@demicodes/provider-grok-build 0.3.2 → 0.4.1

package/dist/index.d.mts

@@ -1,6 +1,20 @@
 import { Provider, ProviderAuthState, ProviderCredentials, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
 import { FileCredentialPool } from "@demicodes/provider/credentials-pool";
 //#region src/auth.d.ts
+/** One credential entry as written by the Grok CLI (`~/.grok/auth.json`). */
+interface GrokAuthEntry {
+  key?: string;
+  auth_mode?: string;
+  refresh_token?: string;
+  expires_at?: string;
+  oidc_issuer?: string;
+  oidc_client_id?: string;
+  email?: string;
+  first_name?: string;
+  user_id?: string;
+  team_id?: string;
+  [key: string]: unknown;
+}
 interface GrokResolvedAuth {
   accessToken: string;
   refreshToken: string | null;
@@ -117,9 +131,31 @@ declare function openGrokCredentialPool(options?: {
 }): FileCredentialPool;
 declare function createGrokBuildCredentials(pool: FileCredentialPool, authStore: GrokAuthStore, options?: {
   grokHome?: string;
-  loginCommand?: string;
-  loginArgs?: string[];
   quota?: ProviderQuota | null;
+  /** Injectable fetch for the device-code login flow (tests). */
+  loginFetch?: typeof fetch;
 }): ProviderCredentials;
 //#endregion
-export { type GrokBuildFetch, type GrokBuildProviderOptions, type GrokBuildQuotaOptions, PoolAwareGrokAuthStore, createGrokBuildCredentials, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, openGrokCredentialPool, parseGrokBuildProviderConfig };
+//#region src/device-login.d.ts
+interface GrokDeviceLoginPending {
+  verificationUrl: string;
+  userCode: string;
+  expiresAt: string;
+}
+interface GrokDeviceLoginOptions {
+  signal?: AbortSignal;
+  /** Fires once with the URL + one-time code the user needs. */
+  onPending?: (pending: GrokDeviceLoginPending) => void;
+  fetch?: typeof fetch;
+  issuer?: string;
+  clientId?: string;
+  scope?: string;
+}
+interface GrokDeviceLoginResult {
+  entryKey: string;
+  entry: GrokAuthEntry;
+}
+/** Runs the full device flow and returns a vendor-shaped auth.json entry keyed like the Grok CLI. */
+declare function runGrokDeviceLogin(options?: GrokDeviceLoginOptions): Promise<GrokDeviceLoginResult>;
+//#endregion
+export { type GrokBuildFetch, type GrokBuildProviderOptions, type GrokBuildQuotaOptions, type GrokDeviceLoginOptions, type GrokDeviceLoginPending, type GrokDeviceLoginResult, PoolAwareGrokAuthStore, createGrokBuildCredentials, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, openGrokCredentialPool, parseGrokBuildProviderConfig, runGrokDeviceLogin };

package/dist/index.mjs

@@ -6,7 +6,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import process from "node:process";
 import { zeroUsage } from "@demicodes/core";
-import { FileCredentialPool, credentialIdFromIdentity, runVendorLoginCommand } from "@demicodes/provider/credentials-pool";
+import { FileCredentialPool, credentialIdFromIdentity } from "@demicodes/provider/credentials-pool";
 import { readFileSync } from "node:fs";
 //#region src/auth.ts
 /** Grok auth.json stores the access token under `key`; redact it alongside the standard fields. */
@@ -599,6 +599,112 @@ function grokUsage(usage) {
 	};
 }
 //#endregion
+//#region src/device-login.ts
+const GROK_ISSUER = "https://auth.x.ai";
+const GROK_CLI_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const GROK_LOGIN_SCOPE = "openid profile email offline_access grok-cli:access";
+const GROK_LOGIN_FALLBACK_INTERVAL_S = 5;
+const GROK_LOGIN_FALLBACK_EXPIRES_S = 900;
+async function postForm(fetchImpl, url, params, signal) {
+	return fetchImpl(url, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams(params).toString(),
+		signal
+	});
+}
+async function jsonBody(response, what) {
+	const body = await response.json().catch(() => null);
+	if (!isRecord(body)) throw new GrokAuthError("auth_invalid", `${what} response is not a JSON object`);
+	return body;
+}
+async function requestDeviceCode(fetchImpl, issuer, clientId, scope, signal) {
+	const response = await postForm(fetchImpl, `${issuer}/oauth2/device/code`, {
+		client_id: clientId,
+		scope
+	}, signal);
+	if (!response.ok) throw new GrokAuthError("auth_invalid", `Grok device code request failed with HTTP ${response.status}`);
+	const body = await jsonBody(response, "Grok device code");
+	const deviceCode = nonEmptyString(body.device_code);
+	const userCode = nonEmptyString(body.user_code);
+	const verificationUrl = nonEmptyString(body.verification_uri_complete) ?? nonEmptyString(body.verification_uri);
+	if (!deviceCode || !userCode || !verificationUrl) throw new GrokAuthError("auth_invalid", "Grok device code response is missing device_code, user_code, or verification_uri");
+	const interval = Number(body.interval);
+	const expiresIn = Number(body.expires_in);
+	return {
+		deviceCode,
+		userCode,
+		verificationUrl,
+		intervalSeconds: Number.isFinite(interval) && interval >= 0 ? interval : GROK_LOGIN_FALLBACK_INTERVAL_S,
+		expiresAt: Date.now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : GROK_LOGIN_FALLBACK_EXPIRES_S) * 1e3
+	};
+}
+async function pollForTokens(fetchImpl, issuer, clientId, device, signal) {
+	let intervalSeconds = device.intervalSeconds;
+	for (;;) {
+		signal?.throwIfAborted();
+		const response = await postForm(fetchImpl, `${issuer}/oauth2/token`, {
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			device_code: device.deviceCode,
+			client_id: clientId
+		}, signal);
+		const body = await jsonBody(response, "Grok device token");
+		if (response.ok) {
+			const accessToken = nonEmptyString(body.access_token);
+			if (!accessToken) throw new GrokAuthError("auth_invalid", "Grok token response is missing access_token");
+			const expiresIn = Number(body.expires_in);
+			return {
+				accessToken,
+				refreshToken: nonEmptyString(body.refresh_token) ?? null,
+				expiresIn: Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : null
+			};
+		}
+		const error = nonEmptyString(body.error);
+		if (error === "slow_down") intervalSeconds += 5;
+		else if (error !== "authorization_pending") throw new GrokAuthError("auth_invalid", `Grok device login failed: ${error ?? `HTTP ${response.status}`}`);
+		if (Date.now() >= device.expiresAt) throw new GrokAuthError("auth_invalid", "Grok device login timed out before the user confirmed");
+		await delay(intervalSeconds * 1e3);
+	}
+}
+async function fetchUserinfo(fetchImpl, issuer, accessToken, signal) {
+	const response = await fetchImpl(`${issuer}/oauth2/userinfo`, {
+		headers: { authorization: `Bearer ${accessToken}` },
+		signal
+	});
+	if (!response.ok) return {};
+	const body = await response.json().catch(() => null);
+	return isRecord(body) ? body : {};
+}
+/** Runs the full device flow and returns a vendor-shaped auth.json entry keyed like the Grok CLI. */
+async function runGrokDeviceLogin(options = {}) {
+	const fetchImpl = options.fetch ?? fetch;
+	const issuer = (options.issuer ?? GROK_ISSUER).replace(/\/+$/, "");
+	const clientId = options.clientId ?? GROK_CLI_CLIENT_ID;
+	const device = await requestDeviceCode(fetchImpl, issuer, clientId, options.scope ?? GROK_LOGIN_SCOPE, options.signal);
+	options.onPending?.({
+		verificationUrl: device.verificationUrl,
+		userCode: device.userCode,
+		expiresAt: new Date(device.expiresAt).toISOString()
+	});
+	const tokens = await pollForTokens(fetchImpl, issuer, clientId, device, options.signal);
+	const userinfo = await fetchUserinfo(fetchImpl, issuer, tokens.accessToken, options.signal);
+	const entry = {
+		key: tokens.accessToken,
+		auth_mode: "oidc",
+		...tokens.refreshToken ? { refresh_token: tokens.refreshToken } : {},
+		...tokens.expiresIn ? { expires_at: new Date(Date.now() + tokens.expiresIn * 1e3).toISOString() } : {},
+		oidc_issuer: issuer,
+		oidc_client_id: clientId,
+		...nonEmptyString(userinfo.email) ? { email: nonEmptyString(userinfo.email) } : {},
+		...nonEmptyString(userinfo.given_name) ? { first_name: nonEmptyString(userinfo.given_name) } : {},
+		...nonEmptyString(userinfo.sub) ? { user_id: nonEmptyString(userinfo.sub) } : {}
+	};
+	return {
+		entryKey: `${issuer}::${clientId}`,
+		entry
+	};
+}
+//#endregion
 //#region src/credentials.ts
 var PoolAwareGrokAuthStore = class {
 	pool;
@@ -642,8 +748,6 @@ function openGrokCredentialPool(options = {}) {
 }
 function createGrokBuildCredentials(pool, authStore, options = {}) {
 	const vendorHome = options.grokHome ?? defaultGrokHome();
-	const loginCommand = options.loginCommand ?? "grok";
-	const loginArgs = options.loginArgs ?? ["login"];
 	const capability = () => ({
 		mode: "supported",
 		canBeginLogin: true,
@@ -710,17 +814,23 @@ function createGrokBuildCredentials(pool, authStore, options = {}) {
 		getActive,
 		setActive,
 		beginLogin: async (loginOptions) => {
-			const result = await runVendorLoginCommand(loginCommand, loginArgs, { signal: loginOptions?.signal });
-			if (result.status === "completed") return { status: "completed" };
-			if (result.status === "cancelled") return { status: "cancelled" };
-			if (result.status === "unavailable") return {
-				status: "unavailable",
-				message: result.message ?? "Login unavailable"
-			};
-			return {
-				status: "failed",
-				message: result.message ?? "Login failed"
-			};
+			try {
+				const { entryKey, entry } = await runGrokDeviceLogin({
+					signal: loginOptions?.signal,
+					onPending: loginOptions?.onPending,
+					fetch: options.loginFetch
+				});
+				return {
+					status: "completed",
+					credentialId: (await importEntry(entryKey, entry, "login:device")).id
+				};
+			} catch (error) {
+				if (loginOptions?.signal?.aborted) return { status: "cancelled" };
+				return {
+					status: "failed",
+					message: errorMessage(error)
+				};
+			}
 		},
 		importDefault: async () => {
 			const authFile = join(vendorHome, "auth.json");
@@ -1214,4 +1324,4 @@ function chatCompletionsUrl(baseUrl) {
 	return normalized.endsWith("/chat/completions") ? normalized : `${normalized}/chat/completions`;
 }
 //#endregion
-export { PoolAwareGrokAuthStore, createGrokBuildCredentials, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, openGrokCredentialPool, parseGrokBuildProviderConfig };
+export { PoolAwareGrokAuthStore, createGrokBuildCredentials, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, openGrokCredentialPool, parseGrokBuildProviderConfig, runGrokDeviceLogin };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-grok-build",
   "description": "Grok Build provider adapter for Demi (reuses ~/.grok OAuth session).",
-  "version": "0.3.2",
+  "version": "0.4.1",
   "private": false,
   "type": "module",
   "exports": {
@@ -12,8 +12,8 @@
   },
   "dependencies": {
     "@demicodes/core": "^0.3.2",
-    "@demicodes/provider": "^0.3.2",
-    "@demicodes/utils": "^0.3.2"
+    "@demicodes/provider": "^0.4.3",
+    "@demicodes/utils": "^0.4.0"
   },
   "license": "Apache-2.0",
   "main": "./dist/index.mjs",