dsh-router-qoder 0.0.0-stage → 0.1.1

package/lib/index.js

@@ -0,0 +1,1766 @@
+import { createCipheriv, createHash, publicEncrypt, randomBytes, randomUUID } from "node:crypto";
+// src/cosy.ts
+/**
+* Qoder「cosy」协议原语 —— 自定义 base64、请求签名、RSA/AES 会话、设备指纹。
+*
+* 这里只有**无状态纯函数 + 加密原语**，一行网络调用都没有；流程在 upstream.ts。
+*
+* 协议来源（社区逆向 + 官方产物核对，均为 MIT）：
+*   - dingminhua/dsh-connect-qoder 的 `src/cosy.ts`（本文件的移植来源，逐字节对齐）；
+*   - fengyinxia/qoder2api 的 `qoder_auth.py`（PAT→jobToken 交换、cosy 签名、
+*     自定义 base64、RSA/AES 会话构建，CN 网关实测可用）；
+*   - x_Zhengyuuuui/qoder2api（Go）的 `internal/cosy/*`（同一协议 + 指纹派生 +
+*     CN/Global 双区域端点）。
+*
+* ⚠️ 这份文件里几乎所有常量都是**上游的字节**（字母表、公钥、签名格式、
+* 会话载荷的键序）。它们看起来可以「整理得更整齐」，但每一个都直接决定
+* 网关认不认这个请求 —— 改任何一个字母都会变成 401 `Signature invalid`。
+*/
+/** cosy 自定义 base64 字母表（与 qoder2api 逐字节一致）。 */
+const CUSTOM_ALPHABET = "_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!";
+const STD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const stdToCustom = /* @__PURE__ */ new Map();
+const customToStd = /* @__PURE__ */ new Map();
+for (let i = 0; i < 64; i += 1) {
+	stdToCustom.set(STD_ALPHABET[i], CUSTOM_ALPHABET[i]);
+	customToStd.set(CUSTOM_ALPHABET[i], STD_ALPHABET[i]);
+}
+stdToCustom.set("=", "$");
+customToStd.set("$", "=");
+/**
+* cosy 自定义 base64 编码：标准 base64 → 按 `n/3` 三块重排 → 逐字符换字母表。
+*
+* 重排是 `std.slice(n-a) + std.slice(a, n-a) + std.slice(0, a)`，`a = floor(n/3)`。
+* 这不是「混淆一下」：网关按同样的顺序反解，顺序错一位整段就是乱码。
+*/
+function cosyEncode(plaintext) {
+	const std = Buffer.from(plaintext).toString("base64");
+	const n = std.length;
+	const a = Math.floor(n / 3);
+	const rearranged = std.slice(n - a) + std.slice(a, n - a) + std.slice(0, a);
+	let out = "";
+	for (const ch of rearranged) {
+		const mapped = stdToCustom.get(ch);
+		if (mapped === void 0) throw new Error(`cosy encode: char out of alphabet: ${ch}`);
+		out += mapped;
+	}
+	return out;
+}
+/** RFC1123 的当前 UTC 时刻（旧式签名的 `date` 头）。 */
+function currentRfc1123Date() {
+	return (/* @__PURE__ */ new Date()).toUTCString();
+}
+function md5Hex(input) {
+	return createHash("md5").update(input, "utf8").digest("hex");
+}
+function sha512Base64Url(input) {
+	return createHash("sha512").update(input, "utf8").digest("base64url");
+}
+const COSY_APPCODE = "cosy";
+/** base64("war, war never changes") —— appcode 的密钥，名字就是这串字面量。 */
+const COSY_SECRET_B64 = "d2FyLCB3YXIgbmV2ZXIgY2hhbmdlcw==";
+/** 旧式请求签名（jobToken 交换用）：`md5("cosy&<secret>&<rfc1123date>")`。 */
+function signLegacy(date) {
+	return md5Hex(`${COSY_APPCODE}&${COSY_SECRET_B64}&${date}`);
+}
+/** 网关公钥（客户端用它加密会话临时密钥）。与 qoder2api / Go 克隆一致。 */
+const SERVER_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
+4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
+6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
+XcW+ML9FoCI6AOvOzwIDAQAB
+-----END PUBLIC KEY-----`;
+/** cosy 版本号（客户端身份的一部分，与 qoder2api 实测一致）。 */
+const COSY_VERSION = "0.1.43";
+/** AES-128-CBC + PKCS7（IV = key，上游如此）。 */
+function aesCbcEncrypt(plain, key) {
+	const iv = key;
+	const blockSize = 16;
+	const padLen = blockSize - plain.length % blockSize;
+	const padded = new Uint8Array(plain.length + padLen);
+	padded.set(plain);
+	padded.fill(padLen, plain.length);
+	const cipher = createCipheriv("aes-128-cbc", key, iv);
+	return new Uint8Array(Buffer.concat([cipher.update(padded), cipher.final()]));
+}
+/** RSA PKCS1v1.5 加密（用网关公钥加密会话临时密钥）。 */
+function rsaEncrypt(plain) {
+	const out = publicEncrypt({
+		key: SERVER_PUBKEY_PEM,
+		padding: 1
+	}, Buffer.from(plain));
+	return new Uint8Array(out);
+}
+/** 从 jobToken 响应构建会话身份（字段名见 upstream 的交换实现）。 */
+function identityFromJobToken(jobToken) {
+	return {
+		name: String(jobToken.name ?? ""),
+		aid: String(jobToken.id ?? ""),
+		uid: String(jobToken.id ?? ""),
+		yx_uid: "",
+		organization_id: "",
+		organization_name: "",
+		user_type: String(jobToken.userType ?? "personal_standard"),
+		security_oauth_token: String(jobToken.securityOauthToken ?? ""),
+		refresh_token: String(jobToken.refreshToken ?? "")
+	};
+}
+/** 身份载荷（键序固定：上游按这份 JSON 原样 AES，键序变了密文就变了）。 */
+function identityPayload(identity) {
+	return {
+		name: identity.name,
+		aid: identity.aid,
+		uid: identity.uid,
+		yx_uid: identity.yx_uid,
+		organization_id: identity.organization_id,
+		organization_name: identity.organization_name,
+		user_type: identity.user_type,
+		security_oauth_token: identity.security_oauth_token,
+		refresh_token: identity.refresh_token
+	};
+}
+/** 新会话：随机临时密钥 → RSA 得 cosyKey → AES 身份载荷得 info。 */
+function newCosySession(identity, fingerprint) {
+	const tempKey = new Uint8Array(Buffer.from(randomBytes(16).toString("hex").slice(0, 16), "utf8"));
+	const cosyKey = Buffer.from(rsaEncrypt(tempKey)).toString("base64");
+	const payload = JSON.stringify(identityPayload(identity));
+	return {
+		tempKey,
+		cosyKey,
+		info: Buffer.from(aesCbcEncrypt(new Uint8Array(Buffer.from(payload, "utf8")), tempKey)).toString("base64"),
+		identity,
+		machineId: fingerprint.machineId,
+		machineToken: fingerprint.machineToken,
+		machineType: fingerprint.machineType
+	};
+}
+/**
+* Bearer 载荷：`{cosyVersion, ideVersion, info, requestId, version}` 的**标准**
+* base64，键按字典序排（上游解析时依赖这个顺序，与 qoder2api 一致）。
+*
+* 注意这里是标准 base64 而不是 {@link cosyEncode} —— 两个编码用在两个不同地方，
+* 混用会得到「签名对、载荷读不出」这种最难查的 401。
+*/
+function buildPayloadB64(info) {
+	const payload = {
+		cosyVersion: COSY_VERSION,
+		ideVersion: "",
+		info,
+		requestId: randomUUID(),
+		version: "v1"
+	};
+	const sorted = Object.fromEntries(Object.entries(payload).sort(([a], [b]) => a < b ? -1 : 1));
+	return Buffer.from(JSON.stringify(sorted)).toString("base64");
+}
+/** 请求签名：`md5(payloadB64 \n cosyKey \n date \n body \n pathWithoutAlgo)`。 */
+function signRequest(payloadB64, cosyKey, cosyDate, body, pathSig) {
+	return md5Hex(`${payloadB64}\n${cosyKey}\n${cosyDate}\n${body}\n${pathSig}`);
+}
+/** `Authorization: Bearer COSY.<payloadB64>.<sig>`。 */
+function composeBearer(payloadB64, sig) {
+	return `Bearer COSY.${payloadB64}.${sig}`;
+}
+/** 签名用的路径：去掉 `/algo` 前缀、丢掉查询串。 */
+function pathSigFrom(fullUrl) {
+	let path;
+	try {
+		path = new URL(fullUrl).pathname;
+	} catch {
+		path = fullUrl;
+	}
+	return path.startsWith("/algo") ? path.slice(5) : path;
+}
+/**
+* 派生设备指纹：以账号 UID（还没有 UID 时用凭据本身）为种子单向哈希。
+*
+* 同一个账号每次派生结果必须一致 —— 网关把这三件套当「这台机器」，每次请求都换
+* 一个新身份反而是异常信号。`uid` 未知时用 `cred:<PAT>` 兜底，保证同一凭据稳定。
+*/
+function deriveFingerprint(uid, credential, installSalt) {
+	const seed = uid !== "" ? uid : `cred:${credential}`;
+	const salted = installSalt ? `${seed}|salt:${installSalt}` : seed;
+	return {
+		machineId: md5Hex(`machine:${salted}`),
+		machineType: md5Hex(`machinetype:${salted}`).slice(0, 18),
+		machineToken: sha512Base64Url(`machinetoken:${salted}`).slice(0, 43)
+	};
+}
+// src/messages.ts
+/**
+* 一份全新的请求体。**每个请求都要新建**（ID 字段必须各自唯一，复用会被上游
+* 当成重复请求）。
+*/
+function createChatBodyTemplate() {
+	return {
+		request_id: "",
+		request_set_id: "",
+		chat_record_id: "",
+		stream: true,
+		chat_task: "FREE_INPUT",
+		chat_context: {
+			extra: {
+				modelConfig: {
+					is_reasoning: false,
+					key: "lite"
+				},
+				originalContent: {
+					type: "text",
+					text: ""
+				}
+			},
+			text: {
+				type: "text",
+				text: ""
+			}
+		},
+		session_id: "",
+		source: 1,
+		version: "3",
+		aliyun_user_type: "personal_standard",
+		session_type: "qodercli",
+		agent_id: "agent_common",
+		task_id: "common",
+		model_config: {
+			key: "lite",
+			is_vl: false,
+			is_reasoning: false,
+			source: "system"
+		},
+		messages: [],
+		business: {
+			id: "",
+			name: "hi",
+			begin_at: 0
+		}
+	};
+}
+/** 模型 key / 图像能力 / 用户类型三处一起改（漏一处就会被网关当成别的模型）。 */
+function applyModelKey(body, key, userType, isVl) {
+	body.model_config.key = key;
+	body.model_config.is_vl = isVl;
+	body.chat_context.extra.modelConfig.key = key;
+	body.aliyun_user_type = userType;
+}
+/**
+* 每条消息都要带的「假回执」。
+*
+* 上游把消息当成**历史回执**读：缺 `response_meta` / `reasoning_content_signature`
+* 的 assistant 消息会被当成格式异常的记录。这里给一份全零的合法骨架，与官方
+* 客户端的形状一致。
+*/
+function blankResponseMeta() {
+	return {
+		id: "",
+		usage: {
+			prompt_tokens: 0,
+			completion_tokens: 0,
+			total_tokens: 0,
+			completion_tokens_details: { reasoning_tokens: 0 },
+			prompt_tokens_details: { cached_tokens: 0 }
+		}
+	};
+}
+function structuredMessage(role, text) {
+	return {
+		role,
+		content: text,
+		response_meta: blankResponseMeta(),
+		reasoning_content_signature: ""
+	};
+}
+function userMessage(text, images = []) {
+	const parts = [];
+	for (const url of images) parts.push({
+		type: "image_url",
+		image_url: { url }
+	});
+	if (text.trim()) parts.push({
+		type: "text",
+		text
+	});
+	if (parts.length === 0) parts.push({
+		type: "text",
+		text: ""
+	});
+	return {
+		role: "user",
+		content: "",
+		contents: parts,
+		response_meta: blankResponseMeta(),
+		reasoning_content_signature: ""
+	};
+}
+function toolMessage(message, text) {
+	const out = structuredMessage("tool", text);
+	if (typeof message.name === "string") out.name = message.name;
+	if (typeof message.tool_call_id === "string") out.tool_call_id = message.tool_call_id;
+	return out;
+}
+/** 取一条 OpenAI 消息的纯文本（content 字符串 / parts 数组 / value 字段）。 */
+function normalizeMessageText(message) {
+	const content = message.content;
+	if (typeof content === "string") return content;
+	if (Array.isArray(content)) {
+		const parts = [];
+		for (const part of content) {
+			if (typeof part === "string") {
+				parts.push(part);
+				continue;
+			}
+			if (part !== null && typeof part === "object") {
+				const p = part;
+				if (typeof p.text === "string") parts.push(p.text);
+				else if (typeof p.value === "string") parts.push(p.value);
+			}
+		}
+		return parts.join("");
+	}
+	return "";
+}
+/** user 消息里的图片 URL（只认 `image_url.url` part）。 */
+function extractMessageImages(message) {
+	if (message.role !== "user") return [];
+	const content = message.content;
+	if (!Array.isArray(content)) return [];
+	const urls = [];
+	for (const part of content) {
+		if (part === null || typeof part !== "object") continue;
+		const iu = part.image_url;
+		if (iu !== null && typeof iu === "object") {
+			const url = iu.url;
+			if (typeof url === "string") urls.push(url);
+		}
+	}
+	return urls;
+}
+const TOOL_CALLS_TEXT_RE = /Tool calls:\s*(\[[\s\S]*?\])/;
+/** 从文本里认回 `Tool calls: [...]`（有的宿主把 tool_calls 渲染成了文本）。 */
+function parseToolCallsText(text) {
+	if (!text) return void 0;
+	const m = TOOL_CALLS_TEXT_RE.exec(text);
+	if (!m?.[1]) return void 0;
+	try {
+		const parsed = JSON.parse(m[1]);
+		if (Array.isArray(parsed) && parsed.every((item) => item !== null && typeof item === "object")) return normalizeToolCalls(parsed);
+	} catch {
+		return;
+	}
+}
+/** `{id, name, input}` 形状 → OpenAI 的 `{id, type, function:{name, arguments}}`。 */
+function normalizeToolCalls(raw) {
+	return raw.map((tc) => {
+		if (tc !== null && typeof tc === "object" && !("function" in tc)) {
+			const r = tc;
+			if (r.id && r.name && r.input) return {
+				id: r.id,
+				type: "function",
+				function: {
+					name: r.name,
+					arguments: JSON.stringify(r.input)
+				}
+			};
+		}
+		return tc;
+	});
+}
+/**
+* 这条 assistant 消息后面有没有**真的** tool 结果。
+*
+* 只有「有回执」的 tool_calls 才能结构化下发：网关要求 assistant 的 tool_calls
+* 与 tool 消息配对出现，一条没有回执的 tool_calls 会被判成断链（与 OpenAI 的
+* 422 同类）。没有回执时改渲染成文本，模型仍然读得到。
+*/
+function hasResolvedToolResponse(messages, assistantIndex) {
+	const message = messages[assistantIndex];
+	if (message === void 0 || message.role !== "assistant") return false;
+	const tc = message.tool_calls;
+	if (!(Array.isArray(tc) && tc.length > 0) && !parseToolCallsText(normalizeMessageText(message))) return false;
+	for (let i = assistantIndex + 1; i < messages.length; i += 1) {
+		const next = messages[i];
+		if (next?.role === "tool") return true;
+		if (next !== void 0 && (next.role === "assistant" || next.role === "user" || next.role === "system")) return false;
+	}
+	return false;
+}
+function renderToolCalls(toolCalls) {
+	return `Tool calls:\n${JSON.stringify(toolCalls)}`;
+}
+function renderToolResult(message, text) {
+	const name = typeof message.name === "string" ? message.name : "";
+	const toolCallId = typeof message.tool_call_id === "string" ? message.tool_call_id : "";
+	let out = "Tool result";
+	if (name) out += ` (${name})`;
+	if (toolCallId) out += ` [${toolCallId}]`;
+	if (text.trim()) out += `:\n${text}`;
+	return out;
+}
+/**
+* 一条 OpenAI 消息 → Qoder 消息。`null` = 这条不携带任何内容（跳过）。
+*
+* `toolsEnabled` 表示这个请求带了 tools；`allowStructuredToolCalls` 表示这条
+* assistant 的 tool_calls 有配对回执、可以结构化下发（见
+* {@link hasResolvedToolResponse}）。
+*/
+function convertIncomingMessage(message, toolsEnabled, allowStructuredToolCalls) {
+	const role = typeof message.role === "string" ? message.role : "user";
+	const text = normalizeMessageText(message);
+	let structuredToolCalls;
+	if (toolsEnabled && allowStructuredToolCalls) {
+		const tc = Array.isArray(message.tool_calls) && message.tool_calls.length > 0 ? message.tool_calls : parseToolCallsText(text);
+		if (tc) structuredToolCalls = tc;
+	}
+	if (role === "assistant" && structuredToolCalls) {
+		const out = structuredMessage("assistant", text);
+		out.tool_calls = structuredToolCalls;
+		return out;
+	}
+	if (role === "tool") {
+		if (toolsEnabled) return toolMessage(message, text);
+		return structuredMessage("user", renderToolResult(message, text));
+	}
+	let finalText = text;
+	if (role === "assistant" && !toolsEnabled && Array.isArray(message.tool_calls) && message.tool_calls.length > 0) finalText = [text, renderToolCalls(message.tool_calls)].filter(Boolean).join("\n\n");
+	const images = role === "user" ? extractMessageImages(message) : [];
+	if (!finalText.trim() && images.length === 0) return null;
+	if (role === "user") return userMessage(images.length > 0 ? finalText.split("\n\n").filter((s) => !s.trim().startsWith("[image] ")).join("\n\n") : finalText, images);
+	return structuredMessage(role, finalText);
+}
+/** OpenAI messages → Qoder messages。 */
+function buildQoderMessages(incoming, prompt, toolsEnabled) {
+	const rebuilt = [];
+	for (let i = 0; i < incoming.length; i += 1) {
+		const allowStructured = toolsEnabled && hasResolvedToolResponse(incoming, i);
+		const converted = convertIncomingMessage(incoming[i], toolsEnabled, allowStructured);
+		if (converted !== null) rebuilt.push(converted);
+	}
+	if (rebuilt.length === 0 && prompt.trim()) rebuilt.push(userMessage(prompt));
+	return rebuilt;
+}
+/** 最后一条 user 消息的纯文本（`business.name` 用它，官方客户端也这么填）。 */
+function extractLatestUserPrompt(messages) {
+	for (let i = messages.length - 1; i >= 0; i -= 1) {
+		const m = messages[i];
+		if (m?.role === "user") {
+			const text = normalizeMessageText(m);
+			if (text.trim()) return text;
+		}
+	}
+	return "";
+}
+/** 深拷贝（模板必须逐请求独立，否则并发请求会互相改对方的 ID）。 */
+function deepClone(value) {
+	return structuredClone(value);
+}
+// src/upstream.ts
+/**
+* Qoder 上游客户端 —— cosy 签名请求、jobToken 交换、模型目录、SSE 聊天、用量、签到。
+*
+* 端点（CN / Global 各自一个网关主机，chat/models/jobToken 共用它）：
+*
+* ```text
+*         gateway            chat                     models                    jobToken
+* CN      gateway.qoder.com.cn  /algo/api/v2/service/pro/sse/agent_chat_generation   /algo/api/v2/model/list   /algo/api/v3/user/jobToken
+* Global  api1.qoder.sh         （同上）                                            （同上）                  （同上）
+* ```
+*
+* 两个区域还各有一个 `openapi` 主机（`openapi.qoder.com.cn` / `openapi.qoder.sh`），
+* 承载 `sash` 那族接口（用量 `/sash/api/v2/me/usage`、活动
+* `/sash/api/v1/me/campaigns`）。
+*
+* **两条身份链并存，不要混用**（实测，两个区域都验证过）：
+*
+* | 面 | 认什么 |
+* | --- | --- |
+* | chat / models（cosy 协议面） | `Authorization: Bearer COSY.<payload>.<sig>` + `cosy-*` 头 |
+* | usage / campaigns（sash 面） | `Authorization: Bearer <jobToken.securityOauthToken>`，**不收** cosy 头 |
+*
+* 拿错凭据的症状是「聊天正常、积分永远 401」，而令牌明明没过期 —— 所以这里是
+* 两套请求构造，不是一套加分支。
+*
+* 协议来源：dingminhua/dsh-connect-qoder（MIT）的 `src/upstream.ts`，其端点为
+* 社区多方实测（qoder2api 系列 + 官方 SDK 产物核对）。
+*
+* @module dsh-router-qoder/upstream
+*/
+const CHAT_PATH = "/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1";
+const MODELS_PATH = "/algo/api/v2/model/list?Encode=1";
+const JOB_TOKEN_PATH = "/algo/api/v3/user/jobToken?Encode=1";
+/**
+* 每日签到走 `sash` 的**活动**接口，路径里没有「签到」二字（叫 campaigns）。
+* 照着 checkin / signin / reward 猜是猜不到的（实测猜了 13 个全 404）——
+* 注意是 **v1**，用量那套是 v2。
+*/
+const CAMPAIGNS_PATH = "/sash/api/v1/me/campaigns";
+const USAGE_PATH = "/sash/api/v2/me/usage";
+/** sash 面要求的客户端标识（参考实现如此，缺了会被拒）。 */
+const SASH_CLIENT_TYPE = "10";
+const SASH_USER_AGENT = "Qoder";
+const QODER_REGIONS = {
+	cn: {
+		gateway: "https://gateway.qoder.com.cn",
+		openapi: "https://openapi.qoder.com.cn",
+		chatPath: CHAT_PATH,
+		modelsPath: MODELS_PATH,
+		jobTokenPath: JOB_TOKEN_PATH,
+		campaignsPath: CAMPAIGNS_PATH,
+		requiresDeviceRisk: false
+	},
+	global: {
+		gateway: "https://api1.qoder.sh",
+		openapi: "https://openapi.qoder.sh",
+		chatPath: CHAT_PATH,
+		modelsPath: MODELS_PATH,
+		jobTokenPath: JOB_TOKEN_PATH,
+		campaignsPath: CAMPAIGNS_PATH,
+		requiresDeviceRisk: true
+	}
+};
+var QoderError = class extends Error {
+	kind;
+	status;
+	code;
+	constructor(kind, message, status = 0, code) {
+		super(message);
+		this.name = "QoderError";
+		this.kind = kind;
+		this.status = status;
+		this.code = code;
+	}
+};
+function isQoderError(error) {
+	return error instanceof QoderError;
+}
+/** 我们的 `BadRequest` 之外，所有 `QoderError` 都已经带 kind，这里只做透传收口。 */
+function asQoderError(error) {
+	if (isQoderError(error)) return error;
+	return new QoderError("network", error instanceof Error ? error.message : String(error), 0);
+}
+const CONTENT_POLICY_MARKERS = [
+	"DataInspectionFailed",
+	"inappropriate content",
+	"input text data may contain",
+	"ContentFilter",
+	"SensitiveContent"
+];
+function isContentPolicy(detail) {
+	return CONTENT_POLICY_MARKERS.some((marker) => detail.includes(marker));
+}
+/** 官方码表里的「用量与配额」族 —— 等周期重置或补额度，**不是**凭据问题。 */
+const QUOTA_CODES = /* @__PURE__ */ new Set([
+	"110",
+	"113",
+	"115",
+	"116",
+	"117",
+	"118",
+	"119",
+	"122",
+	"402",
+	"6004"
+]);
+/** 416 范围/结构无法满足 · 430 能力不支持 · 80411 输入过长 · 80412 媒体过多。 */
+const REQUEST_CODES = /* @__PURE__ */ new Set([
+	"416",
+	"430",
+	"80411",
+	"80412"
+]);
+/** 500 请求失败 / 10408 超时 / 10500 模型服务内部错误 / 10605 排队。 */
+const TRANSIENT_CODES = /* @__PURE__ */ new Set([
+	"500",
+	"10408",
+	"10500",
+	"10605"
+]);
+function classifyBusinessCode(code) {
+	if (code === "105") return "auth";
+	if (QUOTA_CODES.has(code)) return "quota-exhausted";
+	if (code === "406") return "content-policy";
+	if (REQUEST_CODES.has(code)) return "invalid-request";
+	if (TRANSIENT_CODES.has(code)) return "transient";
+	return "unknown";
+}
+function classifyHttpStatus(status, detail) {
+	if (isContentPolicy(detail)) return "content-policy";
+	if (status === 401 || status === 403) return "auth";
+	if (status === 429) return "rate-limited";
+	if (status === 400) return "invalid-request";
+	if (status === 418 || status >= 500) return "transient";
+	return "unknown";
+}
+function parseJson(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+/** 取业务码（字符串或整数两种写法都归一成字符串）。 */
+function businessCodeOf(detail) {
+	const parsed = parseJson(detail.trim());
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
+	const raw = parsed.code;
+	if (typeof raw === "string" && raw !== "") return raw;
+	if (typeof raw === "number" && Number.isInteger(raw)) return String(raw);
+}
+/**
+* 取**最深一层认识的**业务码。
+*
+* 上游的失败帧会层层套：外层 `{code:403, message:"{\"code\":\"10605\",…}"}` ——
+* 外层那个 403 是 HTTP 语义，真码（10605 排队）藏在 message 里。只看最外层就会
+* 把「排队一分钟」判成「凭据被拒」，进而把一个几分钟就自愈的号判死。
+*
+* 三条纪律：只沿 `message` 往里走（不遍历 error/data/result，否则会把外层 HTTP
+* 码当业务码）；认不出的码记下来继续找；找不到就回落 HTTP 状态分类。
+*/
+const MAX_CODE_NESTING = 6;
+function deepestBusinessCode(detail) {
+	let text = detail.trim();
+	let fallback;
+	for (let depth = 0; depth < MAX_CODE_NESTING; depth += 1) {
+		if (!text.startsWith("{")) break;
+		const parsed = parseJson(text);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) break;
+		const record = parsed;
+		const code = businessCodeOf(text);
+		if (code !== void 0) {
+			if (classifyBusinessCode(code) !== "unknown") return code;
+			if (fallback === void 0) fallback = code;
+		}
+		const message = record.message;
+		if (typeof message !== "string") break;
+		text = message.trim();
+	}
+	return fallback;
+}
+/**
+* 一次失败的分类：**业务码优先于 HTTP 状态**。
+*
+* 实测：当日用量用尽回的是 `HTTP 403 {"code":"110","Billing daily count exceeded"}`。
+* 只看状态会判成「凭据被拒」，于是「今天用满、明天自愈」的号被要求换 PAT。
+*/
+function classifyFailure(status, detail) {
+	const code = deepestBusinessCode(detail);
+	if (code !== void 0) {
+		const byCode = classifyBusinessCode(code);
+		if (byCode !== "unknown") return byCode;
+	}
+	return classifyHttpStatus(status, detail);
+}
+function truncate(text, max) {
+	return text.length <= max ? text : `${text.slice(0, max)}…`;
+}
+/** jobToken 交换请求体（PAT 与 `drt-` refresh token 二选一，整体 cosy 编码）。 */
+function jobTokenBody(credential) {
+	const isRefresh = credential.startsWith("drt-");
+	const outer = {
+		payload: JSON.stringify({
+			personalToken: isRefresh ? "" : credential,
+			securityOauthToken: "",
+			refreshToken: isRefresh ? credential : "",
+			needRefresh: isRefresh,
+			authInfo: {}
+		}),
+		encodeVersion: "1"
+	};
+	return cosyEncode(new TextEncoder().encode(JSON.stringify(outer)));
+}
+/**
+* 解析一条 SSE 帧。
+*
+* 帧形状：`data: {"headers":{…},"body":"<内层 JSON>","statusCodeValue":200}`
+* 内层：`{"choices":[{"delta":{…}}],"usage":{…}}`，或业务错误
+* `{"code":"115","message":"…"}`。
+*
+* 返回 `undefined` = 这一帧没有可消费内容（`[DONE]` 之后的空帧、心跳等）。
+*/
+function parseStreamDelta(dataPayload) {
+	const wrapper = parseJson(dataPayload);
+	if (wrapper === null || typeof wrapper !== "object" || Array.isArray(wrapper)) return void 0;
+	const w = wrapper;
+	const scv = w.statusCodeValue;
+	if (scv !== void 0 && scv !== null && Number(scv) !== 200) {
+		const detail = typeof w.body === "string" ? w.body : dataPayload.slice(0, 400);
+		throw new QoderError(classifyFailure(Number(scv), detail), `上游信封错误: HTTP ${scv} ${truncate(detail, 300)}`, Number(scv), deepestBusinessCode(detail));
+	}
+	const innerStr = w.body;
+	if (typeof innerStr !== "string" || innerStr === "") return void 0;
+	const inner = parseJson(innerStr);
+	if (inner === null || typeof inner !== "object" || Array.isArray(inner)) return void 0;
+	const payload = inner;
+	if (typeof payload.code === "string" && payload.code !== "" && payload.code !== "0") throw new QoderError(classifyBusinessCode(payload.code), `上游业务错误 code=${payload.code}: ${String(payload.message ?? "")}`, 0, payload.code);
+	const usage = payload.usage;
+	const inputTokens = readCount2(usage, "prompt_tokens");
+	const outputTokens = readCount2(usage, "completion_tokens");
+	const cachedTokens = readCachedTokens(usage);
+	const tokens = cachedTokens === void 0 ? {
+		inputTokens,
+		outputTokens
+	} : {
+		inputTokens,
+		outputTokens,
+		cachedTokens
+	};
+	const choices = Array.isArray(payload.choices) ? payload.choices : [];
+	for (const ch of choices) {
+		if (ch === null || typeof ch !== "object") continue;
+		const delta = ch.delta;
+		if (delta === null || typeof delta !== "object") continue;
+		const d = delta;
+		const role = typeof d.role === "string" ? d.role : "";
+		const content = typeof d.content === "string" ? d.content : "";
+		const reasoning = typeof d.reasoning_content === "string" ? d.reasoning_content : "";
+		const toolCalls = Array.isArray(d.tool_calls) && d.tool_calls.length > 0 ? d.tool_calls : void 0;
+		if (role !== "" || content !== "" || reasoning !== "" || toolCalls !== void 0) return {
+			role,
+			content,
+			reasoningContent: reasoning,
+			toolCalls,
+			...tokens
+		};
+	}
+	if (inputTokens > 0 || outputTokens > 0) return {
+		role: "",
+		content: "",
+		reasoningContent: "",
+		toolCalls: void 0,
+		...tokens
+	};
+}
+function readCount2(usage, key) {
+	if (usage === null || typeof usage !== "object") return 0;
+	const v = usage[key];
+	return typeof v === "number" && Number.isFinite(v) ? v : 0;
+}
+/**
+* 读缓存命中的输入 token 数。三种拼法（OpenAI / DeepSeek / Kimi）取**第一个存在**
+* 的那个，不相加。
+*
+* 它是 `prompt_tokens` 的**子集**，不是额外增量 —— 加进去就把命中的前缀算两遍。
+* 返回 `undefined` 表示上游这帧没报，**不要**折成 0：那会让「没报」和「命中 0」
+* 变成同一个数字，百分比就不可信了。
+*/
+function readCachedTokens(usage) {
+	if (usage === null || typeof usage !== "object") return void 0;
+	const record = usage;
+	const details = record.prompt_tokens_details;
+	if (details !== null && typeof details === "object" && !Array.isArray(details)) {
+		const fromDetails = readNonNegative(details.cached_tokens);
+		if (fromDetails !== void 0) return fromDetails;
+	}
+	const fromHit = readNonNegative(record.prompt_cache_hit_tokens);
+	if (fromHit !== void 0) return fromHit;
+	return readNonNegative(record.cached_tokens);
+}
+function readNonNegative(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+/** 解析用量响应（兼容 `qoderUsage` 内层与平铺两种形状）。 */
+function parseUsage(data) {
+	const inner = data.qoderUsage;
+	const source = inner !== null && typeof inner === "object" && !Array.isArray(inner) ? inner : data;
+	const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
+	const bucket = (value) => {
+		if (value === null || typeof value !== "object") return void 0;
+		const v = value;
+		return {
+			total: num(v.total),
+			used: num(v.used),
+			remaining: num(v.remaining)
+		};
+	};
+	const out = { isQuotaExceeded: source.isQuotaExceeded === true };
+	const userType = source.userType;
+	if (typeof userType === "string") out.userType = userType;
+	const expiresAt = num(source.expiresAt);
+	if (expiresAt !== void 0) out.expiresAt = expiresAt;
+	const userQuota = bucket(source.userQuota);
+	if (userQuota !== void 0) out.userQuota = userQuota;
+	const addOn = bucket(source.addOnQuota);
+	if (addOn !== void 0) out.addOnQuota = addOn;
+	const org = source.orgResourcePackage;
+	if (org !== null && typeof org === "object") {
+		const o = org;
+		out.orgResourcePackage = {
+			used: num(o.used),
+			cap: num(o.cap),
+			remaining: num(o.remaining),
+			available: o.available === true
+		};
+	}
+	return out;
+}
+const DEFAULT_HEADERS = {
+	"cosy-data-policy": "agree",
+	"content-type": "application/json",
+	"cosy-clienttype": "5",
+	"login-version": "v2",
+	"user-agent": "Go-http-client/2.0",
+	"cosy-scene": "assistant",
+	"cosy-business-product": "ide",
+	"cosy-business-type": "agent"
+};
+/**
+* 一个区域的 Qoder 客户端。
+*
+* 会话按**凭据**缓存（账号池里多个 PAT 各有各的 cosy 会话，用一个字段会互相覆盖）。
+*/
+var QoderClient = class {
+	region;
+	config;
+	log;
+	fetchImpl;
+	sessions = /* @__PURE__ */ new Map();
+	constructor(region, options = {}) {
+		this.region = region;
+		this.config = QODER_REGIONS[region];
+		this.log = options.log ?? (() => {});
+		this.fetchImpl = options.fetch ?? globalThis.fetch;
+	}
+	/** 会话是否还可用（提前 5 分钟视为过期，给续期留时间）。 */
+	sessionValid(credential, now = Date.now()) {
+		const s = this.sessions.get(credential);
+		if (s === void 0) return false;
+		return s.expireAtMs - now > 3e5;
+	}
+	/** 丢掉某个凭据的会话（凭据换掉 / 被判失效时用）。 */
+	forget(credential) {
+		this.sessions.delete(credential);
+	}
+	/**
+	* 用 PAT（`pt-…`）或 refresh token（`drt-…`）换 jobToken，并建立 cosy 会话。
+	*
+	* 这一步用**旧式签名**（`date` + `signature: md5("cosy&<secret>&<date>")`）而不是
+	* chat 那套 Bearer，头里还要带设备指纹三件套。指纹以凭据为种子派生：这时候
+	* 还没拿到 uid，但同一凭据必须得到同一个指纹。
+	*/
+	async exchangeJobToken(credential) {
+		const fingerprint = deriveFingerprint("", credential);
+		const body = jobTokenBody(credential);
+		const date = currentRfc1123Date();
+		const url = `${this.config.gateway}${this.config.jobTokenPath}`;
+		let resp;
+		try {
+			resp = await this.fetchImpl(url, {
+				method: "POST",
+				headers: {
+					"cosy-machinetoken": fingerprint.machineToken,
+					"cosy-machinetype": fingerprint.machineType,
+					"login-version": "v2",
+					appcode: "cosy",
+					accept: "application/json",
+					"accept-encoding": "identity",
+					"cosy-version": "0.1.43",
+					"cosy-clienttype": "5",
+					date,
+					signature: signLegacy(date),
+					"content-type": "application/json",
+					"cosy-machineid": fingerprint.machineId,
+					"user-agent": "Go-http-client/2.0"
+				},
+				body
+			});
+		} catch (error) {
+			throw asQoderError(error);
+		}
+		const text = await resp.text();
+		if (resp.status !== 200) throw new QoderError(classifyFailure(resp.status, text), `jobToken 交换失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status, deepestBusinessCode(text));
+		const data = parseJson(text);
+		if (data === null || typeof data !== "object" || Array.isArray(data)) throw new QoderError("unknown", `jobToken 响应不是 JSON: ${truncate(text, 200)}`, resp.status);
+		const raw = data;
+		const jobToken = {
+			id: String(raw.id ?? ""),
+			name: String(raw.name ?? ""),
+			expireTime: Number(raw.expireTime ?? 0),
+			securityOauthToken: String(raw.securityOauthToken ?? ""),
+			refreshToken: String(raw.refreshToken ?? ""),
+			userType: String(raw.userType ?? "personal_standard")
+		};
+		if (jobToken.id === "" && jobToken.securityOauthToken === "") throw new QoderError("auth", `jobToken 交换响应缺少身份字段: ${truncate(text, 200)}`, resp.status);
+		const session = {
+			cosy: newCosySession(identityFromJobToken(raw), fingerprint),
+			fingerprint,
+			jobToken,
+			expireAtMs: jobToken.expireTime > 0 ? jobToken.expireTime : 0
+		};
+		await this.refreshSashToken(credential, session);
+		this.sessions.set(credential, session);
+		this.log(`[${this.region}] jobToken ok: ${jobToken.name || jobToken.id}`);
+		return jobToken;
+	}
+	/**
+	* 换 sash 面专用令牌（`POST {openapi}/api/v1/jobToken/exchange`）。
+	*
+	* **不抛**：换不到就让 sash 面回落到 `securityOauthToken`（国内版两族等价）；
+	* 这一支失败只该让「积分/签到读不到」，不该把 chat 一起拖挂 —— 两条链路。
+	*
+	* body 的键是 `personal_token`：`personal_access_token` 那种拼写上游回 400。
+	*/
+	async refreshSashToken(credential, session) {
+		try {
+			const resp = await this.fetchImpl(`${this.config.openapi}/api/v1/jobToken/exchange`, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body: JSON.stringify({ personal_token: credential })
+			});
+			const text = await resp.text();
+			if (resp.status !== 200) {
+				this.log(`[${this.region}] sash 令牌交换失败 HTTP ${resp.status}（回落到旧令牌）`);
+				return;
+			}
+			const data = parseJson(text);
+			const raw = data !== null && typeof data === "object" && !Array.isArray(data) ? data : {};
+			const token = typeof raw.token === "string" && raw.token !== "" ? raw.token : typeof raw.job_token === "string" && raw.job_token !== "" ? raw.job_token : typeof raw.jobToken === "string" && raw.jobToken !== "" ? raw.jobToken : "";
+			if (token === "") {
+				this.log(`[${this.region}] sash 令牌响应里没有 token 字段`);
+				return;
+			}
+			session.sashToken = token;
+			const expiry = typeof raw.expires_at === "string" ? Date.parse(raw.expires_at) : NaN;
+			session.sashExpireAtMs = Number.isFinite(expiry) ? expiry : 0;
+		} catch (error) {
+			this.log(`[${this.region}] sash 令牌交换异常（回落到旧令牌）: ${String(error?.message ?? error).slice(0, 120)}`);
+		}
+	}
+	/** 确保有可用会话（过期才重新交换）。 */
+	async ensureSession(credential) {
+		if (this.sessionValid(credential)) return this.sessions.get(credential);
+		await this.exchangeJobToken(credential);
+		return this.sessions.get(credential);
+	}
+	/** 用一次真实交换验证 PAT，返回账号显示名（`addApiKey` 用它）。 */
+	async verifyCredential(credential) {
+		const jobToken = await this.exchangeJobToken(credential);
+		return {
+			id: jobToken.id,
+			name: jobToken.name,
+			userType: jobToken.userType
+		};
+	}
+	/**
+	* cosy 协议面的 GET（models 用）：与 chat 同一套 Bearer，body 为空串参与签名。
+	*/
+	async cosyGet(session, url) {
+		const pathSig = pathSigFrom(url);
+		const payloadB64 = buildPayloadB64(session.cosy.info);
+		const date = String(Math.floor(Date.now() / 1e3));
+		const sig = signRequest(payloadB64, session.cosy.cosyKey, date, "", pathSig);
+		let resp;
+		try {
+			resp = await this.fetchImpl(url, { headers: {
+				...DEFAULT_HEADERS,
+				"cosy-machinetype": session.cosy.machineType,
+				"cosy-date": date,
+				"cosy-user": session.cosy.identity.uid,
+				"cosy-key": session.cosy.cosyKey,
+				accept: "application/json",
+				authorization: composeBearer(payloadB64, sig),
+				"cosy-version": "0.1.43",
+				"cosy-machineid": session.cosy.machineId,
+				"cosy-machinetoken": session.cosy.machineToken
+			} });
+		} catch (error) {
+			throw asQoderError(error);
+		}
+		const text = await resp.text();
+		if (resp.status !== 200) throw new QoderError(classifyFailure(resp.status, text), `models 请求失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status, deepestBusinessCode(text));
+		const data = parseJson(text);
+		if (data === null || typeof data !== "object" || Array.isArray(data)) throw new QoderError("unknown", `models 响应不是 JSON: ${truncate(text, 200)}`, resp.status);
+		return data;
+	}
+	/**
+	* 模型目录。响应 `{chat:[{key, display_name, enable, is_vl, price_factor, …}], …}`。
+	*
+	* 过滤掉上游的 `auto`：它是该区的**默认路由**（请求时才决定解析成哪个模型），
+	* 价格与上下文都由别人临时决定，不是可以选择、也可以如实描述的模型。
+	*/
+	async fetchModels(credential) {
+		const session = await this.ensureSession(credential);
+		const data = await this.cosyGet(session, `${this.config.gateway}${this.config.modelsPath}`);
+		const rows = Array.isArray(data.chat) ? data.chat : [];
+		const out = [];
+		for (const row of rows) {
+			if (row === null || typeof row !== "object") continue;
+			const raw = row;
+			const key = typeof raw.key === "string" ? raw.key : "";
+			const displayName = typeof raw.display_name === "string" ? raw.display_name : "";
+			if (key === "" || displayName === "") continue;
+			if (key.toLowerCase() === "auto") continue;
+			const thinking = raw.thinking_config;
+			const efforts = [];
+			if (thinking !== null && typeof thinking === "object") {
+				const list = thinking.efforts;
+				if (Array.isArray(list)) {
+					for (const e of list) if (typeof e === "string" && e !== "") efforts.push(e);
+				}
+			}
+			out.push({
+				key,
+				displayName,
+				enable: raw.enable !== false,
+				isDefault: raw.is_default === true,
+				isVl: raw.is_vl === true,
+				isReasoning: raw.is_reasoning === true,
+				isFree: raw.is_free === true,
+				priceFactor: typeof raw.price_factor === "number" ? raw.price_factor : void 0,
+				maxInputTokens: typeof raw.max_input_tokens === "number" ? raw.max_input_tokens : void 0,
+				maxOutputTokens: typeof raw.max_output_tokens === "number" ? raw.max_output_tokens : void 0,
+				efforts
+			});
+		}
+		return out;
+	}
+	/**
+	* 建一条聊天 SSE 流（**原样**返回上游响应体，交给 sse.ts 转 OpenAI 格式）。
+	*
+	* 请求体是 Qoder 私有模板（见 messages.ts），签名的 body 段是**cosy 编码后的
+	* 密文**而不是原文 —— 这是最容易搞错的一处：签原文会得到 `Signature invalid`。
+	*/
+	async openChat(credential, modelKey, incoming, options) {
+		const session = await this.ensureSession(credential);
+		const template = deepClone(createChatBodyTemplate());
+		applyModelKey(template, modelKey, session.jobToken.userType, options.isVl === true);
+		if (options.reasoningEffort !== void 0 && options.reasoningEffort !== "") {
+			template.reasoningEffort = options.reasoningEffort;
+			template.parameters = {
+				...template.parameters ?? {},
+				reasoning_effort: options.reasoningEffort
+			};
+		}
+		const prompt = extractLatestUserPrompt(incoming);
+		const toolsEnabled = Array.isArray(options.tools) && options.tools.length > 0;
+		template.messages = buildQoderMessages(incoming, prompt, toolsEnabled);
+		if (toolsEnabled) template.tools = options.tools;
+		template.request_id = randomId();
+		template.chat_record_id = template.request_id;
+		template.request_set_id = randomId();
+		template.session_id = randomId();
+		template.business.id = randomId();
+		template.business.name = prompt.slice(0, 30) || "hi";
+		template.business.begin_at = Date.now();
+		const body = JSON.stringify(template);
+		const url = `${this.config.gateway}${this.config.chatPath}`;
+		const encoded = cosyEncode(new TextEncoder().encode(body));
+		const date = String(Math.floor(Date.now() / 1e3));
+		const payloadB64 = buildPayloadB64(session.cosy.info);
+		const sig = signRequest(payloadB64, session.cosy.cosyKey, date, encoded, pathSigFrom(url));
+		let resp;
+		try {
+			resp = await this.fetchImpl(url, {
+				method: "POST",
+				headers: {
+					...DEFAULT_HEADERS,
+					"cosy-machinetype": session.cosy.machineType,
+					"cosy-date": date,
+					"cosy-user": session.cosy.identity.uid,
+					"cosy-key": session.cosy.cosyKey,
+					"cache-control": "no-cache",
+					accept: "text/event-stream",
+					authorization: composeBearer(payloadB64, sig),
+					"cosy-version": "0.1.43",
+					"cosy-machineid": session.cosy.machineId,
+					"cosy-machinetoken": session.cosy.machineToken,
+					"x-model-key": modelKey,
+					"x-model-source": "system"
+				},
+				body: encoded,
+				...options.signal === void 0 ? {} : { signal: options.signal }
+			});
+		} catch (error) {
+			throw asQoderError(error);
+		}
+		if (resp.status !== 200) {
+			const text = await resp.text();
+			throw new QoderError(classifyFailure(resp.status, text), `聊天请求失败: HTTP ${resp.status} ${truncate(text, 300)}`, resp.status, deepestBusinessCode(text));
+		}
+		if (resp.body === null) throw new QoderError("transient", "聊天响应没有 body", resp.status);
+		return resp.body;
+	}
+	/** sash 面的 GET：`Authorization: Bearer <sashToken || securityOauthToken>`。 */
+	async sashGet(session, url) {
+		const token = this.sashBearer(session);
+		if (token === "") throw new QoderError("auth", "两次令牌交换都没拿到可用令牌，无法访问 sash 接口", 401);
+		let resp;
+		try {
+			resp = await this.fetchImpl(url, { headers: {
+				accept: "application/json",
+				authorization: `Bearer ${token}`,
+				"cosy-clienttype": SASH_CLIENT_TYPE,
+				"user-agent": SASH_USER_AGENT
+			} });
+		} catch (error) {
+			throw asQoderError(error);
+		}
+		return this.readSash(resp, url);
+	}
+	async readSash(resp, url) {
+		const text = await resp.text();
+		if (resp.status !== 200 && resp.status !== 201) {
+			if (this.config.requiresDeviceRisk && (resp.status === 401 || resp.status === 403)) throw new QoderError("auth", `该区域的积分/签到需要本机 Qoder 客户端的设备风控组件（${url}），本插件不伪造它`, resp.status, deepestBusinessCode(text));
+			throw new QoderError(classifyFailure(resp.status, text), `sash 请求失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status, deepestBusinessCode(text));
+		}
+		const data = parseJson(text);
+		if (data === null || typeof data !== "object" || Array.isArray(data)) throw new QoderError("unknown", `sash 响应不是 JSON: ${truncate(text, 200)}`, resp.status);
+		return data;
+	}
+	sashBearer(session) {
+		if (typeof session.sashToken === "string" && session.sashToken !== "") return session.sashToken;
+		return session.jobToken.securityOauthToken;
+	}
+	/** 剩余积分（基础包 + 加量包 + 企业包）。读不到返回 undefined（不是 0）。 */
+	async fetchUsage(credential) {
+		const session = await this.ensureSession(credential);
+		return parseUsage(await this.sashGet(session, `${this.config.openapi}${USAGE_PATH}`));
+	}
+	/** 活动列表（签到挑用）。 */
+	async fetchCampaigns(credential) {
+		const session = await this.ensureSession(credential);
+		const data = await this.sashGet(session, `${this.config.openapi}${this.config.campaignsPath}?forceRefresh=true`);
+		const rows = Array.isArray(data.campaigns) ? data.campaigns : Array.isArray(data.data?.campaigns) ? data.data.campaigns : [];
+		const out = [];
+		for (const row of rows) {
+			if (row === null || typeof row !== "object") continue;
+			const raw = row;
+			const campaignId = String(raw.campaignId ?? "");
+			if (campaignId === "") continue;
+			const benefit = raw.benefit;
+			const b = benefit !== null && typeof benefit === "object" ? benefit : {};
+			const validity = b.validity;
+			const v = validity !== null && typeof validity === "object" ? validity : {};
+			out.push({
+				campaignId,
+				actionType: String(raw.actionType ?? ""),
+				claimStatus: String(raw.claimStatus ?? ""),
+				...typeof b.amount === "number" ? { amount: b.amount } : {},
+				...typeof v.days === "number" ? { validityDays: v.days } : {},
+				...typeof raw.endAt === "number" ? { endAt: raw.endAt } : {}
+			});
+		}
+		return out;
+	}
+	/**
+	* 领取今天那份每日 Credits。
+	*
+	* 一次调用自足：先拉活动列表找出可领的那条，再领取。三种结果分得很清 ——
+	* `claimed` / `already-claimed`（幂等，不是错误）/ `unavailable`（今天上游没
+	* 下发活动，比如企业号或未开窗）。
+	*/
+	async claimDailyCredits(credential) {
+		const campaigns = await this.fetchCampaigns(credential);
+		const daily = campaigns.find((c) => c.actionType === "CLAIM_BENEFIT");
+		const claimable = campaigns.find((c) => c.actionType === "CLAIM_BENEFIT" && c.claimStatus === "CLAIMABLE");
+		if (claimable === void 0) return daily?.claimStatus === "CLAIMED" ? { status: "already-claimed" } : {
+			status: "unavailable",
+			message: "上游今日没有下发可领取的签到活动"
+		};
+		const session = await this.ensureSession(credential);
+		const url = `${this.config.openapi}${this.config.campaignsPath}/${encodeURIComponent(claimable.campaignId)}/claim`;
+		const token = this.sashBearer(session);
+		if (token === "") throw new QoderError("auth", "没有可用令牌，无法领取", 401);
+		let resp;
+		try {
+			resp = await this.fetchImpl(url, {
+				method: "POST",
+				headers: {
+					authorization: `Bearer ${token}`,
+					"cosy-clienttype": SASH_CLIENT_TYPE,
+					accept: "application/json",
+					"accept-language": "zh-CN",
+					"user-agent": SASH_USER_AGENT,
+					"content-type": "application/json",
+					origin: this.config.openapi
+				},
+				body: "{}"
+			});
+		} catch (error) {
+			throw asQoderError(error);
+		}
+		if (resp.status === 409) return { status: "already-claimed" };
+		const data = await this.readSash(resp, url);
+		if (String(data.status ?? "") === "CLAIMED") return {
+			status: "claimed",
+			...claimable.amount === void 0 ? {} : { amount: claimable.amount },
+			...claimable.validityDays === void 0 ? {} : { validityDays: claimable.validityDays }
+		};
+		return {
+			status: "unavailable",
+			message: `签到未完成（上游状态 ${String(data.status ?? "未知")}）`
+		};
+	}
+};
+function randomId() {
+	return globalThis.crypto.randomUUID();
+}
+// src/sse.ts
+/**
+* Qoder SSE → OpenAI SSE。
+*
+* 上游的帧是**一个信封套一层 OpenAI 形状**：
+*
+* ```text
+* data: {"headers":{…},"body":"{\"choices\":[{\"delta\":{\"content\":\"你\"}}]}","statusCodeValue":200}
+* ```
+*
+* 而 dsh-router 只接受 OpenAI SSE（它会把这个流 pipe 给客户端，也会在客户端要
+* 非流式时自己聚合）。所以这一层把信封拆开、把 delta 重新包成 OpenAI chunk，
+* 并在收尾补上 usage 与 `[DONE]`。
+*
+* 为什么要自己拼满这些字段：宿主聚合非流式响应时读的是
+* `choices[0].delta.tool_calls[].function.name` 与 `usage`，缺 `id`/`model`/
+* `created` 会让它拼出一个没有名字的工具调用（下游报 `unknown tool ""`）。
+*/
+/** 把一条 delta 转成 OpenAI chunk。 */
+function chunkOf(id, created, model, delta, finishReason = null) {
+	return `data: ${JSON.stringify({
+		id,
+		object: "chat.completion.chunk",
+		created,
+		model,
+		choices: [{
+			index: 0,
+			delta,
+			finish_reason: finishReason
+		}]
+	})}\n\n`;
+}
+/** delta → OpenAI `delta` 对象（只带上游真的给了的字段）。 */
+function deltaPayload(delta, first) {
+	const out = {};
+	if (first && delta.role !== "") out.role = delta.role;
+	if (delta.content !== "") out.content = delta.content;
+	if (delta.reasoningContent !== "") out.reasoning_content = delta.reasoningContent;
+	if (delta.toolCalls !== void 0) out.tool_calls = delta.toolCalls;
+	return Object.keys(out).length === 0 ? void 0 : out;
+}
+/** usage 帧：OpenAI 的最后一帧 `choices: []` + `usage`。 */
+function usageFrame(id, created, model, delta) {
+	const usage = {
+		prompt_tokens: delta.inputTokens,
+		completion_tokens: delta.outputTokens,
+		total_tokens: delta.inputTokens + delta.outputTokens
+	};
+	if (delta.cachedTokens !== void 0) usage.prompt_tokens_details = { cached_tokens: delta.cachedTokens };
+	return `data: ${JSON.stringify({
+		id,
+		object: "chat.completion.chunk",
+		created,
+		model,
+		choices: [],
+		usage
+	})}\n\n`;
+}
+/**
+* 包装上游响应体。返回的流**始终**以 `data: [DONE]\n\n` 收尾（正常与被拒都一样），
+* 这样客户端不会挂在那儿等一个永远不来的结束帧。
+*/
+function toOpenAiSse(body, options) {
+	const encoder = new TextEncoder();
+	const decoder = new TextDecoder();
+	const id = `chatcmpl-${globalThis.crypto.randomUUID()}`;
+	const created = Math.floor(Date.now() / 1e3);
+	let reader;
+	return new ReadableStream({
+		start: async (ctrl) => {
+			const emit = (text) => {
+				try {
+					ctrl.enqueue(encoder.encode(text));
+				} catch {}
+			};
+			emit(chunkOf(id, created, options.model, { role: "assistant" }));
+			reader = body.getReader();
+			let buffer = "";
+			let sawUsage = false;
+			let finished = false;
+			try {
+				for (;;) {
+					const { done, value } = await reader.read();
+					if (done) break;
+					buffer += decoder.decode(value, { stream: true });
+					const lines = buffer.split("\n");
+					buffer = lines.pop() ?? "";
+					for (const line of lines) {
+						const trimmed = line.trim();
+						if (trimmed === "" || !trimmed.startsWith("data:")) continue;
+						const payload = trimmed.slice(5).trim();
+						if (payload === "" || payload === "[DONE]") continue;
+						let delta;
+						try {
+							delta = parseStreamDelta(payload);
+						} catch (error) {
+							const qoderError = isQoderError(error) ? error : void 0;
+							emit(`data: ${JSON.stringify({ error: {
+								message: error instanceof Error ? error.message : String(error),
+								type: qoderError?.kind ?? "upstream_error",
+								code: qoderError?.code ?? null
+							} })}\n\n`);
+							if (qoderError !== void 0) options.onLateError?.(qoderError);
+							finished = true;
+							break;
+						}
+						if (delta === void 0) continue;
+						if (delta.inputTokens > 0 || delta.outputTokens > 0) sawUsage = true;
+						const payloadDelta = deltaPayload(delta, true);
+						if (payloadDelta !== void 0) emit(chunkOf(id, created, options.model, payloadDelta));
+						if (delta.inputTokens > 0 || delta.outputTokens > 0) emit(usageFrame(id, created, options.model, delta));
+					}
+					if (finished) break;
+				}
+				if (!finished) {
+					emit(chunkOf(id, created, options.model, {}, "stop"));
+					if (!sawUsage);
+				}
+			} catch (error) {
+				const qoderError = isQoderError(error) ? error : void 0;
+				emit(`data: ${JSON.stringify({ error: {
+					message: error instanceof Error ? error.message : String(error),
+					type: qoderError?.kind ?? "stream_error"
+				} })}\n\n`);
+				if (qoderError !== void 0) options.onLateError?.(qoderError);
+			} finally {
+				try {
+					reader.releaseLock();
+				} catch {}
+				emit("data: [DONE]\n\n");
+				try {
+					ctrl.close();
+				} catch {}
+			}
+		},
+		/** 取消必须往下传：不实现它，客户端断开后上游 TCP 连接会一直挂着。 */
+		cancel: (reason) => reader?.cancel(reason)
+	});
+}
+// src/core.ts
+/** 积分缓存 10 分钟（与 codebuddy 同口径）。 */
+const CREDITS_TTL_MS = 6e5;
+/** 拿不到积分时报它（**不是 0**）：核心据此保留上次持久化的值。 */
+const CREDITS_UNKNOWN = -1;
+/** 上游错误种类 → 契约的账号状态。 */
+function stateOf(kind) {
+	switch (kind) {
+		case "auth": return "session_dead";
+		case "quota-exhausted": return "quota";
+		case "rate-limited": return "rate_limit";
+		case "transient": return "rate_limit";
+		case "content-policy":
+		case "invalid-request": return "bad_request";
+		case "network": return "transport";
+		default: return "unknown";
+	}
+}
+/** 剩余额度：基础包 + 加量包 + 企业包（缺哪个算哪个；都缺 = undefined）。 */
+function remainingOf(usage) {
+	const parts = [];
+	for (const bucket of [
+		usage.userQuota,
+		usage.addOnQuota,
+		usage.orgResourcePackage
+	]) if (bucket !== void 0 && typeof bucket.remaining === "number" && Number.isFinite(bucket.remaining)) parts.push(bucket.remaining);
+	if (parts.length === 0) return void 0;
+	return Math.round(parts.reduce((a, b) => a + b, 0) * 100) / 100;
+}
+/** 消息里有没有图片（决定 `model_config.is_vl`）。只看 user 消息的 parts。 */
+function hasImageInput(messages) {
+	for (const m of messages) {
+		if (m === null || typeof m !== "object") continue;
+		const msg = m;
+		if (msg.role !== "user") continue;
+		const content = msg.content;
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (part === null || typeof part !== "object") continue;
+			const p = part;
+			if (p.type === "image_url" || p.type === "input_image") return true;
+		}
+	}
+	return false;
+}
+/** 按 profile 造一个供应商模块。 */
+function createSupplier(p) {
+	return function factory(env) {
+		const id = p.id;
+		const creds = env.credentials;
+		const store = env.store;
+		const log = env.log;
+		const client = new QoderClient(p.region, { log });
+		/** 积分缓存：uid → { value, at }。积分本身由核心持久化，这里只管内存 TTL。 */
+		const creditsCache = /* @__PURE__ */ new Map();
+		/** 正在拉积分的 uid：并发 status() 共享同一次请求。 */
+		const creditsInflight = /* @__PURE__ */ new Set();
+		/** 模型缓存 + 并发去重。 */
+		let modelsCache;
+		let modelsInflight;
+		function listUids() {
+			return creds.list(id);
+		}
+		function getCred(uid) {
+			return creds.get(id, uid);
+		}
+		/** 账号顺序：池顺序优先，未配置按凭证原始顺序。 */
+		function orderedUids() {
+			const all = listUids();
+			const order = store.get(id).poolOrder;
+			return [...order.filter((u) => all.includes(u)), ...all.filter((u) => !order.includes(u))];
+		}
+		/** 当前别名前缀（核心可能在 store 里覆盖默认值）。 */
+		function currentAlias() {
+			return store.get(id).alias || id;
+		}
+		/**
+		* 剥离本供应商的 alias 前缀。
+		*
+		* 只剥自己的（`qoder/xxx`），模型 id 自带的斜杠保留 —— 否则上游的
+		* `org/name` 会被剥成 `name`，请求必然 404。
+		*/
+		function stripAlias(model) {
+			const alias = currentAlias();
+			return alias !== "" && model.startsWith(`${alias}/`) ? model.slice(alias.length + 1) : model;
+		}
+		async function refreshCredits(uid) {
+			if (creditsInflight.has(uid)) return void 0;
+			const cred = getCred(uid);
+			if (cred === void 0) return void 0;
+			creditsInflight.add(uid);
+			try {
+				const usage = await client.fetchUsage(cred.pat);
+				if (usage === void 0) return void 0;
+				const value = remainingOf(usage);
+				if (value === void 0) return void 0;
+				creditsCache.set(uid, {
+					value,
+					at: Date.now()
+				});
+				return value;
+			} catch (error) {
+				if (isQoderError(error) && error.kind === "auth") log(`${p.errPrefix} credits ${uid}: ${error.message}`);
+				return;
+			} finally {
+				creditsInflight.delete(uid);
+			}
+		}
+		async function fetchModelsFromUpstream() {
+			for (const uid of orderedUids()) {
+				const cred = getCred(uid);
+				if (cred === void 0) continue;
+				try {
+					const list = await client.fetchModels(cred.pat);
+					if (list.length > 0) return list;
+				} catch (error) {
+					log(`${p.errPrefix} models ${uid}: ${error.message.slice(0, 160)}`);
+				}
+			}
+			return [];
+		}
+		/**
+		* 上游模型 → 契约的 `ModelInfo`。
+		*
+		* `id` 是上游 key（`qmodel_38max`）—— 组合里存的、请求里发的都是它；
+		* `name` 带上游的 `display_name`（`Qwen3.8-Max`），面板拿它做主标签。
+		* 不带 name 的话，面板上只剩一串猜不出含义的 key，「获取模型」之后
+		* 用户仍然不知道自己勾的是哪个模型。`context_length` 按 k 报，与别的插件一致。
+		*/
+		function toModelInfo(m) {
+			return m.maxInputTokens === void 0 ? {
+				id: m.key,
+				name: m.displayName
+			} : {
+				id: m.key,
+				name: m.displayName,
+				context_length: Math.round(m.maxInputTokens / 1e3)
+			};
+		}
+		async function allModels(force) {
+			if (!force && modelsCache !== void 0) return modelsCache.map(toModelInfo);
+			if (modelsInflight !== void 0) return (await modelsInflight).map(toModelInfo);
+			modelsInflight = fetchModelsFromUpstream().then((list) => {
+				if (list.length > 0) modelsCache = list;
+				return modelsCache ?? [];
+			}).catch(() => modelsCache ?? []).finally(() => {
+				modelsInflight = void 0;
+			});
+			const list = await modelsInflight;
+			return (list.length > 0 ? list : p.fallbackModels.map((m) => ({
+				key: m.id,
+				displayName: m.name ?? m.id,
+				enable: true,
+				isDefault: false,
+				isVl: false,
+				isReasoning: false,
+				isFree: false,
+				priceFactor: void 0,
+				maxInputTokens: m.context_length === void 0 ? void 0 : m.context_length * 1e3,
+				maxOutputTokens: void 0,
+				efforts: []
+			}))).map(toModelInfo);
+		}
+		/** 装一个不落盘的新账号（uid 按前缀递增，跳过已占用的）。 */
+		function allocateUid() {
+			let n = listUids().length + 1;
+			let uid = `${p.uidPrefix}-${n}`;
+			while (getCred(uid) !== void 0) uid = `${p.uidPrefix}-${++n}`;
+			return uid;
+		}
+		return {
+			id,
+			name: p.name,
+			priority: p.priority,
+			icon: p.icon,
+			apiKeyHint: p.apiKeyHint,
+			status: () => {
+				const now = Date.now();
+				const accounts = orderedUids().map((uid) => {
+					const cred = getCred(uid);
+					const cached = creditsCache.get(uid);
+					if (cached === void 0 || now - cached.at > CREDITS_TTL_MS) refreshCredits(uid);
+					return {
+						uid,
+						nickname: cred?.nickname || p.defaultNickname,
+						credits: cached?.value ?? CREDITS_UNKNOWN,
+						state: cred === void 0 ? "session_dead" : "ok"
+					};
+				});
+				return {
+					id,
+					name: p.name,
+					accounts
+				};
+			},
+			listModels: (force) => allModels(!!force),
+			/**
+			* 添加账号：粘贴 PAT。
+			*
+			* 这里**真的去交换一次 jobToken** 才落盘 —— 一个打错一个字符的 PAT 存进去
+			* 之后，面板上只会显示「凭据失效」，用户不知道是当初就错了还是后来过期了。
+			* 交换顺带拿到显示名，比 `qd-1` 这种占位名有用。
+			*/
+			addApiKey: async (input) => {
+				const pat = normalizePat(input.apiKey);
+				if (pat === "") return {
+					ok: false,
+					error: "PAT 不能为空"
+				};
+				for (const uid of listUids()) if (getCred(uid)?.pat === pat) return {
+					ok: false,
+					error: `这个 PAT 已经添加过了（${uid}）`
+				};
+				try {
+					const verified = await client.verifyCredential(pat);
+					const uid = allocateUid();
+					const nickname = input.name.trim() || verified.name || p.defaultNickname;
+					creds.save(id, uid, {
+						nickname,
+						pat,
+						...verified.id === "" ? {} : { userId: verified.id }
+					});
+					log(`${p.errPrefix} account added: ${uid} (${nickname})`);
+					return {
+						ok: true,
+						account: {
+							uid,
+							nickname
+						}
+					};
+				} catch (error) {
+					return {
+						ok: false,
+						error: `PAT 校验失败：${error instanceof Error ? error.message : String(error)}`
+					};
+				}
+			},
+			removeLink: (uid) => {
+				const cred = getCred(uid);
+				if (cred === void 0) return Promise.resolve(false);
+				creds.remove(id, uid);
+				creditsCache.delete(uid);
+				client.forget(cred.pat);
+				return Promise.resolve(true);
+			},
+			/** 对单个账号调一次上游。选号/冷却/换号是核心的活，这里只报结果。 */
+			async chatOnce(uid, lv, req) {
+				const base = stripAlias(req.model);
+				if (base === "") return {
+					ok: false,
+					state: "no_such_model",
+					message: `unknown model ${JSON.stringify(req.model)}`
+				};
+				const cred = getCred(uid);
+				if (cred === void 0) return {
+					ok: false,
+					state: "no_such_model",
+					message: `unknown account ${JSON.stringify(uid)}`
+				};
+				let messages;
+				let tools;
+				try {
+					const body = JSON.parse(req.rawBody);
+					messages = (Array.isArray(body.messages) ? body.messages : []).filter((m) => m !== null && typeof m === "object");
+					tools = Array.isArray(body.tools) && body.tools.length > 0 ? body.tools : void 0;
+				} catch {
+					return {
+						ok: false,
+						state: "bad_request",
+						message: "请求体不是合法 JSON"
+					};
+				}
+				const effort = lv === "auto" || lv === "" || lv === "none" || lv === "off" ? void 0 : lv;
+				try {
+					return {
+						ok: true,
+						stream: toOpenAiSse(await client.openChat(cred.pat, base, messages, {
+							...tools === void 0 ? {} : { tools },
+							...effort === void 0 ? {} : { reasoningEffort: effort },
+							isVl: hasImageInput(messages)
+						}), {
+							model: base,
+							onLateError: (error) => {
+								env.onLateFailure?.(uid, base, stateOf(error.kind), error.message);
+							}
+						})
+					};
+				} catch (error) {
+					if (isQoderError(error)) {
+						if (error.kind === "auth") client.forget(cred.pat);
+						return {
+							ok: false,
+							state: stateOf(error.kind),
+							message: `${p.errPrefix} ${error.message}`
+						};
+					}
+					return {
+						ok: false,
+						state: "unknown",
+						message: error.message
+					};
+				}
+			},
+			/**
+			* 签到：领取今天那份每日 Credits。
+			*
+			* 上游把它做成「活动」（campaigns），不是一个叫签到/checkin 的端点。
+			* `already-claimed` 是**成功**（幂等），不是错误。
+			*/
+			checkinNow: async (uid) => {
+				const cred = getCred(uid);
+				if (cred === void 0) return {
+					ok: false,
+					status: "error",
+					message: "凭证缺失"
+				};
+				try {
+					const outcome = await client.claimDailyCredits(cred.pat);
+					if (outcome.status === "claimed") {
+						await refreshCredits(uid);
+						const amount = outcome.amount === void 0 ? "" : `+${outcome.amount} Credits`;
+						const days = outcome.validityDays === void 0 ? "" : `（${outcome.validityDays} 天有效）`;
+						log(`${p.errPrefix} checkin ${uid}: claimed ${amount}`);
+						return {
+							ok: true,
+							status: "ok",
+							message: `${amount}${days}` || "签到成功"
+						};
+					}
+					if (outcome.status === "already-claimed") {
+						await refreshCredits(uid);
+						return {
+							ok: true,
+							status: "already",
+							message: "今日已签到"
+						};
+					}
+					return {
+						ok: false,
+						status: "error",
+						message: outcome.message
+					};
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					log(`${p.errPrefix} checkin ${uid}: ${message.slice(0, 160)}`);
+					return {
+						ok: false,
+						status: "error",
+						message: `${p.errPrefix} ${message}`
+					};
+				}
+			},
+			dispose: () => {
+				creditsCache.clear();
+				creditsInflight.clear();
+				modelsCache = void 0;
+				modelsInflight = void 0;
+			}
+		};
+	};
+}
+/**
+* 把用户粘进来的输入当作 PAT（容忍带 `Bearer ` 前缀或首尾空白）。
+*
+* 面板上粘贴时很容易带上从文档里复制来的 `Bearer `，那不是令牌的一部分，
+* 直接当 PAT 用只会得到一个难以理解的 401。
+*/
+function normalizePat(input) {
+	return input.trim().replace(/^Bearer\s+/i, "").trim();
+}
+// src/icon.ts
+/**
+* qoder 族供应商共用的面板图标 —— 内联 SVG data URI。
+*
+* 为什么内联：图标不该依赖另一个服务活着，更不该依赖特定端口。国内版与国际版
+* 同族，共用同一张图（只有 name 不同）。
+*/
+const QODER_ICON = "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NCA2NCIgd2lkdGg9IjEyOCIgaGVpZ2h0PSIxMjgiPjxyZWN0IHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgcng9IjE0IiBmaWxsPSIjMmI2YmZmIi8+PGNpcmNsZSBjeD0iMzIiIGN5PSIzMSIgcj0iMTUiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2ZmZmZmZiIgc3Ryb2tlLXdpZHRoPSI2Ii8+PHJlY3QgeD0iMzgiIHk9IjM3IiB3aWR0aD0iMTIiIGhlaWdodD0iNiIgcng9IjMiIHRyYW5zZm9ybT0icm90YXRlKDQ1IDM4IDM3KSIgZmlsbD0iI2ZmZmZmZiIvPjwvc3ZnPg==";
+const profile$1 = {
+	id: "qoder",
+	name: "Qoder",
+	region: "cn",
+	icon: QODER_ICON,
+	priority: -2,
+	uidPrefix: "qd",
+	defaultNickname: "Qoder",
+	errPrefix: "qoder",
+	apiKeyHint: "粘贴 Qoder 个人访问令牌（PAT，形如 pt-…）。在哪拿：登录 qoder.cn / qoder.com.cn 控制台 → 设置 → 个人访问令牌（旧版页面叫「API 令牌」）→ 创建令牌，复制只显示一次的 pt-…。令牌按区域签发，国内版的 pt-… 在国际版卡片上无效（反之亦然）。插件只在本机用它换 jobToken，之后的请求都带签名会话；PAT 不会发给 Qoder 网关以外的任何地方。",
+	fallbackModels: []
+};
+const profile = {
+	id: "qoder-global",
+	name: "Qoder Global",
+	region: "global",
+	icon: QODER_ICON,
+	priority: -2,
+	uidPrefix: "qdg",
+	defaultNickname: "Qoder Global",
+	errPrefix: "qoder-global",
+	apiKeyHint: "粘贴 Qoder 国际版的个人访问令牌（PAT，形如 pt-…）。在哪拿：登录 qoder.com 控制台 → Settings → Personal Access Tokens → 创建（复制只显示一次的 pt-…）。令牌按区域签发，国际版的 pt-… 在国内版卡片上无效（反之亦然）。国际版的积分与每日签到还需要本机安装 Qoder 客户端（设备风控组件），只有 PAT 时聊天与模型可用，积分/签到会如实报错。",
+	fallbackModels: []
+};
+// src/index.ts
+const name = "dsh-router-qoder";
+/** 本插件注册的全部供应商（profile → 工厂）。 */
+const SUPPLIERS = [[profile$1.id, createSupplier(profile$1)], [profile.id, createSupplier(profile)]];
+/** 读取当前 router.suppliers 聚合表（同一 live 对象，可追加）。 */
+function currentSuppliers(ctx) {
+	const c = ctx;
+	return c.get?.("router.suppliers") ?? c.router?.suppliers;
+}
+function apply(ctx) {
+	ctx.inject(["router.suppliers"], (sctx) => {
+		const suppliers = currentSuppliers(sctx);
+		if (!suppliers) return void 0;
+		const added = [];
+		for (const [id, factory] of SUPPLIERS) {
+			if (suppliers[id]) continue;
+			suppliers[id] = factory;
+			added.push(id);
+		}
+		if (added.length > 0) {
+			ctx.emit("internal/service", "router.suppliers", suppliers);
+			ctx.logger?.info?.(`[dsh-router-qoder] registered router.suppliers: ${added.join(", ")}`);
+		}
+		return () => {
+			for (const [id] of SUPPLIERS) delete suppliers[id];
+		};
+	});
+}
+export { apply, name };