theorum 0.1.2 → 0.1.3

package/README.md

@@ -24,7 +24,7 @@ The package is intentionally **not** an agent product. It ships no app profiles,
 [kernel_contract]
 profiles = "Host-owned declarations for model, inputs, outputs, tools, and guardrails"
 runner = "Single deterministic execution path for one agent turn"
-providers = "Adapters for OpenRouter-compatible chat and Google Interactions"
+providers = "createProvider routes protocol/provider; adapters stay internal"
 tools = "Profile allowlist ceiling plus per-turn dynamic declarations"
 egress = "Typed host hook for outbound disclosure checks and repair loops"
 traces = "Host-injected sinks; no environment variables or bundled destinations"
@@ -62,9 +62,9 @@ flowchart TD
     end
 
     subgraph Providers["Provider adapters"]
-        OR["OpenRouter"]
+        OR["OpenRouter chat"]
         GI["Google Interactions"]
-        TTS["OpenRouter TTS"]
+        Speech["Speech (Interactions or /audio/speech)"]
     end
 
     Profile --> Resolve
@@ -80,6 +80,8 @@ flowchart TD
     Runner --> TraceSink
 ```
 
+Hosts bind transports with `createProvider(profile, { gemini, openRouter })`. One door; protocol/provider (and speech role) pick the adapter.
+
 ### Turn Lifecycle
 
 ```mermaid
@@ -148,6 +150,17 @@ const profile = defineProfile({
     protocol: "openAi",
     provider: "openrouter",
     allow: ["gemini35FlashLite"],
+    config: {
+      gemini35FlashLite: {
+        apiId: "gemini-3.5-flash-lite",
+        thinking: { on: "high", off: "minimal" },
+        thinkingLevels: ["minimal", "low", "medium", "high"],
+        summaries: { on: "auto", off: "none" },
+        maxOutputTokens: 8192,
+        temperature: 1,
+        keyBuiltins: [],
+      },
+    },
     thinking: "minimal",
     maxSteps: 1,
   },
@@ -221,7 +234,20 @@ Inbound and outbound safety are generic kernel hooks.
 ```ts
 const guardedProfile = defineProfile({
   id: "assistant.guarded",
-  model: { allow: ["gemini35FlashLite"] },
+  model: {
+    allow: ["gemini35FlashLite"],
+    config: {
+      gemini35FlashLite: {
+        apiId: "gemini-3.5-flash-lite",
+        thinking: { on: "high", off: "minimal" },
+        thinkingLevels: ["minimal", "low", "medium", "high"],
+        summaries: { on: "auto", off: "none" },
+        maxOutputTokens: 8192,
+        temperature: 1,
+        keyBuiltins: [],
+      },
+    },
+  },
   guardrails: {
     egress: {
       onBlock: "reject_to_agent",
@@ -250,33 +276,30 @@ Quota is optional. If a profile omits `guardrails.quota`, the quota helper retur
 
 ## Provider Adapters
 
-THEORUM includes provider adapters but does not own credentials.
+THEORUM includes provider adapters but does not own credentials. Bind them with one door:
 
 ```ts
-import { createOpenRouterProvider } from "jsr:@theorum/core/openrouter";
+import { createProvider, runTurn } from "jsr:@theorum/core";
 
-const provider = createOpenRouterProvider({
-  apiKey: hostSecrets.openRouterApiKey,
-  siteName: "Your app",
-  siteUrl: "https://example.com",
+const provider = createProvider(profile, {
+  gemini: { vault: hostGeminiKeyVault, fetch },
+  openRouter: { apiKey: hostSecrets.openRouterApiKey },
 });
-```
-
-```ts
-import { createInteractionsProvider } from "jsr:@theorum/core/providers";
 
-const provider = createInteractionsProvider({
-  keys: hostGeminiKeyVault,
-  fetch,
-});
+for await (const event of runTurn({ profile: profile.id, input: { text: "…" } }, provider)) {
+  // …
+}
 ```
 
-Provider support is intentionally split by wire protocol:
+`createProvider` routes from `profile.model.protocol` / `provider`. Speech roles use the same call — Interactions when Google, `/audio/speech` when openAi/openrouter (same `openRouter` credentials).
 
-| Provider | Protocol | Use |
-| :--- | :--- | :--- |
-| OpenRouter | `openAi` | Chat completions, reasoning streams, tool calls, structured output, TTS gateway. |
-| Google Interactions | `geminiInteractions` | Native Google Interactions streaming, image response format, interaction continuity, grounding metadata. |
+| Profile | Transport |
+| :--- | :--- |
+| `geminiInteractions` + `google` | Google Interactions (chat, image, speech) |
+| `openAi` + `openrouter` (chat) | OpenRouter chat completions |
+| `openAi` + `openrouter` (speech role) | OpenRouter `/audio/speech` |
+
+Advanced payload helpers live under `theorum/openrouter` (`toOpenRouterPayload`, …). Prefer `createProvider` for turns.
 
 ---
 
@@ -285,11 +308,15 @@ Provider support is intentionally split by wire protocol:
 | Entrypoint | Purpose |
 | :--- | :--- |
 | `jsr:@theorum/core` / `theorum` | Main kernel API: profiles, schemas, runner, core types, provider constructors. |
-| `jsr:@theorum/core/kernel` / `theorum/kernel` | Profile, turn, event, tool, egress, provider, and schema types. |
-| `jsr:@theorum/core/providers` / `theorum/providers` | Provider constructors and provider utility types. |
-| `jsr:@theorum/core/openrouter` / `theorum/openrouter` | OpenRouter payload and streaming adapter. |
+| `jsr:@theorum/core/kernel` / `theorum/kernel` | Profile/turn types, tool catalog, `requireModelSpec`, thinking clamps over host model maps. |
+| `jsr:@theorum/core/providers` / `theorum/providers` | `createProvider` + Gemini vault types. |
+| `jsr:@theorum/core/openrouter` / `theorum/openrouter` | OpenRouter payload helpers (advanced). |
 | `jsr:@theorum/core/guardrails` / `theorum/guardrails` | Sanitization, public error mapping, inbound injection/sensitive-data primitives. |
 | `jsr:@theorum/core/observability` / `theorum/observability` | Trace sinks and trace record helpers. |
+| `jsr:@theorum/core/host` / `theorum/host` | Optional Deno HTTP helpers (`json`, status mapping, cutout mint flush). |
+| `jsr:@theorum/core/cli` / `theorum/cli` | Profile inspection and stress-test CLI (`theorum` binary on npm). |
+| `jsr:@theorum/core/presets` / `theorum/presets` | Optional convenience packs (`registerGooglePreset`, …). |
+| `jsr:@theorum/core/presets/google` / `theorum/presets/google` | Google builtins (search/maps/urlContext) + Interactions/OpenRouter wire metadata. |
 
 Internal files remain present in source for maintainability, but package consumers should use the public entrypoints above.
 
@@ -304,7 +331,15 @@ npm run lint
 deno publish --dry-run --allow-dirty
 ```
 
-Build the npm package from the Deno source:
+Run the packaged CLI locally:
+
+```bash
+deno task theorum --help
+# or after npm install -g / npx:
+# npx theorum --help
+```
+
+Build the npm package from the Deno source (publish only from `npm/`):
 
 ```bash
 npm run build:npm

package/docs/AGENT_PROFILE_CONTRACT.md

@@ -6,10 +6,12 @@ Every profile strictly namespaces its capabilities across 6 functional domains:
 1. `identity` — Persona, display handle, and static base system prompts.
 2. `model` — Protocol, provider backend, model whitelist, thinking level, and controls.
 3. `tools` — Tool access ceiling.
-4. `inputs` — Strict ingress constraints, file limits, and routing slots.
-5. `outputs` — Structured schemas, voice, media, streaming, and validation/auto-repair.
+4. `inputs` — Strict ingress constraints (text, attachments, voice), file limits, and routing slots.
+5. `outputs` — Structured schemas, image, speech, streaming, and validation/auto-repair.
 6. `guardrails` — Rate limits, canary leak detection, content safety, and outbound disclosure policies.
 
+**Vocabulary:** Ingress audio is `inputs.voice`. Generated audio is `outputs.speech` (TTS voice id is `outputs.speech.voice`). Wire container formats for speech (`pcm` / `mp3`) may live in the kernel; vendor voice catalogs and image aspect/size vocabularies live in presets/apps.
+
 ---
 
 ## 1. Authoring Shape
@@ -20,17 +22,30 @@ profiles. The minimum useful profile is:
 ```typescript
 defineProfile({
   id: 'host.agent',
-  model: { allow: ['your-model-id'] },
+  model: {
+    allow: ['your-model-id'],
+    config: {
+      'your-model-id': {
+        apiId: 'provider-native-model-id',
+        thinking: { on: 'high', off: 'minimal' },
+        thinkingLevels: ['minimal', 'low', 'medium', 'high'],
+        summaries: { on: 'auto', off: 'none' },
+        maxOutputTokens: 8192,
+        temperature: 1,
+        keyBuiltins: [],
+      },
+    },
+  },
 });
 ```
 
-Everything except `id` and `model.allow` is optional at authoring time:
+Everything except `id`, `model.allow`, and `model.config` is optional at authoring time:
 
 ```typescript
 export type ProfileDefinition = {
   id: ProfileId;
   identity?: Partial<Profile['identity']>;
-  model: Partial<Profile['model']> & Pick<Profile['model'], 'allow'>;
+  model: Partial<Profile['model']> & Pick<Profile['model'], 'allow' | 'config'>;
   tools?: Partial<Profile['tools']>;
   inputs?: Partial<Profile['inputs']>;
   outputs?: Partial<Profile['outputs']>;
@@ -61,6 +76,8 @@ export interface Profile {
     protocol: 'geminiInteractions' | 'openAi';
     provider: 'google' | 'openrouter';
     allow: ModelId[];
+    /** Host-owned wire config for every id in `allow`. */
+    config: Record<ModelId, ModelSpec>;
     select?: Record<string, ModelId>;
     thinking?: ThinkingLevel | Record<string, ThinkingLevel>;
     controls?: ControlId[];
@@ -85,11 +102,13 @@ export interface Profile {
     slots?: Record<string, string[]>;
   };
 
-  /** 5. Outputs (Structured output, voice, media, validation, streaming) */
+  /** 5. Outputs (Structured output, image, speech, validation, streaming) */
   outputs: {
     structured?: StructuredSchemaId | StructuredBySlot | null;
-    media?: boolean;
-    voice?: ProfileVoiceSpec;
+    /** Pins for an image-role profile. Model id lives on `model`. */
+    image?: ProfileImageSpec;
+    /** Pins for a speech-role profile. Model id lives on `model`. */
+    speech?: ProfileSpeechSpec;
     validation?: ProfileValidationSpec;
     streaming?: ProfileStreamingSpec;
   };
@@ -118,39 +137,47 @@ export interface Profile {
 ### `model`
 - `model.protocol`: Wire framing protocol (`'geminiInteractions'` for Google Interactions API, `'openAi'` for OpenAI/OpenRouter compatible chat completions API).
 - `model.provider`: Provider execution backend (`'google'` or `'openrouter'`).
-- `model.allow`: Whitelist of allowable `ModelId`s for this profile.
-- `model.select`: Named model mappings (e.g. `{ fast: 'gemini35FlashLite', deep: 'gemini31ProPreview' }`).
-- `model.thinking`: Pinned thinking level (`'minimal' | 'low' | 'medium' | 'high'`) when not user-controllable.
+- `model.allow`: Whitelist of host-defined `ModelId`s for this profile. THEORUM does not ship model names.
+- `model.config`: Host-owned `ModelSpec` map keyed by the same ids as `allow` / `select` (`apiId`, thinking levels, tokens, `keyBuiltins`, optional per-model `key`, etc.).
+- `model.select`: Named model mappings (e.g. `{ fast: 'flash', deep: 'pro' }` — ids are host-defined).
+- `model.thinking`: Pinned thinking level (`'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max'`) when not user-controllable. Each model’s accepted subset is declared on `ModelSpec.thinkingLevels`.
 - `model.controls`: User-togglable controls on this profile (e.g. `['thinking']`).
 - `model.maxSteps`: Step limit on autonomous tool loops (1 = one-shot; >1 = autonomous tool loop).
-- `model.key`: Gemini free bucket quota pool (`'freeA' | 'freeB' | 'freeC'`).
+- `model.key`: Default Gemini vault slot for this profile (`'freeA' | 'freeB' | 'freeC'`). Overflow uses `'paid'`.
+
+### `ModelSpec` (host-owned, per id in `config`)
+- `apiId` / optional `openRouterId`: Provider-native wire ids.
+- `keyBuiltins`: Builtins that may use `profile.model.key`. Any other enabled builtin selects the overflow vault slot. Host policy — THEORUM does not infer tool pricing.
+- `key`: Optional vault slot override for this model (e.g. pin an image model to `'paid'`). When set, wins over profile key and builtin routing.
 
 ### `tools`
 - `tools.allow`: Whitelist of tool IDs permitted to run under this profile. Calls to unlisted tools are blocked at the kernel boundary.
+- Harness tools (`askUser`) ship with THEORUM and are always in the catalog.
+- Provider builtins (e.g. Google search/maps/urlContext) are registered by optional presets such as `theorum/presets/google` via `registerGooglePreset()`.
 
 ### `inputs`
 - `inputs.text`: Boolean flag accepting user text input.
 - `inputs.attachments`: Allowed mime types for uploaded file attachments.
-- `inputs.voice`: Allowed mime types for recorded audio clips.
+- `inputs.voice`: Allowed mime types for recorded audio clips (ingress only).
 - `inputs.maxFiles`: Maximum number of files permitted per message.
 - `inputs.maxBytes`: Maximum byte size permitted per single file.
 - `inputs.maxTurnBytes`: Maximum total byte size permitted across all files in one turn.
 - `inputs.limitsByMime`: Granular per-MIME byte limits (e.g. `{ 'application/pdf': 50 * 1024 * 1024, 'video/*': 100 * 1024 * 1024 }`).
-- `inputs.slots`: Allowed values for dynamic routing slots.
+- `inputs.slots`: Allowed values for dynamic routing slots. Image-role overrides use `slots.aspectRatio` / `slots.size`.
 
 ### `outputs`
 - `outputs.structured`: Structured JSON schema specification (or slot-based schema routing).
-- `outputs.media`: Flag enabling native image generation output.
-- `outputs.voice`: Voice specification for TTS (`voice.voice`, `voice.responseFormat: 'pcm' | 'mp3'`).
+- `outputs.image`: Pins for an image-role profile (`aspectRatio`, `size`, `mimeType`, optional `allowsGrounding`, `maxInputImages`). The image model itself is selected via `model.allow` / `model.config`. Slot overrides use `slots.aspectRatio` / `slots.size` when the profile lists allowlists under `inputs.slots`. Adapters map `size` to provider wire keys (e.g. Google Interactions `imageSize`).
+- `outputs.speech`: Pins for a speech-role profile (`voice`, optional `format: 'pcm' | 'mp3'`). The speech model itself is selected via `model.allow` / `model.config`. Bind with `createProvider(profile, …)` — same door as chat/image. `geminiInteractions` uses Interactions (`response_format: audio` + `speech_config`); `openAi`/`openrouter` speech roles use `/audio/speech` with the same `openRouter` credentials. `format: 'pcm'` (default) yields WAV media on both. `format: 'mp3'` is only valid on `openAi` speech — Interactions rejects it at resolve.
 - `outputs.validation`: In-harness auto-correction validator (`validate`, optional `extract`, `maxRetries`, `repairGuidance`). If `extract` is omitted, the structured output itself is validated.
-- `outputs.streaming`: SSE streaming behaviors (`streamThoughts`, `gateMedia`).
+- `outputs.streaming`: SSE streaming behaviors (`streamThoughts`, `gateMedia`). `gateMedia` controls whether stream `media` events are held until validation/egress — unrelated to a profile output flag.
 
 ### `guardrails`
 - `guardrails.quota.perDay`: Optional daily turn quota enforced per client IP. If omitted, quota enforcement is explicitly `not_configured`.
 - `guardrails.canary`: Enable unique token canary leak interception (default `true`).
 - `guardrails.sanitizeInput`: Run prompt injection / jailbreak redaction on ingress text (default `true`).
 - `guardrails.redactSensitive`: Redact SSN, credit cards, IP addresses, API keys from inputs (default `true`).
-- `guardrails.egress`: Generic outbound disclosure control engine (`enforce`, `onBlock: 'reject_to_agent' | 'refuse_to_user'`, `maxRetries`, `repairGuidance`). Runs deterministic auto-repair loops for chat or immediate in-character refusal for voice.
+- `guardrails.egress`: Generic outbound disclosure control engine (`enforce`, `onBlock: 'reject_to_agent' | 'refuse_to_user'`, `maxRetries`, `repairGuidance`). Runs deterministic auto-repair loops for chat or immediate in-character refusal when blocking egress on voice-input turns.
 
 ### Per-turn Interactions state
 - `TurnRequest.input`: Optional turn input object. If omitted, Theorum normalizes it to an empty input and still runs the profile/provider turn.

package/docs/CLI_SPEC.md

@@ -48,7 +48,7 @@ theorum test --all [--lite] [--concurrency 4]
 | `--lite` | `boolean` | Minimal single-turn connectivity ping (fast mode, tools off, text only) |
 | `--matrix` | `boolean` | Generate and execute all valid permutations for the profile |
 | `--attachment` | `string[]` | Path(s) to custom attachment files (PNG, PDF, CSV, etc.) |
-| `--voice` | `string` | Path to custom voice audio (WAV, PCM) |
+| `--voice` | `string` | Path to custom voice input audio (WAV, PCM) |
 | `--search` | `boolean` | Force Google Search tool on |
 | `--map` | `boolean` | Force Google Maps tool on |
 | `--mode` | `'fast' \| 'smart'` | Force reasoning / model speed tier |
@@ -112,7 +112,7 @@ interface SynthesizedTurn {
    - If profile supports `smart` mode $\to$ select `smart` (highest pinned thinking tokens).
    - Otherwise $\to$ use default profile model.
 2. **Multimodal Fixtures**:
-   - If `inputs.voice === true` $\to$ inject synthetic 16kHz PCM/WAV speech fixture.
+   - If `inputs.voice` is set $\to$ inject synthetic 16kHz PCM/WAV voice-input fixture.
    - If `inputs.attachments === true` $\to$ inject synthetic test document/image matching allowed MIME types within byte ceilings (`maxBytes`).
 3. **Tool Resolution & Conflict Handling**:
    - Turn on all allowed tools in `profile.tools.allow`.

package/docs/SECRETS.md

@@ -9,39 +9,44 @@ Host applications own credentials, runtime configuration, and secret storage. Th
 - Do not create `.env` files in this repository.
 - Do not commit key templates to this repository.
 - Do not teach Theorum to discover keys from the shell or process environment.
-- Business applications pass credentials into provider constructors or transport objects.
+- Business applications pass credentials into `createProvider`.
 
-## 2. OpenRouter
+## 2. Single door: `createProvider`
 
 ```ts
-import { createOpenRouterProvider } from 'theorum/openrouter';
-
-const provider = createOpenRouterProvider({
-  apiKey: hostResolvedOpenRouterKey,
-});
-```
-
-## 3. Google Interactions
-
-```ts
-import { createInteractionsProvider } from 'theorum/providers';
-
-const provider = createInteractionsProvider({
-  vault: {
-    freeA: hostResolvedFreeAKey,
-    freeB: hostResolvedFreeBKey,
-    freeC: hostResolvedFreeCKey,
-    paid: hostResolvedPaidKey,
+import { createProvider, runTurn } from 'theorum';
+
+const provider = createProvider(profile, {
+  // geminiInteractions / google
+  gemini: {
+    vault: {
+      freeA: hostResolvedFreeAKey,
+      freeB: hostResolvedFreeBKey,
+      freeC: hostResolvedFreeCKey,
+      paid: hostResolvedPaidKey,
+    },
+  },
+  // openAi / openrouter (chat or speech role — same credentials)
+  openRouter: {
+    apiKey: hostResolvedOpenRouterKey,
   },
 });
+
+for await (const event of runTurn({ profile: profile.id, input: { text: '…' } }, provider)) {
+  // …
+}
 ```
 
-## 4. Tracing
+`createProvider` picks the transport from `profile.model.protocol` / `provider` (and whether the profile is a speech role). Hosts do not choose a separate speech constructor.
+
+## 3. Tracing
 
 Tracing is silent by default. Hosts opt in by passing a sink to `runTurn`.
 
 ```ts
-import { jsonlSink, runTurn } from 'theorum';
+import { createProvider, jsonlSink, runTurn } from 'theorum';
+
+const provider = createProvider(profile, { openRouter: { apiKey: hostResolvedOpenRouterKey } });
 
 for await (const event of runTurn(request, provider, jsonlSink(hostTraceDir))) {
   // stream events

package/esm/_dnt.polyfills.d.ts

@@ -9,3 +9,102 @@ declare global {
     }
 }
 export {};
+/**
+ * Based on [import-meta-ponyfill](https://github.com/gaubee/import-meta-ponyfill),
+ * but instead of using npm to install additional dependencies,
+ * this approach manually consolidates cjs/mjs/d.ts into a single file.
+ *
+ * Note that this code might be imported multiple times
+ * (for example, both dnt.test.polyfills.ts and dnt.polyfills.ts contain this code;
+ *  or Node.js might dynamically clear the cache and then force a require).
+ * Therefore, it's important to avoid redundant writes to global objects.
+ * Additionally, consider that commonjs is used alongside esm,
+ * so the two ponyfill functions are stored independently in two separate global objects.
+ */
+import { createRequire } from "node:module";
+import { type URL } from "node:url";
+declare global {
+    interface ImportMeta {
+        /** A string representation of the fully qualified module URL. When the
+         * module is loaded locally, the value will be a file URL (e.g.
+         * `file:///path/module.ts`).
+         *
+         * You can also parse the string as a URL to determine more information about
+         * how the current module was loaded. For example to determine if a module was
+         * local or not:
+         *
+         * ```ts
+         * const url = new URL(import.meta.url);
+         * if (url.protocol === "file:") {
+         *   console.log("this module was loaded locally");
+         * }
+         * ```
+         */
+        url: string;
+        /**
+         * A function that returns resolved specifier as if it would be imported
+         * using `import(specifier)`.
+         *
+         * ```ts
+         * console.log(import.meta.resolve("./foo.js"));
+         * // file:///dev/foo.js
+         * ```
+         *
+         * @param specifier The module specifier to resolve relative to `parent`.
+         * @param parent The absolute parent module URL to resolve from.
+         * @returns The absolute (`file:`) URL string for the resolved module.
+         */
+        resolve(specifier: string, parent?: string | URL | undefined): string;
+        /** A flag that indicates if the current module is the main module that was
+         * called when starting the program under Deno.
+         *
+         * ```ts
+         * if (import.meta.main) {
+         *   // this was loaded as the main module, maybe do some bootstrapping
+         * }
+         * ```
+         */
+        main: boolean;
+        /** The absolute path of the current module.
+         *
+         * This property is only provided for local modules (ie. using `file://` URLs).
+         *
+         * Example:
+         * ```
+         * // Unix
+         * console.log(import.meta.filename); // /home/alice/my_module.ts
+         *
+         * // Windows
+         * console.log(import.meta.filename); // C:\alice\my_module.ts
+         * ```
+         */
+        filename: string;
+        /** The absolute path of the directory containing the current module.
+         *
+         * This property is only provided for local modules (ie. using `file://` URLs).
+         *
+         * * Example:
+         * ```
+         * // Unix
+         * console.log(import.meta.dirname); // /home/alice
+         *
+         * // Windows
+         * console.log(import.meta.dirname); // C:\alice
+         * ```
+         */
+        dirname: string;
+    }
+}
+type NodeRequest = ReturnType<typeof createRequire>;
+type NodeModule = NonNullable<NodeRequest["main"]>;
+interface ImportMetaPonyfillCommonjs {
+    (require: NodeRequest, module: NodeModule): ImportMeta;
+}
+interface ImportMetaPonyfillEsmodule {
+    (importMeta: ImportMeta): ImportMeta;
+}
+interface ImportMetaPonyfill extends ImportMetaPonyfillCommonjs, ImportMetaPonyfillEsmodule {
+}
+export declare let import_meta_ponyfill_commonjs: ImportMetaPonyfillCommonjs;
+export declare let import_meta_ponyfill_esmodule: ImportMetaPonyfillEsmodule;
+export declare let import_meta_ponyfill: ImportMetaPonyfill;

package/esm/_dnt.polyfills.js

@@ -12,4 +12,133 @@ if (!Object.hasOwn) {
         writable: true,
     });
 }
-export {};
+/**
+ * Based on [import-meta-ponyfill](https://github.com/gaubee/import-meta-ponyfill),
+ * but instead of using npm to install additional dependencies,
+ * this approach manually consolidates cjs/mjs/d.ts into a single file.
+ *
+ * Note that this code might be imported multiple times
+ * (for example, both dnt.test.polyfills.ts and dnt.polyfills.ts contain this code;
+ *  or Node.js might dynamically clear the cache and then force a require).
+ * Therefore, it's important to avoid redundant writes to global objects.
+ * Additionally, consider that commonjs is used alongside esm,
+ * so the two ponyfill functions are stored independently in two separate global objects.
+ */
+//@ts-ignore
+import { createRequire } from "node:module";
+//@ts-ignore
+import { fileURLToPath, pathToFileURL } from "node:url";
+//@ts-ignore
+import { dirname } from "node:path";
+const defineGlobalPonyfill = (symbolFor, fn) => {
+    if (!Reflect.has(globalThis, Symbol.for(symbolFor))) {
+        Object.defineProperty(globalThis, Symbol.for(symbolFor), {
+            configurable: true,
+            get() {
+                return fn;
+            },
+        });
+    }
+};
+export let import_meta_ponyfill_commonjs = (Reflect.get(globalThis, Symbol.for("import-meta-ponyfill-commonjs")) ??
+    (() => {
+        const moduleImportMetaWM = new WeakMap();
+        return (require, module) => {
+            let importMetaCache = moduleImportMetaWM.get(module);
+            if (importMetaCache == null) {
+                const importMeta = Object.assign(Object.create(null), {
+                    url: pathToFileURL(module.filename).href,
+                    main: require.main == module,
+                    resolve: (specifier, parentURL = importMeta.url) => {
+                        return pathToFileURL((importMeta.url === parentURL
+                            ? require
+                            : createRequire(parentURL))
+                            .resolve(specifier)).href;
+                    },
+                    filename: module.filename,
+                    dirname: module.path,
+                });
+                moduleImportMetaWM.set(module, importMeta);
+                importMetaCache = importMeta;
+            }
+            return importMetaCache;
+        };
+    })());
+defineGlobalPonyfill("import-meta-ponyfill-commonjs", import_meta_ponyfill_commonjs);
+export let import_meta_ponyfill_esmodule = (Reflect.get(globalThis, Symbol.for("import-meta-ponyfill-esmodule")) ??
+    ((importMeta) => {
+        const resolveFunStr = String(importMeta.resolve);
+        const shimWs = new WeakSet();
+        //@ts-ignore
+        const mainUrl = ("file:///" + process.argv[1].replace(/\\/g, "/"))
+            .replace(/\/{3,}/, "///");
+        const commonShim = (importMeta) => {
+            if (typeof importMeta.main !== "boolean") {
+                importMeta.main = importMeta.url === mainUrl;
+            }
+            if (typeof importMeta.filename !== "string") {
+                importMeta.filename = fileURLToPath(importMeta.url);
+                importMeta.dirname = dirname(importMeta.filename);
+            }
+        };
+        if (
+        // v16.2.0+, v14.18.0+: Add support for WHATWG URL object to parentURL parameter.
+        resolveFunStr === "undefined" ||
+            // v20.0.0+, v18.19.0+"" This API now returns a string synchronously instead of a Promise.
+            resolveFunStr.startsWith("async")
+        // enable by --experimental-import-meta-resolve flag
+        ) {
+            import_meta_ponyfill_esmodule = (importMeta) => {
+                if (!shimWs.has(importMeta)) {
+                    shimWs.add(importMeta);
+                    const importMetaUrlRequire = {
+                        url: importMeta.url,
+                        require: createRequire(importMeta.url),
+                    };
+                    // note: the parameter types must be explicitly annotated because
+                    // `@types/node` also declares `ImportMeta.resolve`, which makes
+                    // the contextual type an overload set that provides no inference
+                    importMeta.resolve = function resolve(specifier, parentURL = importMeta.url) {
+                        return pathToFileURL((importMetaUrlRequire.url === parentURL
+                            ? importMetaUrlRequire.require
+                            : createRequire(parentURL)).resolve(specifier)).href;
+                    };
+                    commonShim(importMeta);
+                }
+                return importMeta;
+            };
+        }
+        else {
+            /// native support
+            import_meta_ponyfill_esmodule = (importMeta) => {
+                if (!shimWs.has(importMeta)) {
+                    shimWs.add(importMeta);
+                    commonShim(importMeta);
+                }
+                return importMeta;
+            };
+        }
+        return import_meta_ponyfill_esmodule(importMeta);
+    }));
+defineGlobalPonyfill("import-meta-ponyfill-esmodule", import_meta_ponyfill_esmodule);
+export let import_meta_ponyfill = ((...args) => {
+    const _MODULE = (() => {
+        if (typeof require === "function" && typeof module === "object") {
+            return "commonjs";
+        }
+        else {
+            // eval("typeof import.meta");
+            return "esmodule";
+        }
+    })();
+    if (_MODULE === "commonjs") {
+        //@ts-ignore
+        import_meta_ponyfill = (r, m) => import_meta_ponyfill_commonjs(r, m);
+    }
+    else {
+        //@ts-ignore
+        import_meta_ponyfill = (im) => import_meta_ponyfill_esmodule(im);
+    }
+    //@ts-ignore
+    return import_meta_ponyfill(...args);
+});

package/esm/mod.d.ts

@@ -11,7 +11,20 @@
  *
  * const profile = defineProfile({
  *   id: "assistant.basic",
- *   model: { allow: ["gemini35FlashLite"] },
+ *   model: {
+ *     allow: ["gemini35FlashLite"],
+ *     config: {
+ *       gemini35FlashLite: {
+ *         apiId: "gemini-3.5-flash-lite",
+ *         thinking: { on: "high", off: "minimal" },
+ *         thinkingLevels: ["minimal", "low", "medium", "high"],
+ *         summaries: { on: "auto", off: "none" },
+ *         maxOutputTokens: 8192,
+ *         temperature: 1,
+ *         keyBuiltins: [],
+ *       },
+ *     },
+ *   },
  *   tools: { allow: [] },
  *   inputs: { text: true },
  *   outputs: {},
@@ -27,11 +40,14 @@ import "./_dnt.polyfills.js";
 export { publicError, TheorumError } from './src/guardrails/error.js';
 export { PROJECT_ID_MAX, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, } from './src/guardrails/sanitize.js';
 export { runTurn } from './src/kernel/engine/runner.js';
-export { defineProfile, getProfile, hasProfile, listProfiles, registerProfile, registerProfiles, } from './src/kernel/registry/profiles.js';
+export { CATALOG, clampThinkingLevel, clampThinkingLevelForApiId, getTool, listBuiltinIds, modelEntryByApiId, registerTools, requireModelSpec, resetTools, } from './src/kernel/registry/catalog.js';
+export type { ProfileDefinition } from './src/kernel/registry/profiles.js';
+export { clearProfiles, defineProfile, getProfile, hasProfile, listProfiles, registerProfile, registerProfiles, } from './src/kernel/registry/profiles.js';
 export { projectProfile, resolveTurn } from './src/kernel/registry/resolve.js';
 export { getStructured, registerStructured } from './src/kernel/registry/schemas.js';
 export { executeTool } from './src/kernel/registry/tools.js';
 export type * from './src/kernel/types.js';
 export { jsonlSink, memorySink, noopSink, resolveTraceDir, sinkFromDir, writeTrace, } from './src/observability/trace.js';
 export type { TraceRecord } from './src/observability/trace-record.js';
-export { createInteractionsProvider, createOpenRouterProvider, createOpenRouterTtsProvider, resolveOpenRouterApiKey, resolveOpenRouterModel, streamOpenRouterTts, toOpenRouterPayload, wrapPcmAsWav, } from './src/providers/mod.js';
+export type { CreateProviderOptions, GeminiTransport, GeminiVault } from './src/providers/mod.js';
+export { createProvider } from './src/providers/mod.js';