@demicodes/provider-grok-build 0.2.0

package/dist/index.mjs

@@ -0,0 +1,1217 @@
+import { delay, errorCode, errorMessage, isAbortError, isRecord, nonEmptyString, normalizeBaseUrl, numberOrNull, numberOrZero, parseJsonObject, parseJsonOrString, stringOrNull } from "@demicodes/utils";
+import { createProviderQuota, defineProvider, httpRequestFailedEvent, normalizeErrorCode, numberHeader, providerErrorFromUnknown, redactCredentialText, severityFromUsedPercent, toolResultContentToText, usedPercentFromRatio } from "@demicodes/provider";
+import { Buffer } from "node:buffer";
+import { chmod, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import process from "node:process";
+import { zeroUsage } from "@demicodes/core";
+import { FileCredentialPool, credentialIdFromIdentity, runVendorLoginCommand } from "@demicodes/provider/credentials-pool";
+import { readFileSync } from "node:fs";
+//#region src/auth.ts
+/** Grok auth.json stores the access token under `key`; redact it alongside the standard fields. */
+const SECRET_FIELD_PATTERNS = ["\\bkey\\b"];
+function redactGrokSecretText(text) {
+	return redactCredentialText(text, SECRET_FIELD_PATTERNS);
+}
+const DEFAULT_TOKEN_ENDPOINT = "https://auth.x.ai/oauth2/token";
+const REFRESH_EXPIRY_SKEW_MS = 300 * 1e3;
+async function grokBuildAuthStatus(options = {}) {
+	return new FileGrokAuthStore(options).status();
+}
+var FileGrokAuthStore = class {
+	grokHome;
+	authFile;
+	entryKey;
+	refreshImpl;
+	now;
+	lockRetryDelayMs;
+	lockTimeoutMs;
+	constructor(options = {}) {
+		this.grokHome = options.grokHome ?? defaultGrokHome();
+		this.authFile = options.authFile ?? join(this.grokHome, "auth.json");
+		this.entryKey = nonEmptyString(options.entryKey) ?? null;
+		this.refreshImpl = options.refresh ?? refreshGrokOidcToken;
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+		this.lockRetryDelayMs = options.lockRetryDelayMs ?? 25;
+		this.lockTimeoutMs = options.lockTimeoutMs ?? 3e4;
+	}
+	async status() {
+		try {
+			const auth = await this.resolveAuth();
+			return {
+				status: "authenticated",
+				accountLabel: auth.email ?? auth.entryKey
+			};
+		} catch (error) {
+			if (error instanceof GrokAuthError && error.code === "auth_missing") return {
+				status: "unauthenticated",
+				message: error.message
+			};
+			return {
+				status: "error",
+				message: redactGrokSecretText(error instanceof Error ? error.message : String(error))
+			};
+		}
+	}
+	async resolveAuth(options = {}) {
+		const file = await this.readAuthFile();
+		const selected = this.entryKey ? selectAuthEntryByKey(file, this.entryKey) : selectAuthEntry(file);
+		if (!selected) throw new GrokAuthError("auth_missing", this.entryKey ? `No Grok OAuth entry "${this.entryKey}" in ${this.authFile}` : `No Grok OAuth session found in ${this.authFile}. Run \`grok login\` first.`);
+		const { entryKey, entry } = selected;
+		const accessToken = nonEmptyString(entry.key);
+		if (!accessToken) throw new GrokAuthError("auth_missing", `Grok auth entry "${entryKey}" has no access token (key)`);
+		const refreshToken = nonEmptyString(entry.refresh_token) ?? null;
+		const clientId = nonEmptyString(entry.oidc_client_id) ?? parseClientIdFromEntryKey(entryKey);
+		const issuer = nonEmptyString(entry.oidc_issuer) ?? parseIssuerFromEntryKey(entryKey);
+		const expiresAt = parseExpiresAt(entry.expires_at) ?? parseJwtExpiration(accessToken);
+		if ((options.forceRefresh === true || expiresWithin(expiresAt, this.now(), REFRESH_EXPIRY_SKEW_MS)) && refreshToken && clientId) return this.refreshAndResolve(accessToken, entryKey, {
+			refreshToken,
+			clientId,
+			tokenEndpoint: tokenEndpointForIssuer(issuer)
+		});
+		return {
+			accessToken,
+			refreshToken,
+			expiresAt,
+			email: stringOrNull(entry.email),
+			issuer,
+			clientId,
+			entryKey,
+			authFile: this.authFile
+		};
+	}
+	async refreshAndResolve(staleAccessToken, entryKey, refreshInput) {
+		return this.withAuthFileLock(async () => {
+			const latest = await this.readAuthFile();
+			const latestEntry = latest[entryKey];
+			if (!latestEntry || typeof latestEntry !== "object") throw new GrokAuthError("auth_missing", `Grok auth entry "${entryKey}" disappeared during refresh`);
+			const refreshToken = nonEmptyString(latestEntry.refresh_token) ?? refreshInput.refreshToken;
+			const clientId = nonEmptyString(latestEntry.oidc_client_id) ?? refreshInput.clientId;
+			const issuer = nonEmptyString(latestEntry.oidc_issuer) ?? parseIssuerFromEntryKey(entryKey);
+			const latestAccessToken = nonEmptyString(latestEntry.key);
+			if (latestAccessToken && latestAccessToken !== staleAccessToken) {
+				const latestExpiresAt = parseExpiresAt(latestEntry.expires_at) ?? parseJwtExpiration(latestAccessToken);
+				if (!expiresWithin(latestExpiresAt, this.now(), REFRESH_EXPIRY_SKEW_MS)) return {
+					accessToken: latestAccessToken,
+					refreshToken: nonEmptyString(latestEntry.refresh_token) ?? null,
+					expiresAt: latestExpiresAt,
+					email: stringOrNull(latestEntry.email),
+					issuer,
+					clientId,
+					entryKey,
+					authFile: this.authFile
+				};
+			}
+			const response = await this.refreshImpl({
+				refreshToken,
+				clientId,
+				tokenEndpoint: tokenEndpointForIssuer(issuer) || refreshInput.tokenEndpoint
+			});
+			const accessToken = nonEmptyString(response.access_token);
+			if (!accessToken) throw new GrokAuthError("auth_refresh_failed", "Grok token refresh returned no access_token");
+			const expiresAt = typeof response.expires_in === "number" && Number.isFinite(response.expires_in) ? new Date(this.now().getTime() + response.expires_in * 1e3) : parseJwtExpiration(accessToken);
+			const nextEntry = {
+				...latestEntry,
+				key: accessToken,
+				...nonEmptyString(response.refresh_token) ? { refresh_token: response.refresh_token } : {},
+				...expiresAt ? { expires_at: expiresAt.toISOString() } : {}
+			};
+			const nextFile = {
+				...latest,
+				[entryKey]: nextEntry
+			};
+			await writeAuthJsonAtomic(this.authFile, nextFile);
+			return {
+				accessToken,
+				refreshToken: nonEmptyString(nextEntry.refresh_token) ?? null,
+				expiresAt,
+				email: stringOrNull(nextEntry.email),
+				issuer,
+				clientId,
+				entryKey,
+				authFile: this.authFile
+			};
+		});
+	}
+	async readAuthFile() {
+		try {
+			const parsed = JSON.parse(await readFile(this.authFile, "utf8"));
+			if (!isRecord(parsed)) throw new GrokAuthError("auth_invalid", `Grok auth file is not an object: ${this.authFile}`);
+			return parsed;
+		} catch (error) {
+			if (error instanceof GrokAuthError) throw error;
+			if (errorCode(error) === "ENOENT") throw new GrokAuthError("auth_missing", `Grok auth file not found: ${this.authFile}. Run \`grok login\` first.`);
+			throw new GrokAuthError("auth_invalid", `Failed to read Grok auth file ${this.authFile}: ${redactGrokSecretText(errorMessage(error))}`);
+		}
+	}
+	async withAuthFileLock(fn) {
+		const lockFile = `${this.authFile}.lock`;
+		await mkdir(dirname(this.authFile), { recursive: true });
+		const started = Date.now();
+		let handle = null;
+		let brokeStaleLock = false;
+		while (!handle) try {
+			handle = await open(lockFile, "wx", 384);
+		} catch (error) {
+			if (errorCode(error) !== "EEXIST") throw new GrokAuthError("auth_lock_failed", `Failed to lock Grok auth file: ${redactGrokSecretText(errorMessage(error))}`);
+			const staleIdentity = brokeStaleLock ? null : await fileIdentity(lockFile);
+			if (staleIdentity && await isAbandonedGrokAuthLock(lockFile, this.now())) {
+				if (await removeLockFileIfSame(lockFile, staleIdentity)) brokeStaleLock = true;
+				continue;
+			}
+			if (Date.now() - started > this.lockTimeoutMs) throw new GrokAuthError("auth_lock_failed", `Timed out waiting for Grok auth lock ${lockFile}. If no other Grok process is running, delete the lock file and retry.`);
+			await delay(this.lockRetryDelayMs);
+		}
+		try {
+			await writeFile(lockFile, `${process.pid}:${Math.floor(this.now().getTime() / 1e3)}`, { mode: 384 });
+			return await fn();
+		} finally {
+			const ownedIdentity = await handle.stat().then(toFileIdentity).catch(() => null);
+			await handle.close().catch(() => void 0);
+			if (ownedIdentity) await removeLockFileIfSame(lockFile, ownedIdentity);
+		}
+	}
+};
+var GrokAuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "GrokAuthError";
+	}
+};
+function defaultGrokHome() {
+	const fromEnv = process.env.GROK_HOME;
+	return fromEnv && fromEnv.trim() ? fromEnv : join(homedir(), ".grok");
+}
+function selectAuthEntry(file) {
+	const candidates = [];
+	for (const [entryKey, value] of Object.entries(file)) {
+		if (!isRecord(value)) continue;
+		const entry = value;
+		if (!nonEmptyString(entry.key)) continue;
+		let score = 0;
+		if (entry.auth_mode === "oidc") score += 4;
+		if (nonEmptyString(entry.refresh_token)) score += 2;
+		if (entryKey.includes("auth.x.ai") || entry.oidc_issuer === "https://auth.x.ai") score += 1;
+		candidates.push({
+			entryKey,
+			entry,
+			score
+		});
+	}
+	candidates.sort((a, b) => b.score - a.score || a.entryKey.localeCompare(b.entryKey));
+	return candidates[0] ?? null;
+}
+function selectAuthEntryByKey(file, entryKey) {
+	const value = file[entryKey];
+	if (!isRecord(value)) return null;
+	const entry = value;
+	if (!nonEmptyString(entry.key)) return null;
+	return {
+		entryKey,
+		entry
+	};
+}
+async function refreshGrokOidcToken(input, signal) {
+	const body = new URLSearchParams({
+		grant_type: "refresh_token",
+		refresh_token: input.refreshToken,
+		client_id: input.clientId
+	});
+	const response = await fetch(input.tokenEndpoint, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		},
+		body,
+		signal
+	});
+	if (!response.ok) throw new GrokAuthError("auth_refresh_failed", `Grok token refresh failed with HTTP ${response.status}`);
+	return await response.json();
+}
+function parseJwtExpiration(jwt) {
+	const exp = decodeJwtPayload(jwt)?.exp;
+	return typeof exp === "number" ? /* @__PURE__ */ new Date(exp * 1e3) : null;
+}
+function tokenEndpointForIssuer(issuer) {
+	if (!issuer) return DEFAULT_TOKEN_ENDPOINT;
+	if (issuer === "https://auth.x.ai" || issuer === "https://auth.x.ai/") return DEFAULT_TOKEN_ENDPOINT;
+	return `${issuer.replace(/\/$/, "")}/oauth2/token`;
+}
+function parseIssuerFromEntryKey(entryKey) {
+	const sep = entryKey.indexOf("::");
+	if (sep <= 0) return null;
+	return entryKey.slice(0, sep);
+}
+function parseClientIdFromEntryKey(entryKey) {
+	const sep = entryKey.indexOf("::");
+	if (sep < 0 || sep === entryKey.length - 2) return null;
+	return entryKey.slice(sep + 2) || null;
+}
+function parseExpiresAt(value) {
+	if (typeof value !== "string" || !value) return null;
+	const ms = Date.parse(value);
+	return Number.isFinite(ms) ? new Date(ms) : null;
+}
+function expiresWithin(expiresAt, now, skewMs) {
+	return expiresAt !== null && expiresAt.getTime() - now.getTime() <= skewMs;
+}
+async function writeAuthJsonAtomic(authFile, auth) {
+	await mkdir(dirname(authFile), { recursive: true });
+	const temp = `${authFile}.${process.pid}.${Date.now()}.tmp`;
+	await writeFile(temp, `${JSON.stringify(auth, null, 2)}\n`, { mode: 384 });
+	await chmod(temp, 384);
+	await rename(temp, authFile);
+}
+function decodeJwtPayload(jwt) {
+	const parts = jwt.split(".");
+	if (parts.length !== 3 || !parts[1]) return null;
+	try {
+		const normalized = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+		const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+		return JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+	} catch {
+		return null;
+	}
+}
+/** Grok CLI lock format is `pid:unix_seconds`. A valid live PID always owns its lock. */
+async function isAbandonedGrokAuthLock(lockFile, now, maxAgeMs = 3e4) {
+	try {
+		const raw = (await readFile(lockFile, "utf8")).trim();
+		const match = /^(\d+):(\d+)$/.exec(raw);
+		if (match) {
+			const pid = Number(match[1]);
+			const tsSec = Number(match[2]);
+			if (Number.isFinite(pid) && pid > 0) return !isProcessAlive(pid);
+			if (Number.isFinite(tsSec) && now.getTime() - tsSec * 1e3 > maxAgeMs) return true;
+			return false;
+		}
+		const info = await stat(lockFile);
+		return now.getTime() - info.mtimeMs > maxAgeMs;
+	} catch {
+		return true;
+	}
+}
+function toFileIdentity(info) {
+	return {
+		dev: info.dev,
+		ino: info.ino
+	};
+}
+async function fileIdentity(path) {
+	return stat(path).then(toFileIdentity).catch(() => null);
+}
+async function removeLockFileIfSame(lockFile, expected) {
+	const current = await fileIdentity(lockFile);
+	if (!current || current.dev !== expected.dev || current.ino !== expected.ino) return false;
+	return rm(lockFile).then(() => true).catch(() => false);
+}
+function isProcessAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		if (errorCode(error) === "EPERM") return true;
+		return false;
+	}
+}
+//#endregion
+//#region src/chat.ts
+function buildGrokChatCompletionsBody(request) {
+	const body = {
+		model: request.modelId,
+		messages: inferenceItemsToMessages(request.systemPrompt, request.items),
+		stream: true,
+		stream_options: { include_usage: true }
+	};
+	if (request.tools.length > 0) {
+		body.tools = request.tools.map(toolToGrokTool);
+		body.tool_choice = "auto";
+	}
+	const reasoningEffort = thinkingToReasoningEffort(request);
+	if (reasoningEffort) body.reasoning_effort = reasoningEffort;
+	return body;
+}
+async function* mapGrokChatCompletionStream(events, signal) {
+	const toolCalls = /* @__PURE__ */ new Map();
+	let thinkingStarted = false;
+	let usage = zeroUsage();
+	for await (const event of events) {
+		if (signal?.aborted) {
+			yield { type: "abort" };
+			return;
+		}
+		const data = event.data;
+		if (data === "[DONE]") {
+			yield* flushToolCalls(toolCalls);
+			yield {
+				type: "response",
+				usage
+			};
+			return;
+		}
+		const chunk = parseJsonObject(data);
+		if (!chunk) continue;
+		const error = isRecord(chunk.error) ? chunk.error : null;
+		if (error) {
+			const message = stringOrNull(error.message) ?? "Grok Build stream error";
+			yield {
+				type: "error",
+				message,
+				code: normalizeErrorCode(stringOrNull(error.code) ?? stringOrNull(error.type), message)
+			};
+			return;
+		}
+		if (isRecord(chunk.usage)) usage = grokUsage(chunk.usage);
+		const choices = Array.isArray(chunk.choices) ? chunk.choices : [];
+		for (const choice of choices) {
+			if (!isRecord(choice)) continue;
+			const delta = isRecord(choice.delta) ? choice.delta : null;
+			if (delta) {
+				const reasoning = stringOrNull(delta.reasoning_content);
+				if (reasoning) {
+					if (!thinkingStarted) {
+						thinkingStarted = true;
+						yield { type: "thinking_start" };
+					}
+					yield {
+						type: "thinking_delta",
+						text: reasoning
+					};
+				}
+				const content = stringOrNull(delta.content);
+				if (content) yield {
+					type: "text_delta",
+					text: content
+				};
+				if (Array.isArray(delta.tool_calls)) collectToolCalls(delta.tool_calls, toolCalls);
+			}
+			if (choice.finish_reason === "tool_calls") yield* flushToolCalls(toolCalls);
+		}
+	}
+	yield* flushToolCalls(toolCalls);
+	yield {
+		type: "response",
+		usage
+	};
+}
+async function* readServerSentEvents(body, signal) {
+	if (!body) return;
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	let eventName = null;
+	let dataLines = [];
+	const flush = function* () {
+		if (dataLines.length === 0) return;
+		yield {
+			event: eventName,
+			data: dataLines.join("\n")
+		};
+		eventName = null;
+		dataLines = [];
+	};
+	try {
+		while (true) {
+			if (signal?.aborted) return;
+			const { value, done } = await reader.read();
+			if (done) break;
+			buffer += decoder.decode(value, { stream: true });
+			let newline = buffer.indexOf("\n");
+			while (newline !== -1) {
+				const raw = buffer.slice(0, newline);
+				buffer = buffer.slice(newline + 1);
+				const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
+				if (line === "") yield* flush();
+				else if (line.startsWith("event:")) eventName = line.slice(6).trim();
+				else if (line.startsWith("data:")) dataLines.push(line.slice(5).trimStart());
+				newline = buffer.indexOf("\n");
+			}
+		}
+		buffer += decoder.decode();
+		if (buffer) {
+			const line = buffer.endsWith("\r") ? buffer.slice(0, -1) : buffer;
+			if (line.startsWith("data:")) dataLines.push(line.slice(5).trimStart());
+			else if (line.startsWith("event:")) eventName = line.slice(6).trim();
+		}
+		yield* flush();
+	} finally {
+		reader.releaseLock();
+	}
+}
+function inferenceItemsToMessages(systemPrompt, items) {
+	const messages = [];
+	let assistant = null;
+	const flushAssistant = () => {
+		if (!assistant) return;
+		messages.push({
+			role: "assistant",
+			content: assistant.content || null,
+			...assistant.toolCalls.length > 0 ? { tool_calls: assistant.toolCalls } : {}
+		});
+		assistant = null;
+	};
+	if (systemPrompt.trim()) messages.push({
+		role: "system",
+		content: systemPrompt
+	});
+	for (const item of items) switch (item.type) {
+		case "user_message":
+		case "user_steer":
+			flushAssistant();
+			messages.push({
+				role: "user",
+				content: userContentToParts(item.content)
+			});
+			break;
+		case "assistant_text":
+			assistant ??= {
+				content: "",
+				toolCalls: []
+			};
+			assistant.content += item.text;
+			break;
+		case "tool_use":
+			assistant ??= {
+				content: "",
+				toolCalls: []
+			};
+			assistant.toolCalls.push({
+				id: item.toolUseId,
+				type: "function",
+				function: {
+					name: item.toolName,
+					arguments: stringifyToolArguments(item.input)
+				}
+			});
+			break;
+		case "tool_result":
+			flushAssistant();
+			messages.push({
+				role: "tool",
+				tool_call_id: item.toolUseId,
+				content: toolResultContentToText(item.output)
+			});
+			break;
+		case "assistant_thinking":
+		case "assistant_redacted_thinking": break;
+	}
+	flushAssistant();
+	return messages;
+}
+function userContentToParts(content) {
+	const parts = [];
+	for (const block of content) if (block.type === "text") parts.push({
+		type: "text",
+		text: block.text
+	});
+	else if (block.type === "reference") parts.push({
+		type: "text",
+		text: block.reference
+	});
+	else if (block.type === "document") parts.push({
+		type: "text",
+		text: `[document:${block.source.fileName} ${block.source.mediaType}]`
+	});
+	else if (block.type === "video") parts.push({
+		type: "text",
+		text: `[video:${block.source.type === "url" ? block.source.url : block.source.mediaType}]`
+	});
+	else if (block.source.type === "url") parts.push({
+		type: "image_url",
+		image_url: {
+			url: block.source.url,
+			detail: "auto"
+		}
+	});
+	else parts.push({
+		type: "image_url",
+		image_url: {
+			url: `data:${block.source.mediaType};base64,${Buffer.from(block.source.data).toString("base64")}`,
+			detail: "auto"
+		}
+	});
+	if (parts.every((part) => part.type === "text")) return parts.map((part) => part.text).join("\n");
+	return parts;
+}
+function toolToGrokTool(tool) {
+	return {
+		type: "function",
+		function: {
+			name: tool.name,
+			description: tool.description,
+			parameters: tool.inputSchema
+		}
+	};
+}
+function collectToolCalls(values, toolCalls) {
+	for (const value of values) {
+		if (!isRecord(value)) continue;
+		const index = typeof value.index === "number" ? value.index : toolCalls.size;
+		const existing = toolCalls.get(index) ?? {
+			id: "",
+			name: "",
+			arguments: ""
+		};
+		const fn = isRecord(value.function) ? value.function : null;
+		const id = stringOrNull(value.id);
+		if (id) existing.id = id;
+		const name = stringOrNull(fn?.name);
+		if (name) existing.name = name;
+		const delta = stringOrNull(fn?.arguments);
+		if (delta) existing.arguments += delta;
+		toolCalls.set(index, existing);
+	}
+}
+function* flushToolCalls(toolCalls) {
+	for (const [index, call] of [...toolCalls.entries()].sort(([a], [b]) => a - b)) {
+		if (!call.name) continue;
+		yield {
+			type: "tool_call_requested",
+			toolUseId: call.id || `tool_call_${index}`,
+			toolName: call.name,
+			input: parseJsonOrString(call.arguments || "{}")
+		};
+	}
+	toolCalls.clear();
+}
+function thinkingToReasoningEffort(request) {
+	const thinking = request.thinking;
+	if (!thinking || thinking.type === "disabled" || thinking.type === "budget") return void 0;
+	return thinking.effort;
+}
+function stringifyToolArguments(input) {
+	return typeof input === "string" ? input : JSON.stringify(input ?? {});
+}
+function grokUsage(usage) {
+	const inputTokens = numberOrZero(usage.prompt_tokens);
+	const outputTokens = numberOrZero(usage.completion_tokens);
+	const promptDetails = isRecord(usage.prompt_tokens_details) ? usage.prompt_tokens_details : null;
+	const cachedTokens = promptDetails ? numberOrZero(promptDetails.cached_tokens) : 0;
+	return {
+		inputTokens: Math.max(0, inputTokens - cachedTokens),
+		outputTokens,
+		cacheReadTokens: cachedTokens,
+		cacheWriteTokens: 0
+	};
+}
+//#endregion
+//#region src/credentials.ts
+var PoolAwareGrokAuthStore = class {
+	pool;
+	vendorHome;
+	fileAuthOptions;
+	constructor(pool, options = {}) {
+		this.pool = pool;
+		this.vendorHome = options.grokHome ?? defaultGrokHome();
+		this.fileAuthOptions = options.fileAuthOptions ?? {};
+	}
+	async status() {
+		return this.currentStore().then((s) => s.status());
+	}
+	async resolveAuth(options) {
+		return this.currentStore().then((s) => s.resolveAuth(options));
+	}
+	async currentStore() {
+		await this.pool.ensureActivePointer();
+		const activeId = await this.pool.getActiveId();
+		if (activeId) {
+			const entryKey = (await this.pool.readMeta(activeId))?.identityKey ?? void 0;
+			return new FileGrokAuthStore({
+				...this.fileAuthOptions,
+				authFile: this.pool.secretPath(activeId),
+				grokHome: this.pool.entryDir(activeId),
+				entryKey
+			});
+		}
+		return new FileGrokAuthStore({
+			...this.fileAuthOptions,
+			grokHome: this.vendorHome
+		});
+	}
+};
+function openGrokCredentialPool(options = {}) {
+	return new FileCredentialPool({
+		stateDir: options.stateDir,
+		providerKey: "grok-build",
+		secretFileName: "auth.json"
+	});
+}
+function createGrokBuildCredentials(pool, authStore, options = {}) {
+	const vendorHome = options.grokHome ?? defaultGrokHome();
+	const loginCommand = options.loginCommand ?? "grok";
+	const loginArgs = options.loginArgs ?? ["login"];
+	const capability = () => ({
+		mode: "supported",
+		canBeginLogin: true,
+		canImportDefault: true,
+		canAdd: true,
+		multi: true
+	});
+	const getActive = async () => {
+		await pool.ensureActivePointer();
+		return {
+			credentialId: await pool.getActiveId(),
+			status: await authStore.status()
+		};
+	};
+	const setActive = async (credentialId) => {
+		await pool.setActiveId(credentialId);
+		options.quota?.clearLatest?.();
+		return getActive();
+	};
+	const importEntry = async (entryKey, entry, source) => {
+		const label = nonEmptyString(entry.email) ?? entryKey;
+		const identityKey = entryKey;
+		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
+		const file = { [entryKey]: entry };
+		const meta = {
+			id,
+			label,
+			detail: nonEmptyString(entry.auth_mode) ?? "oidc",
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			source,
+			identityKey
+		};
+		await pool.writeEntry(meta, `${JSON.stringify(file, null, 2)}\n`);
+		if (!await pool.getActiveId()) await pool.setActiveId(id);
+		options.quota?.clearLatest?.();
+		return {
+			id: meta.id,
+			label: meta.label,
+			detail: meta.detail,
+			updatedAt: meta.updatedAt
+		};
+	};
+	const importFromAuthJsonText = async (text, source) => {
+		let file;
+		try {
+			file = JSON.parse(text);
+		} catch {
+			throw new GrokAuthError("auth_invalid", "Grok auth material is not valid JSON");
+		}
+		if (!isRecord(file)) throw new GrokAuthError("auth_invalid", "Grok auth material is not an object");
+		const imported = [];
+		for (const [entryKey, value] of Object.entries(file)) {
+			if (!isRecord(value)) continue;
+			const entry = value;
+			if (!nonEmptyString(entry.key)) continue;
+			imported.push(await importEntry(entryKey, entry, source));
+		}
+		if (imported.length === 0) throw new GrokAuthError("auth_missing", "No Grok OAuth entries with access tokens found to import");
+		return imported;
+	};
+	return {
+		capability,
+		list: () => pool.list(),
+		getActive,
+		setActive,
+		beginLogin: async (loginOptions) => {
+			const result = await runVendorLoginCommand(loginCommand, loginArgs, { signal: loginOptions?.signal });
+			if (result.status === "completed") return { status: "completed" };
+			if (result.status === "cancelled") return { status: "cancelled" };
+			if (result.status === "unavailable") return {
+				status: "unavailable",
+				message: result.message ?? "Login unavailable"
+			};
+			return {
+				status: "failed",
+				message: result.message ?? "Login failed"
+			};
+		},
+		importDefault: async () => {
+			const authFile = join(vendorHome, "auth.json");
+			let text;
+			try {
+				text = await readFile(authFile, "utf8");
+			} catch {
+				throw new GrokAuthError("auth_missing", `No Grok auth at ${authFile}. Run grok login or beginLogin first.`);
+			}
+			const all = await importFromAuthJsonText(text, `vendor:${authFile}`);
+			const preferred = selectAuthEntry(JSON.parse(text));
+			if (preferred) {
+				const byKey = (await pool.listMeta()).find((m) => m.identityKey === preferred.entryKey);
+				if (byKey) {
+					await pool.setActiveId(byKey.id);
+					options.quota?.clearLatest?.();
+					return {
+						id: byKey.id,
+						label: byKey.label,
+						detail: byKey.detail,
+						updatedAt: byKey.updatedAt
+					};
+				}
+			}
+			return all[0];
+		},
+		add: async (input) => {
+			if (typeof input.authJsonText === "string") return (await importFromAuthJsonText(input.authJsonText, "add:authJsonText"))[0];
+			if (typeof input.authFile === "string") {
+				const text = await readFile(input.authFile, "utf8");
+				return (await importFromAuthJsonText(text, `add:authFile:${input.authFile}`))[0];
+			}
+			if (typeof input.entryKey === "string" && isRecord(input.entry)) return importEntry(input.entryKey, input.entry, "add:entry");
+			throw new Error("Grok credentials.add expects authJsonText, authFile, or { entryKey, entry }");
+		},
+		remove: async (credentialId) => {
+			await pool.remove(credentialId);
+			options.quota?.clearLatest?.();
+		}
+	};
+}
+const GROK_CLI_TOKEN_AUTH = "xai-grok-cli";
+const GROK_CLIENT_SURFACE = "grok-build";
+function buildGrokBuildHeaders(auth, request, options) {
+	const headers = new Headers(options?.extra);
+	headers.set("authorization", `Bearer ${auth.accessToken}`);
+	headers.set("X-XAI-Token-Auth", GROK_CLI_TOKEN_AUTH);
+	headers.set("x-grok-client-surface", GROK_CLIENT_SURFACE);
+	headers.set("x-grok-client-version", resolveGrokClientVersion(options?.clientVersion, options?.grokHome));
+	if (request?.modelId) headers.set("x-grok-model-override", request.modelId);
+	if (request?.sessionId) headers.set("x-grok-session-id", request.sessionId);
+	if (request?.requestId) headers.set("x-grok-req-id", request.requestId);
+	return headers;
+}
+function resolveGrokClientVersion(explicit, grokHome) {
+	const fromExplicit = nonEmptyString(explicit);
+	if (fromExplicit) return fromExplicit;
+	return readGrokCliVersion(grokHome ?? defaultGrokHome()) ?? "0.1.202";
+}
+function readGrokCliVersion(grokHome) {
+	try {
+		const parsed = JSON.parse(readFileSync(join(grokHome, "version.json"), "utf8"));
+		if (!isRecord(parsed)) return null;
+		return nonEmptyString(parsed.version) ?? null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/models.ts
+const FALLBACK_SOURCE_FETCHED_AT = "1970-01-01T00:00:00.000Z";
+function grokBuildFallbackModels(providerId = "grok-build") {
+	const sourceFetchedAt = FALLBACK_SOURCE_FETCHED_AT;
+	const model = {
+		providerId,
+		id: "grok-4.5",
+		displayName: "Grok 4.5",
+		description: "Grok Build frontier model",
+		contextWindow: 5e5,
+		outputLimit: null,
+		supportsTools: true,
+		supportsAttachments: capabilitiesForModel("grok-4.5").supportsAttachments,
+		supportsReasoning: true,
+		supportedThinkingEfforts: [
+			"low",
+			"medium",
+			"high"
+		],
+		defaultThinkingEffort: "high",
+		canDisableThinking: null,
+		serviceTiers: null,
+		defaultServiceTierId: null,
+		sourceFetchedAt,
+		stale: true
+	};
+	return {
+		providerId,
+		models: [model],
+		defaultModelId: model.id,
+		warnings: ["Using fallback Grok Build model catalog (live /v1/models unavailable)"],
+		sourceFetchedAt,
+		stale: true
+	};
+}
+async function listGrokBuildModels(options = {}) {
+	const providerId = options.providerId ?? "grok-build";
+	const authStore = options.authStore ?? new FileGrokAuthStore({ grokHome: options.grokHome });
+	const fetchImpl = options.fetch ?? fetch;
+	const baseUrl = normalizeBaseUrl(options.baseUrl ?? "https://cli-chat-proxy.grok.com/v1");
+	try {
+		const auth = await authStore.resolveAuth();
+		const response = await fetchImpl(modelsUrl(baseUrl), {
+			method: "GET",
+			headers: buildGrokBuildHeaders(auth, void 0, {
+				clientVersion: options.clientVersion,
+				grokHome: options.grokHome
+			})
+		});
+		if (!response.ok) return {
+			...grokBuildFallbackModels(providerId),
+			warnings: [`Grok Build /v1/models returned HTTP ${response.status}; using fallback catalog`]
+		};
+		return modelListFromGrokModelsPayload(await response.json(), providerId);
+	} catch {
+		return grokBuildFallbackModels(providerId);
+	}
+}
+function modelListFromGrokModelsPayload(payload, providerId) {
+	const sourceFetchedAt = (/* @__PURE__ */ new Date()).toISOString();
+	const data = isRecord(payload) && Array.isArray(payload.data) ? payload.data : Array.isArray(payload) ? payload : [];
+	const models = [];
+	for (const item of data) {
+		if (!isRecord(item)) continue;
+		const id = nonEmptyString(item.id) ?? nonEmptyString(item.model);
+		if (!id) continue;
+		const reasoningEfforts = parseReasoningEfforts(item);
+		models.push({
+			providerId,
+			id,
+			displayName: stringOrNull(item.name) ?? id,
+			description: stringOrNull(item.description) ?? void 0,
+			contextWindow: positiveOrDefault(numberOrNull(item.context_window), 2e5),
+			outputLimit: null,
+			supportsTools: true,
+			supportsAttachments: capabilitiesForModel(id).supportsAttachments,
+			supportsReasoning: item.supports_reasoning_effort === true || reasoningEfforts.length > 0 ? true : null,
+			supportedThinkingEfforts: reasoningEfforts.length > 0 ? reasoningEfforts : null,
+			defaultThinkingEffort: defaultReasoningEffort(item, reasoningEfforts),
+			canDisableThinking: null,
+			serviceTiers: null,
+			defaultServiceTierId: null,
+			sourceFetchedAt,
+			stale: false
+		});
+	}
+	if (models.length === 0) return grokBuildFallbackModels(providerId);
+	return {
+		providerId,
+		models,
+		defaultModelId: models[0]?.id ?? null,
+		warnings: [],
+		sourceFetchedAt,
+		stale: false
+	};
+}
+const DEFAULT_MODEL_CAPABILITIES = { supportsAttachments: false };
+/**
+* Known Grok Build models. Extend this table when the proxy adds ids;
+* do not invent prefix heuristics here.
+*/
+const KNOWN_MODEL_CAPABILITIES = {
+	"grok-4.5": { supportsAttachments: true },
+	"grok-composer-2.5-fast": { supportsAttachments: false }
+};
+function capabilitiesForModel(modelId) {
+	return KNOWN_MODEL_CAPABILITIES[modelId] ?? DEFAULT_MODEL_CAPABILITIES;
+}
+function modelsUrl(baseUrl) {
+	const normalized = normalizeBaseUrl(baseUrl);
+	return normalized.endsWith("/models") ? normalized : `${normalized}/models`;
+}
+function parseReasoningEfforts(item) {
+	if (!Array.isArray(item.reasoning_efforts)) return [];
+	const ids = [];
+	for (const entry of item.reasoning_efforts) {
+		if (!isRecord(entry)) continue;
+		const id = nonEmptyString(entry.id) ?? nonEmptyString(entry.value);
+		if (id) ids.push(id);
+	}
+	return ids;
+}
+function defaultReasoningEffort(item, efforts) {
+	if (Array.isArray(item.reasoning_efforts)) {
+		for (const entry of item.reasoning_efforts) if (isRecord(entry) && entry.default === true) return nonEmptyString(entry.id) ?? nonEmptyString(entry.value) ?? null;
+	}
+	const advertised = nonEmptyString(item.reasoning_effort);
+	if (advertised) return advertised;
+	return efforts[0] ?? null;
+}
+function positiveOrDefault(value, fallback) {
+	return value !== null && Number.isFinite(value) && value > 0 ? Math.trunc(value) : fallback;
+}
+//#endregion
+//#region src/quota.ts
+/**
+* Active probe against cli-chat-proxy:
+* - GET /v1/user?include=subscription → tier
+* - GET /v1/billing → monthly used/limit
+*
+* Optional observation of short-window x-ratelimit-* headers from chat responses
+* (separate windows from monthly subscription quota).
+*/
+function createGrokBuildQuota(options = {}) {
+	const providerId = options.providerId ?? "grok-build";
+	const authStore = options.authStore ?? new FileGrokAuthStore({ grokHome: options.grokHome });
+	const baseUrl = (options.baseUrl ?? "https://cli-chat-proxy.grok.com/v1").replace(/\/+$/, "");
+	const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+	const grokHome = options.grokHome;
+	const clientVersion = options.clientVersion;
+	return createProviderQuota({
+		providerId,
+		canProbe: true,
+		canObserve: true,
+		probeCost: "free",
+		staleAfterMs: 6e4,
+		probe: async ({ signal } = {}) => {
+			const auth = await authStore.resolveAuth();
+			const [user, billing] = await Promise.all([fetchJson(fetchImpl, `${baseUrl}/user?include=subscription`, auth, {
+				grokHome,
+				clientVersion
+			}, signal), fetchJson(fetchImpl, `${baseUrl}/billing`, auth, {
+				grokHome,
+				clientVersion
+			}, signal)]);
+			return mapGrokQuotaProbe(user, billing, auth);
+		},
+		observe: ({ headers }) => observeGrokRateLimitHeaders(headers)
+	});
+}
+function mapGrokQuotaProbe(user, billing, auth) {
+	const userRecord = isRecord(user) ? user : {};
+	const billingRecord = isRecord(billing) ? billing : {};
+	const config = isRecord(billingRecord.config) ? billingRecord.config : {};
+	const monthlyLimit = moneyVal(config.monthlyLimit);
+	const used = moneyVal(config.used);
+	const onDemandCap = moneyVal(config.onDemandCap);
+	const usedPercent = usedPercentFromRatio(used, monthlyLimit);
+	const windows = [{
+		id: "monthly",
+		label: "Monthly credits",
+		usedPercent,
+		used,
+		limit: monthlyLimit,
+		unit: "credits",
+		resetsAt: stringOrNull(config.billingPeriodEnd),
+		severity: severityFromUsedPercent(usedPercent)
+	}];
+	if (onDemandCap != null && onDemandCap > 0) windows.push({
+		id: "on_demand_cap",
+		label: "On-demand cap",
+		usedPercent: null,
+		used: null,
+		limit: onDemandCap,
+		unit: "credits",
+		resetsAt: stringOrNull(config.billingPeriodEnd)
+	});
+	const tier = stringOrNull(userRecord.subscriptionTier);
+	return {
+		plan: tier ? {
+			id: tier,
+			label: tier,
+			raw: tier
+		} : null,
+		accountLabel: auth?.email ?? stringOrNull(userRecord.email),
+		windows,
+		raw: {
+			user,
+			billing
+		}
+	};
+}
+/** Short-window chat ratelimits — not subscription monthly quota. */
+function observeGrokRateLimitHeaders(headers) {
+	if (!headers) return null;
+	const remReq = numberHeader(headers, "x-ratelimit-remaining-requests");
+	const limReq = numberHeader(headers, "x-ratelimit-limit-requests");
+	const remTok = numberHeader(headers, "x-ratelimit-remaining-tokens");
+	const limTok = numberHeader(headers, "x-ratelimit-limit-tokens");
+	if (remReq == null && limReq == null && remTok == null && limTok == null) return null;
+	const windows = [];
+	if (limReq != null) {
+		const used = remReq != null ? limReq - remReq : null;
+		const usedPercent = usedPercentFromRatio(used, limReq);
+		windows.push({
+			id: "rpm",
+			label: "Requests (short window)",
+			usedPercent,
+			used,
+			limit: limReq,
+			unit: "requests",
+			resetsAt: null,
+			severity: severityFromUsedPercent(usedPercent)
+		});
+	}
+	if (limTok != null) {
+		const used = remTok != null ? limTok - remTok : null;
+		const usedPercent = usedPercentFromRatio(used, limTok);
+		windows.push({
+			id: "tpm",
+			label: "Tokens (short window)",
+			usedPercent,
+			used,
+			limit: limTok,
+			unit: "tokens",
+			resetsAt: null,
+			severity: severityFromUsedPercent(usedPercent)
+		});
+	}
+	return windows.length > 0 ? { windows } : null;
+}
+async function fetchJson(fetchImpl, url, auth, opts, signal) {
+	const headers = buildGrokBuildHeaders(auth, void 0, {
+		clientVersion: opts.clientVersion ?? resolveGrokClientVersion(void 0, opts.grokHome),
+		grokHome: opts.grokHome
+	});
+	headers.set("accept", "application/json");
+	const response = await fetchImpl(url, {
+		method: "GET",
+		headers,
+		signal
+	});
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`Grok quota request failed (${response.status}): ${body.slice(0, 200)}`);
+	}
+	return response.json();
+}
+function moneyVal(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (isRecord(value) && typeof value.val === "number" && Number.isFinite(value.val)) return value.val;
+	return null;
+}
+//#endregion
+//#region src/provider.ts
+var GrokBuildProvider = class {
+	options;
+	constructor(options) {
+		this.options = options;
+	}
+	async *run(request) {
+		if (request.cancel.aborted) {
+			yield { type: "abort" };
+			return;
+		}
+		let forceRefresh = false;
+		let accessToken;
+		for (let attempt = 0; attempt < 2; attempt++) {
+			let auth;
+			try {
+				auth = await this.options.authStore.resolveAuth({ forceRefresh });
+				accessToken = auth.accessToken;
+			} catch (error) {
+				if (error instanceof GrokAuthError && error.code === "auth_missing") {
+					yield {
+						type: "error",
+						message: error.message,
+						code: "auth_missing"
+					};
+					return;
+				}
+				yield providerErrorFromUnknown(error, accessToken);
+				return;
+			}
+			try {
+				const headers = buildGrokBuildHeaders(auth, request, {
+					extra: this.options.headers,
+					clientVersion: this.options.clientVersion,
+					grokHome: this.options.grokHome
+				});
+				headers.set("accept", "text/event-stream");
+				headers.set("content-type", "application/json");
+				const response = await this.options.fetch(chatCompletionsUrl(this.options.baseUrl), {
+					method: "POST",
+					headers,
+					body: JSON.stringify(buildGrokChatCompletionsBody(request)),
+					signal: request.cancel
+				});
+				try {
+					this.options.quota?.observeResponse?.({
+						headers: response.headers,
+						status: response.status
+					});
+				} catch {}
+				if (response.status === 401 && !forceRefresh) {
+					await response.body?.cancel().catch(() => {});
+					forceRefresh = true;
+					continue;
+				}
+				if (!response.ok) {
+					yield await httpRequestFailedEvent(response, accessToken, "Grok Build");
+					return;
+				}
+				yield* mapGrokChatCompletionStream(readServerSentEvents(response.body, request.cancel), request.cancel);
+				return;
+			} catch (error) {
+				if (request.cancel.aborted || isAbortError(error)) {
+					yield { type: "abort" };
+					return;
+				}
+				yield providerErrorFromUnknown(error, accessToken);
+				return;
+			}
+		}
+	}
+};
+function createGrokBuildProvider(options = {}) {
+	const id = options.id ?? "grok-build";
+	const displayName = options.displayName ?? "Grok Build";
+	const enableCredentials = options.credentials ?? options.authStore === void 0;
+	const pool = !options.authStore && enableCredentials ? openGrokCredentialPool({ stateDir: options.stateDir }) : null;
+	const authStore = options.authStore ?? (pool ? new PoolAwareGrokAuthStore(pool, { grokHome: options.grokHome }) : new FileGrokAuthStore({ grokHome: options.grokHome }));
+	const baseUrl = normalizeBaseUrl(options.baseUrl ?? "https://cli-chat-proxy.grok.com/v1");
+	const fetchImpl = options.fetch ?? fetch;
+	const quota = createGrokBuildQuota({
+		providerId: id,
+		grokHome: options.grokHome,
+		baseUrl,
+		clientVersion: options.clientVersion,
+		authStore,
+		fetch: fetchImpl
+	});
+	const credentialsApi = pool ? createGrokBuildCredentials(pool, authStore, {
+		grokHome: options.grokHome,
+		quota
+	}) : void 0;
+	const runtimeOptions = {
+		baseUrl,
+		grokHome: options.grokHome,
+		clientVersion: options.clientVersion,
+		authStore,
+		headers: options.headers,
+		fetch: fetchImpl,
+		quota
+	};
+	return defineProvider({
+		id,
+		displayName,
+		auth: { status: () => authStore.status() },
+		quota,
+		...credentialsApi ? { credentials: credentialsApi } : {},
+		state: () => ({
+			status: "ready",
+			message: credentialsApi ? "Uses Grok CLI OAuth + demi credential pool via cli-chat-proxy" : "Uses Grok CLI OAuth session (~/.grok/auth.json) via cli-chat-proxy"
+		}),
+		listModels: () => listGrokBuildModels({
+			providerId: id,
+			grokHome: options.grokHome,
+			baseUrl,
+			clientVersion: options.clientVersion,
+			authStore,
+			fetch: fetchImpl
+		}),
+		createRuntime: (_selection) => new GrokBuildProvider(runtimeOptions)
+	});
+}
+function parseGrokBuildProviderConfig(config) {
+	if (config === void 0 || config === null) return {};
+	if (!isRecord(config)) throw new Error("Grok Build provider config must be an object");
+	const parsed = {};
+	if (config.grokHome !== void 0) {
+		if (typeof config.grokHome !== "string") throw new Error("Grok Build provider config field \"grokHome\" must be a string");
+		parsed.grokHome = config.grokHome;
+	}
+	if (config.baseUrl !== void 0) {
+		if (typeof config.baseUrl !== "string") throw new Error("Grok Build provider config field \"baseUrl\" must be a string");
+		parsed.baseUrl = config.baseUrl;
+	}
+	if (config.headers !== void 0) {
+		if (!isRecord(config.headers)) throw new Error("Grok Build provider config field \"headers\" must be an object");
+		const headers = {};
+		for (const [key, value] of Object.entries(config.headers)) {
+			if (typeof value !== "string") throw new Error(`Grok Build provider config headers.${key} must be a string`);
+			headers[key] = value;
+		}
+		parsed.headers = headers;
+	}
+	return parsed;
+}
+function chatCompletionsUrl(baseUrl) {
+	const normalized = normalizeBaseUrl(baseUrl);
+	return normalized.endsWith("/chat/completions") ? normalized : `${normalized}/chat/completions`;
+}
+//#endregion
+export { PoolAwareGrokAuthStore, createGrokBuildCredentials, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, openGrokCredentialPool, parseGrokBuildProviderConfig };