@yanlinglabs/winter-provider-runtime 0.0.2

package/dist/adapters/openai/codex-config.d.ts

@@ -0,0 +1,42 @@
+export declare const CODEX: {
+    /** OAuth application id — shared by all Codex CLI clients. */
+    readonly clientId: "app_EMoamEEZ73f0CkXaXp7hrann";
+    /** Authorization endpoint: `{issuer}/oauth/authorize`. */
+    readonly authorizeUrl: "https://auth.openai.com/oauth/authorize";
+    /** Token exchange + refresh endpoint. */
+    readonly tokenUrl: "https://auth.openai.com/oauth/token";
+    /** Local callback port (primary). */
+    readonly callbackPort: 1455;
+    /** The fallback port, per codex-rs's own allow-list. A login refuses rather than drifting onto an arbitrary port. */
+    readonly fallbackCallbackPort: 1457;
+    /** OAuth scopes — codex-rs's own scope string from `build_authorize_url`. */
+    readonly scope: "openid profile email offline_access api.connectors.read api.connectors.invoke";
+    /** Base URL for the ChatGPT Codex backend; `/responses` is appended for a turn. */
+    readonly backendUrl: "https://chatgpt.com/backend-api/codex";
+    readonly headers: Record<string, string>;
+};
+/** The DEFAULT `originator` value, exported so a fixture asserts on it by name rather than by string literal. */
+export declare const CODEX_ORIGINATOR: string;
+/**
+ * The date `CODEX_MODELS` was last checked against the live `/models` catalogue, carried from the
+ * port. It lives next to the data it dates so the two cannot drift apart.
+ */
+export declare const CODEX_MODELS_VERIFIED = "2026-07-31";
+/**
+ * The static Codex model set.
+ *
+ * The backend returns only these slugs for ChatGPT-account auth; other OpenAI model ids answer
+ * HTTP 400 ("not supported when using Codex with a ChatGPT account"), so this is an ALLOW-LIST in
+ * effect and not merely a convenience. `contextWindow` is 272000 for every model the catalogue
+ * offers — a number the port records as having been WRONG once (372000, hand-transcribed), which
+ * put an auto-compaction threshold above the backend's own hard ceiling and killed compaction
+ * silently. Re-derive it from the live catalogue; never edit it by hand.
+ */
+export declare const CODEX_MODELS: ReadonlyArray<{
+    id: string;
+    contextWindow: number;
+    supportsVision: boolean;
+}>;
+export declare const DEFAULT_CODEX_MODEL = "gpt-5.6-sol";
+/** The Keychain account a codex credential occupies: `codex-oauth:<accountId>` (R6-10's one-record-per-provider/account rule). */
+export declare function codexCredentialAccount(accountId: string): string;

package/dist/adapters/openai/codex-oauth.d.ts

@@ -0,0 +1,47 @@
+import type { CredentialRef, CredentialStore, ProviderAdapter } from "../../types.js";
+import { QuotaManager } from "./quota.js";
+import { type OpenAiAdapterOptions } from "./shared.js";
+export interface CodexAdapterOptions extends OpenAiAdapterOptions {
+    /** The token endpoint. Injectable for a fixture; the production value is `CODEX.tokenUrl`. */
+    tokenUrl?: string;
+    /** Shared across turns so the subscription state survives one. A fixture may inject its own clock. */
+    quota?: QuotaManager;
+}
+/** How a codex credential is stored: one `oauth` material under `codex-oauth:<accountId>`. */
+export declare function codexCredentialRef(accountId: string, service?: string): Extract<CredentialRef, {
+    kind: "keychain";
+}>;
+export interface CodexLoginOptions {
+    openUrl: (url: string) => Promise<void>;
+    /** Overridden by a fixture; production uses `CODEX`'s own values. */
+    authorizeUrl?: string;
+    tokenUrl?: string;
+    callbackPort?: number;
+    fallbackCallbackPort?: number;
+    timeoutMs?: number;
+    /** The Keychain service the record lands in — `config.keychainService` from the host. */
+    service?: string;
+    onAuthStatus?: (status: {
+        isAuthenticating: boolean;
+        output?: string[];
+        error?: string;
+    }) => void;
+}
+export interface CodexLoginResult {
+    ref: Extract<CredentialRef, {
+        kind: "keychain";
+    }>;
+    accountId: string;
+    expiresAt: number;
+}
+/**
+ * The host-invoked login. Runs the PKCE loopback flow and PERSISTS the result through the
+ * credential store, returning the ref a session should be configured with.
+ *
+ * An account id is required to name the record: without one there is no per-account slot, and R6-10
+ * is explicit that a credential occupies one record per provider/account rather than a shared global
+ * slot. A token exchange that returned no id token is therefore a refusal, not a fallback to some
+ * default name.
+ */
+export declare function startCodexLogin(store: CredentialStore, options: CodexLoginOptions): Promise<CodexLoginResult>;
+export declare function createCodexOauthAdapter(options: CodexAdapterOptions): ProviderAdapter;

package/dist/adapters/openai/index.d.ts

@@ -0,0 +1,20 @@
+export { createResponsesAdapter, buildResponsesBody, mapResponsesInput, mapResponsesTools, responsesTurn, streamResponsesTurn, privilegedHeaders, ResponsesStreamMapper, OPENAI_API_BASE_URL } from "./responses.js";
+export type { ResponsesTurnPlan } from "./responses.js";
+export { createChatCompletionsAdapter, buildChatBody, mapChatMessages, mapChatTools, chatTurn, deepSeekProfile, openRouterProfile, ChatStreamMapper, DEEPSEEK_BASE_URL, OPENAI_CHAT_BASE_URL, OPENROUTER_BASE_URL, } from "./chat-completions.js";
+export type { ChatTurnOptions, ExposedReasoningItem } from "./chat-completions.js";
+export { createCodexOauthAdapter, codexCredentialRef, startCodexLogin } from "./codex-oauth.js";
+export type { CodexAdapterOptions, CodexLoginOptions, CodexLoginResult } from "./codex-oauth.js";
+export { CODEX, CODEX_MODELS, CODEX_MODELS_VERIFIED, CODEX_ORIGINATOR, DEFAULT_CODEX_MODEL, codexCredentialAccount } from "./codex-config.js";
+export { QuotaManager, quotaEvent } from "./quota.js";
+export type { QuotaState } from "./quota.js";
+export { base64Url, buildAuthorizeUrl, decodeAccountId, generatePkce, refreshTokens, runLoginFlow } from "./pkce.js";
+export type { LoginConfig, OAuthTokens } from "./pkce.js";
+export { XAI_CONSENT_DISCLOSURE, XAI_OAUTH, XAI_OAUTH_ADAPTER_ID, createXaiOauthAdapter, startXaiLogin, xaiCredentialRef } from "./xai-oauth.js";
+export type { XaiLoginOptions, XaiLoginResult } from "./xai-oauth.js";
+export { DERIVED_XAI, DERIVED_XAI_COMMIT, DERIVED_XAI_MODELS } from "./xai-derived-shapes.js";
+export { createLocalOpenAIAdapter } from "./local.js";
+export type { LocalAdapterOptions } from "./local.js";
+export { createAzureOpenAIAdapter, azureProfile, azureRouting, azureTurnUrl, AZURE_PREVIEW_API_VERSION } from "./azure.js";
+export type { AzureAdapterOptions } from "./azure.js";
+export { EFFORT_LADDER, EventQueue, assertRepresentableTools, assertWithinLimits, buildHeaders, capabilitiesFrom, capabilityRefusal, fetchOpenAiModels, mapEffortAgainst, pumpEvents, resolveEndpoint, resolveReasoning, snapNumericEffort, } from "./shared.js";
+export type { AuthStyle, DescriptorLookup, OpenAiAdapterOptions, ReasoningPlan, ResolvedEndpoint } from "./shared.js";

package/dist/adapters/openai/local.d.ts

@@ -0,0 +1,16 @@
+import type { ProviderAdapter } from "../../types.js";
+import { type ChatTurnOptions } from "./chat-completions.js";
+export interface LocalAdapterOptions extends ChatTurnOptions {
+    /** Which surface this server speaks. Almost every local server is `chat`; a few expose Responses. */
+    surface?: "chat" | "responses";
+    /**
+     * The registered adapter id.
+     *
+     * Overridable because the catalog's twelve local providers currently name
+     * `winter.openai-chat-completions` as their `adapterId`, and a registry resolves an adapter BY
+     * THAT ID. A host that wants the `/api/tags` fallback registers this adapter under whichever id
+     * its catalog rows actually point at.
+     */
+    id?: string;
+}
+export declare function createLocalOpenAIAdapter(options: LocalAdapterOptions): ProviderAdapter;

package/dist/adapters/openai/pkce.d.ts

@@ -0,0 +1,111 @@
+export interface OAuthTokens {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    accountId?: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+}
+export interface LoginConfig {
+    clientId: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    /** 1455 in production (codex-rs parity); `0` gives an ephemeral port, which is what a fixture uses. */
+    callbackPort: number;
+    /** Tried when `callbackPort` is already taken. Omitted for an ephemeral port. */
+    fallbackCallbackPort?: number;
+    /**
+     * The loopback callback's PATH, which is part of what a registered `redirect_uri` matches.
+     *
+     * P6.5 lane A2: this was a hard-coded `/auth/callback` when codex was the only flow, and the
+     * Anthropic Console client registers `/callback` instead (derived-shapes-p6b.md §2.2). Optional
+     * and defaulted, so codex's own value is unchanged and no existing caller sees a difference.
+     */
+    callbackPath?: string;
+    /**
+     * Names the flow in this file's user-facing failures ("the … login timed out").
+     *
+     * Defaulted to codex for the same reason: those strings were written when there was one flow, and
+     * an Anthropic user told their sign-in failed because "the codex login timed out" would be reading
+     * a message about a product they are not using.
+     */
+    label?: string;
+    /**
+     * P7a pre-publish (N1): the EXPORTED function a caller invoked, for `BunRequiredError.functionName`.
+     *
+     * Separate from `label` on purpose, because the two answer different questions and round 3
+     * conflated them. `label` is USER-FACING PROSE ("the Anthropic Console login timed out") and its
+     * own doc above reserves it for that; `functionName` is a DEVELOPER-FACING identifier that must be
+     * the symbol in the caller's code (`bun-required.ts`: "never the internal helper that reaches for
+     * Bun"). Round 3 fixed the identifier by writing it into `label`, which made a codex user read
+     * "the startCodexLogin login timed out" -- a function name where a product name goes.
+     *
+     * Absent -> the guard names `runLoginFlow`, which is honest for a direct caller of this helper.
+     */
+    functionName?: string;
+    /**
+     * The token exchange's body encoding. Defaults to `"form"`.
+     *
+     * P6.5 ruling R-A2-1 — see `adapters/oauth/refresh.ts` for the whole reasoning. Short version:
+     * RFC 6749 §4.1.3 requires a token endpoint to accept form encoding, but the Anthropic Console
+     * endpoint is only ever OBSERVED receiving JSON, and guessing wrong there breaks the login
+     * outright. The default keeps codex byte-identical.
+     */
+    bodyEncoding?: "form" | "json";
+    /**
+     * Whether the authorization-code grant carries `state`. Defaults to `false`.
+     *
+     * `state` is NOT an RFC 6749 token-request parameter — it is the authorize-request nonce echoed
+     * back on the redirect, and this flow has already compared it before accepting the code. The
+     * Anthropic Console client sends it on the grant anyway, so Winter matches that endpoint's observed
+     * request; every other flow must not, because sending a parameter a vendor never sees from its own
+     * client is a gratuitous difference on the one request whose failure mode is "your login is
+     * broken". It was briefly unconditional and the controller reverted it: codex's token request is
+     * byte-identical to what it was before this lane, and a fixture pins the exact body to keep it so.
+     */
+    includeStateInTokenRequest?: boolean;
+    scope: string;
+    timeoutMs?: number;
+    /** Opens the browser. HOST-supplied: the SDK never shells out to a browser itself. */
+    openUrl: (url: string) => Promise<void>;
+    onAuthStatus?: (status: {
+        isAuthenticating: boolean;
+        output?: string[];
+        error?: string;
+    }) => void;
+}
+/** base64url over raw bytes, no padding. Hand-rolled because `btoa` needs a binary string and the padding has to go. */
+export declare function base64Url(bytes: Uint8Array): string;
+/** A PKCE verifier/challenge pair. 48 random bytes is 64 base64url characters — inside RFC 7636's 43-128 range. */
+export declare function generatePkce(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+/**
+ * Reads the ChatGPT account id out of an id token WITHOUT verifying it.
+ *
+ * That is safe for exactly one reason, and only that one: the value is used as a LOCATOR — the
+ * Keychain account name and a request header — never as an authorization decision. The token came
+ * from a TLS-authenticated token endpoint over a PKCE-bound exchange; nothing here treats a claim
+ * in it as a permission.
+ */
+export declare function decodeAccountId(idToken: string): string | undefined;
+export declare function refreshTokens(tokenUrl: string, clientId: string, refreshToken: string): Promise<OAuthTokens>;
+/**
+ * Runs the loopback authorization-code flow.
+ *
+ * The callback server binds `127.0.0.1` ONLY: an authorization code is a single-use credential, and
+ * a server on `0.0.0.0` would make it reachable from the LAN for as long as the login is open.
+ * `state` is compared before the code is accepted, which is what makes a CSRF-planted callback fail
+ * instead of completing someone else's login into this process.
+ */
+export declare function runLoginFlow(cfg: LoginConfig): Promise<OAuthTokens>;
+/** The authorize URL a login would open, for a fixture that wants to drive the callback without a browser. */
+export declare function buildAuthorizeUrl(cfg: {
+    authorizeUrl: string;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    state: string;
+    challenge: string;
+}): string;

package/dist/adapters/openai/quota.d.ts

@@ -0,0 +1,99 @@
+import type { ProviderEvent } from "../../types.js";
+/**
+ * `resumeAt` is OPTIONAL, and that is the whole of finding I1's fix.
+ *
+ * A 429 without a `Retry-After` header is a limit whose WINDOW IS UNKNOWN — the account is refused,
+ * and nothing has said when it resumes. Modelling that as `resumeAt: <some number>` forced the
+ * caller to invent one (the previous code handed it Winter's own jittered backoff, which then rode
+ * the pinned `SDKRateLimitInfo.resetsAt` as a claim about the subscription), and modelling it as
+ * `resumeAt: 0` made it indistinguishable from "not limited". So `limited` is tracked as its own
+ * flag, independent of any window, and a window-unknown limit omits `resetsAt` entirely.
+ */
+export type QuotaState = {
+    kind: "ok";
+} | {
+    kind: "limited";
+    resumeAt?: number;
+};
+export interface QuotaManagerOptions {
+    maxConcurrent?: number;
+    /** Injected so a fixture never waits out a real limit window. */
+    now?: () => number;
+    /**
+     * How `waitIfLimited` waits. Injectable for the same reason `RetryPolicyOptions.sleep` is, and it
+     * is NOT redundant with it: in production the retry backoff and the quota window are the same
+     * wait (the backoff consumes the window), but a fixture that mocks only the retry sleep still
+     * spends the real window here — twice per 429 scenario.
+     */
+    sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+}
+/**
+ * Tracks a ChatGPT account's quota state and caps concurrent turns against it.
+ *
+ * `resumeAt` is epoch MILLISECONDS internally and is rendered as epoch SECONDS on the event, which
+ * is the pinned `SDKRateLimitInfo.resetsAt` convention. Only fields the pin actually declares are
+ * emitted: `status` and `resetsAt`. Inventing a `rateLimitType` (whose six members are all
+ * consumer-subscription shapes) would be a claim about which window was hit, and the backend's 429
+ * does not say.
+ */
+export declare class QuotaManager {
+    private readonly maxConcurrent;
+    private readonly now;
+    private readonly sleep;
+    private active;
+    private waiters;
+    /** Set by a refusal, cleared only by `noteRecovered()`. Survives the window elapsing — see `hasPendingLimit`. */
+    private limited;
+    /** `0` means "limited, window unknown". Never a synthesised value. */
+    private limitedUntil;
+    private listeners;
+    private totals;
+    constructor(opts?: QuotaManagerOptions);
+    /**
+     * The state a `rate_limit` event is rendered from.
+     *
+     * A KNOWN window that has elapsed reads `ok` — the account is presumed serving again, which is
+     * what the backend told us. A window-UNKNOWN limit stays `limited` until something says otherwise,
+     * because nothing has: guessing that it lapsed would be the same invention `resumeAt` refuses.
+     */
+    state(): QuotaState;
+    /**
+     * True from a refusal until `noteRecovered()`, WHATEVER the clock says.
+     *
+     * `state()` cannot answer this (finding I2): by the time a retried turn completes, the retry
+     * backoff has slept the whole window, so `state()` reads `ok` and "was this turn rate-limited?"
+     * silently becomes "no" — which made the recovery event unreachable under a real clock while a
+     * fixture with a 1 ms mocked sleep passed.
+     */
+    hasPendingLimit(): boolean;
+    onStateChange(callback: (state: QuotaState) => void): () => void;
+    private emit;
+    /**
+     * Records that the backend refused for quota reasons.
+     *
+     * `retryAfterMs` MUST come from the refused response's own `Retry-After` header, never from a
+     * computed backoff (finding I1). Absent means the window is unknown, which is recorded as exactly
+     * that: limited, with no resume time.
+     */
+    noteRateLimit(retryAfterMs: number | undefined): void;
+    /** The account is serving again. Silent when it never stopped — a listener must not see a state change that did not happen. */
+    noteRecovered(): void;
+    accumulate(inputTokens: number, outputTokens: number): void;
+    usage(): {
+        inputTokens: number;
+        outputTokens: number;
+    };
+    acquire(): Promise<void>;
+    release(): void;
+    /** Waits out a known limit window, ABORTABLY: an interrupt must not have to outlast a quota reset. */
+    waitIfLimited(signal?: AbortSignal): Promise<void>;
+}
+/**
+ * A quota state -> the pinned-shaped `rate_limit` event.
+ *
+ * `kind: "subscription-quota"` is the type-level statement that this is NOT an HTTP 429 (R6-B), and
+ * it is the only `kind` the seam admits.
+ */
+export declare function quotaEvent(state: QuotaState): Extract<ProviderEvent, {
+    type: "rate_limit";
+}>;

package/dist/adapters/openai/responses.d.ts

@@ -0,0 +1,142 @@
+import type { WinterModelDescriptor } from "@yanlinglabs/winter-provider-catalog";
+import type { ProviderAdapter, ProviderContext, ProviderEvent, ProviderMessageLike, TurnRequest } from "../../types.js";
+import { EventQueue, type OpenAiAdapterOptions, type ReasoningPlan, type ResolvedEndpoint } from "./shared.js";
+export declare const OPENAI_API_BASE_URL = "https://api.openai.com/v1";
+/**
+ * `ProviderMessageLike[]` -> the Responses `input` array.
+ *
+ * The STRUCTURED content form is mandatory, and that is a live finding rather than a style choice:
+ * the flat `{ role, content: "string" }` form was rejected with an HTTP 400 by the codex backend
+ * (Norma, 2026-06-13). Assistant content is `output_text`, everything else `input_text`.
+ *
+ * NATIVE STATE LEADS ITS MESSAGE. §5.3 requires the provider's completed output items to be replayed
+ * in their original order among messages and tool calls; a turn's real order is reasoning item(s)
+ * first, then the message / function_call it produced. The renderer has already dropped any state
+ * from a foreign continuation domain before this sees it, so what arrives here is replayable by
+ * construction.
+ */
+export declare function mapResponsesInput(messages: readonly ProviderMessageLike[]): unknown[];
+export declare function mapResponsesTools(tools: TurnRequest["tools"]): unknown[];
+/**
+ * The Responses request body.
+ *
+ * `instructions` is sent ONLY when the caller supplied a non-empty system prompt — a deliberate
+ * deviation from the port, which sent a default string. Global Constraints forbid vendor prompt
+ * text, and inventing a Winter one would put an instruction in front of the model that no caller
+ * asked for; codex-rs itself skips the field when it is empty.
+ */
+export declare function buildResponsesBody(req: TurnRequest, reasoning: ReasoningPlan, descriptor: WinterModelDescriptor | undefined): Record<string, unknown>;
+/**
+ * Responses SSE frames -> Winter's normalized `ProviderEvent`s.
+ *
+ * One instance per turn: the reasoning-item accumulator, the seen-a-call flag and the
+ * did-this-call-stream-its-arguments map are all per-turn state.
+ */
+/**
+ * Which stream event this family treats as COMPLETING, from the descriptor's own `completionEvent`
+ * evidence (review round 1, C — ledger line 36).
+ *
+ * Lane B's pattern, applied here: `anthropicCaptureEvent` and the Google resolver both read this
+ * field, and this family hard-coded `"response.completed"` — so a catalog row that DECLARED a
+ * different terminator was silently ignored, and the evidence existed for two families out of four.
+ *
+ * MATCHED LENIENTLY BY MENTION, for the same reason those two are: the field is a prose-ish
+ * `CapabilityEvidence<string>`, not an enum. `"response.completed"` stays as the fallback and is the
+ * conservative answer — the pinned terminator for this surface, and the one every unlisted row means.
+ *
+ * `response.incomplete` is always ALSO treated as terminal and is deliberately not configurable: it
+ * is a truncation, not a completion, and a row that named some other event would still have to end
+ * its stream somewhere.
+ */
+export declare function responsesCompletionEvent(descriptor: WinterModelDescriptor | undefined): string;
+export declare class ResponsesStreamMapper {
+    private readonly completionEvent;
+    /** The event this stream's descriptor says completes a response. Injected so the mapper never reaches for a catalog itself. */
+    constructor(completionEvent?: string);
+    private sawToolCall;
+    private sawRefusal;
+    private started;
+    /**
+     * The completed reasoning items, ordered by the response's OWN `output_index` and, for anything
+     * that carried none, by arrival after everything that did.
+     *
+     * A list rather than a `Map<number, unknown>` keyed on `output_index ?? 0` (minor 6): that default
+     * made every indexless item collide on key 0, so a stream carrying two of them replayed ONE — a
+     * silently truncated continuation whose next turn fails at the provider, far from here.
+     */
+    private readonly reasoningItems;
+    private arrivals;
+    /** Item ids already reported as unrepresentable, so `added` + `done` for one call is ONE error (minor 5). */
+    private readonly reportedUnrepresentable;
+    /** item_id -> call_id, so an arguments delta (which carries only the item id) can name its call. */
+    private readonly callIdByItem;
+    /** call_ids whose arguments arrived as deltas — the final item must not re-send them. */
+    private readonly streamedArguments;
+    private completed;
+    map(data: string): ProviderEvent[];
+    /**
+     * Called when the byte stream ended.
+     *
+     * A stream that stopped before `response.completed` is a TRUNCATED turn, and reporting it as a
+     * finished one would hand the caller a partial answer as if it were whole. It becomes a
+     * non-retryable `network` error: bytes flowed, so R6-6 forbids replaying it.
+     */
+    finish(): ProviderEvent[];
+    private onCreated;
+    private onItemAdded;
+    private onArgumentsDelta;
+    private onItemDone;
+    private onCompleted;
+    private noteRefusal;
+    /**
+     * ONE error per unrepresentable CALL, not one per lifecycle event (minor 5).
+     *
+     * A call appears twice in the stream (`output_item.added`, then `.done`), so reporting on both
+     * emitted two errors for one refusal — which a consumer counting failures reads as two problems.
+     */
+    private unrepresentable;
+    private unrepresentableError;
+    private failureMessage;
+}
+/** What a Responses-speaking adapter (plain OpenAI, codex-oauth, Azure's preview surface) has to supply beyond the request body. */
+export interface ResponsesTurnPlan {
+    /** The provider-local model id this plan is for — the descriptor lookup's key (review round 1, C). */
+    model: string;
+    url: string;
+    headers: Record<string, string>;
+    endpoint: ResolvedEndpoint;
+    ctx: ProviderContext;
+    options: OpenAiAdapterOptions;
+    body: string;
+    beforeAttempt?: (attempt: number) => Promise<void>;
+    recover?: (status: number, attempt: number) => Promise<Record<string, string> | undefined>;
+    /** Observes the refused response before its body is read — the codex quota manager's only honest source for a limit window (finding I1). */
+    onRefused?: (response: Response) => void;
+    /** Observed after a successful turn — the codex quota manager's "we are no longer limited" hook. */
+    onSuccess?: () => void;
+    /** Observed on a rate-limited failure, BEFORE the retry sleeps. The one producer of `rate_limit` events (R6-B). */
+    onRateLimited?: (retry: Extract<ProviderEvent, {
+        type: "retry";
+    }>, queue: EventQueue) => void;
+    /** Pre-seeded observations (an `auth_status` from a token refresh that already happened). */
+    queue?: EventQueue;
+}
+/**
+ * Opens the stream, consumes it, and yields the normalized events.
+ *
+ * `policy.commit()` fires on the FIRST SSE event, not at header time: WS-13 §13's line is the first
+ * response byte consumed, and a 5xx that arrives with headers and an error body is still safely
+ * retryable.
+ */
+export declare function streamResponsesTurn(plan: ResponsesTurnPlan, signal: AbortSignal | undefined): AsyncIterable<ProviderEvent>;
+export declare function createResponsesAdapter(options: OpenAiAdapterOptions): ProviderAdapter;
+/** PRIVILEGED headers (R6-L): identifiers that only mean something at the reviewed endpoint they were minted for. `applyPrivilegedHeaders` drops them for a user endpoint. */
+export declare function privilegedHeaders(options: OpenAiAdapterOptions): Record<string, string>;
+/**
+ * The plain-OpenAI (and Azure-preview) turn: resolve the endpoint and credential, validate the
+ * SELECTION before anything is sent, then stream.
+ *
+ * Everything that can be refused is refused here, synchronously enough that the fake records ZERO
+ * requests — which is what the effort-mapping and limit-rejection fixtures assert on.
+ */
+export declare function responsesTurn(req: TurnRequest, ctx: ProviderContext, options: OpenAiAdapterOptions, fallbackBaseUrl: string | undefined, urlFor: (baseUrl: string) => string, extraProtocolHeaders?: Record<string, string>): AsyncIterable<ProviderEvent>;