@usewind/node 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,609 @@
+/**
+ * Wire types — hand-derived from `apps/docs/public/openapi.yaml` (Wind API 0.1.0).
+ * Keep in lock-step with that file; it is the source of truth.
+ *
+ * Money is always integer micro-cents, USD. `100_000_000` mc = $1.00 (1¢ = `1_000_000` mc). Fields end `_mc`.
+ */
+/** `POST /oauth/token` — 200 body, both grant types. */
+interface TokenResponse {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    connection_id: string;
+    allocation_mc?: number;
+}
+interface ChatMessage {
+    role: 'system' | 'user' | 'assistant' | 'tool';
+    content: unknown;
+    [k: string]: unknown;
+}
+/** Present on every successful `POST /v1/ai/*` response. */
+interface WindBlock {
+    feature: string | null;
+    hold_amount_mc: number;
+    provider_cost_mc: number;
+    wind_fee_mc: number;
+    dev_margin_mc: number;
+    user_charge_mc: number;
+    allocation_remaining_mc: number;
+}
+interface ChatUsage {
+    prompt_tokens: number;
+    completion_tokens: number;
+    total_tokens: number;
+}
+/** `POST /v1/ai/{model}` — 200 body. */
+interface ChatResult {
+    id: string;
+    choices: unknown[];
+    usage: ChatUsage;
+    wind: WindBlock;
+}
+/**
+ * Arguments to `.chat()` / `.chatStream()`. No `model` field — model is bound
+ * once via `wind.connection(userId).model(id)`, not passed per call. (Feature
+ * calls resolve their model server-side from the feature's `default_model`.)
+ */
+interface ChatParams {
+    messages: ChatMessage[];
+    /** Optional — hold cap resolves request → feature → app default → model ceiling. */
+    max_tokens?: number;
+    temperature?: number;
+    /** Prefer `.chatStream()` over setting this directly. */
+    stream?: boolean;
+    /** Defaults to `crypto.randomUUID()`; the same value is reused for every internal retry. */
+    idempotencyKey?: string;
+    signal?: AbortSignal;
+}
+interface ChatStreamChunk {
+    /** Raw provider SSE `data:` payload, JSON-parsed. */
+    delta: unknown;
+    /** The final chunk of a stream carries the settled `wind` block; `null` on all others. */
+    wind: WindBlock | null;
+}
+/** 'frozen' — Wind's own risk layer, independent of anything you or the user configured; clears when the user reconnects. */
+type ConnectionStatus = 'active' | 'exhausted' | 'revoked' | 'frozen';
+interface Connection {
+    id: string;
+    app_id: string;
+    user_account_id: string;
+    /** Optional lifetime ceiling — null means no fixed cap; spend is bounded instead by per-call/velocity/revocation/risk controls. */
+    reserved_allocation_mc: number | null;
+    consumed_mc: number;
+    held_mc: number;
+    velocity_limit_mc: number | null;
+    status: ConnectionStatus;
+    created_at: string;
+}
+interface RevokeResult {
+    id: string;
+    status: 'revoked';
+    revoked_at: string;
+    released_mc: number;
+}
+interface AllocationRequestParams {
+    targetAllocationMc: number;
+    reason?: string;
+}
+interface AllocationRequest {
+    id: string;
+    connection_id: string;
+    status: 'pending' | 'approved' | 'denied' | 'superseded';
+    current_allocation_mc: number;
+    target_allocation_mc: number;
+    approval_url: string;
+}
+interface Account {
+    wac_id: string;
+    email: string;
+    sandbox: boolean;
+    balance_available_mc: number;
+    balance_reserved_mc: number;
+}
+interface Feature {
+    slug: string;
+    display_name: string;
+    description: string;
+    max_cost_per_call_mc?: number | null;
+    max_tokens?: number | null;
+    rate_limit?: number | null;
+    default_model?: string | null;
+    /** Overrides App.dev_margin_rate for calls tagged with this feature; null falls back to the app-wide rate. */
+    dev_margin_rate?: number | null;
+}
+/**
+ * The per-user credential the application persists. Carries everything needed to
+ * make billed calls for one user, and nothing else. The app stores and returns
+ * it whole — never field by field (that is how rotation bugs happen).
+ */
+interface Grant {
+    connectionId: string;
+    refreshToken: string;
+    accessToken?: string;
+    accessTokenExpiresAt?: number;
+}
+interface WebhookEvent {
+    id: string;
+    type: string;
+    created_at: string;
+    data: Record<string, unknown>;
+}
+
+/**
+ * Configuration resolution and validation. Explicit args beat environment
+ * variables; env is only consulted for the three credential fields.
+ */
+
+/**
+ * The one persistence abstraction the SDK relies on for correctness.
+ *
+ * Refresh tokens rotate on every use, so `set` is called both after first
+ * connect and after every refresh, and the SDK **awaits it before using the new
+ * tokens** — a throw from `set` aborts the operation rather than stranding a
+ * rotated refresh token. Implement `set` so it commits in the same transaction
+ * as whatever work triggered the refresh.
+ *
+ * `delete` is called when a connection is revoked (terminal).
+ *
+ * Any Map-shaped store works; for production back it with your database.
+ */
+interface GrantStore {
+    get(userId: string): Promise<Grant | null> | Grant | null;
+    set(userId: string, grant: Grant): Promise<void> | void;
+    delete(userId: string): Promise<void> | void;
+}
+/**
+ * An in-memory `GrantStore` backed by a `Map`. **Dev/test only** — grants
+ * vanish on restart and are not shared across instances, so a multi-instance
+ * or restart-prone deployment will spuriously "disconnect" users. Back
+ * production with your database instead.
+ */
+declare function memoryGrantStore(): GrantStore;
+interface WindConfig {
+    clientId: string;
+    clientSecret: string;
+    /** Must exactly match a registered redirect URI and the callback route's URL. */
+    redirectUri: string;
+    baseUrl?: string;
+    accountsUrl?: string;
+    webhookSecret?: string;
+    /** Injectable for tests; defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+    /** Injectable for tests; defaults to `Date.now`. */
+    clock?: () => number;
+    /**
+     * Where per-user grants are persisted. Required for every user-scoped path
+     * (`wind.routes()`, `wind.handler()`, `wind.connection()`); those throw
+     * `WindConfigError` without it. Not needed for client-credentials-only use
+     * (`wind.connections.*`, `wind.account()`, `wind.raw`).
+     */
+    grantStore?: GrantStore;
+    /**
+     * Optional notification — fires once, after a user first connects. Runs after
+     * `grantStore.set` has committed. Not correctness-critical: a throw here is
+     * caught and ignored. Use it for audit logs, analytics, welcome emails.
+     */
+    onConnected?: (userId: string, grant: Grant) => Promise<void> | void;
+    /**
+     * Optional notification — fires after every refresh-token rotation, once
+     * `grantStore.set` has committed. Errors are caught and ignored.
+     */
+    onGrantRotated?: (userId: string, grant: Grant) => Promise<void> | void;
+}
+interface ResolvedConfig extends Required<Omit<WindConfig, 'webhookSecret' | 'grantStore' | 'onConnected' | 'onGrantRotated'>> {
+    webhookSecret?: string;
+    grantStore?: GrantStore;
+    onConnected?: WindConfig['onConnected'];
+    onGrantRotated?: WindConfig['onGrantRotated'];
+}
+
+/**
+ * RawClient — one method per openapi.yaml path, no ergonomics. The escape hatch
+ * behind `wind.raw`, and the transport every higher-level module builds on.
+ */
+
+interface RawRequest {
+    method: 'GET' | 'POST' | 'PATCH' | 'DELETE';
+    path: string;
+    /** `application/json` body; omit for GET. */
+    body?: unknown;
+    headers?: Record<string, string>;
+    /** `Authorization: Bearer` value — mutually exclusive with `basic`. */
+    bearer?: string;
+    /** Use HTTP Basic client credentials for `Authorization`. */
+    basic?: boolean;
+    signal?: AbortSignal;
+}
+interface RawResponse<T = unknown> {
+    status: number;
+    headers: Headers;
+    body: T;
+    requestId: string | null;
+}
+declare class RawClient {
+    private readonly config;
+    constructor(config: ResolvedConfig);
+    /** Low-level: perform one request, parse JSON, never throw on non-2xx (returns the response). */
+    request<T = unknown>(req: RawRequest): Promise<RawResponse<T>>;
+    /** `POST /oauth/token` — `grant_type=authorization_code`. */
+    exchangeCode(args: {
+        code: string;
+        redirectUri: string;
+        codeVerifier: string;
+    }): Promise<TokenResponse>;
+    /** `POST /oauth/token` — `grant_type=refresh_token`. */
+    refresh(refreshToken: string): Promise<TokenResponse>;
+    private postToken;
+    /** `POST /v1/ai/{model}`. Returns the raw response so callers can branch on status/headers. */
+    inference(args: {
+        model: string;
+        accessToken: string;
+        idempotencyKey: string;
+        feature?: string;
+        body: unknown;
+        signal?: AbortSignal;
+    }): Promise<RawResponse>;
+    /** `POST /v1/ai/features/{slug}`. */
+    inferenceFeature(args: {
+        slug: string;
+        accessToken: string;
+        idempotencyKey: string;
+        body: unknown;
+        signal?: AbortSignal;
+    }): Promise<RawResponse>;
+    listConnections(): Promise<Connection[]>;
+    getConnection(id: string): Promise<Connection>;
+    revokeConnection(id: string): Promise<RevokeResult>;
+    createAllocationRequest(id: string, body: {
+        target_allocation_mc: number;
+        reason?: string;
+    }): Promise<AllocationRequest>;
+    getAccount(): Promise<Account>;
+    listFeatures(appId: string): Promise<Feature[]>;
+    registerFeature(appId: string, feature: Feature): Promise<Feature>;
+    updateFeature(appId: string, slug: string, patch: Partial<Feature>): Promise<Feature>;
+    private unwrap;
+    get<T = unknown>(path: string, init?: Omit<RawRequest, 'method' | 'path' | 'body'>): Promise<RawResponse<T>>;
+    post<T = unknown>(path: string, init?: Omit<RawRequest, 'method' | 'path'>): Promise<RawResponse<T>>;
+}
+
+/**
+ * The connect flow, framework-neutral. Adapters (Express, fetch-handler) call
+ * into `OAuthFlow`; they own request/response plumbing, this owns the protocol.
+ */
+
+/** The short-lived value stashed between `/wind/start` and `/wind/callback`. */
+interface ConnectTransaction {
+    verifier: string;
+    state: string;
+    createdAt: number;
+}
+/** Pluggable storage for the transaction. Default is a signed cookie (see adapters). */
+interface TransactionStore {
+    put(id: string, tx: ConnectTransaction): Promise<void> | void;
+    take(id: string): Promise<ConnectTransaction | null> | ConnectTransaction | null;
+}
+interface RoutesOptions {
+    startPath?: string;
+    callbackPath?: string;
+    /** REQUIRED — Wind is not your login. Identify the signed-in user of your app. */
+    currentUser: (req: unknown) => string | null | undefined | Promise<string | null | undefined>;
+    /** Override the config's `grantStore` for these routes. Falls back to config. */
+    grantStore?: GrantStore;
+    /** Optional post-connect notification (see `WindConfig.onConnected`). */
+    onConnected?: (userId: string, grant: Grant) => Promise<void> | void;
+    /** Pre-fill the consent screen's spend cap (micro-cents). */
+    requestedAllocationMc?: number;
+    /** Feature slugs → the consent "what for" line. */
+    features?: string[];
+    session?: 'cookie' | TransactionStore;
+    successRedirect?: string;
+    onError?: (err: unknown, req: unknown, res: unknown) => void;
+}
+
+/**
+ * Access-token cache + atomic refresh-token rotation.
+ *
+ * The one rule: after a refresh, the rotated grant is written via
+ * `grantStore.set(userId, next)` and **awaited before** the caller may use the
+ * new access token. A crash between "got new refresh token" and "persisted it"
+ * kills the connection, so the SDK never proceeds past an unpersisted rotation.
+ * The optional `onGrantRotated` hook fires afterward and its errors are ignored.
+ */
+
+declare class TokenManager {
+    private readonly config;
+    private readonly raw;
+    constructor(config: ResolvedConfig, raw: RawClient);
+    /** True if the grant's cached access token is present and outside the skew window. */
+    isFresh(grant: Grant): boolean;
+    /**
+     * Return a grant guaranteed to have a usable access token. If a refresh was
+     * needed, `grantStore.set(userId, next)` has already been awaited before this
+     * resolves (then `onGrantRotated` fired). Refresh failure (`invalid_grant`)
+     * throws `ConnectionRevokedError` — the caller then clears the store entry.
+     */
+    ensureAccessToken(userId: string, grant: Grant): Promise<Grant>;
+    /** Force a refresh regardless of cache state (used on a 401 retry). */
+    forceRefresh(userId: string, grant: Grant): Promise<Grant>;
+}
+
+/**
+ * Billed-call surface: `wind.connection(userId).model('gpt-5').chat(params)`
+ * or `wind.connection(userId).feature('summarize').chat(params)`.
+ *
+ * Model and feature are DELIBERATELY mutually exclusive, no chaining — each
+ * hits a different route (`POST /v1/ai/{model}` vs `POST /v1/ai/features/{slug}`)
+ * with a different model-resolution rule, and picking one is an explicit,
+ * unambiguous choice at the call site rather than something that falls out of
+ * which optional param you happened to pass. The one combination this can't
+ * express — a specific model AND a feature tag on the same call (`X-Wind-Feature`
+ * on `POST /v1/ai/{model}`) — is still reachable via `wind.raw.inference(...)`;
+ * "wrap, don't hide" means the ergonomic surface enforcing a simpler mental
+ * model doesn't have to cost the escape hatch anything.
+ */
+
+interface Chattable {
+    /** Refresh-and-retry, idempotency key, and error mapping are all handled internally. */
+    chat(params: ChatParams): Promise<ChatResult>;
+    /** Streaming variant — async iterable; the last chunk carries the settled `wind` block. */
+    chatStream(params: ChatParams): AsyncIterable<ChatStreamChunk>;
+}
+/** `POST /v1/ai/{model}` — no feature tag; see the mutual-exclusivity note above. */
+declare class ModelScope implements Chattable {
+    private readonly ctx;
+    private readonly userId;
+    private readonly model;
+    constructor(ctx: ScopeContext, userId: string, model: string);
+    chat(params: ChatParams): Promise<ChatResult>;
+    chatStream(params: ChatParams): AsyncIterable<ChatStreamChunk>;
+}
+/** `POST /v1/ai/features/{slug}` — model resolved server-side from the feature's `default_model`. */
+declare class FeatureScope implements Chattable {
+    private readonly ctx;
+    private readonly userId;
+    private readonly feature;
+    constructor(ctx: ScopeContext, userId: string, feature: string);
+    chat(params: ChatParams): Promise<ChatResult>;
+    chatStream(params: ChatParams): AsyncIterable<ChatStreamChunk>;
+}
+declare class ConnectionScope {
+    private readonly ctx;
+    private readonly userId;
+    constructor(ctx: ScopeContext, userId: string);
+    /** `wind.connection(userId).model('gpt-5').chat(...)` — hits `POST /v1/ai/{model}`. */
+    model(id: string): ModelScope;
+    /** `wind.connection(userId).feature('summarize').chat(...)` — hits `POST /v1/ai/features/{slug}`. */
+    feature(slug: string): FeatureScope;
+    /** `GET /v1/connections/{id}` for this user's connection. Named `.get()`, not `.connection()` — avoids `wind.connection(userId).connection()`. */
+    get(): Promise<Connection>;
+    /** `POST /v1/connections/{id}/revoke`. */
+    revoke(): Promise<RevokeResult>;
+    /** `POST /v1/connections/{id}/allocation-requests` — returns `{ approvalUrl }`. */
+    requestIncrease(params: AllocationRequestParams): Promise<AllocationRequest>;
+}
+/** Shared dependencies handed to every scope. */
+interface ScopeContext {
+    config: ResolvedConfig;
+    raw: RawClient;
+    tokens: TokenManager;
+}
+
+/**
+ * Express adapter. `wind.routes(opts)` returns a middleware that owns
+ * `startPath` + `callbackPath`; every other request falls through to `next()`.
+ *
+ * Express is detected structurally (duck-typed req/res) and never imported, so
+ * this package has no Express dependency.
+ */
+
+/** Minimal shape this adapter relies on — a subset of Express req/res. */
+interface ExpressLikeRequest {
+    method?: string;
+    url?: string;
+    path?: string;
+    query?: Record<string, unknown>;
+    headers: Record<string, string | string[] | undefined>;
+}
+interface ExpressLikeResponse {
+    statusCode: number;
+    setHeader(name: string, value: string): void;
+    redirect(url: string): void;
+    status(code: number): ExpressLikeResponse;
+    send(body?: unknown): void;
+}
+type NextFn = (err?: unknown) => void;
+type ExpressMiddleware = (req: ExpressLikeRequest, res: ExpressLikeResponse, next: NextFn) => void;
+
+/**
+ * Web-standard adapter. `wind.handler(opts)` returns `(Request) => Promise<Response>`
+ * covering both `startPath` and `callbackPath`. Mount under a catch-all route:
+ *
+ *   // Next.js — app/wind/[...wind]/route.ts
+ *   export const GET = wind.handler({ currentUser: … })
+ *
+ * Also works for Hono, Bun.serve, Deno, and Remix.
+ */
+
+type FetchHandler = (req: Request) => Promise<Response>;
+
+/**
+ * Error hierarchy for `@usewind/node`.
+ *
+ * This module is fully implemented (the skeleton stubs live elsewhere). The
+ * mapping mirrors `apps/docs/src/content/docs/errors-and-types.mdx`.
+ */
+interface WindErrorEnvelope {
+    error?: {
+        code?: string;
+        message?: string;
+        type?: string;
+        connection_id?: string | null;
+        increase_url?: string | null;
+    };
+}
+interface WindErrorInit {
+    status?: number;
+    code?: string;
+    type?: string;
+    connectionId?: string | null;
+    requestId?: string | null;
+    raw?: unknown;
+    cause?: unknown;
+}
+/** Base class for everything this SDK throws. */
+declare class WindError extends Error {
+    readonly status?: number;
+    readonly code?: string;
+    readonly type?: string;
+    readonly connectionId?: string | null;
+    readonly requestId?: string | null;
+    readonly raw?: unknown;
+    constructor(message: string, init?: WindErrorInit);
+    /**
+     * Build the right subclass from an HTTP response. Matches on the envelope's
+     * `error.code` first, then falls back to `status`.
+     */
+    static fromResponse(status: number, body: WindErrorEnvelope | undefined, extra?: {
+        requestId?: string | null;
+        retryAfterMs?: number;
+    }): WindError;
+}
+/** Missing or invalid configuration. Thrown at `configure()` or first use. */
+declare class WindConfigError extends WindError {
+}
+/** `grantStore.get(userId)` returned null — the user has no Wind connection yet. */
+declare class WindNotConnectedError extends WindError {
+}
+/** Webhook HMAC mismatch, malformed signature header, or stale timestamp. */
+declare class WindSignatureError extends WindError {
+}
+/** Marks an unimplemented skeleton path. Remove as bodies land. */
+declare class WindNotImplementedError extends WindError {
+    constructor(what: string);
+}
+/** Any non-2xx not classified below. */
+declare class WindApiError extends WindError {
+}
+/** 402 `allocation_exhausted` — connection spent its reserved cap. */
+declare class AllocationExhaustedError extends WindApiError {
+    readonly increaseUrl: string | null;
+    constructor(message: string, init?: WindErrorInit & {
+        increaseUrl?: string | null;
+    });
+}
+/** 402 `feature_cost_exceeded` — one call blew a per-feature guardrail. Not billed. */
+declare class FeatureCostExceededError extends WindApiError {
+}
+/** 400 `feature_model_not_configured` — the feature has no `default_model` set. Config bug, not runtime-retryable. */
+declare class FeatureModelNotConfiguredError extends WindApiError {
+}
+/** 403 `connection_revoked` (or refresh `invalid_grant`). Terminal — clear stored grant, prompt reconnect. */
+declare class ConnectionRevokedError extends WindApiError {
+}
+/**
+ * 403 `connection_frozen` — Wind's own platform risk layer, not user
+ * revocation, froze this connection on an abnormal spend pattern. Unlike
+ * `ConnectionRevokedError`, do NOT delete the stored grant — the same
+ * connection reactivates once the user goes through the connect flow again.
+ */
+declare class ConnectionFrozenError extends WindApiError {
+}
+/**
+ * 403 `app_suspended` — the app itself is switched off, by Wind or by you.
+ * Every connection is affected, so stop calling and surface it; don't clear
+ * any grants — they work again once the app is unsuspended.
+ */
+declare class AppSuspendedError extends WindApiError {
+}
+/** 403 `model_not_allowed` — model is outside the app's allowlist. Integration bug. */
+declare class ModelNotAllowedError extends WindApiError {
+}
+/**
+ * 429 — a spend or request limit, not an error in the call. `code` says which:
+ * `rate_limited` (Feature.rate_limit), `daily_limit_reached` (the connection's
+ * 24h limit), `app_spend_limited` (the app's daily limit on its tier) or
+ * `sandbox_live_cost_limited` (the daily live-model allowance in sandbox).
+ * The SDK does not auto-sleep; back off using `retryAfterMs`.
+ */
+declare class RateLimitedError extends WindApiError {
+    readonly retryAfterMs: number | null;
+    constructor(message: string, init?: WindErrorInit & {
+        retryAfterMs?: number;
+    });
+}
+/** 429 `risk_throttled` — Wind's platform risk layer, not the per-feature rate limit. Same shape as `RateLimitedError`, distinct so callers can tell the two apart. */
+declare class RiskThrottledError extends WindApiError {
+    readonly retryAfterMs: number | null;
+    constructor(message: string, init?: WindErrorInit & {
+        retryAfterMs?: number;
+    });
+}
+/** 502 `provider_error` — upstream provider failed. Retried internally with the same idempotency key; not billed. */
+declare class ProviderError extends WindApiError {
+}
+/** 401 `token_expired` — internal; surfaces only if a refresh also fails. */
+declare class TokenExpiredError extends WindApiError {
+}
+/** 409 `idempotency_key_reused` — the same Idempotency-Key was sent with a different request body. Integration bug (or a genuine UUID collision, practically never). */
+declare class IdempotencyKeyReusedError extends WindApiError {
+}
+
+/**
+ * @usewind/node — server SDK for Connect with Wind.
+ *
+ * Two ways in:
+ *   import { wind } from '@usewind/node'          // lazily reads WIND_CLIENT_* from env
+ *   import { createWind } from '@usewind/node'    // explicit instance (tests, multi-tenant)
+ *
+ * See DESIGN.md for the full surface.
+ */
+
+declare class Wind {
+    #private;
+    constructor(config?: Partial<WindConfig>);
+    /** Set or override configuration. Call once at boot. Resets memoised internals. */
+    configure(config: Partial<WindConfig>): this;
+    /** The low-level HTTP client — one method per openapi path. Escape hatch. */
+    get raw(): RawClient;
+    /** Express middleware owning `startPath` + `callbackPath`. */
+    routes(opts: RoutesOptions): ExpressMiddleware;
+    /** Web-standard `(Request) => Response` handler for the same two routes. */
+    handler(opts: RoutesOptions): FetchHandler;
+    /**
+     * Scope subsequent calls to one user of your app. Loads their grant via
+     * `grantStore.get`. Singular, one user's connection — distinct from the
+     * plural `wind.connections` below (client-credentials management across
+     * every connection).
+     */
+    connection(userId: string): ConnectionScope;
+    readonly connections: {
+        list: () => Promise<Connection[]>;
+        get: (id: string) => Promise<Connection>;
+        revoke: (id: string) => Promise<RevokeResult>;
+        requestIncrease: (id: string, p: {
+            targetAllocationMc: number;
+            reason?: string;
+        }) => Promise<AllocationRequest>;
+    };
+    account(): Promise<Account>;
+    readonly features: {
+        list: (appId: string) => Promise<Feature[]>;
+        register: (appId: string, feature: Feature) => Promise<Feature>;
+        update: (appId: string, slug: string, patch: Partial<Feature>) => Promise<Feature>;
+    };
+    /** Verify a webhook's `X-Wind-Signature` and return the typed event. Needs the raw body. */
+    verify(input: {
+        payload: string | Buffer;
+        signature: string;
+    }): WebhookEvent;
+}
+/** An explicit, independent instance. Use for tests or multi-tenant servers. */
+declare function createWind(config?: Partial<WindConfig>): Wind;
+/**
+ * The default instance. Lazily reads `WIND_CLIENT_ID` / `WIND_CLIENT_SECRET` /
+ * `WIND_REDIRECT_URI` on first use; `wind.configure({ … })` overrides.
+ */
+declare const wind: Wind;
+
+export { type Account, AllocationExhaustedError, type AllocationRequest, type AllocationRequestParams, AppSuspendedError, type ChatMessage, type ChatParams, type ChatResult, type ChatStreamChunk, type ChatUsage, type Chattable, type ConnectTransaction, type Connection, ConnectionFrozenError, ConnectionRevokedError, ConnectionScope, type ConnectionStatus, type Feature, FeatureCostExceededError, FeatureModelNotConfiguredError, FeatureScope, type Grant, type GrantStore, IdempotencyKeyReusedError, ModelNotAllowedError, ProviderError, RateLimitedError, type RevokeResult, RiskThrottledError, type RoutesOptions, TokenExpiredError, type TokenResponse, type TransactionStore, type WebhookEvent, Wind, WindApiError, type WindBlock, type WindConfig, WindConfigError, WindError, type WindErrorEnvelope, type WindErrorInit, WindNotConnectedError, WindNotImplementedError, WindSignatureError, createWind, memoryGrantStore, wind };