@timo972/cc-router 0.11.0 → 0.12.0-rc.0

package/dist/config/manager.js

@@ -110,9 +110,11 @@ export function renameAccountRecordById(oldId, newId) {
     return target;
 }
 function normalizeAccountProvider(record) {
-    return record.provider === "openai_subscription"
-        ? "openai_subscription"
-        : "anthropic_subscription";
+    if (record.provider === "openai_subscription")
+        return "openai_subscription";
+    if (record.provider === "xai_subscription")
+        return "xai_subscription";
+    return "anthropic_subscription";
 }
 export function migrateLegacyAccountProviders(path = ACCOUNTS_PATH) {
     const records = readRawFromPath(path);
@@ -184,6 +186,20 @@ export function saveOpenAIAccountsToPath(accounts, path) {
 export function saveOpenAIAccounts(accounts) {
     saveOpenAIAccountsToPath(accounts, ACCOUNTS_PATH);
 }
+export function loadXaiAccounts(path) {
+    const records = readRawFromPath(path ?? ACCOUNTS_PATH);
+    return records
+        .filter(a => a.provider === "xai_subscription")
+        .map(a => ({
+        id: a.id,
+        provider: "xai_subscription",
+        accessToken: a.accessToken,
+        refreshToken: a.refreshToken,
+        expiresAt: a.expiresAt,
+        enabled: a.enabled !== false,
+        ...(Array.isArray(a.scopes) ? { scopes: a.scopes } : {}),
+    }));
+}
 function parseProxyConfig(raw) {
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {

package/dist/config/paths.js

@@ -5,6 +5,7 @@ export const CONFIG_DIR = path.join(os.homedir(), ".cc-router");
 export const ACCOUNTS_PATH = process.env["ACCOUNTS_PATH"] ??
     path.join(CONFIG_DIR, "accounts.json");
 export const CLAUDE_SETTINGS_PATH = path.join(os.homedir(), ".claude", "settings.json");
+export const CODEX_CONFIG_PATH = path.join(os.homedir(), ".codex", "config.toml");
 export const PROXY_PORT = parseInt(process.env["PORT"] ?? "3456", 10);
 export const LITELLM_PORT = 4000;
 // When set, the server forwards to LiteLLM instead of Anthropic directly

package/dist/protocol/model-ref.js

@@ -20,7 +20,7 @@ function cleanModel(model) {
  * costs the Anthropic path nothing. Everything else unprefixed still goes to
  * Anthropic, which is what existing setups rely on.
  */
-function isBareOpenAIModel(publicModel) {
+export function isBareOpenAIModel(publicModel) {
     return publicModel.toLowerCase().startsWith("gpt-");
 }
 export function parseModelRef(model, config = {}) {

package/dist/providers/openai/account-state.js

@@ -132,8 +132,11 @@ export function applyCodexRateLimits(account, update, nowMs) {
     }
     if (update.credits)
         limits.credits = update.credits;
-    if (update.buckets.length > 0 || update.credits)
+    if (update.resetCredits)
+        limits.resetCredits = update.resetCredits;
+    if (update.buckets.length > 0 || update.credits || update.resetCredits) {
         limits.lastUpdated = nowMs;
+    }
 }
 function normalizeModelSlug(model) {
     const normalized = model?.trim().toLowerCase();

package/dist/providers/openai/usage.js

@@ -246,7 +246,20 @@ export function parseCodexUsagePayload(value, nowMs) {
             };
         }
     }
-    return { buckets, ...(credits ? { credits } : {}) };
+    let resetCredits;
+    const rawResetCredits = payload["rate_limit_reset_credits"];
+    if (typeof rawResetCredits === "object" && rawResetCredits !== null) {
+        const record = rawResetCredits;
+        const count = usageNumber(record["available_count"]) ?? usageNumber(record["available"]);
+        if (count !== undefined) {
+            resetCredits = { available: Math.max(0, Math.min(99, Math.floor(count))) };
+        }
+    }
+    return {
+        buckets,
+        ...(credits ? { credits } : {}),
+        ...(resetCredits ? { resetCredits } : {}),
+    };
 }
 export function resolveActiveLimit(headers) {
     const raw = headerString(headers, "x-codex-active-limit")?.trim();

package/dist/providers/xai/account-record.js

@@ -0,0 +1,42 @@
+export const XAI_PROVIDER = "xai_subscription";
+export const XAI_DEFAULT_SCOPES = [
+    "openid",
+    "profile",
+    "email",
+    "offline_access",
+    "grok-cli:access",
+    "api:access",
+];
+function parseExpiresAt(value) {
+    const parsed = typeof value === "number" ? value : Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw new Error("expiresAt must be a positive Unix timestamp in milliseconds");
+    }
+    return parsed;
+}
+function parseScopes(value) {
+    if (Array.isArray(value))
+        return value.filter(Boolean);
+    if (typeof value === "string")
+        return value.split(/\s+/).filter(Boolean);
+    return [...XAI_DEFAULT_SCOPES];
+}
+export function createXaiAccountRecord(input) {
+    const id = input.id.trim();
+    if (!/^[a-zA-Z0-9_-]+$/.test(id)) {
+        throw new Error("Only letters, numbers, _ and - allowed in account ID");
+    }
+    if (!input.accessToken.trim())
+        throw new Error("Access token is required");
+    if (!input.refreshToken.trim())
+        throw new Error("Refresh token is required");
+    return {
+        id,
+        provider: XAI_PROVIDER,
+        accessToken: input.accessToken.trim(),
+        refreshToken: input.refreshToken.trim(),
+        expiresAt: parseExpiresAt(input.expiresAt),
+        scopes: parseScopes(input.scopes),
+        enabled: input.enabled ?? true,
+    };
+}

package/dist/providers/xai/device-oauth.js

@@ -0,0 +1,116 @@
+import { createXaiAccountRecord, XAI_DEFAULT_SCOPES } from "./account-record.js";
+const DEFAULT_ISSUER = "https://auth.x.ai";
+const DEFAULT_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
+function issuerOf(opts) {
+    return (opts.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+}
+function clientIdOf(opts) {
+    return opts.clientId ?? DEFAULT_CLIENT_ID;
+}
+function fetchOf(opts) {
+    return opts.fetchImpl ?? fetch;
+}
+async function readError(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return "";
+    }
+}
+function parseAccessTokenExpiry(accessToken, expiresIn, now = Date.now()) {
+    const parts = accessToken.split(".");
+    if (parts[1]) {
+        try {
+            const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+            if (typeof claims.exp === "number" && Number.isFinite(claims.exp) && claims.exp > 0) {
+                return claims.exp * 1000;
+            }
+        }
+        catch { /* fall through */ }
+    }
+    if (typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0) {
+        return now + expiresIn * 1000;
+    }
+    throw new Error("xAI access token has no usable expiry");
+}
+export async function requestXaiDeviceCode(opts = {}) {
+    const issuer = issuerOf(opts);
+    const form = new URLSearchParams({
+        client_id: clientIdOf(opts),
+        scope: XAI_DEFAULT_SCOPES.join(" "),
+    });
+    const res = await fetchOf(opts)(`${issuer}/oauth2/device/code`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: form.toString(),
+    });
+    if (!res.ok) {
+        throw new Error(`xAI device code request failed (${res.status}): ${await readError(res)}`);
+    }
+    const body = await res.json();
+    if (!body.device_code || !body.user_code || !body.verification_uri) {
+        throw new Error("xAI device code response is missing device_code, user_code, or verification_uri");
+    }
+    return {
+        verificationUrl: body.verification_uri_complete ?? body.verification_uri,
+        userCode: body.user_code,
+        deviceCode: body.device_code,
+        intervalSeconds: Number(body.interval ?? 5),
+    };
+}
+export async function exchangeXaiDeviceCodeForTokens(opts) {
+    const issuer = issuerOf(opts);
+    const sleep = opts.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
+    const now = opts.now ?? Date.now;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const started = now();
+    while (now() - started <= timeoutMs) {
+        const form = new URLSearchParams({
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            device_code: opts.deviceCode.deviceCode,
+            client_id: clientIdOf(opts),
+        });
+        const res = await fetchOf(opts)(`${issuer}/oauth2/token`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
+            body: form.toString(),
+        });
+        const body = await res.json().catch(() => ({}));
+        if (res.ok && body.access_token && body.refresh_token) {
+            return {
+                accessToken: body.access_token,
+                refreshToken: body.refresh_token,
+                expiresAt: parseAccessTokenExpiry(body.access_token, body.expires_in, now()),
+            };
+        }
+        const error = body.error ?? "";
+        if (error === "authorization_pending" || error === "slow_down" || res.status === 400 && !error) {
+            const wait = error === "slow_down"
+                ? Math.max(1, opts.deviceCode.intervalSeconds) + 5
+                : Math.max(1, opts.deviceCode.intervalSeconds);
+            await sleep(wait * 1000);
+            continue;
+        }
+        throw new Error(`xAI device authorization failed (${res.status}): ${body.error_description ?? (error || await readError(res))}`);
+    }
+    throw new Error("xAI device authorization timed out");
+}
+export async function loginXaiWithDeviceCode(opts) {
+    const deviceCode = await requestXaiDeviceCode(opts);
+    opts.onDeviceCode?.(deviceCode);
+    const tokens = await exchangeXaiDeviceCodeForTokens({ ...opts, deviceCode });
+    return createXaiAccountRecord({
+        id: opts.accountId,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: tokens.expiresAt,
+    });
+}

package/dist/providers/xai/import-auth.js

@@ -0,0 +1,70 @@
+import { existsSync, readFileSync } from "fs";
+import path from "path";
+import { grokHomeDir } from "./overview.js";
+import { createXaiAccountRecord } from "./account-record.js";
+/**
+ * Copy the Grok CLI OIDC login (~/.grok/auth.json) into an accounts.json record.
+ * Does not write the file itself — the caller persists via upsert.
+ */
+export function importGrokCliAuth(opts = {}) {
+    const grokHome = opts.grokHome ?? grokHomeDir();
+    const fileExists = opts.fileExists ?? existsSync;
+    const readFile = opts.readFile ?? ((filePath) => readFileSync(filePath, "utf-8"));
+    const authPath = path.join(grokHome, "auth.json");
+    if (!fileExists(authPath)) {
+        throw new Error(`No Grok CLI login at ${authPath}. Run: grok login`);
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFile(authPath));
+    }
+    catch {
+        throw new Error(`Could not parse ${authPath}`);
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error(`${authPath} is not a Grok auth map`);
+    }
+    const entry = firstOidcEntry(raw);
+    if (!entry) {
+        throw new Error("No OIDC Grok login found in auth.json. Run: grok login");
+    }
+    const accessToken = typeof entry.key === "string" ? entry.key.trim() : "";
+    const refreshToken = typeof entry.refresh_token === "string" ? entry.refresh_token.trim() : "";
+    const expiresAt = parseExpiresAt(entry.expires_at, accessToken);
+    const id = opts.accountId?.trim() || "grok";
+    return createXaiAccountRecord({
+        id,
+        accessToken,
+        refreshToken,
+        expiresAt,
+    });
+}
+function firstOidcEntry(raw) {
+    for (const value of Object.values(raw)) {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            continue;
+        const entry = value;
+        if (entry.auth_mode === "oidc" && typeof entry.key === "string" && typeof entry.refresh_token === "string") {
+            return entry;
+        }
+    }
+    return undefined;
+}
+function parseExpiresAt(value, accessToken) {
+    if (typeof value === "string" && value.trim()) {
+        const parsed = Date.parse(value);
+        if (Number.isFinite(parsed) && parsed > 0)
+            return parsed;
+    }
+    const parts = accessToken.split(".");
+    if (parts[1]) {
+        try {
+            const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+            if (typeof claims.exp === "number" && Number.isFinite(claims.exp) && claims.exp > 0) {
+                return claims.exp * 1000;
+            }
+        }
+        catch { /* fall through */ }
+    }
+    throw new Error("Grok login is missing a usable expiry");
+}

package/dist/providers/xai/overview.js

@@ -0,0 +1,279 @@
+import { existsSync, readFileSync } from "fs";
+import os from "os";
+import path from "path";
+import { loadXaiAccounts } from "../../config/manager.js";
+import { fetchGrokSubscription } from "./subscription-fetch.js";
+function loadConfiguredXaiAccounts() {
+    // Read the override at call time. This keeps the overview aligned with the
+    // manager's documented ACCOUNTS_PATH override even when the environment is
+    // installed after this module has been imported (as in embedded callers and
+    // tests); without it the paths module's import-time snapshot can hide stored
+    // xAI accounts from the dashboard.
+    return loadXaiAccounts(process.env["ACCOUNTS_PATH"] || undefined);
+}
+export function grokHomeDir(homeDir = os.homedir()) {
+    const fromEnv = process.env["GROK_HOME"]?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return path.join(homeDir, ".grok");
+}
+export function loadGrokAccountSnapshots(opts = {}) {
+    const grokHome = opts.grokHome ?? grokHomeDir();
+    const now = opts.now ?? Date.now;
+    const isProcessAlive = opts.isProcessAlive ?? defaultIsProcessAlive;
+    const readFile = opts.readFile ?? ((filePath) => readFileSync(filePath, "utf-8"));
+    const fileExists = opts.fileExists ?? existsSync;
+    const authPath = path.join(grokHome, "auth.json");
+    if (!fileExists(authPath))
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(readFile(authPath));
+    }
+    catch {
+        return [];
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return [];
+    const liveSessions = readLiveSessions(path.join(grokHome, "active_sessions.json"), { readFile, fileExists, isProcessAlive });
+    const nowMs = now();
+    const usedIds = new Set();
+    const snapshots = [];
+    for (const entry of Object.values(raw)) {
+        const snapshot = snapshotFromAuthEntry(entry, liveSessions.length, nowMs, usedIds);
+        if (snapshot)
+            snapshots.push(snapshot);
+    }
+    return snapshots;
+}
+/** Stored xAI accounts if any, otherwise the live Grok CLI login. */
+export function loadGrokHealthSnapshots(opts = {}) {
+    const overlay = loadGrokAccountSnapshots(opts);
+    const liveSessions = overlay.reduce((sum, account) => Math.max(sum, account.activeSessions), 0);
+    const stored = loadConfiguredXaiAccounts();
+    if (stored.length === 0)
+        return overlay;
+    const now = (opts.now ?? Date.now)();
+    return stored.map(account => {
+        const tier = grokTierFromAccessToken(account.accessToken);
+        return {
+            id: account.id,
+            provider: "xai_subscription",
+            enabled: true,
+            healthy: account.enabled !== false && account.expiresAt > now,
+            busy: liveSessions > 0,
+            inFlightRequests: 0,
+            activeSessions: liveSessions,
+            requestCount: 0,
+            errorCount: 0,
+            expiresInMs: account.expiresAt - now,
+            lastUsedMs: 0,
+            lastRefreshMs: 0,
+            ...(tier !== undefined ? { tier } : {}),
+        };
+    });
+}
+/**
+ * Sync snapshots enriched with the live plan name + code-access flag. Each
+ * stored xAI account gets one `/v1/user` lookup (matched by id); a failed or
+ * missing lookup leaves the snapshot on its access-token `tier` fallback, so an
+ * offline dashboard degrades to the coarse tier instead of dropping the row.
+ */
+export async function loadGrokHealthSnapshotsWithSubscription(opts = {}) {
+    const base = loadGrokHealthSnapshots(opts);
+    if (base.length === 0)
+        return base;
+    const accounts = opts.accounts ?? loadConfiguredXaiAccounts();
+    const fetchSubscription = opts.fetchSubscription
+        ?? ((accessToken) => fetchGrokSubscription({ accessToken }));
+    return Promise.all(base.map(async (snapshot) => {
+        const account = accounts.find(candidate => candidate.id === snapshot.id);
+        if (!account)
+            return snapshot;
+        const result = await fetchSubscription(account.accessToken);
+        if (!result.ok)
+            return snapshot;
+        return {
+            ...snapshot,
+            ...(result.subscriptionTier !== undefined ? { subscriptionTier: result.subscriptionTier } : {}),
+            ...(result.hasCodeAccess !== undefined ? { hasCodeAccess: result.hasCodeAccess } : {}),
+        };
+    }));
+}
+export function grokSnapshotAsHealthAccount(snapshot) {
+    const xai = {
+        ...(snapshot.tier !== undefined ? { tier: snapshot.tier } : {}),
+        ...(snapshot.subscriptionTier !== undefined ? { subscriptionTier: snapshot.subscriptionTier } : {}),
+        ...(snapshot.hasCodeAccess !== undefined ? { hasCodeAccess: snapshot.hasCodeAccess } : {}),
+    };
+    return {
+        id: snapshot.id,
+        provider: "xai_subscription",
+        enabled: true,
+        healthy: snapshot.healthy,
+        busy: snapshot.busy,
+        inFlightRequests: 0,
+        activeSessions: snapshot.activeSessions,
+        requestCount: snapshot.requestCount,
+        errorCount: snapshot.errorCount,
+        expiresInMs: snapshot.expiresInMs,
+        lastUsedMs: snapshot.lastUsedMs,
+        lastRefreshMs: snapshot.lastRefreshMs,
+        ...(Object.keys(xai).length > 0 ? { xai } : {}),
+    };
+}
+export function mergeGrokIntoHealth(health, snapshots = loadGrokHealthSnapshots()) {
+    // The proxy daemon already emits the Grok row from the sync (network-free)
+    // path, so it carries only the coarse `tier`. Rather than skip enrichment,
+    // overlay the live plan name / code-access flag from the async snapshots the
+    // caller polled — otherwise the daemon-served row would stay stuck on "tier N".
+    if (health.accounts.some(account => account.provider === "xai_subscription")) {
+        return enrichExistingGrokAccounts(health, snapshots);
+    }
+    const grokAccounts = snapshots.map(grokSnapshotAsHealthAccount);
+    if (grokAccounts.length === 0)
+        return health;
+    const healthy = grokAccounts.filter(account => account.healthy).length;
+    const xai = {
+        configured: true,
+        accounts: grokAccounts.length,
+        healthy,
+        enabled: grokAccounts.length,
+    };
+    return {
+        ...health,
+        accounts: [...health.accounts, ...grokAccounts],
+        ...(health.operational
+            ? { operational: { ...health.operational, providers: { ...health.operational.providers, xai } } }
+            : {}),
+    };
+}
+/**
+ * Overlay the live plan name / code-access flag from freshly-polled snapshots
+ * onto the tier-only Grok rows the proxy daemon serves. Matches by account id,
+ * with a single-account fallback (the common one-Grok-login case). Returns the
+ * same object untouched when nothing changed, so the fast poll path stays cheap.
+ */
+function enrichExistingGrokAccounts(health, snapshots) {
+    if (snapshots.length === 0)
+        return health;
+    const byId = new Map(snapshots.map(snapshot => [snapshot.id, snapshot]));
+    let changed = false;
+    const accounts = health.accounts.map(account => {
+        if (account.provider !== "xai_subscription")
+            return account;
+        const snapshot = (account.id !== undefined ? byId.get(account.id) : undefined)
+            ?? (snapshots.length === 1 ? snapshots[0] : undefined);
+        if (!snapshot)
+            return account;
+        const enrichment = {
+            ...(snapshot.tier !== undefined ? { tier: snapshot.tier } : {}),
+            ...(snapshot.subscriptionTier !== undefined ? { subscriptionTier: snapshot.subscriptionTier } : {}),
+            ...(snapshot.hasCodeAccess !== undefined ? { hasCodeAccess: snapshot.hasCodeAccess } : {}),
+        };
+        if (Object.keys(enrichment).length === 0)
+            return account;
+        changed = true;
+        return { ...account, xai: { ...account.xai, ...enrichment } };
+    });
+    return changed ? { ...health, accounts } : health;
+}
+function snapshotFromAuthEntry(value, liveSessionCount, nowMs, usedIds) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entry = value;
+    if (entry.auth_mode !== "oidc" && typeof entry.key !== "string")
+        return undefined;
+    const claims = typeof entry.key === "string" ? decodeJwtPayload(entry.key) : null;
+    const id = uniqueAccountId("grok", usedIds);
+    const expiresAt = parseExpiresAt(entry.expires_at, claims);
+    const expiresInMs = expiresAt > 0 ? expiresAt - nowMs : 0;
+    const healthy = expiresInMs > 0;
+    const tier = numberClaim(claims, "tier");
+    return {
+        id,
+        provider: "xai_subscription",
+        enabled: true,
+        healthy,
+        busy: liveSessionCount > 0,
+        inFlightRequests: 0,
+        activeSessions: liveSessionCount,
+        requestCount: 0,
+        errorCount: 0,
+        expiresInMs,
+        lastUsedMs: 0,
+        lastRefreshMs: 0,
+        ...(tier !== undefined ? { tier } : {}),
+    };
+}
+function readLiveSessions(sessionsPath, opts) {
+    if (!opts.fileExists(sessionsPath))
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(opts.readFile(sessionsPath));
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((row) => {
+        if (row === null || typeof row !== "object")
+            return false;
+        const pid = row.pid;
+        return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && opts.isProcessAlive(pid);
+    });
+}
+function uniqueAccountId(base, used) {
+    if (!used.has(base)) {
+        used.add(base);
+        return base;
+    }
+    let n = 2;
+    while (used.has(`${base}-${n}`))
+        n += 1;
+    const id = `${base}-${n}`;
+    used.add(id);
+    return id;
+}
+function parseExpiresAt(value, claims) {
+    if (typeof value === "string" && value.trim()) {
+        const parsed = Date.parse(value);
+        if (Number.isFinite(parsed) && parsed > 0)
+            return parsed;
+    }
+    const exp = numberClaim(claims, "exp");
+    return exp !== undefined && exp > 0 ? exp * 1000 : 0;
+}
+export function grokTierFromAccessToken(accessToken) {
+    return numberClaim(decodeJwtPayload(accessToken), "tier");
+}
+function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length < 2 || !parts[1])
+        return null;
+    try {
+        const json = Buffer.from(parts[1], "base64url").toString("utf-8");
+        const parsed = JSON.parse(json);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function numberClaim(claims, key) {
+    const value = claims?.[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function defaultIsProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/providers/xai/subscription-fetch.js

@@ -0,0 +1,56 @@
+/**
+ * Live subscription lookup for the Grok dashboard row.
+ *
+ * The Grok CLI's own backend is `https://cli-chat-proxy.grok.com/v1`. A
+ * bearer-only GET on `/v1/user?include=subscription` answers with the account
+ * identity plus `subscriptionTier` ("GrokPro", …) and `hasGrokCodeAccess` — the
+ * only quota-relevant signals xAI exposes to the OIDC CLI token. The
+ * `?include=subscription` query is REQUIRED: the bare `/v1/user` omits
+ * `subscriptionTier` entirely (verified live 2026-08-21).
+ *
+ * Probed 2026-08-21 against the live endpoint: there is NO usage/limit/reset
+ * data here. `/v1/usage`, `/v1/rate-limits`, `/v1/quota` and friends all 404;
+ * no `x-ratelimit-*` response headers. xAI's weekly usage pool lives only in the
+ * web app's Settings → Usage surface behind a different auth context, so the
+ * dashboard shows the plan, not a percentage. This is why the Grok row has no
+ * Claude-style 5h/7d windows — they do not exist.
+ */
+export const GROK_USER_ENDPOINT = "https://cli-chat-proxy.grok.com/v1/user?include=subscription";
+export async function fetchGrokSubscription(account, options = {}) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetchImpl(GROK_USER_ENDPOINT, {
+            headers: { authorization: `Bearer ${account.accessToken}`, accept: "application/json" },
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        return { ok: false, reason: "network" };
+    }
+    if (response.status === 401 || response.status === 403)
+        return { ok: false, reason: "auth" };
+    if (!response.ok)
+        return { ok: false, reason: "http" };
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        return { ok: false, reason: "malformed" };
+    }
+    return parseGrokUserPayload(body);
+}
+export function parseGrokUserPayload(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        return { ok: false, reason: "malformed" };
+    }
+    const record = body;
+    const tier = record["subscriptionTier"];
+    const codeAccess = record["hasGrokCodeAccess"];
+    return {
+        ok: true,
+        ...(typeof tier === "string" && tier.trim() ? { subscriptionTier: tier.trim() } : {}),
+        ...(typeof codeAccess === "boolean" ? { hasCodeAccess: codeAccess } : {}),
+    };
+}