.\n */\nfunction persistAndPatch(path: string, body: string): RefreshModelCatalogResult {\n  try {\n    writeCacheAtomic(path, body);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache write failed (${(err as Error).message})\\n`);\n  }\n  try {\n    return { source: \"network\", models: patchIndexFromApiJson(JSON.parse(body)) };\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev patch failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return { source: \"cache\", models: 0 };\n  }\n}\n\n/**\n * Explicitly refresh the model catalog from models.dev (the ONLY network trigger in the subsystem).\n * Fail-closed: any failure keeps serving the current index (cache or vendored). Kill-switch:\n * `THEOKIT_DISABLE_MODELS_FETCH`.\n *\n * The sequence carried a cognitive-complexity suppression whose reason said splitting it would\n * \"separate a step from the fallback it owns\". The four helpers above each KEEP their fallback: the\n * TTL gate owns \"no cache\", the fetch owns every network and validation failure, the persist owns\n * the write and the patch. What is left here is the order they run in, which is what this function\n * was always for.\n *\n * Still true, and NOT fixed by the split: three of the paths return `{ source: \"cache\" }`, so a\n * caller cannot tell a timeout from an unparseable body from a patch failure. Distinguishing them\n * means adding a field to the PUBLIC `RefreshModelCatalogResult`, which is a release decision rather\n * than a refactor. The `diag` line already names the cause for an operator.\n */\nexport async function refreshModelCatalog(\n  opts: RefreshModelCatalogOptions = {},\n): Promise<RefreshModelCatalogResult> {\n  // M44 M4 fix — self-initialize provider registration so the `@theokit/sdk/models` subpath works\n  // standalone (without the consumer having built an Agent first).\n  registerBuiltins();\n  if (fetchDisabledByEnv()) return { source: \"skipped\", models: 0 };\n\n  const url = opts.url ?? process.env.THEOKIT_MODELS_URL ?? DEFAULT_URL;\n  const path = cachePathFor(url);\n  const now = opts.deps?.now ?? (() => Date.now());\n\n  if (opts.force !== true) {\n    const cached = servedFromFreshCache(url, path, now);\n    if (cached !== undefined) return cached;\n  }\n\n  const body = await fetchCatalogBody(url, boundFetch(opts.deps?.fetch));\n  // fail-closed: serve whatever we already have (stale cache if present, else vendored)\n  if (body === undefined) return { source: \"cache\", models: loadCacheIntoIndex(url) };\n\n  return persistAndPatch(path, body);\n}\n\n/** The enriched per-model view (public via `@theokit/sdk/models`): index lookup by (possibly prefixed) id. */\nexport function getModelInfo(modelId: string): ReturnType<typeof getCatalogModelInfo> {\n  return getCatalogModelInfo(modelId);\n}\n"]}