@hilbras/omnihilbras 1.11.3 → 1.12.1

package/dist/adapters/cline.js

@@ -35,7 +35,7 @@ export const CLINE_OAUTH = {
 };
 const defaultRefreshSkewMs = 60_000;
 /** Reported to Cline as this client's version. */
-const omnihilbrasVersion = '1.11.3';
+const omnihilbrasVersion = '1.12.1';
 /** Cline only accepts WorkOS JWTs with an explicit prefix. */
 export function toClineAccessToken(token) {
     const trimmed = token.trim();

package/dist/adapters/qwen-web.d.ts

@@ -0,0 +1,46 @@
+import type { Model } from '../types.js';
+import type { HttpTransport } from '../transport.js';
+export declare const qwenWebProviderId = "qwen-web";
+/** Reads a pasted cookie header, or a lone `name=value`, into a plain object. */
+export declare function parseQwenCookieHeader(raw: string): Record<string, string>;
+export type QwenProbeResult = {
+    /** Whether the credential authorises anything at all. */
+    authenticated: boolean;
+    /** Whether a turn was served. The TMD gate refuses with HTTP 200, so this is read from the body. */
+    turnServed: boolean;
+    /** The provider's own words about the turn. Never replaced with a summary. */
+    detail: string;
+    /** What the auth origin said. A guest is refused here first, and a bad credential shows up here. */
+    authDetail: string;
+    /** The models Qwen serves, which are readable by guests and so are always available. */
+    models: string[];
+};
+/**
+ * Asks Qwen three questions and reports all three answers.
+ *
+ * Deliberately a *probe* rather than a connect. The whole reason this exists is that one question
+ * — does the bot-protection gate apply to an authenticated request? — cannot be answered without
+ * a signed-in account, and guessing wrong in either direction is bad: claiming it works would
+ * ship a card that cannot answer, and refusing to try would be refusing on the strength of a
+ * measurement nobody made. So it asks, and it says what came back.
+ */
+export declare function probeQwenWeb(cookieHeader: string, transport: HttpTransport, signal?: AbortSignal, options?: {
+    timeoutMs?: number;
+}): Promise<QwenProbeResult>;
+/**
+ * The provider's own refusal, read out of a **200** response.
+ *
+ * Qwen signals every refusal in the body and never in the status code, on both origins. A check
+ * that trusted the status would report a guest cookie as a working credential.
+ */
+/**
+ * The catalog, read from the live `GET /api/v2/models/` rather than written from memory.
+ *
+ * I first wrote ten plausible ids — `qwen3.7-flash`, `qwen3.7-coder-plus`, `qwen3.7-vl-plus` and
+ * so on. The endpoint answers **three**, and running the probe against the live site is what
+ * showed it. Guessing a catalog is the same fault as guessing a capability: the card would have
+ * advertised models that do not exist and offered turns guaranteed to fail, with nothing on the
+ * page to say why. Qwen publishes no context length on this endpoint, so none is claimed.
+ */
+export declare const QWEN_WEB_MODELS: Model[];
+//# sourceMappingURL=qwen-web.d.ts.map

package/dist/adapters/qwen-web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qwen-web.d.ts","sourceRoot":"","sources":["../../src/adapters/qwen-web.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA+CrD,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAM5C,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA8BzE;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAC;IACvB,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;IACpB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AA4BF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,aAAa,EACxB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAAC,eAAe,CAAC,CAyF1B;AAED;;;;;GAKG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,EAIlC,CAAC"}

package/dist/adapters/qwen-web.js

@@ -0,0 +1,222 @@
+import { ProviderError } from '../errors.js';
+/**
+ * Qwen Web, through the credential a signed-in chat.qwen.ai session holds.
+ *
+ * ## What is measured, and what is not
+ *
+ * Everything here was established against the live site, not assumed. The shape of the blocker
+ * is unusual enough to be worth stating plainly:
+ *
+ * - `GET https://auth.qwen.ai/api/v2/auths/refresh` answers **401 Unauthorized** for a guest, and
+ *   no auth cookie is set on any host. Qwen's auth is on a *different origin* from its chat app,
+ *   so there is nothing for an unauthenticated client to present.
+ * - `POST https://chat.qwen.ai/api/v2/chat/completions` answers **HTTP 200** with a refusal in
+ *   the body: `{"ret":["FAIL_SYS_USER_VALIDATE","RGV587_ERROR::SM::…"],"data":{"url":"…/_____tmd_____/punish?…"}}`.
+ *   The status code says success. A client that checks only the status sees a working provider.
+ * - That `_____tmd_____/punish` URL is **not a clearance flow**: requesting it returns 200,
+ *   renders "Please connect them in order", sets no cookie, and the retry is refused with a
+ *   freshly minted challenge. It is a human puzzle, so a client cannot satisfy it.
+ * - `GET /api/v2/models/` *does* answer for a guest, which is why the model catalog is real while
+ *   the provider cannot serve a turn.
+ *
+ * So the open question is one that cannot be answered without a signed-in account: **does the
+ * TMD gate apply to an authenticated request?** Everything else about the request is known and
+ * written down here, so the moment a credential exists the only thing left to learn is that one
+ * answer — and `probeQwenWeb` reports it rather than guessing.
+ */
+const QWEN_ORIGIN = 'https://chat.qwen.ai';
+const QWEN_AUTH_ORIGIN = 'https://auth.qwen.ai';
+const TURN_PATH = '/api/v2/chat/completions';
+const AUTH_PATH = '/api/v2/auths/';
+/** The Qwen web client's own fingerprint. Qwen's gateway is picky about being itself. */
+const FINGERPRINT_HEADERS = {
+    accept: 'application/json',
+    'accept-language': 'en-US,en;q=0.9',
+    origin: QWEN_ORIGIN,
+    referer: `${QWEN_ORIGIN}/`,
+    'sec-ch-ua': '"Chromium";v="151", "Not(A:Brand";v="8"',
+    'sec-ch-ua-mobile': '?0',
+    'sec-ch-ua-platform': '"Linux"',
+    'sec-fetch-dest': 'empty',
+    'sec-fetch-mode': 'cors',
+    'sec-fetch-site': 'same-origin',
+};
+export const qwenWebProviderId = 'qwen-web';
+/** The browser's own user agent, sent verbatim so the client cannot be told apart from the app. */
+const BROWSER_USER_AGENT = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.34 Safari/537.36';
+/** Reads a pasted cookie header, or a lone `name=value`, into a plain object. */
+export function parseQwenCookieHeader(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed) {
+        throw new ProviderError('INVALID_REQUEST', 'Paste the Cookie header from auth.qwen.ai.', {
+            providerId: qwenWebProviderId,
+            publicMessage: 'Paste the Cookie header from auth.qwen.ai.',
+        });
+    }
+    // A pasted request line is the commonest mistake and reads as a nonsense credential.
+    if (/^(GET|POST|PUT|HEAD|OPTIONS)\s+\//i.test(trimmed)) {
+        throw new ProviderError('INVALID_REQUEST', 'That is a request line, not a cookie. Copy the value of the Cookie header only.', {
+            providerId: qwenWebProviderId,
+            publicMessage: 'That is a request line, not a cookie. Copy the value of the Cookie header only.',
+        });
+    }
+    const out = {};
+    for (const part of trimmed.split(';')) {
+        const at = part.indexOf('=');
+        if (at <= 0)
+            continue;
+        const name = part.slice(0, at).trim();
+        const value = part.slice(at + 1).trim();
+        if (name && value)
+            out[name] = value;
+    }
+    if (Object.keys(out).length === 0) {
+        throw new ProviderError('INVALID_REQUEST', 'That does not look like a cookie header — it has no name=value pairs in it.', {
+            providerId: qwenWebProviderId,
+            publicMessage: 'That does not look like a cookie header — it has no name=value pairs in it.',
+        });
+    }
+    return out;
+}
+/**
+ * The provider's own refusal, read out of a **200** response.
+ *
+ * Qwen signals every refusal in the body and never in the status code, on both origins. A check
+ * that trusted the status would report a guest cookie as a working credential.
+ */
+function readRefusal(payload) {
+    if (!payload || typeof payload !== 'object')
+        return undefined;
+    const record = payload;
+    if (record.success !== false)
+        return undefined;
+    const code = record.data?.code;
+    const details = record.data?.details;
+    return [typeof code === 'string' ? code : undefined, typeof details === 'string' ? details : undefined]
+        .filter(Boolean)
+        .join(' — ') || 'refused';
+}
+function readModels(payload) {
+    if (!payload || typeof payload !== 'object')
+        return [];
+    const data = payload.data;
+    const rows = Array.isArray(data) ? data : Array.isArray(data?.data) ? (data.data) : [];
+    return rows
+        .map((row) => (row && typeof row === 'object' ? String(row.id ?? '') : ''))
+        .filter(Boolean);
+}
+/**
+ * Asks Qwen three questions and reports all three answers.
+ *
+ * Deliberately a *probe* rather than a connect. The whole reason this exists is that one question
+ * — does the bot-protection gate apply to an authenticated request? — cannot be answered without
+ * a signed-in account, and guessing wrong in either direction is bad: claiming it works would
+ * ship a card that cannot answer, and refusing to try would be refusing on the strength of a
+ * measurement nobody made. So it asks, and it says what came back.
+ */
+export async function probeQwenWeb(cookieHeader, transport, signal, options = {}) {
+    const cookies = parseQwenCookieHeader(cookieHeader);
+    const cookie = Object.entries(cookies).map(([name, value]) => `${name}=${value}`).join('; ');
+    const headers = (extra = {}) => ({
+        ...FINGERPRINT_HEADERS,
+        cookie,
+        'user-agent': BROWSER_USER_AGENT,
+        ...extra,
+    });
+    /**
+     * A budget for the whole probe, because the alternative is a spinner that never resolves.
+     *
+     * Not the network — the three requests together take about a second. It is that a caller
+     * waiting on a promise it cannot see into will sit there indefinitely if anything stalls, and
+     * "Ask Qwen" with no outcome is indistinguishable from a broken button. On expiry the answers
+     * gathered so far are returned rather than discarded: a slow auth origin with a fast refusal on
+     * the turn is still a useful answer, and throwing it away would be its own kind of dishonesty.
+     */
+    const timeoutMs = options.timeoutMs ?? 20_000;
+    const controller = new AbortController();
+    const onAbort = () => controller.abort();
+    if (signal)
+        signal.addEventListener('abort', onAbort, { once: true });
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    timer.unref?.();
+    const ask = async (url, init) => {
+        try {
+            const response = await transport.request({
+                method: init.method,
+                url,
+                headers: init.headers,
+                providerId: qwenWebProviderId,
+                ...(init.body ? { body: init.body } : {}),
+                signal: controller.signal,
+            });
+            return { status: response.status, data: response.data, error: undefined };
+        }
+        catch (error) {
+            // A refusal is an answer here, not a failure to report around. The transport throws on a
+            // non-2xx and the message carries the status, which is exactly the evidence wanted.
+            return { status: 0, data: undefined, error: error instanceof Error ? error.message : String(error) };
+        }
+    };
+    try {
+        /**
+         * All three at once, and the turn last only because it needs a model id.
+         *
+         * Sequential requests cost three round trips to a host on another continent. The models
+         * catalog is the only dependency between them, and it does not need the turn's answer — so
+         * the turn is fired as soon as the catalog lands and the two never wait on each other.
+         */
+        const authPromise = ask(`${QWEN_AUTH_ORIGIN}${AUTH_PATH}`, { method: 'GET', headers: headers() });
+        const catalogPromise = ask(`${QWEN_ORIGIN}/api/v2/models/`, { method: 'GET', headers: headers() });
+        const [auth, catalog] = await Promise.all([authPromise, catalogPromise]);
+        const models = readModels(catalog.data);
+        const turn = await ask(`${QWEN_ORIGIN}${TURN_PATH}`, {
+            method: 'POST',
+            headers: headers({ 'content-type': 'application/json' }),
+            body: JSON.stringify({ model: models[0] ?? 'qwen3.7-plus', messages: [{ role: 'user', content: 'hi' }], stream: false }),
+        });
+        // 1. The auth origin. A guest is refused here first, so this separates "no credential" from
+        //    "the credential is not the problem".
+        //
+        //    Read from the **body**, not the status. `auth.qwen.ai` answers a guest with **HTTP 200**
+        //    and `{"success":false,"data":{"code":"Unauthorized"}}` — the status code is a lie and the
+        //    transport, correctly, does not throw. Trusting the status is what made a guest cookie
+        //    report as `authenticated: true`.
+        const authRefused = readRefusal(auth.data) ?? (auth.error ? auth.error : undefined);
+        const authenticated = auth.error === undefined && !authRefused;
+        const authDetail = authRefused ?? `HTTP ${auth.status}`;
+        // 2. The turn — the question that actually matters, and the one the refusal answers.
+        const ret = Array.isArray(turn.data?.ret) ? (turn.data.ret) : [];
+        const turnRefusal = readRefusal(turn.data);
+        const turnServed = turn.error === undefined && ret.length === 0 && !turnRefusal;
+        const detail = turn.error
+            ?? (ret.length > 0 ? `Qwen refused the turn: ${ret.join(', ')}` : undefined)
+            ?? turnRefusal
+            ?? `Qwen answered HTTP ${turn.status}.`;
+        return { authenticated, turnServed, detail, authDetail, models };
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', onAbort);
+    }
+}
+/**
+ * The provider's own refusal, read out of a **200** response.
+ *
+ * Qwen signals every refusal in the body and never in the status code, on both origins. A check
+ * that trusted the status would report a guest cookie as a working credential.
+ */
+/**
+ * The catalog, read from the live `GET /api/v2/models/` rather than written from memory.
+ *
+ * I first wrote ten plausible ids — `qwen3.7-flash`, `qwen3.7-coder-plus`, `qwen3.7-vl-plus` and
+ * so on. The endpoint answers **three**, and running the probe against the live site is what
+ * showed it. Guessing a catalog is the same fault as guessing a capability: the card would have
+ * advertised models that do not exist and offered turns guaranteed to fail, with nothing on the
+ * page to say why. Qwen publishes no context length on this endpoint, so none is claimed.
+ */
+export const QWEN_WEB_MODELS = [
+    { id: 'qwen3.7-plus', providerId: qwenWebProviderId },
+    { id: 'qwen3.8-max', providerId: qwenWebProviderId },
+    { id: 'qwen3.8-omni-flash', providerId: qwenWebProviderId },
+];
+//# sourceMappingURL=qwen-web.js.map

package/dist/adapters/qwen-web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qwen-web.js","sourceRoot":"","sources":["../../src/adapters/qwen-web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAC7C,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAEnC,yFAAyF;AACzF,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,kBAAkB;IAC1B,iBAAiB,EAAE,gBAAgB;IACnC,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,GAAG,WAAW,GAAG;IAC1B,WAAW,EAAE,yCAAyC;IACtD,kBAAkB,EAAE,IAAI;IACxB,oBAAoB,EAAE,SAAS;IAC/B,gBAAgB,EAAE,OAAO;IACzB,gBAAgB,EAAE,MAAM;IACxB,gBAAgB,EAAE,aAAa;CACvB,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,mGAAmG;AACnG,MAAM,kBAAkB,GACtB,2GAA2G,CAAC;AAE9G,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,4CAA4C,EAAE;YACvF,UAAU,EAAE,iBAAiB;YAC7B,aAAa,EAAE,4CAA4C;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,qFAAqF;IACrF,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,iFAAiF,EAAE;YAC5H,UAAU,EAAE,iBAAiB;YAC7B,aAAa,EAAE,iFAAiF;SACjG,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,IAAI,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,6EAA6E,EAAE;YACxH,UAAU,EAAE,iBAAiB;YAC7B,aAAa,EAAE,6EAA6E;SAC7F,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,MAAM,GAAG,OAA8E,CAAC;IAC9F,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;IACrC,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;SACpG,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB;IAClC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,IAAI,GAAI,OAA8B,CAAC,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAE,IAA2B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,IAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxI,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAE,GAAwB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAChG,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,SAAwB,EACxB,MAAoB,EACpB,UAAkC,EAAE;IAEpC,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,CAAC,QAAgC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,GAAG,mBAAmB;QACtB,MAAM;QACN,YAAY,EAAE,kBAAkB;QAChC,GAAG,KAAK;KACT,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACzC,IAAI,MAAM;QAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAEhB,MAAM,GAAG,GAAG,KAAK,EAAE,GAAW,EAAE,IAAgF,EAAE,EAAE;QAClH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAU;gBAChD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG;gBACH,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,iBAAiB;gBAC7B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,SAA+B,EAAE,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yFAAyF;YACzF,oFAAoF;YACpF,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvG,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH;;;;;;WAMG;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,gBAAgB,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClG,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,WAAW,iBAAiB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAEnG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,WAAW,GAAG,SAAS,EAAE,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACzH,CAAC,CAAC;QAEH,4FAA4F;QAC5F,0CAA0C;QAC1C,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,2FAA2F;QAC3F,sCAAsC;QACtC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC;QAC/D,MAAM,UAAU,GAAG,WAAW,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAExD,qFAAqF;QACrF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAE,IAAI,CAAC,IAA0B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,IAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;QAChF,MAAM,MAAM,GACV,IAAI,CAAC,KAAK;eACP,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;eACzE,WAAW;eACX,sBAAsB,IAAI,CAAC,MAAM,GAAG,CAAC;QAE1C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAY;IACtC,EAAE,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE;IACrD,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAE;IACpD,EAAE,EAAE,EAAE,oBAAoB,EAAE,UAAU,EAAE,iBAAiB,EAAE;CAC5D,CAAC"}

package/dist/index.d.ts

@@ -18,5 +18,6 @@ export * from './adapters/kiro.js';
 export * from './adapters/chatgpt-web.js';
 export * from './adapters/deepseek-pow.js';
 export * from './adapters/deepseek-web.js';
+export * from './adapters/qwen-web.js';
 export * from './url.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC"}

package/dist/index.js

@@ -18,5 +18,6 @@ export * from './adapters/kiro.js';
 export * from './adapters/chatgpt-web.js';
 export * from './adapters/deepseek-pow.js';
 export * from './adapters/deepseek-web.js';
+export * from './adapters/qwen-web.js';
 export * from './url.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hilbras/omnihilbras",
-  "version": "1.11.3",
+  "version": "1.12.1",
   "description": "Typed provider SDK for the OmniHilbras gateway: normalized chat, streaming, model listing, and capability contracts for OpenAI, Anthropic, Gemini, and OpenAI-compatible providers.",
   "license": "MIT",
   "author": "Hilbras",