release: 3.13.2 — sync router-core to 18bf4ab (Python SDK parity) + repair 3.13.1 version drift

[VickyXAI]

Syncs the TypeScript SDK onto the same @blockrun/router-core commit the Python SDK's port tracks, and repairs the version drift 3.13.1 left behind.

Pin: d430804 → 18bf4ab

Upstream's only change between the two commits: free/deepseek-v4-flash is dropped from the eco SIMPLE fallback chain. NVIDIA EOL'd it on 2026-08-12 (HTTP 410), as it did seed-oss-36b on 2026-08-03. free/gpt-oss-120b and -20b already head that chain, so the rungs are dropped rather than retargeted — no request that was being served changes model. What changes is that an eco SIMPLE request falling past the gpt-oss pair no longer burns a recovery hop on a dead model.

Cross-SDK parity

18bf4ab is the commit blockrun-llm 1.11.0 ported to Python, so both SDKs and the gateway now route from one configuration. Verified against a snapshot of the live catalog (92 available models), 24 request shapes — chat, reasoning, MCQ, math, code edit, debug, extraction (zh), creative, long context, code agent, tool agent, retail high-risk, airline standard + global-optimization, terminal simple + safety-sensitive, deep web research, parallel tool use, vision, structured output, large output, eco, premium ×2:

24/24 identical — model, tier, task type and the full candidate chain.

One methodology note for anyone repeating this: the portfolio decays performance-profile freshness against wall-clock time, so two near-tied fallbacks can swap position between runs minutes apart (seen once on the MCQ case, positions 2 and 3). The selected model is unaffected. Compare runs generated back-to-back, or the diff is in your method, not the router.

Also fixes: main has been red since 2026-08-12

3.13.1 bumped package.json and src/version.ts but left VERSION on 3.13.0 and never recorded the release in CHANGELOG.md. The version-consistency guard catches both, but publish.yml triggers on a GitHub Release and doesn't run the suite, so the failure only appeared on the push-triggered CI run — after the release was already on npm. Both files are corrected here and the 3.13.1 entry is written retroactively.

Worth considering separately: the Python SDK's publish workflow runs black/ruff/pytest and a tag-vs-VERSION check before it publishes, which is what would have blocked this. This repo's does not.

Test change

test/unit/smart-chat-fallbacks.test.ts used free/deepseek-v4-flash as the vehicle for the free/* → nvidia/* mapping assertion and went red with the new pin. The test's subject is the namespace mapping — the v3.11.0 regression where eco silently became a paid profile — not that particular model, so it now exercises the gpt-oss pair that heads the chain. Same assertions: mapped id, costEstimate === 0, savings === 1.

Verification

• vitest run: 265 passed, 12 skipped, 0 failed (was 1 failed on this branch before the test retarget, and 2 failed on main).
• eslint src/ clean, tsc --noEmit clean, tsup build succeeds.
• Built bundle confirmed to carry the new core (eco SIMPLE chain no longer lists the EOL model).

Second commit: the brand-numbers red

The first CI run on this branch failed on brand-numbers --check, not on anything in the release: CLAUDE.md:3 still carried 71 while brand-numbers.json says 70. The corrected line was sitting uncommitted in a working tree — running node scripts/sync-brand-numbers.mjs reports "already up to date" against it, so it was generated by the repo's own tool and simply never committed after the 2026-08-12 sync (#28). Committed here, since this PR's job is to get main green.