@demicodes/provider-grok-build 0.10.3 → 0.12.0

package/README.md

@@ -5,8 +5,28 @@ stored by the official Grok CLI in `~/.grok/auth.json` (subscription login).
 
 ```ts
 import { createGrokBuildProvider } from '@demicodes/provider-grok-build'
+
+const provider = createGrokBuildProvider()
+// provider.auth, provider.quota, provider.credentials (multi-account pool by default)
 ```
 
-Requires a prior `grok login` (or equivalent) so `~/.grok/auth.json` contains an
-OIDC session. Implements the [`@demicodes/provider`](../provider/README.md)
-contract. Part of [Demi](../../README.md). Apache-2.0.
+## Auth and credentials
+
+- Default material: `~/.grok/auth.json` (or `$GROK_HOME`); multi-entry map supported.
+- Multi-credential pool under `$DEMI_HOME/credentials/grok-build/`; `importDefault`
+  can snapshot each OIDC entry as its own pool credential.
+- Lifecycle: `beginLogin` → `grok login` → `importDefault` → `setActive`.
+
+Requires a prior login (or `beginLogin`) so vendor material exists before import.
+See [docs/provider-global-credentials.md](../../docs/provider-global-credentials.md).
+
+## Quota
+
+- **probe** (cost: `free`): `/v1/billing` + `/v1/user?include=subscription` on
+  cli-chat-proxy.
+- **observe**: short-window ratelimit headers on chat responses (separate from monthly).
+
+See [docs/provider-quota.md](../../docs/provider-quota.md).
+
+Implements the [`@demicodes/provider`](../provider/README.md) contract. Part of
+[Demi](../../README.md). Apache-2.0.

package/dist/index.d.mts

@@ -1,6 +1,20 @@
-import { Provider, ProviderAuthState, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
-
+import { Provider, ProviderAuthState, ProviderCredentials, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
+import { FileCredentialPool } from "@demicodes/provider/credentials-pool";
 //#region src/auth.d.ts
+/** One credential entry as written by the Grok CLI (`~/.grok/auth.json`). */
+interface GrokAuthEntry {
+  key?: string;
+  auth_mode?: string;
+  refresh_token?: string;
+  expires_at?: string;
+  oidc_issuer?: string;
+  oidc_client_id?: string;
+  email?: string;
+  first_name?: string;
+  user_id?: string;
+  team_id?: string;
+  [key: string]: unknown;
+}
 interface GrokResolvedAuth {
   accessToken: string;
   refreshToken: string | null;
@@ -19,6 +33,13 @@ interface GrokAuthStore {
 }
 interface FileGrokAuthStoreOptions {
   grokHome?: string;
+  /** Override auth.json path (e.g. demi credential pool entry). */
+  authFile?: string;
+  /**
+   * Prefer this map key when the auth file has multiple OIDC entries.
+   * When unset, uses {@link selectAuthEntry} scoring.
+   */
+  entryKey?: string;
   refresh?: GrokTokenRefresh;
   now?: () => Date;
   lockRetryDelayMs?: number;
@@ -48,6 +69,10 @@ interface GrokBuildProviderOptions {
   authStore?: GrokAuthStore;
   headers?: Record<string, string>;
   fetch?: GrokBuildFetch;
+  /** Demi state root for credential pool (`$DEMI_HOME` / `~/.demi`). */
+  stateDir?: string;
+  /** When true (default if `authStore` unset), attach multi-credential pool. */
+  credentials?: boolean;
 }
 declare function createGrokBuildProvider(options?: GrokBuildProviderOptions): Provider;
 declare function parseGrokBuildProviderConfig(config: unknown): Pick<GrokBuildProviderOptions, 'grokHome' | 'baseUrl' | 'headers'>;
@@ -86,4 +111,51 @@ declare function mapGrokQuotaProbe(user: unknown, billing: unknown, auth?: Pick<
 /** Short-window chat ratelimits — not subscription monthly quota. */
 declare function observeGrokRateLimitHeaders(headers: Headers | undefined): ProviderQuotaProbeResult | null;
 //#endregion
-export { type GrokBuildFetch, type GrokBuildProviderOptions, type GrokBuildQuotaOptions, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, parseGrokBuildProviderConfig };
+//#region src/credentials.d.ts
+declare class PoolAwareGrokAuthStore implements GrokAuthStore {
+  private readonly pool;
+  private readonly vendorHome;
+  private readonly fileAuthOptions;
+  constructor(pool: FileCredentialPool, options?: {
+    grokHome?: string;
+    fileAuthOptions?: Omit<FileGrokAuthStoreOptions, 'grokHome' | 'authFile' | 'entryKey'>;
+  });
+  status(): Promise<import("@demicodes/provider").ProviderAuthState>;
+  resolveAuth(options?: {
+    forceRefresh?: boolean;
+  }): Promise<GrokResolvedAuth>;
+  private currentStore;
+}
+declare function openGrokCredentialPool(options?: {
+  stateDir?: string;
+}): FileCredentialPool;
+declare function createGrokBuildCredentials(pool: FileCredentialPool, authStore: GrokAuthStore, options?: {
+  grokHome?: string;
+  quota?: ProviderQuota | null;
+  /** Injectable fetch for the device-code login flow (tests). */
+  loginFetch?: typeof fetch;
+}): ProviderCredentials;
+//#endregion
+//#region src/device-login.d.ts
+interface GrokDeviceLoginPending {
+  verificationUrl: string;
+  userCode: string;
+  expiresAt: string;
+}
+interface GrokDeviceLoginOptions {
+  signal?: AbortSignal;
+  /** Fires once with the URL + one-time code the user needs. */
+  onPending?: (pending: GrokDeviceLoginPending) => void;
+  fetch?: typeof fetch;
+  issuer?: string;
+  clientId?: string;
+  scope?: string;
+}
+interface GrokDeviceLoginResult {
+  entryKey: string;
+  entry: GrokAuthEntry;
+}
+/** Runs the full device flow and returns a vendor-shaped auth.json entry keyed like the Grok CLI. */
+declare function runGrokDeviceLogin(options?: GrokDeviceLoginOptions): Promise<GrokDeviceLoginResult>;
+//#endregion
+export { type GrokBuildFetch, type GrokBuildProviderOptions, type GrokBuildQuotaOptions, type GrokDeviceLoginOptions, type GrokDeviceLoginPending, type GrokDeviceLoginResult, PoolAwareGrokAuthStore, createGrokBuildCredentials, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, openGrokCredentialPool, parseGrokBuildProviderConfig, runGrokDeviceLogin };

package/dist/index.mjs

@@ -1,32 +1,40 @@
-import { delay, errorMessage, isAbortError, isRecord, nonEmptyString, normalizeBaseUrl, numberOrNull, numberOrZero, parseJsonObject, parseJsonOrString, stringOrNull } from "@demicodes/utils";
-import { createProviderQuota, defineProvider, httpRequestFailedEvent, normalizeErrorCode, providerErrorFromUnknown, severityFromUsedPercent, usedPercentFromRatio } from "@demicodes/provider";
+import { delay, errorCode, errorMessage, isAbortError, isRecord, nonEmptyString, normalizeBaseUrl, numberOrNull, numberOrZero, parseJsonObject, parseJsonOrString, stringOrNull } from "@demicodes/utils";
+import { createProviderQuota, defineProvider, httpRequestFailedEvent, normalizeErrorCode, numberHeader, providerErrorFromUnknown, redactCredentialText, severityFromUsedPercent, toolResultContentToText, usedPercentFromRatio } from "@demicodes/provider";
 import { Buffer } from "node:buffer";
 import { chmod, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import process from "node:process";
 import { zeroUsage } from "@demicodes/core";
+import { FileCredentialPool, credentialIdFromIdentity } from "@demicodes/provider/credentials-pool";
 import { readFileSync } from "node:fs";
 //#region src/auth.ts
+/** Grok auth.json stores the access token under `key`; redact it alongside the standard fields. */
+const SECRET_FIELD_PATTERNS = ["\\bkey\\b"];
+function redactGrokSecretText(text) {
+	return redactCredentialText(text, SECRET_FIELD_PATTERNS);
+}
 const DEFAULT_TOKEN_ENDPOINT = "https://auth.x.ai/oauth2/token";
-const REFRESH_EXPIRY_SKEW_MS = 300 * 1e3;
+const REFRESH_EXPIRY_SKEW_MS = 3e5;
 async function grokBuildAuthStatus(options = {}) {
 	return new FileGrokAuthStore(options).status();
 }
 var FileGrokAuthStore = class {
 	grokHome;
 	authFile;
+	entryKey;
 	refreshImpl;
 	now;
 	lockRetryDelayMs;
 	lockTimeoutMs;
 	constructor(options = {}) {
 		this.grokHome = options.grokHome ?? defaultGrokHome();
-		this.authFile = join(this.grokHome, "auth.json");
+		this.authFile = options.authFile ?? join(this.grokHome, "auth.json");
+		this.entryKey = nonEmptyString(options.entryKey) ?? null;
 		this.refreshImpl = options.refresh ?? refreshGrokOidcToken;
 		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
 		this.lockRetryDelayMs = options.lockRetryDelayMs ?? 25;
-		this.lockTimeoutMs = options.lockTimeoutMs ?? 5e3;
+		this.lockTimeoutMs = options.lockTimeoutMs ?? 3e4;
 	}
 	async status() {
 		try {
@@ -42,14 +50,14 @@ var FileGrokAuthStore = class {
 			};
 			return {
 				status: "error",
-				message: redactSecretText(error instanceof Error ? error.message : String(error))
+				message: redactGrokSecretText(error instanceof Error ? error.message : String(error))
 			};
 		}
 	}
 	async resolveAuth(options = {}) {
 		const file = await this.readAuthFile();
-		const selected = selectAuthEntry(file);
-		if (!selected) throw new GrokAuthError("auth_missing", `No Grok OAuth session found in ${this.authFile}. Run \`grok login\` first.`);
+		const selected = this.entryKey ? selectAuthEntryByKey(file, this.entryKey) : selectAuthEntry(file);
+		if (!selected) throw new GrokAuthError("auth_missing", this.entryKey ? `No Grok OAuth entry "${this.entryKey}" in ${this.authFile}` : `No Grok OAuth session found in ${this.authFile}. Run \`grok login\` first.`);
 		const { entryKey, entry } = selected;
 		const accessToken = nonEmptyString(entry.key);
 		if (!accessToken) throw new GrokAuthError("auth_missing", `Grok auth entry "${entryKey}" has no access token (key)`);
@@ -57,7 +65,7 @@ var FileGrokAuthStore = class {
 		const clientId = nonEmptyString(entry.oidc_client_id) ?? parseClientIdFromEntryKey(entryKey);
 		const issuer = nonEmptyString(entry.oidc_issuer) ?? parseIssuerFromEntryKey(entryKey);
 		const expiresAt = parseExpiresAt(entry.expires_at) ?? parseJwtExpiration(accessToken);
-		if ((options.forceRefresh === true || expiresWithin(expiresAt, this.now(), REFRESH_EXPIRY_SKEW_MS)) && refreshToken && clientId) return this.refreshAndResolve(file, entryKey, {
+		if ((options.forceRefresh === true || expiresWithin(expiresAt, this.now(), REFRESH_EXPIRY_SKEW_MS)) && refreshToken && clientId) return this.refreshAndResolve(accessToken, entryKey, {
 			refreshToken,
 			clientId,
 			tokenEndpoint: tokenEndpointForIssuer(issuer)
@@ -73,7 +81,7 @@ var FileGrokAuthStore = class {
 			authFile: this.authFile
 		};
 	}
-	async refreshAndResolve(_file, entryKey, refreshInput) {
+	async refreshAndResolve(staleAccessToken, entryKey, refreshInput) {
 		return this.withAuthFileLock(async () => {
 			const latest = await this.readAuthFile();
 			const latestEntry = latest[entryKey];
@@ -81,6 +89,20 @@ var FileGrokAuthStore = class {
 			const refreshToken = nonEmptyString(latestEntry.refresh_token) ?? refreshInput.refreshToken;
 			const clientId = nonEmptyString(latestEntry.oidc_client_id) ?? refreshInput.clientId;
 			const issuer = nonEmptyString(latestEntry.oidc_issuer) ?? parseIssuerFromEntryKey(entryKey);
+			const latestAccessToken = nonEmptyString(latestEntry.key);
+			if (latestAccessToken && latestAccessToken !== staleAccessToken) {
+				const latestExpiresAt = parseExpiresAt(latestEntry.expires_at) ?? parseJwtExpiration(latestAccessToken);
+				if (!expiresWithin(latestExpiresAt, this.now(), REFRESH_EXPIRY_SKEW_MS)) return {
+					accessToken: latestAccessToken,
+					refreshToken: nonEmptyString(latestEntry.refresh_token) ?? null,
+					expiresAt: latestExpiresAt,
+					email: stringOrNull(latestEntry.email),
+					issuer,
+					clientId,
+					entryKey,
+					authFile: this.authFile
+				};
+			}
 			const response = await this.refreshImpl({
 				refreshToken,
 				clientId,
@@ -119,8 +141,8 @@ var FileGrokAuthStore = class {
 			return parsed;
 		} catch (error) {
 			if (error instanceof GrokAuthError) throw error;
-			if (isNodeError(error) && error.code === "ENOENT") throw new GrokAuthError("auth_missing", `Grok auth file not found: ${this.authFile}. Run \`grok login\` first.`);
-			throw new GrokAuthError("auth_invalid", `Failed to read Grok auth file ${this.authFile}: ${redactSecretText(errorMessage(error))}`);
+			if (errorCode(error) === "ENOENT") throw new GrokAuthError("auth_missing", `Grok auth file not found: ${this.authFile}. Run \`grok login\` first.`);
+			throw new GrokAuthError("auth_invalid", `Failed to read Grok auth file ${this.authFile}: ${redactGrokSecretText(errorMessage(error))}`);
 		}
 	}
 	async withAuthFileLock(fn) {
@@ -132,10 +154,10 @@ var FileGrokAuthStore = class {
 		while (!handle) try {
 			handle = await open(lockFile, "wx", 384);
 		} catch (error) {
-			if (!isNodeError(error) || error.code !== "EEXIST") throw new GrokAuthError("auth_lock_failed", `Failed to lock Grok auth file: ${redactSecretText(errorMessage(error))}`);
-			if (!brokeStaleLock && await isAbandonedGrokAuthLock(lockFile, this.now())) {
-				await rm(lockFile, { force: true }).catch(() => void 0);
-				brokeStaleLock = true;
+			if (errorCode(error) !== "EEXIST") throw new GrokAuthError("auth_lock_failed", `Failed to lock Grok auth file: ${redactGrokSecretText(errorMessage(error))}`);
+			const staleIdentity = brokeStaleLock ? null : await fileIdentity(lockFile);
+			if (staleIdentity && await isAbandonedGrokAuthLock(lockFile, this.now())) {
+				if (await removeLockFileIfSame(lockFile, staleIdentity)) brokeStaleLock = true;
 				continue;
 			}
 			if (Date.now() - started > this.lockTimeoutMs) throw new GrokAuthError("auth_lock_failed", `Timed out waiting for Grok auth lock ${lockFile}. If no other Grok process is running, delete the lock file and retry.`);
@@ -145,8 +167,9 @@ var FileGrokAuthStore = class {
 			await writeFile(lockFile, `${process.pid}:${Math.floor(this.now().getTime() / 1e3)}`, { mode: 384 });
 			return await fn();
 		} finally {
+			const ownedIdentity = await handle.stat().then(toFileIdentity).catch(() => null);
 			await handle.close().catch(() => void 0);
-			await rm(lockFile, { force: true }).catch(() => void 0);
+			if (ownedIdentity) await removeLockFileIfSame(lockFile, ownedIdentity);
 		}
 	}
 };
@@ -181,6 +204,16 @@ function selectAuthEntry(file) {
 	candidates.sort((a, b) => b.score - a.score || a.entryKey.localeCompare(b.entryKey));
 	return candidates[0] ?? null;
 }
+function selectAuthEntryByKey(file, entryKey) {
+	const value = file[entryKey];
+	if (!isRecord(value)) return null;
+	const entry = value;
+	if (!nonEmptyString(entry.key)) return null;
+	return {
+		entryKey,
+		entry
+	};
+}
 async function refreshGrokOidcToken(input, signal) {
 	const body = new URLSearchParams({
 		grant_type: "refresh_token",
@@ -199,9 +232,6 @@ async function refreshGrokOidcToken(input, signal) {
 	if (!response.ok) throw new GrokAuthError("auth_refresh_failed", `Grok token refresh failed with HTTP ${response.status}`);
 	return await response.json();
 }
-function redactSecretText(text) {
-	return text.replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/g, "Bearer [REDACTED]").replace(/(access_token|refresh_token|id_token|\bkey\b)["'=:\s]+[A-Za-z0-9._~+/=-]+/gi, "$1=[REDACTED]");
-}
 function parseJwtExpiration(jwt) {
 	const exp = decodeJwtPayload(jwt)?.exp;
 	return typeof exp === "number" ? /* @__PURE__ */ new Date(exp * 1e3) : null;
@@ -247,10 +277,7 @@ function decodeJwtPayload(jwt) {
 		return null;
 	}
 }
-function isNodeError(error) {
-	return error instanceof Error && "code" in error;
-}
-/** Grok CLI lock format is `pid:unix_seconds`. Steal only when the owner is dead or very stale. */
+/** Grok CLI lock format is `pid:unix_seconds`. A valid live PID always owns its lock. */
 async function isAbandonedGrokAuthLock(lockFile, now, maxAgeMs = 3e4) {
 	try {
 		const raw = (await readFile(lockFile, "utf8")).trim();
@@ -258,7 +285,7 @@ async function isAbandonedGrokAuthLock(lockFile, now, maxAgeMs = 3e4) {
 		if (match) {
 			const pid = Number(match[1]);
 			const tsSec = Number(match[2]);
-			if (Number.isFinite(pid) && pid > 0 && !isProcessAlive(pid)) return true;
+			if (Number.isFinite(pid) && pid > 0) return !isProcessAlive(pid);
 			if (Number.isFinite(tsSec) && now.getTime() - tsSec * 1e3 > maxAgeMs) return true;
 			return false;
 		}
@@ -268,12 +295,26 @@ async function isAbandonedGrokAuthLock(lockFile, now, maxAgeMs = 3e4) {
 		return true;
 	}
 }
+function toFileIdentity(info) {
+	return {
+		dev: info.dev,
+		ino: info.ino
+	};
+}
+async function fileIdentity(path) {
+	return stat(path).then(toFileIdentity).catch(() => null);
+}
+async function removeLockFileIfSame(lockFile, expected) {
+	const current = await fileIdentity(lockFile);
+	if (!current || current.dev !== expected.dev || current.ino !== expected.ino) return false;
+	return rm(lockFile).then(() => true).catch(() => false);
+}
 function isProcessAlive(pid) {
 	try {
 		process.kill(pid, 0);
 		return true;
 	} catch (error) {
-		if (isNodeError(error) && error.code === "EPERM") return true;
+		if (errorCode(error) === "EPERM") return true;
 		return false;
 	}
 }
@@ -303,53 +344,52 @@ async function* mapGrokChatCompletionStream(events, signal) {
 			yield { type: "abort" };
 			return;
 		}
-		for (const data of event.data) {
-			if (data === "[DONE]") {
-				yield* flushToolCalls(toolCalls);
-				yield {
-					type: "response",
-					usage
-				};
-				return;
-			}
-			const chunk = parseJsonObject(data);
-			if (!chunk) continue;
-			const error = isRecord(chunk.error) ? chunk.error : null;
-			if (error) {
-				const message = stringOrNull(error.message) ?? "Grok Build stream error";
-				yield {
-					type: "error",
-					message,
-					code: normalizeErrorCode(stringOrNull(error.code) ?? stringOrNull(error.type), message)
-				};
-				return;
-			}
-			if (isRecord(chunk.usage)) usage = grokUsage(chunk.usage);
-			const choices = Array.isArray(chunk.choices) ? chunk.choices : [];
-			for (const choice of choices) {
-				if (!isRecord(choice)) continue;
-				const delta = isRecord(choice.delta) ? choice.delta : null;
-				if (delta) {
-					const reasoning = stringOrNull(delta.reasoning_content);
-					if (reasoning) {
-						if (!thinkingStarted) {
-							thinkingStarted = true;
-							yield { type: "thinking_start" };
-						}
-						yield {
-							type: "thinking_delta",
-							text: reasoning
-						};
+		const data = event.data;
+		if (data === "[DONE]") {
+			yield* flushToolCalls(toolCalls);
+			yield {
+				type: "response",
+				usage
+			};
+			return;
+		}
+		const chunk = parseJsonObject(data);
+		if (!chunk) continue;
+		const error = isRecord(chunk.error) ? chunk.error : null;
+		if (error) {
+			const message = stringOrNull(error.message) ?? "Grok Build stream error";
+			yield {
+				type: "error",
+				message,
+				code: normalizeErrorCode(stringOrNull(error.code) ?? stringOrNull(error.type), message)
+			};
+			return;
+		}
+		if (isRecord(chunk.usage)) usage = grokUsage(chunk.usage);
+		const choices = Array.isArray(chunk.choices) ? chunk.choices : [];
+		for (const choice of choices) {
+			if (!isRecord(choice)) continue;
+			const delta = isRecord(choice.delta) ? choice.delta : null;
+			if (delta) {
+				const reasoning = stringOrNull(delta.reasoning_content);
+				if (reasoning) {
+					if (!thinkingStarted) {
+						thinkingStarted = true;
+						yield { type: "thinking_start" };
 					}
-					const content = stringOrNull(delta.content);
-					if (content) yield {
-						type: "text_delta",
-						text: content
+					yield {
+						type: "thinking_delta",
+						text: reasoning
 					};
-					if (Array.isArray(delta.tool_calls)) collectToolCalls(delta.tool_calls, toolCalls);
 				}
-				if (choice.finish_reason === "tool_calls") yield* flushToolCalls(toolCalls);
+				const content = stringOrNull(delta.content);
+				if (content) yield {
+					type: "text_delta",
+					text: content
+				};
+				if (Array.isArray(delta.tool_calls)) collectToolCalls(delta.tool_calls, toolCalls);
 			}
+			if (choice.finish_reason === "tool_calls") yield* flushToolCalls(toolCalls);
 		}
 	}
 	yield* flushToolCalls(toolCalls);
@@ -364,15 +404,15 @@ async function* readServerSentEvents(body, signal) {
 	const decoder = new TextDecoder();
 	let buffer = "";
 	let eventName = null;
-	let data = [];
+	let dataLines = [];
 	const flush = function* () {
-		if (data.length === 0) return;
+		if (dataLines.length === 0) return;
 		yield {
 			event: eventName,
-			data
+			data: dataLines.join("\n")
 		};
 		eventName = null;
-		data = [];
+		dataLines = [];
 	};
 	try {
 		while (true) {
@@ -387,14 +427,14 @@ async function* readServerSentEvents(body, signal) {
 				const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
 				if (line === "") yield* flush();
 				else if (line.startsWith("event:")) eventName = line.slice(6).trim();
-				else if (line.startsWith("data:")) data.push(line.slice(5).trimStart());
+				else if (line.startsWith("data:")) dataLines.push(line.slice(5).trimStart());
 				newline = buffer.indexOf("\n");
 			}
 		}
 		buffer += decoder.decode();
 		if (buffer) {
 			const line = buffer.endsWith("\r") ? buffer.slice(0, -1) : buffer;
-			if (line.startsWith("data:")) data.push(line.slice(5).trimStart());
+			if (line.startsWith("data:")) dataLines.push(line.slice(5).trimStart());
 			else if (line.startsWith("event:")) eventName = line.slice(6).trim();
 		}
 		yield* flush();
@@ -455,9 +495,6 @@ function inferenceItemsToMessages(systemPrompt, items) {
 				tool_call_id: item.toolUseId,
 				content: toolResultContentToText(item.output)
 			});
-			break;
-		case "assistant_thinking":
-		case "assistant_redacted_thinking": break;
 	}
 	flushAssistant();
 	return messages;
@@ -476,6 +513,10 @@ function userContentToParts(content) {
 		type: "text",
 		text: `[document:${block.source.fileName} ${block.source.mediaType}]`
 	});
+	else if (block.type === "video") parts.push({
+		type: "text",
+		text: `[video:${block.source.type === "url" ? block.source.url : block.source.mediaType}]`
+	});
 	else if (block.source.type === "url") parts.push({
 		type: "image_url",
 		image_url: {
@@ -493,9 +534,6 @@ function userContentToParts(content) {
 	if (parts.every((part) => part.type === "text")) return parts.map((part) => part.text).join("\n");
 	return parts;
 }
-function toolResultContentToText(output) {
-	return output.map((block) => block.type === "text" ? block.text : `[image:${block.source.mediaType}]`).join("\n");
-}
 function toolToGrokTool(tool) {
 	return {
 		type: "function",
@@ -557,6 +595,280 @@ function grokUsage(usage) {
 		cacheWriteTokens: 0
 	};
 }
+//#endregion
+//#region src/device-login.ts
+const GROK_ISSUER = "https://auth.x.ai";
+const GROK_CLI_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const GROK_LOGIN_SCOPE = "openid profile email offline_access grok-cli:access";
+const GROK_LOGIN_FALLBACK_INTERVAL_S = 5;
+const GROK_LOGIN_FALLBACK_EXPIRES_S = 900;
+async function postForm(fetchImpl, url, params, signal) {
+	return fetchImpl(url, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams(params).toString(),
+		signal
+	});
+}
+async function jsonBody(response, what) {
+	const body = await response.json().catch(() => null);
+	if (!isRecord(body)) throw new GrokAuthError("auth_invalid", `${what} response is not a JSON object`);
+	return body;
+}
+async function requestDeviceCode(fetchImpl, issuer, clientId, scope, signal) {
+	const response = await postForm(fetchImpl, `${issuer}/oauth2/device/code`, {
+		client_id: clientId,
+		scope
+	}, signal);
+	if (!response.ok) throw new GrokAuthError("auth_invalid", `Grok device code request failed with HTTP ${response.status}`);
+	const body = await jsonBody(response, "Grok device code");
+	const deviceCode = nonEmptyString(body.device_code);
+	const userCode = nonEmptyString(body.user_code);
+	const verificationUrl = nonEmptyString(body.verification_uri_complete) ?? nonEmptyString(body.verification_uri);
+	if (!deviceCode || !userCode || !verificationUrl) throw new GrokAuthError("auth_invalid", "Grok device code response is missing device_code, user_code, or verification_uri");
+	const interval = Number(body.interval);
+	const expiresIn = Number(body.expires_in);
+	return {
+		deviceCode,
+		userCode,
+		verificationUrl,
+		intervalSeconds: Number.isFinite(interval) && interval >= 0 ? interval : GROK_LOGIN_FALLBACK_INTERVAL_S,
+		expiresAt: Date.now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : GROK_LOGIN_FALLBACK_EXPIRES_S) * 1e3
+	};
+}
+async function pollForTokens(fetchImpl, issuer, clientId, device, signal) {
+	let intervalSeconds = device.intervalSeconds;
+	for (;;) {
+		signal?.throwIfAborted();
+		const response = await postForm(fetchImpl, `${issuer}/oauth2/token`, {
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			device_code: device.deviceCode,
+			client_id: clientId
+		}, signal);
+		const body = await jsonBody(response, "Grok device token");
+		if (response.ok) {
+			const accessToken = nonEmptyString(body.access_token);
+			if (!accessToken) throw new GrokAuthError("auth_invalid", "Grok token response is missing access_token");
+			const expiresIn = Number(body.expires_in);
+			return {
+				accessToken,
+				refreshToken: nonEmptyString(body.refresh_token) ?? null,
+				expiresIn: Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : null
+			};
+		}
+		const error = nonEmptyString(body.error);
+		if (error === "slow_down") intervalSeconds += 5;
+		else if (error !== "authorization_pending") throw new GrokAuthError("auth_invalid", `Grok device login failed: ${error ?? `HTTP ${response.status}`}`);
+		if (Date.now() >= device.expiresAt) throw new GrokAuthError("auth_invalid", "Grok device login timed out before the user confirmed");
+		await delay(intervalSeconds * 1e3);
+	}
+}
+async function fetchUserinfo(fetchImpl, issuer, accessToken, signal) {
+	const response = await fetchImpl(`${issuer}/oauth2/userinfo`, {
+		headers: { authorization: `Bearer ${accessToken}` },
+		signal
+	});
+	if (!response.ok) return {};
+	const body = await response.json().catch(() => null);
+	return isRecord(body) ? body : {};
+}
+/** Runs the full device flow and returns a vendor-shaped auth.json entry keyed like the Grok CLI. */
+async function runGrokDeviceLogin(options = {}) {
+	const fetchImpl = options.fetch ?? fetch;
+	const issuer = (options.issuer ?? GROK_ISSUER).replace(/\/+$/, "");
+	const clientId = options.clientId ?? GROK_CLI_CLIENT_ID;
+	const device = await requestDeviceCode(fetchImpl, issuer, clientId, options.scope ?? GROK_LOGIN_SCOPE, options.signal);
+	options.onPending?.({
+		verificationUrl: device.verificationUrl,
+		userCode: device.userCode,
+		expiresAt: new Date(device.expiresAt).toISOString()
+	});
+	const tokens = await pollForTokens(fetchImpl, issuer, clientId, device, options.signal);
+	const userinfo = await fetchUserinfo(fetchImpl, issuer, tokens.accessToken, options.signal);
+	const entry = {
+		key: tokens.accessToken,
+		auth_mode: "oidc",
+		...tokens.refreshToken ? { refresh_token: tokens.refreshToken } : {},
+		...tokens.expiresIn ? { expires_at: new Date(Date.now() + tokens.expiresIn * 1e3).toISOString() } : {},
+		oidc_issuer: issuer,
+		oidc_client_id: clientId,
+		...nonEmptyString(userinfo.email) ? { email: nonEmptyString(userinfo.email) } : {},
+		...nonEmptyString(userinfo.given_name) ? { first_name: nonEmptyString(userinfo.given_name) } : {},
+		...nonEmptyString(userinfo.sub) ? { user_id: nonEmptyString(userinfo.sub) } : {}
+	};
+	return {
+		entryKey: `${issuer}::${clientId}`,
+		entry
+	};
+}
+//#endregion
+//#region src/credentials.ts
+var PoolAwareGrokAuthStore = class {
+	pool;
+	vendorHome;
+	fileAuthOptions;
+	constructor(pool, options = {}) {
+		this.pool = pool;
+		this.vendorHome = options.grokHome ?? defaultGrokHome();
+		this.fileAuthOptions = options.fileAuthOptions ?? {};
+	}
+	async status() {
+		return this.currentStore().then((s) => s.status());
+	}
+	async resolveAuth(options) {
+		return this.currentStore().then((s) => s.resolveAuth(options));
+	}
+	async currentStore() {
+		await this.pool.ensureActivePointer();
+		const activeId = await this.pool.getActiveId();
+		if (activeId) {
+			const entryKey = (await this.pool.readMeta(activeId))?.identityKey ?? void 0;
+			return new FileGrokAuthStore({
+				...this.fileAuthOptions,
+				authFile: this.pool.secretPath(activeId),
+				grokHome: this.pool.entryDir(activeId),
+				entryKey
+			});
+		}
+		return new FileGrokAuthStore({
+			...this.fileAuthOptions,
+			grokHome: this.vendorHome
+		});
+	}
+};
+function openGrokCredentialPool(options = {}) {
+	return new FileCredentialPool({
+		stateDir: options.stateDir,
+		providerKey: "grok-build",
+		secretFileName: "auth.json"
+	});
+}
+function createGrokBuildCredentials(pool, authStore, options = {}) {
+	const vendorHome = options.grokHome ?? defaultGrokHome();
+	const capability = () => ({
+		mode: "supported",
+		canBeginLogin: true,
+		canImportDefault: true,
+		canAdd: true,
+		multi: true
+	});
+	const getActive = async () => {
+		await pool.ensureActivePointer();
+		return {
+			credentialId: await pool.getActiveId(),
+			status: await authStore.status()
+		};
+	};
+	const setActive = async (credentialId) => {
+		await pool.setActiveId(credentialId);
+		options.quota?.clearLatest?.();
+		return getActive();
+	};
+	const importEntry = async (entryKey, entry, source) => {
+		const label = nonEmptyString(entry.email) ?? entryKey;
+		const identityKey = entryKey;
+		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
+		const file = { [entryKey]: entry };
+		const meta = {
+			id,
+			label,
+			detail: nonEmptyString(entry.auth_mode) ?? "oidc",
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			source,
+			identityKey
+		};
+		await pool.writeEntry(meta, `${JSON.stringify(file, null, 2)}\n`);
+		if (!await pool.getActiveId()) await pool.setActiveId(id);
+		options.quota?.clearLatest?.();
+		return {
+			id: meta.id,
+			label: meta.label,
+			detail: meta.detail,
+			updatedAt: meta.updatedAt
+		};
+	};
+	const importFromAuthJsonText = async (text, source) => {
+		let file;
+		try {
+			file = JSON.parse(text);
+		} catch {
+			throw new GrokAuthError("auth_invalid", "Grok auth material is not valid JSON");
+		}
+		if (!isRecord(file)) throw new GrokAuthError("auth_invalid", "Grok auth material is not an object");
+		const imported = [];
+		for (const [entryKey, value] of Object.entries(file)) {
+			if (!isRecord(value)) continue;
+			const entry = value;
+			if (!nonEmptyString(entry.key)) continue;
+			imported.push(await importEntry(entryKey, entry, source));
+		}
+		if (imported.length === 0) throw new GrokAuthError("auth_missing", "No Grok OAuth entries with access tokens found to import");
+		return imported;
+	};
+	return {
+		capability,
+		list: () => pool.list(),
+		getActive,
+		setActive,
+		beginLogin: async (loginOptions) => {
+			try {
+				const { entryKey, entry } = await runGrokDeviceLogin({
+					signal: loginOptions?.signal,
+					onPending: loginOptions?.onPending,
+					fetch: options.loginFetch
+				});
+				return {
+					status: "completed",
+					credentialId: (await importEntry(entryKey, entry, "login:device")).id
+				};
+			} catch (error) {
+				if (loginOptions?.signal?.aborted) return { status: "cancelled" };
+				return {
+					status: "failed",
+					message: errorMessage(error)
+				};
+			}
+		},
+		importDefault: async () => {
+			const authFile = join(vendorHome, "auth.json");
+			let text;
+			try {
+				text = await readFile(authFile, "utf8");
+			} catch {
+				throw new GrokAuthError("auth_missing", `No Grok auth at ${authFile}. Run grok login or beginLogin first.`);
+			}
+			const all = await importFromAuthJsonText(text, `vendor:${authFile}`);
+			const preferred = selectAuthEntry(JSON.parse(text));
+			if (preferred) {
+				const byKey = (await pool.listMeta()).find((m) => m.identityKey === preferred.entryKey);
+				if (byKey) {
+					await pool.setActiveId(byKey.id);
+					options.quota?.clearLatest?.();
+					return {
+						id: byKey.id,
+						label: byKey.label,
+						detail: byKey.detail,
+						updatedAt: byKey.updatedAt
+					};
+				}
+			}
+			return all[0];
+		},
+		add: async (input) => {
+			if (typeof input.authJsonText === "string") return (await importFromAuthJsonText(input.authJsonText, "add:authJsonText"))[0];
+			if (typeof input.authFile === "string") {
+				const text = await readFile(input.authFile, "utf8");
+				return (await importFromAuthJsonText(text, `add:authFile:${input.authFile}`))[0];
+			}
+			if (typeof input.entryKey === "string" && isRecord(input.entry)) return importEntry(input.entryKey, input.entry, "add:entry");
+			throw new Error("Grok credentials.add expects authJsonText, authFile, or { entryKey, entry }");
+		},
+		remove: async (credentialId) => {
+			await pool.remove(credentialId);
+			options.quota?.clearLatest?.();
+		}
+	};
+}
 const GROK_CLI_TOKEN_AUTH = "xai-grok-cli";
 const GROK_CLIENT_SURFACE = "grok-build";
 function buildGrokBuildHeaders(auth, request, options) {
@@ -858,19 +1170,16 @@ function moneyVal(value) {
 	if (isRecord(value) && typeof value.val === "number" && Number.isFinite(value.val)) return value.val;
 	return null;
 }
-function numberHeader(headers, name) {
-	const raw = headers.get(name);
-	if (raw == null || raw === "") return null;
-	const n = Number(raw);
-	return Number.isFinite(n) ? n : null;
-}
 //#endregion
 //#region src/provider.ts
-var GrokBuildProvider = class {
+var GrokBuildProvider = class GrokBuildProvider {
 	options;
 	constructor(options) {
 		this.options = options;
 	}
+	clone() {
+		return new GrokBuildProvider(this.options);
+	}
 	async *run(request) {
 		if (request.cancel.aborted) {
 			yield { type: "abort" };
@@ -916,6 +1225,7 @@ var GrokBuildProvider = class {
 					});
 				} catch {}
 				if (response.status === 401 && !forceRefresh) {
+					await response.body?.cancel().catch(() => {});
 					forceRefresh = true;
 					continue;
 				}
@@ -939,7 +1249,9 @@ var GrokBuildProvider = class {
 function createGrokBuildProvider(options = {}) {
 	const id = options.id ?? "grok-build";
 	const displayName = options.displayName ?? "Grok Build";
-	const authStore = options.authStore ?? new FileGrokAuthStore({ grokHome: options.grokHome });
+	const enableCredentials = options.credentials ?? options.authStore === void 0;
+	const pool = !options.authStore && enableCredentials ? openGrokCredentialPool({ stateDir: options.stateDir }) : null;
+	const authStore = options.authStore ?? (pool ? new PoolAwareGrokAuthStore(pool, { grokHome: options.grokHome }) : new FileGrokAuthStore({ grokHome: options.grokHome }));
 	const baseUrl = normalizeBaseUrl(options.baseUrl ?? "https://cli-chat-proxy.grok.com/v1");
 	const fetchImpl = options.fetch ?? fetch;
 	const quota = createGrokBuildQuota({
@@ -950,6 +1262,10 @@ function createGrokBuildProvider(options = {}) {
 		authStore,
 		fetch: fetchImpl
 	});
+	const credentialsApi = pool ? createGrokBuildCredentials(pool, authStore, {
+		grokHome: options.grokHome,
+		quota
+	}) : void 0;
 	const runtimeOptions = {
 		baseUrl,
 		grokHome: options.grokHome,
@@ -964,9 +1280,10 @@ function createGrokBuildProvider(options = {}) {
 		displayName,
 		auth: { status: () => authStore.status() },
 		quota,
+		...credentialsApi ? { credentials: credentialsApi } : {},
 		state: () => ({
 			status: "ready",
-			message: "Uses Grok CLI OAuth session (~/.grok/auth.json) via cli-chat-proxy"
+			message: credentialsApi ? "Uses Grok CLI OAuth + demi credential pool via cli-chat-proxy" : "Uses Grok CLI OAuth session (~/.grok/auth.json) via cli-chat-proxy"
 		}),
 		listModels: () => listGrokBuildModels({
 			providerId: id,
@@ -1007,4 +1324,4 @@ function chatCompletionsUrl(baseUrl) {
 	return normalized.endsWith("/chat/completions") ? normalized : `${normalized}/chat/completions`;
 }
 //#endregion
-export { createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, parseGrokBuildProviderConfig };
+export { PoolAwareGrokAuthStore, createGrokBuildCredentials, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, openGrokCredentialPool, parseGrokBuildProviderConfig, runGrokDeviceLogin };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-grok-build",
   "description": "Grok Build provider adapter for Demi (reuses ~/.grok OAuth session).",
-  "version": "0.10.3",
+  "version": "0.12.0",
   "private": false,
   "type": "module",
   "exports": {
@@ -11,9 +11,9 @@
     }
   },
   "dependencies": {
-    "@demicodes/core": "^0.10.3",
-    "@demicodes/provider": "^0.10.3",
-    "@demicodes/utils": "^0.10.3"
+    "@demicodes/core": "^0.12.0",
+    "@demicodes/provider": "^0.12.0",
+    "@demicodes/utils": "^0.12.0"
   },
   "license": "Apache-2.0",
   "main": "./dist/index.mjs",