@yanlinglabs/winter-provider-runtime 0.0.2

package/dist/adapters/bedrock/sigv4.d.ts

@@ -0,0 +1,119 @@
+/** The signing algorithm's own name, as it appears in the string-to-sign and the Authorization header. */
+export declare const SIGV4_ALGORITHM = "AWS4-HMAC-SHA256";
+/** The AWS service name Bedrock signs under — both the runtime and control planes use it. */
+export declare const BEDROCK_SERVICE = "bedrock";
+/** The AWS credential material a signature needs. A structural mirror of `CredentialMaterial`'s `aws` arm, so this module stays free of the credential types. */
+export interface AwsSigningCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+export interface SignRequestInput {
+    method: string;
+    /** The ABSOLUTE request URL, path already once-encoded (the canonical form encodes it again). */
+    url: string;
+    /** Headers to sign ALONGSIDE the derived ones. `host`, `x-amz-date`, `x-amz-content-sha256` and `x-amz-security-token` are added here and must not be passed in. */
+    headers: Record<string, string>;
+    /** The exact request body bytes, or empty for a GET. Hashed verbatim — a re-serialization would sign a different payload than the one sent. */
+    body: Uint8Array;
+    credentials: AwsSigningCredentials;
+    region: string;
+    service?: string;
+    /** Injected so a fixture can pin a signature. Defaults to now. */
+    date?: Date;
+}
+/**
+ * RFC 3986 percent-encoding with AWS's unreserved set: `A-Za-z0-9` plus `-`, `_`, `.` and `~`.
+ *
+ * DELIBERATELY STRICTER THAN `encodeURIComponent`, which leaves `!*'()` alone. AWS's own SDKs use
+ * `encodeURIComponent` for the path, so the two disagree on those five characters — a discrepancy
+ * that is unreachable for Bedrock (a model id matches `[a-zA-Z0-9-:.]+`, and an ARN adds only `/`
+ * and `:`), and the spec's reading is the safer one to be wrong in the direction of. Recorded here
+ * rather than left as a silent choice.
+ */
+export declare function awsUriEncode(value: string, encodeSlash: boolean): string;
+/**
+ * The canonical URI: the path, normalized then encoded a SECOND time (see the file header).
+ *
+ * `%2F` is restored to `/` after the whole path is encoded, which is what makes the separators
+ * survive an encoding pass that would otherwise escape them — the same manoeuvre the AWS SDKs use.
+ */
+export declare function canonicalUri(pathname: string): string;
+/** The canonical query string: every parameter encoded once, then sorted by name and, within a name, by value. */
+export declare function canonicalQuery(search: string): string;
+/**
+ * The canonical headers block and the signed-headers list.
+ *
+ * Names are lowercased and sorted; values are trimmed and their internal runs of whitespace
+ * collapsed to a single space (AWS's own rule, and the reason a header value with a stray double
+ * space still verifies).
+ *
+ * NAMES ARE DE-DUPLICATED AFTER LOWERCASING, and that is a latent-bug fix rather than a live one
+ * (Lane N r1 carry). Every caller today hands this a map whose keys are already lowercase, so the
+ * two spellings cannot both be present — but nothing in the signature *type* says so, and a future
+ * caller passing `{ "X-Amz-Date": …, "x-amz-date": … }` would have produced `x-amz-date` TWICE in
+ * both the canonical block and `SignedHeaders`. AWS would reject that with an
+ * `InvalidSignatureException` whose text is about the signature, not about a duplicate header, so
+ * the failure would read as a broken signer. `byLower` already collapsed the VALUES; only the name
+ * list did not.
+ */
+export declare function canonicalHeaders(headers: Record<string, string>): {
+    canonical: string;
+    signed: string;
+};
+export declare function sha256Hex(bytes: Uint8Array): Promise<string>;
+/** The four chained HMACs of step 3. Derived per request rather than cached: the key is scoped to a DATE, and a cache would need invalidating at midnight UTC for no measurable gain. */
+export declare function signingKey(secretAccessKey: string, datestamp: string, region: string, service: string): Promise<Uint8Array>;
+/** `YYYYMMDDTHHMMSSZ` — an ISO instant with every separator removed, which is the only form the header accepts. */
+export declare function amzDate(date: Date): string;
+export interface CanonicalRequestInput {
+    method: string;
+    pathname: string;
+    search: string;
+    headers: Record<string, string>;
+    payloadHash: string;
+}
+/** Step 1, exported whole so a fixture and the conformance fake can both assert on the exact string a signature was computed over. */
+export declare function buildCanonicalRequest(input: CanonicalRequestInput): {
+    canonicalRequest: string;
+    signedHeaders: string;
+};
+/** Step 2, exported so a fixture can assert the exact string a signature was taken over — and so a verifier rebuilds it rather than re-deriving it differently. */
+export declare function buildStringToSign(canonicalRequest: string, stamp: string, scope: string): Promise<string>;
+/** Steps 3 and 4's hash: the signing key, then one HMAC over the string-to-sign, hex-encoded. */
+export declare function computeSignature(secretAccessKey: string, datestamp: string, region: string, service: string, stringToSign: string): Promise<string>;
+export interface SignedRequest {
+    /** The headers to ADD to the request. `host` is deliberately absent — it is signed but never set (see the file header). */
+    headers: Record<string, string>;
+    /** Exposed for fixtures and for the fake's recomputation; never logged. */
+    canonicalRequest: string;
+    stringToSign: string;
+    signature: string;
+    signedHeaders: string;
+}
+/**
+ * Signs a request, returning the headers to attach.
+ *
+ * `x-amz-content-sha256` is ALWAYS sent, not only where a service requires it: it is what lets a
+ * verifier (real AWS, or this repo's fake) check that the payload it received is the payload that
+ * was signed, rather than only that the two agree about the headers.
+ */
+export declare function signRequest(input: SignRequestInput): Promise<SignedRequest>;
+export interface ParsedAuthorization {
+    accessKeyId: string;
+    datestamp: string;
+    region: string;
+    service: string;
+    signedHeaders: string[];
+    signature: string;
+}
+/**
+ * Parses an `Authorization` header back into its parts.
+ *
+ * Exists so a VERIFIER can rebuild the canonical request from what the wire actually carried — the
+ * signed-header list included — rather than from what the signer intended to send. That distinction
+ * is the whole value of the conformance fake's signature check: a verifier that re-derived the
+ * signed-header set from its own idea of the request would agree with a buggy signer about a header
+ * neither of them included.
+ */
+export declare function parseAuthorization(header: string | null | undefined): ParsedAuthorization | undefined;

package/dist/adapters/bedrock/testing.d.ts

@@ -0,0 +1,46 @@
+/** One header to encode. Only the string type is offered: it is the only type Bedrock's own frames use, and a fixture that needed another would be testing the decoder rather than the adapter. */
+export interface EventStreamHeaderInput {
+    name: string;
+    value: string;
+}
+/** Encodes one complete event-stream frame: prelude + prelude CRC + headers + payload + message CRC. */
+export declare function encodeEventStreamMessage(headers: EventStreamHeaderInput[], payload: Uint8Array): Uint8Array;
+/** A ConverseStream `event` frame carrying a JSON payload — the shape every happy-path frame takes. */
+export declare function converseStreamEvent(eventType: string, payload: unknown): Uint8Array;
+/** A ConverseStream `exception` frame — how Bedrock reports a failure that begins AFTER the 200 (`ThrottlingException`, `ModelStreamErrorException`, …). */
+export declare function converseStreamException(exceptionType: string, payload?: unknown): Uint8Array;
+/** Concatenates frames into one response body. */
+export declare function concatFrames(frames: Uint8Array[]): Uint8Array;
+/** What the fake's signature check is given: the LIVE request, plus the secret it should verify against. */
+export interface VerifySigV4Input {
+    method: string;
+    /** The absolute request URL, exactly as the server received it. */
+    url: string;
+    /** The live request headers. MUST come from the `Request`, never from the fake base's recorded copy — that copy redacts `authorization` before a route ever runs. */
+    headers: Headers;
+    /** The exact request body bytes the server received. */
+    body: Uint8Array;
+    secretAccessKey: string;
+    expectedAccessKeyId?: string;
+}
+export type SigV4Verdict = {
+    ok: true;
+    accessKeyId: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Recomputes a request's signature and compares it with the one the client sent.
+ *
+ * THE CANONICAL REQUEST IS REBUILT FROM THE WIRE, not from any notion of what the adapter meant to
+ * send: the header set comes from the `SignedHeaders=` list in the Authorization header, each value
+ * is read off the live request, and the payload hash is taken over the bytes the server actually
+ * received. That is what makes the check independent of `signRequest` in the way that matters — a
+ * signer that forgot a header, signed a stale body, or signed the wrong host produces a signature
+ * this function will not reproduce.
+ *
+ * `x-amz-content-sha256` is additionally checked AGAINST THE BODY, so a client cannot sign a hash of
+ * one payload and send another.
+ */
+export declare function verifySigV4(input: VerifySigV4Input): Promise<SigV4Verdict>;

package/dist/adapters/content-blocks.d.ts

@@ -0,0 +1,7 @@
+import type { ContentBlockLike } from "../types.js";
+/** Every `image` block in `content`, including those nested inside a `tool_result`, in wire order. */
+export declare function collectImages(content: string | ContentBlockLike[], depth?: number): Array<Extract<ContentBlockLike, {
+    type: "image";
+}>>;
+/** True when `content` carries an image ANYWHERE — the capability gate's real question. */
+export declare function containsImage(content: string | ContentBlockLike[]): boolean;

package/dist/adapters/google/adc.d.ts

@@ -0,0 +1,35 @@
+import type { CredentialMaterial } from "../../types.js";
+/** The scope a Vertex generation needs. The one value; it is not configurable, so it cannot drift. */
+export declare const GCP_CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+export interface AccessTokenSourceOptions {
+    /** Injected in tests so a cache-expiry fixture never has to wait for real time. */
+    now?: () => number;
+    /** Declares the token endpoint local, so a loopback fake can stand in for it. Mirrors `ConnectionProfile.local`. */
+    local?: boolean;
+}
+export interface AccessTokenSource {
+    /** The bearer token to send. Cached until it expires; a cache miss performs the exchange. */
+    token(signal?: AbortSignal): Promise<string>;
+    /** Test/diagnostic seam: how many exchanges have actually been performed. NEVER exposes the token. */
+    exchanges(): number;
+}
+/** A `gcp-access-token` ref: the host already holds a token, so there is nothing to exchange. */
+export declare function createStaticAccessTokenSource(token: string): AccessTokenSource;
+/**
+ * The service-account flow: sign an assertion, exchange it, cache the result until it expires.
+ *
+ * The KEY IS IMPORTED ONCE and the promise is memoised -- both because importing is not free and
+ * because a concurrent burst of turns would otherwise import the same key many times over. The
+ * imported `CryptoKey` is non-extractable (`importRs256PrivateKey` passes `false`), so even holding
+ * it cannot re-export the PEM.
+ */
+export declare function createServiceAccountTokenSource(material: Extract<CredentialMaterial, {
+    kind: "gcp-service-account";
+}>, opts?: AccessTokenSourceOptions): AccessTokenSource;
+/**
+ * The material -> a token source.
+ *
+ * `undefined` for material this flow does not handle, so the caller can produce its own typed
+ * refusal naming the kind -- a `null` here would be indistinguishable from "no credential".
+ */
+export declare function createAccessTokenSource(material: CredentialMaterial, opts?: AccessTokenSourceOptions): AccessTokenSource | undefined;

package/dist/adapters/google/generate-content.d.ts

@@ -0,0 +1,136 @@
+import type { WinterCatalog, WinterModelDescriptor } from "@yanlinglabs/winter-provider-catalog";
+import { type RetryPolicyOptions } from "../../retry.js";
+import { type EndpointPolicy } from "../../endpoint-policy.js";
+import type { ProviderAdapter, ProviderContext, ProviderMessageLike, TurnRequest } from "../../types.js";
+export declare const GOOGLE_ADAPTER_ID = "winter.google-generate-content";
+/** The GENERATED endpoint. Immutable (R6-11); pinned to the catalog row by a test. */
+export declare const GOOGLE_DEFAULT_BASE_URL = "https://generativelanguage.googleapis.com";
+export declare const GOOGLE_API_VERSION_PATH = "v1beta";
+export interface GoogleAdapterOptions {
+    catalog?: WinterCatalog;
+    requestTimeoutMs?: number;
+    maxBodyBytes?: number;
+    retry?: RetryPolicyOptions;
+    defaultMaxOutputTokens?: number;
+}
+/**
+ * What differs between the Gemini API and Vertex: the URL, the credential, and whether a bounded
+ * list endpoint is in scope. Everything else -- the whole wire mapping and the whole normalizer --
+ * is shared.
+ */
+export interface GoogleTransport {
+    readonly id: string;
+    readonly version: string;
+    /** Resolves the base URL and its endpoint policy, or throws a typed capability refusal. */
+    endpoint(ctx: ProviderContext): {
+        base: string;
+        policy: EndpointPolicy;
+    };
+    /**
+     * `identity` is the ROW's own Winter-authored second identity field (WS-13b §7/§8.4, R-FW-2),
+     * already `<version>`-substituted -- `{}` for every row whose vendor names none, which is every
+     * row this family serves today. It is a PARAMETER rather than something a transport derives,
+     * because a transport has no catalog and the adapter above it does.
+     */
+    headers(ctx: ProviderContext, policy: EndpointPolicy, json: boolean, identity: Record<string, string>): Promise<Record<string, string>>;
+    streamPath(ctx: ProviderContext, model: string): string;
+    countTokensPath(ctx: ProviderContext, model: string): string;
+    /** ABSENT when this transport has no bounded model-list endpoint in this phase's scope (Vertex). */
+    listPath?: (ctx: ProviderContext, pageToken: string | undefined, pageSize: number) => string;
+    /** Credential kinds this transport can authenticate with, for `validateCredential`'s honest `unsupported`. */
+    readonly credentialKinds: readonly string[];
+}
+/**
+ * Which chunk this family treats as COMPLETING, from the descriptor's own `completionEvent` evidence.
+ *
+ * THIS FAMILY HAS EXACTLY ONE HONOURABLE MARKER: the chunk carrying `finishReason`. There is no
+ * per-block terminator to choose instead, and `usageMetadata` -- the only other candidate a row might
+ * plausibly name -- is shipped on EVERY chunk, so treating it as the completion signal would report
+ * the turn finished from the first chunk and capture continuation state the provider had not finished
+ * minting. That is precisely the failure the completion-event rule exists to prevent, so a row naming
+ * it is REFUSED before the request rather than honoured into an early capture.
+ *
+ * Everything else falls back to `finish-reason`, and the asymmetry is deliberate: an UNRECOGNISED
+ * value means "this adapter does not know what the row meant", and the safe answer to that is the
+ * conservative default (a fallback can only ever capture later, never earlier). A value this adapter
+ * DOES recognise and cannot honour safely is a different thing entirely — it is a claim, and the
+ * honest answer to a claim that cannot be met is a refusal.
+ *
+ * Matched by MENTION rather than equality, because the field is a prose-ish
+ * `CapabilityEvidence<string>` whose existing catalog values read like sentences (Lane A's row says
+ * `response.completed`; this lane's fixtures say "the chunk carrying finishReason").
+ */
+export declare function googleCompletionMarker(descriptor: WinterModelDescriptor | undefined): {
+    ok: true;
+    marker: "finish-reason";
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * One opaque continuation item: a `thoughtSignature` and enough addressing to put it back on the
+ * EXACT part it came from.
+ *
+ * The value itself is OPAQUE (Global Constraints): it reaches the provider-state sidecar and the
+ * next request body, and nothing else -- never a log line, never an error message, never a frame.
+ */
+export interface GoogleThoughtSignatureItem {
+    /** The wire part index it arrived on. The family's own truth, recorded even though replay keys on `callId` where one exists. */
+    partIndex: number;
+    /**
+     * WHICH KIND of part carried it, and this is what makes replay addressable rather than positional.
+     *
+     * A `thought` part is FOREIGN reasoning and is never replayed as content (R6-8) -- so there is no
+     * part on the next request for its signature to ride. Before this discriminator existed, any
+     * non-`functionCall` signature was treated as a text item and stamped onto the first replayed text
+     * block: a signature minted for a thought part, re-attached to a different part, which is exactly
+     * the mis-attachment decision #2 exists to prevent and which a validating endpoint can reject.
+     * A `thought` item is now RETAINED as opaque state and attached to nothing.
+     */
+    kind: "function-call" | "text" | "thought" | "other";
+    /** The tool-call id this adapter minted for the `functionCall` part. Absent for every other kind. */
+    callId?: string;
+    signature: string;
+}
+type WirePart = Record<string, unknown>;
+interface SerializeResult {
+    contents: Array<{
+        role: "user" | "model";
+        parts: WirePart[];
+    }>;
+    /** How many blocks from ANOTHER dialect were dropped at this boundary. Reported as a count, never as content. */
+    droppedForeignReasoning: number;
+}
+/**
+ * Engine messages -> `contents`.
+ *
+ * `assistant` becomes `model`; `tool` becomes `user` carrying `functionResponse` parts (this family
+ * has no tool role either). Adjacent same-role entries are merged, which preserves part ORDER
+ * exactly and keeps a two-tool-message history from producing the consecutive same-role entries the
+ * endpoint rejects.
+ */
+export declare function toContents(messages: ProviderMessageLike[]): SerializeResult;
+export declare function findDescriptor(catalog: WinterCatalog, providerId: string, model: string): WinterModelDescriptor | undefined;
+export type GoogleEffortMapping = {
+    ok: true;
+    value: {
+        thinkingBudget: number;
+    };
+} | {
+    ok: false;
+    reason: string;
+};
+/** Effort -> the model's VERIFIED vocabulary, or a refusal (WS-13 §8.2). Identical rule to the Anthropic adapter's; the LADDER differs because the families' budgets do. */
+export declare function mapGoogleEffort(effort: TurnRequest["effort"], descriptor: WinterModelDescriptor | undefined): GoogleEffortMapping;
+export declare function createGoogleFamilyAdapter(transport: GoogleTransport, opts?: GoogleAdapterOptions): ProviderAdapter;
+/**
+ * The Gemini API transport: `generativelanguage.googleapis.com`, `x-goog-api-key`.
+ *
+ * `x-goog-user-project` is the one PRIVILEGED header this family has (R6-L names it explicitly), so
+ * it goes through `applyPrivilegedHeaders` and is therefore dropped for a user-supplied `baseUrl` --
+ * an account identifier must never be disclosed to a host the reviewed catalog never named. The
+ * api-key, content-type and accept headers are PROTOCOL headers and are not routed through it.
+ */
+export declare function geminiTransport(): GoogleTransport;
+export declare function createGoogleGenerateContentAdapter(opts?: GoogleAdapterOptions): ProviderAdapter;
+export {};

package/dist/adapters/google/index.d.ts

@@ -0,0 +1,8 @@
+export { GOOGLE_ADAPTER_ID, GOOGLE_API_VERSION_PATH, GOOGLE_DEFAULT_BASE_URL, createGoogleFamilyAdapter, createGoogleGenerateContentAdapter, findDescriptor, geminiTransport, googleCompletionMarker, mapGoogleEffort, toContents, } from "./generate-content.js";
+export type { GoogleAdapterOptions, GoogleEffortMapping, GoogleThoughtSignatureItem, GoogleTransport } from "./generate-content.js";
+export { VERTEX_ADAPTER_ID, VERTEX_API_VERSION_PATH, createVertexGeminiAdapter, vertexEndpointUrl, vertexModelPath, vertexTransport } from "./vertex.js";
+export type { VertexAdapterOptions } from "./vertex.js";
+export { GCP_CLOUD_PLATFORM_SCOPE, createAccessTokenSource, createServiceAccountTokenSource, createStaticAccessTokenSource } from "./adc.js";
+export type { AccessTokenSource, AccessTokenSourceOptions } from "./adc.js";
+export { JwtKeyError, RS256, base64UrlEncode, base64UrlEncodeText, importRs256PrivateKey, pkcs8DerFromPem, signRs256Jwt } from "./jwt-rs256.js";
+export type { ServiceAccountJwtClaims } from "./jwt-rs256.js";

package/dist/adapters/google/jwt-rs256.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The signing algorithm, in the one spelling `importKey`/`sign` both accept.
+ *
+ * EXPORTED because the loopback fake's verifier needs the identical parameters, and a second literal
+ * there is a second thing that can drift from this one.
+ */
+export declare const RS256: RsaHashedImportParams;
+/** Raised when a PEM cannot be read or a key cannot be imported. Its message NEVER contains key material. */
+export declare class JwtKeyError extends Error {
+    constructor(message: string);
+}
+/** base64url, no padding -- the only encoding a JWT uses. */
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64UrlEncodeText(text: string): string;
+/**
+ * The DER bytes of a PKCS#8 PEM block.
+ *
+ * The block TYPE is checked explicitly so a PKCS#1 key (`BEGIN RSA PRIVATE KEY`, which openssl still
+ * emits by default) produces a message that says what to convert rather than an opaque WebCrypto
+ * `DataError`.
+ */
+export declare function pkcs8DerFromPem(pem: string): Uint8Array;
+/** Imports a PKCS#8 PEM as an RS256 signing key. */
+export declare function importRs256PrivateKey(pem: string): Promise<CryptoKey>;
+/** The claims a Google service-account assertion carries. `iat`/`exp` are seconds since the epoch, as the spec requires. */
+export interface ServiceAccountJwtClaims {
+    iss: string;
+    scope: string;
+    aud: string;
+    iat: number;
+    exp: number;
+    /** Domain-wide delegation. Omitted for an ordinary service account. */
+    sub?: string;
+}
+/** Signs `{header}.{payload}` and returns the compact JWT. */
+export declare function signRs256Jwt(claims: ServiceAccountJwtClaims, key: CryptoKey): Promise<string>;

package/dist/adapters/google/vertex.d.ts

@@ -0,0 +1,15 @@
+import type { ProviderAdapter } from "../../types.js";
+import { type GoogleAdapterOptions, type GoogleTransport } from "./generate-content.js";
+import { type AccessTokenSourceOptions } from "./adc.js";
+export declare const VERTEX_ADAPTER_ID = "winter.vertex-gemini";
+/** The API version segment of the location endpoint. Vertex's GenerateContent surface is `v1`, not the Gemini API's `v1beta`. */
+export declare const VERTEX_API_VERSION_PATH = "v1";
+export interface VertexAdapterOptions extends GoogleAdapterOptions, AccessTokenSourceOptions {
+}
+/** Composes the location endpoint. Exported so a fixture can assert the exact URL the ruling names, without reaching the network. */
+export declare function vertexEndpointUrl(location: string): string;
+/** Composes the model path under a resolved base. Exported for the same reason. */
+export declare function vertexModelPath(project: string, location: string, model: string, method: string, search?: string): string;
+export declare function vertexTransport(opts?: VertexAdapterOptions): GoogleTransport;
+/** The Vertex adapter: the shared GenerateContent mapping over the Vertex transport. */
+export declare function createVertexGeminiAdapter(opts?: VertexAdapterOptions): ProviderAdapter;

package/dist/adapters/index.d.ts

@@ -0,0 +1,34 @@
+import type { WinterCatalog, WinterModelDescriptor } from "@yanlinglabs/winter-provider-catalog";
+import type { ProviderAdapter } from "../types.js";
+/** A per-adapter descriptor lookup: the provider-local model id (or key, or alias) a request named -> its catalog row. */
+export type AdapterDescriptorLookup = (providerLocalModelId: string) => WinterModelDescriptor | undefined;
+/**
+ * Every row served by ONE adapter id, indexed by the three spellings a request may use.
+ *
+ * Built once per registration rather than scanned per request: `streamTurn` calls the lookup on
+ * every turn, and a linear scan of the whole catalog per turn is a cost with no reason.
+ */
+export declare function descriptorLookupForAdapter(catalog: WinterCatalog, adapterId: string): AdapterDescriptorLookup;
+/** The adapter ids this build ships, in the order they are registered. Exported so a test can assert the catalog names no adapter this list omits. */
+export declare const SHIPPED_ADAPTER_IDS: readonly ["winter.openai-responses", "winter.openai-chat-completions", "winter.codex-oauth", "winter.xai-oauth", "winter.azure-openai", "winter.local-openai", "winter.anthropic-messages", "winter.google-generate-content", "winter.vertex-gemini", "winter.bedrock-converse"];
+/**
+ * Builds every adapter this build ships against ONE catalog.
+ *
+ * The production wiring's only adapter-construction site (`production-wiring.ts`), and the corpus's
+ * whole-catalog probe's too — so "which adapters does a session have?" and "which adapters did the
+ * probe check?" cannot answer differently.
+ */
+export declare function createShippedAdapters(catalog: WinterCatalog): ProviderAdapter[];
+export { ANTHROPIC_ADAPTER_ID, ANTHROPIC_API_VERSION, ANTHROPIC_DEFAULT_BASE_URL, ANTHROPIC_DEFAULT_MAX_TOKENS, createAnthropicMessagesAdapter, mapAnthropicEffort, toWireMessages, } from "./anthropic/index.js";
+export type { AnthropicAdapterOptions } from "./anthropic/index.js";
+export { GOOGLE_ADAPTER_ID, GOOGLE_API_VERSION_PATH, GOOGLE_DEFAULT_BASE_URL, VERTEX_ADAPTER_ID, VERTEX_API_VERSION_PATH, createGoogleFamilyAdapter, createGoogleGenerateContentAdapter, createVertexGeminiAdapter, geminiTransport, mapGoogleEffort, toContents, vertexEndpointUrl, vertexTransport, } from "./google/index.js";
+export type { GoogleAdapterOptions, GoogleTransport, VertexAdapterOptions } from "./google/index.js";
+export { BEDROCK_ADAPTER_ID, BEDROCK_ADAPTER_VERSION, createBedrockConverseAdapter, mapBedrockEffort, requireRegion, resolveAwsCredentials, signRequest, } from "./bedrock/index.js";
+export type { BedrockAdapter, BedrockAdapterOptions } from "./bedrock/index.js";
+export { CODEX_ORIGINATOR, DEEPSEEK_BASE_URL, OPENAI_API_BASE_URL, OPENAI_CHAT_BASE_URL, OPENROUTER_BASE_URL, createChatCompletionsAdapter, createCodexOauthAdapter, createResponsesAdapter, codexCredentialAccount, codexCredentialRef, deepSeekProfile, openRouterProfile, startCodexLogin, XAI_CONSENT_DISCLOSURE, XAI_OAUTH, XAI_OAUTH_ADAPTER_ID, createXaiOauthAdapter, startXaiLogin, xaiCredentialRef, DERIVED_XAI, DERIVED_XAI_COMMIT, DERIVED_XAI_MODELS, } from "./openai/index.js";
+export type { CodexAdapterOptions, CodexLoginOptions, CodexLoginResult, XaiLoginOptions, XaiLoginResult } from "./openai/index.js";
+export { createAzureOpenAIAdapter } from "./openai/azure.js";
+export type { AzureAdapterOptions } from "./openai/azure.js";
+export { createLocalOpenAIAdapter } from "./openai/local.js";
+export type { LocalAdapterOptions } from "./openai/local.js";
+export { PRIVILEGED_IDENTITY_HEADERS } from "./privileged-headers.js";

package/dist/adapters/oauth/device-code.d.ts

@@ -0,0 +1,32 @@
+import type { LoginConfig, OAuthTokens } from "../openai/pkce.js";
+export interface DeviceCodeConfig {
+    clientId: string;
+    /** Where the device/user code pair is minted (RFC 8628 §3.1). */
+    deviceCodeUrl: string;
+    tokenUrl: string;
+    scope: string;
+    /**
+     * WINTER'S OWN NAME, and the form field the vendor's flow carries it in. Sent on the device
+     * request AND on every poll. Never omitted, never another product's name (WS-13 §5, D21).
+     */
+    identity: {
+        field: string;
+        value: string;
+    };
+    /** Floor for the poll interval. The vendor's own `interval` wins when it is larger (RFC 8628 §3.5). */
+    pollIntervalMs?: number;
+    /** How much `slow_down` widens the interval. RFC 8628 §3.5's own increment is 5 seconds. */
+    slowDownStepMs?: number;
+    /** Default 15 minutes — longer than any vendor's device code lives, so the code expires before this does. */
+    timeoutMs?: number;
+    onAuthStatus?: LoginConfig["onAuthStatus"];
+}
+/**
+ * Runs the device authorization grant to completion and returns the tokens.
+ *
+ * Ends in exactly one of four ways: tokens; a vendor error code (`access_denied`,
+ * `expired_token`, …) as a typed `ProviderRequestError` naming ONLY the code — never the
+ * `error_description`, which routinely quotes the request; the timeout; or a malformed response.
+ * There is no fifth path where it keeps polling.
+ */
+export declare function runDeviceCodeFlow(cfg: DeviceCodeConfig): Promise<OAuthTokens>;

package/dist/adapters/oauth/refresh.d.ts

@@ -0,0 +1,40 @@
+import type { CredentialMaterial, CredentialRef, CredentialStore } from "../../types.js";
+/** The oauth arm of `CredentialMaterial` — what a refresh reads, merges into, and writes back. */
+export type OauthMaterial = Extract<CredentialMaterial, {
+    kind: "oauth";
+}>;
+/** Tokens live in ONE Keychain record per provider/account (R6-10), so a refresh is addressed by a keychain ref. */
+export type KeychainRef = Extract<CredentialRef, {
+    kind: "keychain";
+}>;
+export interface RefreshOauthMaterialInput {
+    store: CredentialStore;
+    ref: KeychainRef;
+    tokenUrl: string;
+    clientId: string;
+    /** Injectable clock, so a fixture can assert the exact `expiresAt` instead of a range. Defaults to `Date.now`. */
+    now?: () => number;
+    /** Extra body fields the vendor's flow requires — an honest identity field, for instance. Never a credential. */
+    extraFields?: Record<string, string>;
+    /**
+     * The grant's body encoding. Defaults to `"form"`.
+     *
+     * P6.5 ruling R-A2-1, "artifact wins": RFC 6749 §4.1.3 requires a token endpoint to ACCEPT
+     * `application/x-www-form-urlencoded`, and every Winter flow posted that — but the Anthropic
+     * Console endpoint is only ever OBSERVED receiving `application/json`, and an unobserved encoding
+     * that turns out to be rejected breaks that flow completely rather than partially. So the
+     * encoding is a per-flow fact rather than a constant. The default keeps codex byte-identical.
+     */
+    bodyEncoding?: "form" | "json";
+}
+/**
+ * Exchanges the record's refresh token for a fresh access token, PERSISTS the merged material, and
+ * returns it.
+ *
+ * Failure modes, all typed `CredentialResolutionError` and all naming the ref rather than the token:
+ * no record, a record that is not `oauth`, a record with no refresh token (refused BEFORE any
+ * request — asking a vendor to refresh nothing is a pointless round trip that also tells them the
+ * account exists), a non-2xx, an unparseable body, and a 200 that carries no access token. In every
+ * failure the OLD material is left exactly as it was.
+ */
+export declare function refreshOauthMaterial(input: RefreshOauthMaterialInput): Promise<OauthMaterial>;

package/dist/adapters/openai/azure.d.ts

@@ -0,0 +1,38 @@
+import type { ProviderAdapter, ProviderContext } from "../../types.js";
+import { type OpenAiAdapterOptions } from "./shared.js";
+/** The `apiVersion` that selects the `/openai/v1` Responses surface rather than the deployment path. */
+export declare const AZURE_PREVIEW_API_VERSION = "preview";
+export interface AzureAdapterOptions extends OpenAiAdapterOptions {
+    /** Used when the connection profile names none. A host that configures neither gets a typed refusal. */
+    defaultApiVersion?: string;
+}
+interface AzureRouting {
+    apiVersion: string;
+    preview: boolean;
+    deployment?: string;
+}
+/**
+ * Reads the routing facts off the connection profile, refusing rather than defaulting.
+ *
+ * A missing `api-version` is a refusal because Azure rejects every call without one — guessing a
+ * version would silently pin the operator to a surface they never chose. A missing `deployment` is a
+ * refusal only on the classic path, where it IS the address.
+ */
+export declare function azureRouting(ctx: ProviderContext, options: AzureAdapterOptions): AzureRouting;
+/** The turn URL for a routing. `deployment` is percent-encoded: it is untrusted profile input going into a path. */
+export declare function azureTurnUrl(baseUrl: string, routing: AzureRouting): string;
+export declare function createAzureOpenAIAdapter(options: AzureAdapterOptions): ProviderAdapter;
+/** An Azure connection profile, so a host names the three facts in one place. */
+export declare function azureProfile(opts: {
+    baseUrl: string;
+    deployment?: string;
+    apiVersion: string;
+    headers?: Record<string, string>;
+}): {
+    providerId: string;
+    baseUrl: string;
+    apiVersion: string;
+    deployment?: string;
+    headers?: Record<string, string>;
+};
+export {};

package/dist/adapters/openai/chat-completions.d.ts

@@ -0,0 +1,86 @@
+import type { WinterModelDescriptor } from "@yanlinglabs/winter-provider-catalog";
+import type { ProviderAdapter, ProviderContext, ProviderEvent, ProviderMessageLike, TurnRequest } from "../../types.js";
+import { type AuthStyle, type OpenAiAdapterOptions, type ReasoningPlan, type ResolvedEndpoint } from "./shared.js";
+export declare const OPENAI_CHAT_BASE_URL = "https://api.openai.com/v1";
+export declare const DEEPSEEK_BASE_URL = "https://api.deepseek.com";
+export declare const OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1";
+/** The `native_state` item DeepSeek-class exposed reasoning rides in. A Winter-shaped wrapper, because the text is ours to place — it is not an opaque provider object. */
+export interface ExposedReasoningItem {
+    type: "winter.exposed_reasoning";
+    text: string;
+}
+/**
+ * `ProviderMessageLike[]` -> chat `messages`.
+ *
+ * `system` is prepended by the caller rather than derived here, so the ordering is visible at the
+ * one place that owns the body.
+ */
+export declare function mapChatMessages(messages: readonly ProviderMessageLike[], replayExposedReasoning: boolean): unknown[];
+export declare function mapChatTools(tools: TurnRequest["tools"]): unknown[];
+/**
+ * The chat request body.
+ *
+ * `max_completion_tokens` vs `max_tokens`: the newer spelling is required on reasoning models and
+ * rejected by many local servers, and the old one is the reverse. The descriptor's own reasoning
+ * evidence is what decides, which keeps the choice a recorded FACT about the model rather than a
+ * guess about the endpoint. Disclosed.
+ */
+export declare function buildChatBody(req: TurnRequest, reasoning: ReasoningPlan, descriptor: WinterModelDescriptor | undefined, replayExposedReasoning: boolean): Record<string, unknown>;
+/**
+ * Chat Completions SSE chunks -> Winter's normalized events.
+ *
+ * ARGUMENTS ARE ASSEMBLED BY `index`, NOT BY ID: only the FIRST fragment of a call carries its `id`
+ * and `function.name`; every later fragment carries the index alone. An adapter keyed on id would
+ * drop every continuation fragment and produce empty arguments for every call — silently.
+ */
+export declare class ChatStreamMapper {
+    private readonly captureExposedReasoning;
+    private started;
+    private stopReason;
+    private exposed;
+    private completed;
+    private readonly callsByIndex;
+    private readonly order;
+    constructor(captureExposedReasoning: boolean);
+    map(data: string): ProviderEvent[];
+    /** The stream ended. A turn that reached a `finish_reason` is complete even without a `[DONE]` — many OpenAI-compatible servers never send one. */
+    finish(): ProviderEvent[];
+    private finalize;
+    private mapDelta;
+}
+export interface ChatTurnOptions extends OpenAiAdapterOptions {
+    /** Azure's deployment surface needs `api-key`; everything else is a bearer. */
+    authStyle?: AuthStyle;
+}
+/**
+ * The chat turn, from selection validation to the last event.
+ *
+ * Everything refusable is refused before the endpoint is even resolved, so a rejected selection
+ * leaves the fake with zero recorded requests — which is what the corpus asserts on.
+ */
+export declare function chatTurn(req: TurnRequest, ctx: ProviderContext, options: ChatTurnOptions, fallbackBaseUrl: string | undefined, urlFor: (endpoint: ResolvedEndpoint) => string, extraProtocolHeaders?: Record<string, string>): AsyncIterable<ProviderEvent>;
+export declare function createChatCompletionsAdapter(options: ChatTurnOptions): ProviderAdapter;
+/**
+ * OpenRouter as a CONNECTION PROFILE of the chat adapter, not a fourth adapter.
+ *
+ * The attribution headers are set ONLY when the caller supplies them. They identify the operator's
+ * app to a third party, so defaulting them would disclose something the host never asked to
+ * disclose — and they are user-supplied rather than privileged precisely because OpenRouter's own
+ * endpoint is where they belong.
+ */
+export declare function openRouterProfile(opts?: {
+    baseUrl?: string;
+    referer?: string;
+    title?: string;
+}): {
+    providerId: string;
+    baseUrl: string;
+    headers?: Record<string, string>;
+};
+/** DeepSeek as a connection profile. Its `reasoning_content` handling is descriptor-driven, so there is nothing endpoint-specific to configure beyond the base URL. */
+export declare function deepSeekProfile(opts?: {
+    baseUrl?: string;
+}): {
+    providerId: string;
+    baseUrl: string;
+};