QVAC-19908 chore: release sdk + bare-sdk 0.13.4

Fix-only patch release: recover malformed Qwen hybrid tool-call frames (#2677).
Bumps @qvac/sdk and @qvac/bare-sdk to 0.13.4 and adds the 0.13.4 changelog.

(cherry picked from commit 8fbb222)

Author: simon-iribarren

packages/bare-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qvac/bare-sdk",
-  "version": "0.13.3",
+  "version": "0.13.4",
   "license": "Apache-2.0",
   "description": "Bare-targeted slim assembly of the QVAC SDK. Consumers install only the addon packages they need and register plugins explicitly. No addon dependencies pulled in by default.",
   "repository": {

packages/sdk/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.13.4]
+
+📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.13.4
+
+A patch release that hardens tool-call parsing for Qwen models used in agentic
+workflows.
+
+## Bug Fixes
+
+### Recover malformed Qwen tool-call frames
+
+Qwen3.5/3.6 can intermittently emit a malformed tool-call frame that fuses its
+XML and JSON tool templates, embedding the `function=<name>` token as a bare
+string key inside an otherwise JSON object. Previously the parser rejected that
+frame as invalid JSON, so no structured tool call was produced and callers saw
+the raw markup as assistant text. The parser now recognizes and repairs this
+specific shape, so the tool call is recovered and dispatched correctly.
+
 ## [0.13.3]
 
 📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.13.3

packages/sdk/changelog/0.13.4/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog v0.13.4
+
+Release Date: 2026-06-18
+
+## 🐞 Fixes
+
+- Recover Qwen hybrid tool-call frames. (see PR [#2677](https://github.com/tetherto/qvac/pull/2677))
+

packages/sdk/changelog/0.13.4/CHANGELOG_LLM.md

@@ -0,0 +1,17 @@
+# QVAC SDK v0.13.4 Release Notes
+
+📦 **NPM:** https://www.npmjs.com/package/@qvac/sdk/v/0.13.4
+
+A patch release that hardens tool-call parsing for Qwen models used in agentic
+workflows.
+
+## Bug Fixes
+
+### Recover malformed Qwen tool-call frames
+
+Qwen3.5/3.6 can intermittently emit a malformed tool-call frame that fuses its
+XML and JSON tool templates, embedding the `function=<name>` token as a bare
+string key inside an otherwise JSON object. Previously the parser rejected that
+frame as invalid JSON, so no structured tool call was produced and callers saw
+the raw markup as assistant text. The parser now recognizes and repairs this
+specific shape, so the tool call is recovered and dispatched correctly.

packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qvac/sdk",
-  "version": "0.13.3",
+  "version": "0.13.4",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",