@qduc/term2 0.14.0 → 0.16.0

package/dist/providers/grok-auth.js

@@ -0,0 +1,318 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import envPaths from 'env-paths';
+import { runPkceLoopbackLogin } from './oauth-pkce.js';
+import { OAuthAccountStore } from './oauth-account-store.js';
+import { getJwtClaims } from './jwt-claims.js';
+import { recordSessionAccount } from './oauth-session-account.js';
+import { ProviderReauthenticationRequiredError } from './common/provider-errors.js';
+/**
+ * Grok (xAI) OAuth 2.0 + PKCE login and token storage.
+ *
+ * The public desktop client id, the loopback redirect, and the scope set below
+ * are the ones the official `grok` CLI registers with https://auth.x.ai. They
+ * are public by design (a native app cannot keep a secret), but the values are
+ * load-bearing: the authorization server rejects an unregistered redirect_uri
+ * or client_id outright, so do not "clean them up" into settings without
+ * re-registering.
+ */
+export const GROK_OIDC_ISSUER = 'https://auth.x.ai';
+export const GROK_OIDC_CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';
+export const GROK_AUTHORIZE_ENDPOINT = `${GROK_OIDC_ISSUER}/oauth2/authorize`;
+export const GROK_TOKEN_ENDPOINT = `${GROK_OIDC_ISSUER}/oauth2/token`;
+/** The authorization server only accepts this exact loopback callback. */
+export const GROK_REDIRECT_PORT = 22255;
+export const GROK_REDIRECT_URI = `http://localhost:${GROK_REDIRECT_PORT}/callback`;
+export const GROK_SCOPES = [
+    'openid',
+    'profile',
+    'email',
+    'offline_access',
+    'grok-cli:access',
+    'api:access',
+    'conversations:read',
+    'conversations:write',
+];
+/** Refresh this long before the access token's stated expiry. */
+const REFRESH_SKEW_MS = 5 * 60 * 1000;
+/** term2's own credential file. We never write to the grok CLI's store. */
+export function resolveGrokAuthPath() {
+    const dir = process.env.TERM2_CONFIG_DIR || envPaths('term2').config;
+    return path.join(dir, 'grok-auth.json');
+}
+/**
+ * The official `grok` CLI's credential file, used read-only as a fallback so a
+ * host that already ran `grok login` works without a second login. Its store is
+ * keyed by `<issuer>::<client_id>` and holds many scopes at once.
+ */
+export function resolveGrokCliAuthPath() {
+    const home = process.env.GROK_HOME || (os.homedir() ? path.join(os.homedir(), '.grok') : null);
+    if (!home)
+        return null;
+    const candidate = path.join(home, 'auth.json');
+    try {
+        return fs.existsSync(candidate) && fs.statSync(candidate).isFile() ? candidate : null;
+    }
+    catch {
+        return null;
+    }
+}
+function parseExpiry(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string') {
+        const parsed = Date.parse(value);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return undefined;
+}
+/**
+ * Import a credential from the grok CLI's store — **the access token only.**
+ *
+ * xAI rotates refresh tokens: each refresh invalidates the one before it. If
+ * term2 carried the CLI's refresh token, the two processes would be two writers
+ * on one rotation chain and the loser would be silently logged out. So this is
+ * a one-way, short-lived grace: an already-logged-in host works immediately,
+ * and once that access token expires the user runs `term2 --grok-login` to get
+ * a rotation chain of our own.
+ */
+export function readGrokCliTokens(filePath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    const entries = Object.values(parsed ?? {}).filter((entry) => entry && typeof entry === 'object' && typeof entry.key === 'string' && entry.key);
+    // Prefer an unexpired entry; a stale one is useless to us now that we cannot
+    // refresh it, but returning it still beats returning nothing when it is all
+    // the host has (the caller reports the expiry as a login prompt).
+    const now = Date.now();
+    const isLive = (candidate) => {
+        const expiry = parseExpiry(candidate.expires_at);
+        return expiry === undefined || expiry > now;
+    };
+    const entry = entries.find(isLive) ?? entries[0];
+    if (!entry)
+        return null;
+    return {
+        access_token: entry.key,
+        expires_at: parseExpiry(entry.expires_at),
+        email: typeof entry.email === 'string' ? entry.email : undefined,
+        user_id: typeof entry.user_id === 'string' ? entry.user_id : undefined,
+        team_id: typeof entry.team_id === 'string' ? entry.team_id : undefined,
+        imported: true,
+    };
+}
+/**
+ * Names a Grok account from its credential. The id must be stable across
+ * logins to the same account, or switching would accumulate duplicates, so it
+ * prefers the immutable subject over the display email.
+ */
+function identifyGrokAccount(tokens) {
+    const claims = tokens.id_token ? getJwtClaims(tokens.id_token) : null;
+    const email = tokens.email || (typeof claims?.email === 'string' ? claims.email : undefined);
+    const subject = tokens.user_id || (typeof claims?.sub === 'string' ? claims.sub : undefined);
+    const fallbackId = `anon-${crypto.createHash('sha256').update(tokens.access_token).digest('hex').slice(0, 12)}`;
+    return { id: subject || email || fallbackId, label: email || subject || 'Grok account' };
+}
+export function createGrokAccountStore(filePath = resolveGrokAuthPath()) {
+    return new OAuthAccountStore({
+        filePath,
+        identify: identifyGrokAccount,
+        // A v1 file was a single bare credential object.
+        migrateLegacy: (body) => body && typeof body.access_token === 'string' && body.access_token
+            ? { ...body, expires_at: parseExpiry(body.expires_at) }
+            : null,
+    });
+}
+/** The credential of whichever Grok account is currently selected. */
+export function readStoredGrokTokens(filePath = resolveGrokAuthPath()) {
+    return createGrokAccountStore(filePath).getActiveTokens();
+}
+/** Stores a credential as an account and makes it the active one. */
+export function saveGrokTokens(tokens, filePath = resolveGrokAuthPath()) {
+    createGrokAccountStore(filePath).upsert(tokens);
+}
+export function listGrokAccounts(filePath = resolveGrokAuthPath()) {
+    return createGrokAccountStore(filePath).list();
+}
+export function getActiveGrokAccount(filePath = resolveGrokAuthPath()) {
+    return createGrokAccountStore(filePath).getActive();
+}
+export function setActiveGrokAccount(accountId, filePath = resolveGrokAuthPath()) {
+    return createGrokAccountStore(filePath).setActive(accountId);
+}
+export function removeGrokAccount(accountId, filePath = resolveGrokAuthPath()) {
+    return createGrokAccountStore(filePath).remove(accountId);
+}
+/** True when term2 or the grok CLI has a usable Grok credential on this host. */
+export function hasGrokLogin() {
+    if (readStoredGrokTokens())
+        return true;
+    const cliPath = resolveGrokCliAuthPath();
+    const imported = cliPath ? readGrokCliTokens(cliPath) : null;
+    // An imported token cannot be refreshed, so an expired one is not a login.
+    return Boolean(imported && (imported.expires_at === undefined || imported.expires_at > Date.now()));
+}
+function toTokens(body, previous) {
+    const rawExpiresIn = body?.expires_in;
+    const expiresIn = typeof rawExpiresIn === 'number'
+        ? rawExpiresIn
+        : typeof rawExpiresIn === 'string'
+            ? Number(rawExpiresIn)
+            : undefined;
+    const expiresAt = Number.isFinite(expiresIn)
+        ? Date.now() + expiresIn * 1000
+        : previous?.expires_at;
+    return {
+        access_token: body?.access_token,
+        refresh_token: body?.refresh_token || previous?.refresh_token,
+        id_token: body?.id_token || previous?.id_token,
+        expires_at: expiresAt,
+        email: previous?.email ?? claimedEmail(body?.id_token),
+        user_id: previous?.user_id ?? claimedSubject(body?.id_token),
+        team_id: previous?.team_id,
+    };
+}
+function claimedEmail(idToken) {
+    const claims = typeof idToken === 'string' ? getJwtClaims(idToken) : null;
+    return typeof claims?.email === 'string' ? claims.email : undefined;
+}
+function claimedSubject(idToken) {
+    const claims = typeof idToken === 'string' ? getJwtClaims(idToken) : null;
+    return typeof claims?.sub === 'string' ? claims.sub : undefined;
+}
+/**
+ * Resolves a live access token, refreshing it when it is expired or close to
+ * expiring. Concurrent callers share one refresh so the single-use refresh
+ * token is not spent twice.
+ */
+export class GrokTokenManager {
+    activeRefresh = null;
+    /**
+     * The account this manager resolved first, held for its whole lifetime.
+     *
+     * Selecting a different account in the UI changes the store's active pointer,
+     * but a running session keeps authenticating as whoever it started as —
+     * provider response chaining is bound to that identity, so swapping it
+     * mid-session would break the chain.
+     */
+    pinnedAccountId = null;
+    fetchImpl;
+    authPath;
+    cliAuthPathResolver;
+    constructor(options) {
+        this.fetchImpl = options?.fetchImpl || globalThis.fetch;
+        this.authPath = options?.authPath || resolveGrokAuthPath();
+        this.cliAuthPathResolver = options?.cliAuthPathResolver || resolveGrokCliAuthPath;
+    }
+    load() {
+        const store = createGrokAccountStore(this.authPath);
+        const pinned = this.pinnedAccountId ? store.get(this.pinnedAccountId) : null;
+        // Falls back to the active account if the pinned one was signed out.
+        const account = pinned ?? store.getActive();
+        if (account) {
+            this.pinnedAccountId = account.id;
+            recordSessionAccount('grok', account.id);
+            return account.tokens;
+        }
+        const cliPath = this.cliAuthPathResolver();
+        return cliPath ? readGrokCliTokens(cliPath) : null;
+    }
+    /** The account id this session is authenticating as, once it has resolved one. */
+    getPinnedAccountId() {
+        return this.pinnedAccountId;
+    }
+    async getOrRefreshAccessToken() {
+        const tokens = this.load();
+        if (!tokens) {
+            throw new ProviderReauthenticationRequiredError('Not logged in to Grok. Run `term2 --grok-login` (or `grok login`) first.');
+        }
+        const expiringSoon = tokens.expires_at !== undefined && Date.now() + REFRESH_SKEW_MS >= tokens.expires_at;
+        if (!expiringSoon)
+            return tokens.access_token;
+        if (!tokens.refresh_token) {
+            throw new ProviderReauthenticationRequiredError(tokens.imported
+                ? 'The access token imported from the `grok` CLI has expired. Run `term2 --grok-login` so term2 holds its own credential.'
+                : 'Grok access token expired and no refresh token is stored. Run `term2 --grok-login` again.');
+        }
+        if (this.activeRefresh)
+            return this.activeRefresh;
+        this.activeRefresh = (async () => {
+            try {
+                const response = await this.fetchImpl(GROK_TOKEN_ENDPOINT, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                    body: new URLSearchParams({
+                        grant_type: 'refresh_token',
+                        refresh_token: tokens.refresh_token,
+                        client_id: GROK_OIDC_CLIENT_ID,
+                    }).toString(),
+                });
+                if (!response.ok) {
+                    throw new Error(`Grok token refresh failed with status ${response.status}`);
+                }
+                const body = await response.json();
+                if (!body?.access_token) {
+                    throw new Error('Grok refresh response did not contain access_token');
+                }
+                const refreshed = toTokens(body, tokens);
+                // Refresh the account this session is pinned to, not whichever the
+                // user has since selected.
+                const store = createGrokAccountStore(this.authPath);
+                // Cross-process guard: if another term2 instance already refreshed
+                // this account with the same single-use refresh_token, its write
+                // will have changed the stored refresh_token. Don't overwrite it.
+                const current = this.pinnedAccountId
+                    ? store.get(this.pinnedAccountId)?.tokens
+                    : store.getActive()?.tokens;
+                if (current?.refresh_token && current.refresh_token !== tokens.refresh_token) {
+                    return current.access_token;
+                }
+                if (this.pinnedAccountId)
+                    store.updateTokens(this.pinnedAccountId, refreshed);
+                else
+                    store.updateActiveTokens(refreshed);
+                return refreshed.access_token;
+            }
+            finally {
+                this.activeRefresh = null;
+            }
+        })();
+        return this.activeRefresh;
+    }
+}
+export const GROK_PKCE_CONFIG = {
+    label: 'Grok',
+    clientId: GROK_OIDC_CLIENT_ID,
+    authorizeEndpoint: GROK_AUTHORIZE_ENDPOINT,
+    tokenEndpoint: GROK_TOKEN_ENDPOINT,
+    redirectPorts: [GROK_REDIRECT_PORT],
+    redirectUriFor: () => GROK_REDIRECT_URI,
+    callbackPath: '/callback',
+    scopes: GROK_SCOPES,
+    portConflictHint: 'often a running `grok login`',
+};
+/**
+ * Runs the browser OAuth + PKCE flow and persists the resulting tokens into
+ * term2's own store. Resolves only after the human finishes in the browser.
+ */
+export async function loginToGrok(options) {
+    const body = await runPkceLoopbackLogin(GROK_PKCE_CONFIG, {
+        fetchImpl: options?.fetchImpl,
+        openBrowser: options?.openBrowser,
+        onPrompt: options?.onPrompt,
+        signal: options?.signal,
+        pasteInput: options?.pasteInput,
+        onPasteRejected: options?.onPasteRejected,
+    });
+    const tokens = toTokens(body);
+    saveGrokTokens(tokens, options?.authPath ?? resolveGrokAuthPath());
+    return tokens;
+}
+//# sourceMappingURL=grok-auth.js.map

package/dist/providers/grok-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-auth.js","sourceRoot":"","sources":["../../source/providers/grok-auth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AAEpF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,gBAAgB,mBAAmB,CAAC;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,gBAAgB,eAAe,CAAC;AACtE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,kBAAkB,WAAW,CAAC;AACnF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,QAAQ;IACR,SAAS;IACT,OAAO;IACP,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,iEAAiE;AACjE,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAetC,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACrE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAChD,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CACxF,CAAC;IACX,6EAA6E;IAC7E,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,CAAC,SAAc,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG,CAAC;IAC9C,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC;QACzC,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAChE,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACtE,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACtE,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,QAAQ,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAChH,OAAO,EAAE,EAAE,EAAE,OAAO,IAAI,KAAK,IAAI,UAAU,EAAE,KAAK,EAAE,KAAK,IAAI,OAAO,IAAI,cAAc,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAQ,GAAG,mBAAmB,EAAE;IACrE,OAAO,IAAI,iBAAiB,CAAa;QACvC,QAAQ;QACR,QAAQ,EAAE,mBAAmB;QAC7B,iDAAiD;QACjD,aAAa,EAAE,CAAC,IAAS,EAAE,EAAE,CAC3B,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY;YAChE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;YACvD,CAAC,CAAC,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,oBAAoB,CAAC,QAAQ,GAAG,mBAAmB,EAAE;IACnE,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;AAC5D,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,MAAkB,EAAE,QAAQ,GAAG,mBAAmB,EAAE;IACjF,sBAAsB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAQ,GAAG,mBAAmB,EAAE;IAC/D,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAQ,GAAG,mBAAmB,EAAE;IACnE,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,QAAQ,GAAG,mBAAmB,EAAE;IACtF,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,QAAQ,GAAG,mBAAmB,EAAE;IACnF,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY;IAC1B,IAAI,oBAAoB,EAAE;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,sBAAsB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,2EAA2E;IAC3E,OAAO,OAAO,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,QAAQ,CAAC,IAAS,EAAE,QAAqB;IAChD,MAAM,YAAY,GAAG,IAAI,EAAE,UAAU,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,YAAY,KAAK,QAAQ;QAC9B,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,YAAY,KAAK,QAAQ;YAClC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;YACtB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAmB,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAI,SAAoB,GAAG,IAAI;QAC3C,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC;IACzB,OAAO;QACL,YAAY,EAAE,IAAI,EAAE,YAAY;QAChC,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,QAAQ,EAAE,aAAa;QAC7D,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,QAAQ,EAAE,QAAQ;QAC9C,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IACnB,aAAa,GAA2B,IAAI,CAAC;IACrD;;;;;;;OAOG;IACK,eAAe,GAAkB,IAAI,CAAC;IAC7B,SAAS,CAAe;IACxB,QAAQ,CAAS;IACjB,mBAAmB,CAAsB;IAE1D,YAAY,OAAoG;QAC9G,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3D,IAAI,CAAC,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,IAAI,sBAAsB,CAAC;IACpF,CAAC;IAEO,IAAI;QACV,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,EAAE,CAAC;YAClC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACzC,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,kFAAkF;IAClF,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,qCAAqC,CAC7C,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,IAAI,MAAM,CAAC,UAAU,CAAC;QAC1G,IAAI,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC;QAE9C,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,IAAI,qCAAqC,CAC7C,MAAM,CAAC,QAAQ;gBACb,CAAC,CAAC,wHAAwH;gBAC1H,CAAC,CAAC,2FAA2F,CAChG,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAElD,IAAI,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE;oBACzD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;wBACxB,UAAU,EAAE,eAAe;wBAC3B,aAAa,EAAE,MAAM,CAAC,aAAc;wBACpC,SAAS,EAAE,mBAAmB;qBAC/B,CAAC,CAAC,QAAQ,EAAE;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACzC,mEAAmE;gBACnE,2BAA2B;gBAC3B,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpD,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe;oBAClC,CAAC,CAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAiC;oBACrE,CAAC,CAAE,KAAK,CAAC,SAAS,EAAE,EAAE,MAAiC,CAAC;gBAC1D,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;oBAC7E,OAAO,OAAO,CAAC,YAAY,CAAC;gBAC9B,CAAC;gBACD,IAAI,IAAI,CAAC,eAAe;oBAAE,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;;oBACzE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBACzC,OAAO,SAAS,CAAC,YAAY,CAAC;YAChC,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,mBAAmB;IAC7B,iBAAiB,EAAE,uBAAuB;IAC1C,aAAa,EAAE,mBAAmB;IAClC,aAAa,EAAE,CAAC,kBAAkB,CAAC;IACnC,cAAc,EAAE,GAAG,EAAE,CAAC,iBAAiB;IACvC,YAAY,EAAE,WAAW;IACzB,MAAM,EAAE,WAAW;IACnB,gBAAgB,EAAE,8BAA8B;CACjD,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAGoB;IAEpB,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,EAAE;QACxD,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,WAAW,EAAE,OAAO,EAAE,WAAW;QACjC,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAC3B,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,UAAU,EAAE,OAAO,EAAE,UAAU;QAC/B,eAAe,EAAE,OAAO,EAAE,eAAe;KAC1C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,IAAI,mBAAmB,EAAE,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/providers/grok-credit-usage.d.ts

@@ -0,0 +1,53 @@
+/** One product's share of the credit period, as a percentage of the whole. */
+export interface GrokProductUsage {
+    readonly product: string;
+    readonly usagePercent: number;
+}
+/**
+ * The credit meter for the current period.
+ *
+ * Note this is a *percentage consumed of a period*, not a request or token
+ * allowance — there is no "requests remaining" to report, and the period is
+ * weekly rather than the rolling windows Codex reports.
+ */
+export interface GrokCreditUsage {
+    /** Percentage of the period's credit consumed, 0-100. */
+    readonly creditUsagePercent: number;
+    /** End of the current credit period, as epoch milliseconds. */
+    readonly periodEndMs?: number;
+    /** Per-product split. Empty when the provider sends none. */
+    readonly productUsage: readonly GrokProductUsage[];
+}
+/**
+ * Extracts the meter from a `?format=credits` body, or returns null when the
+ * response doesn't carry one.
+ *
+ * `creditUsagePercent` is the only required field: the period and the product
+ * split are presentation extras, and a body missing them is still worth
+ * showing. A body missing the percentage is not, so it is treated as no data
+ * rather than as zero usage — reporting 0% when we simply failed to read the
+ * number would be worse than showing nothing.
+ */
+export declare const parseGrokCreditUsage: (body: unknown) => GrokCreditUsage | null;
+/** Raised when the provider rejects the token, so the caller can stop asking. */
+export declare class GrokCreditUsageUnauthorizedError extends Error {
+    constructor();
+}
+/** Raised when the provider asks us to back off, carrying its own delay. */
+export declare class GrokCreditUsageRateLimitedError extends Error {
+    readonly retryAfterMs: number | undefined;
+    constructor(retryAfterMs: number | undefined);
+}
+export interface FetchGrokCreditUsageOptions {
+    readonly accessToken: string;
+    readonly fetchImpl?: typeof fetch;
+    readonly baseUrl?: string;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Fetches the credit meter. Returns null when the response is well-formed but
+ * carries no meter; throws for transport and status failures so the caller can
+ * distinguish "nothing to show" from "ask again later".
+ */
+export declare const fetchGrokCreditUsage: ({ accessToken, fetchImpl, baseUrl, signal, }: FetchGrokCreditUsageOptions) => Promise<GrokCreditUsage | null>;
+//# sourceMappingURL=grok-credit-usage.d.ts.map

package/dist/providers/grok-credit-usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-credit-usage.d.ts","sourceRoot":"","sources":["../../source/providers/grok-credit-usage.ts"],"names":[],"mappings":"AAgBA,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACpD;AA0BD;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,SAAU,OAAO,KAAG,eAAe,GAAG,IAetE,CAAC;AAEF,iFAAiF;AACjF,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,cAGC;CACF;AAED,4EAA4E;AAC5E,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,YAAY,YAAY,EAAE,MAAM,GAAG,SAAS,EAI3C;CACF;AAUD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,iDAK9B,2BAA2B,KAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAiB9D,CAAC"}

package/dist/providers/grok-credit-usage.js

@@ -0,0 +1,108 @@
+/**
+ * Reads Grok's credit-usage meter — the number the official `grok` CLI shows
+ * under `/usage`.
+ *
+ * This does not come from the inference lane. Grok's Responses stream carries
+ * no quota frame (unlike Codex, which pushes `codex.rate_limits` mid-stream),
+ * and the proxy returns no rate-limit response headers. The meter lives behind
+ * a separate REST call on the same host, and nothing fetches it unless we ask.
+ *
+ * Endpoint and shape were established against the live proxy on 2026-08-21:
+ * a bearer token alone is accepted, `?format=credits` selects the weekly
+ * percentage view (omitting it returns monthly billing totals instead), and an
+ * unauthenticated call returns a clean 401.
+ */
+import { GROK_BASE_URL } from './grok.provider.js';
+const asRecord = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+const asFiniteNumber = (value) => typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+const parseTimestampMs = (value) => {
+    if (typeof value !== 'string' || !value)
+        return undefined;
+    const parsed = Date.parse(value);
+    return Number.isNaN(parsed) ? undefined : parsed;
+};
+const parseProductUsage = (value) => {
+    if (!Array.isArray(value))
+        return [];
+    const parsed = [];
+    for (const entry of value) {
+        const record = asRecord(entry);
+        const usagePercent = asFiniteNumber(record?.usagePercent);
+        const product = typeof record?.product === 'string' ? record.product : undefined;
+        if (product && usagePercent !== undefined)
+            parsed.push({ product, usagePercent });
+    }
+    return parsed;
+};
+/**
+ * Extracts the meter from a `?format=credits` body, or returns null when the
+ * response doesn't carry one.
+ *
+ * `creditUsagePercent` is the only required field: the period and the product
+ * split are presentation extras, and a body missing them is still worth
+ * showing. A body missing the percentage is not, so it is treated as no data
+ * rather than as zero usage — reporting 0% when we simply failed to read the
+ * number would be worse than showing nothing.
+ */
+export const parseGrokCreditUsage = (body) => {
+    const config = asRecord(asRecord(body)?.config);
+    if (!config)
+        return null;
+    const creditUsagePercent = asFiniteNumber(config.creditUsagePercent);
+    if (creditUsagePercent === undefined)
+        return null;
+    const currentPeriod = asRecord(config.currentPeriod);
+    const periodEndMs = parseTimestampMs(currentPeriod?.end) ?? parseTimestampMs(config.billingPeriodEnd);
+    return {
+        creditUsagePercent,
+        ...(periodEndMs !== undefined ? { periodEndMs } : {}),
+        productUsage: parseProductUsage(config.productUsage),
+    };
+};
+/** Raised when the provider rejects the token, so the caller can stop asking. */
+export class GrokCreditUsageUnauthorizedError extends Error {
+    constructor() {
+        super('Grok rejected the credentials for the credit-usage endpoint.');
+        this.name = 'GrokCreditUsageUnauthorizedError';
+    }
+}
+/** Raised when the provider asks us to back off, carrying its own delay. */
+export class GrokCreditUsageRateLimitedError extends Error {
+    retryAfterMs;
+    constructor(retryAfterMs) {
+        super('Grok rate-limited the credit-usage endpoint.');
+        this.name = 'GrokCreditUsageRateLimitedError';
+        this.retryAfterMs = retryAfterMs;
+    }
+}
+const parseRetryAfterMs = (value) => {
+    if (!value)
+        return undefined;
+    const seconds = Number(value.trim());
+    if (Number.isFinite(seconds) && seconds >= 0)
+        return seconds * 1000;
+    const dateMs = Date.parse(value.trim());
+    return Number.isNaN(dateMs) ? undefined : Math.max(0, dateMs - Date.now());
+};
+/**
+ * Fetches the credit meter. Returns null when the response is well-formed but
+ * carries no meter; throws for transport and status failures so the caller can
+ * distinguish "nothing to show" from "ask again later".
+ */
+export const fetchGrokCreditUsage = async ({ accessToken, fetchImpl = globalThis.fetch, baseUrl = GROK_BASE_URL, signal, }) => {
+    const response = await fetchImpl(`${baseUrl}/billing?format=credits`, {
+        headers: { authorization: `Bearer ${accessToken}`, accept: 'application/json' },
+        ...(signal ? { signal } : {}),
+    });
+    if (response.status === 401 || response.status === 403) {
+        throw new GrokCreditUsageUnauthorizedError();
+    }
+    if (response.status === 429) {
+        throw new GrokCreditUsageRateLimitedError(parseRetryAfterMs(response.headers.get('retry-after')));
+    }
+    if (!response.ok) {
+        throw new Error(`Grok credit-usage request failed with HTTP ${response.status}.`);
+    }
+    return parseGrokCreditUsage(await response.json());
+};
+//# sourceMappingURL=grok-credit-usage.js.map

package/dist/providers/grok-credit-usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-credit-usage.js","sourceRoot":"","sources":["../../source/providers/grok-credit-usage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAwBnD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAuC,EAAE,CACvE,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE/G,MAAM,cAAc,GAAG,CAAC,KAAc,EAAsB,EAAE,CAC5D,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAE1E,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAsB,EAAE;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAsB,EAAE;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,IAAI,OAAO,IAAI,YAAY,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAa,EAA0B,EAAE;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEtG,OAAO;QACL,kBAAkB;QAClB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC;KACrD,CAAC;AACJ,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACzD;QACE,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,YAAY,CAAqB;IAE1C,YAAY,YAAgC;QAC1C,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,CAAC,KAAoB,EAAsB,EAAE;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,OAAO,GAAG,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC;AASF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,EACzC,WAAW,EACX,SAAS,GAAG,UAAU,CAAC,KAAK,EAC5B,OAAO,GAAG,aAAa,EACvB,MAAM,GACsB,EAAmC,EAAE;IACjE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,yBAAyB,EAAE;QACpE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC/E,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,gCAAgC,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,+BAA+B,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,oBAAoB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC,CAAC"}

package/dist/providers/grok.provider.d.ts

@@ -0,0 +1,24 @@
+import type { ProviderDeps, ProviderFetch } from './registry.js';
+import { GrokTokenManager } from './grok-auth.js';
+import type { StreamedModelTurn } from '../contracts/streamed-model-turn.js';
+/**
+ * Grok subscription access goes through the CLI chat proxy, not the metered
+ * public xAI API: an OAuth access token is only accepted here. The proxy speaks
+ * OpenAI chat completions.
+ */
+export declare const GROK_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
+export declare const DEFAULT_GROK_MODEL = "grok-4.6";
+/**
+ * The proxy hard-rejects requests whose client version it does not recognise
+ * (HTTP 426), so this header is required, not cosmetic. Raise it when the proxy
+ * starts refusing this floor.
+ */
+export declare const GROK_CLIENT_VERSION = "1.0.5";
+export declare function buildGrokFetch(deps: ProviderDeps, tokenManager: GrokTokenManager, defaultModel: string): typeof fetch;
+export declare function fetchGrokModels(deps: ProviderDeps, fetchImpl?: ProviderFetch): Promise<Array<{
+    id: string;
+    name?: string;
+    default_reasoning_level?: string;
+}>>;
+export declare function createGrokStreamedModel(model: string, deps: ProviderDeps): StreamedModelTurn;
+//# sourceMappingURL=grok.provider.d.ts.map

package/dist/providers/grok.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.provider.d.ts","sourceRoot":"","sources":["../../source/providers/grok.provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAWjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,aAAa,uCAAuC,CAAC;AAClE,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,UAAU,CAAC;AA8D3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,KAAK,CAarH;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,YAAY,EAClB,SAAS,GAAE,aAAqB,GAC/B,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,uBAAuB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA8BjF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,iBAAiB,CAgC5F"}