@vib-rato/ai 0.16.0

package/src/utils/oauth/types.ts

@@ -0,0 +1,122 @@
+export type OAuthCredentials = {
+	refresh: string;
+	access: string;
+	expires: number;
+	enterpriseUrl?: string;
+	projectId?: string;
+	email?: string;
+	accountId?: string;
+};
+
+export type OAuthProvider =
+	| "kiro"
+	| "alibaba-token-plan"
+	| "anthropic"
+	| "bizrouter"
+	| "mara"
+	| "cerebras"
+	| "cloudflare-ai-gateway"
+	| "cursor"
+	| "deepseek"
+	| "deepinfra"
+	| "fireworks"
+	| "firepass"
+	| "fugu"
+	| "github-copilot"
+	| "google-gemini-cli"
+	| "google-antigravity"
+	| "gitlab-duo"
+	| "huggingface"
+	| "kimi-code"
+	| "kilo"
+	| "kagi"
+	| "litellm"
+	| "lm-studio"
+	| "minimax-code"
+	| "minimax-code-cn"
+	| "moonshot"
+	| "nvidia"
+	| "nanogpt"
+	| "ollama"
+	| "ollama-cloud"
+	| "openai-codex"
+	| "openai-codex-device"
+	| "opencode-go"
+	| "opencode-zen"
+	| "commandcode-goat"
+	| "opengateway"
+	| "openrouter"
+	| "parallel"
+	| "perplexity"
+	| "qianfan"
+	| "qwen-portal"
+	| "sglang"
+	| "synthetic"
+	| "tavily"
+	| "together"
+	| "venice"
+	| "vercel-ai-gateway"
+	| "vllm"
+	| "xai"
+	| "glm-zcode"
+	| "xiaomi"
+	| "xiaomi-token-plan-sgp"
+	| "xiaomi-token-plan-ams"
+	| "xiaomi-token-plan-cn"
+	| "zenmux"
+	| "opencodex"
+	| "zai";
+
+export type OAuthProviderId = OAuthProvider | (string & {});
+
+export type OAuthPrompt = {
+	message: string;
+	placeholder?: string;
+	allowEmpty?: boolean;
+};
+
+export type OAuthAuthInfo = {
+	url: string;
+	instructions?: string;
+};
+
+export interface OAuthProviderInfo {
+	id: OAuthProviderId;
+	name: string;
+	available: boolean;
+}
+
+/** Per-login switches that change how the authorization code is delivered. */
+export interface OAuthLoginOptions {
+	/**
+	 * Pair by pasting the authorization code the provider displays instead of
+	 * waiting on a local loopback callback. Set when the browser completing the
+	 * login has no network route back to the machine running vib (SSH, remote
+	 * container, headless host). Providers without a paste-a-code redirect
+	 * ignore it.
+	 */
+	manualCode?: boolean;
+}
+
+export interface OAuthController {
+	onAuth?(info: OAuthAuthInfo): void;
+	onProgress?(message: string): void;
+	onManualCodeInput?(): Promise<string>;
+	onPrompt?(prompt: OAuthPrompt): Promise<string>;
+	signal?: AbortSignal;
+	fetch?: typeof globalThis.fetch;
+}
+
+export interface OAuthLoginCallbacks extends OAuthController {
+	onAuth: (info: OAuthAuthInfo) => void;
+	onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+}
+
+export interface OAuthProviderInterface {
+	readonly id: OAuthProviderId;
+	readonly name: string;
+	readonly sourceId?: string;
+	login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials | string>;
+	refreshToken?(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+	getApiKey?(credentials: OAuthCredentials): string;
+}

package/src/utils/oauth/venice.ts

@@ -0,0 +1,59 @@
+/**
+ * Venice login flow.
+ *
+ * Venice provides OpenAI-compatible models via https://api.venice.ai/api/v1.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to Venice API key settings
+ * 2. User copies their API key
+ * 3. User pastes the API key into the CLI
+ */
+
+import { validateOpenAICompatibleApiKey } from "./api-key-validation";
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://venice.ai/settings/api";
+const API_BASE_URL = "https://api.venice.ai/api/v1";
+const VALIDATION_MODEL = "qwen3-4b";
+
+/**
+ * Login to Venice.
+ *
+ * Opens browser to API keys page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginVenice(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error("Venice login requires onPrompt callback");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Copy your API key from the Venice dashboard",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Venice API key",
+		placeholder: "vapi_...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("API key is required");
+	}
+
+	options.onProgress?.("Validating API key...");
+	await validateOpenAICompatibleApiKey({
+		provider: "Venice",
+		apiKey: trimmed,
+		baseUrl: API_BASE_URL,
+		model: VALIDATION_MODEL,
+		signal: options.signal,
+	});
+
+	return trimmed;
+}

package/src/utils/oauth/vercel-ai-gateway.ts

@@ -0,0 +1,47 @@
+/**
+ * Vercel AI Gateway login flow.
+ *
+ * Vercel AI Gateway proxies upstream model providers through a unified endpoint.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open Vercel AI Gateway docs
+ * 2. User copies their API key
+ * 3. User pastes the API key into the CLI
+ */
+
+import type { OAuthController } from "./types";
+
+const AUTH_URL = "https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai-gateway%2Fapi-keys&title=AI+Gateway+API+Keys";
+
+/**
+ * Login to Vercel AI Gateway.
+ *
+ * Opens browser to Vercel AI Gateway docs and prompts for an API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginVercelAiGateway(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error("Vercel AI Gateway login requires onPrompt callback");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Copy your Vercel AI Gateway API key from the Vercel dashboard",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Vercel AI Gateway API key",
+		placeholder: "vck_...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("API key is required");
+	}
+
+	return trimmed;
+}

package/src/utils/oauth/vllm.ts

@@ -0,0 +1,42 @@
+/**
+ * vLLM login flow.
+ *
+ * vLLM is commonly self-hosted with an OpenAI-compatible API at a local base URL.
+ * Some deployments require a bearer token, others allow unauthenticated access.
+ *
+ * This flow stores an API-key-style credential used by `/login` and auth storage.
+ */
+
+import type { OAuthController, OAuthProvider } from "./types";
+
+const PROVIDER_ID: OAuthProvider = "vllm";
+const AUTH_URL = "https://docs.vllm.ai/en/latest/serving/openai_compatible_server.html";
+const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:8000/v1";
+/**
+ * Login to vLLM.
+ *
+ * Opens vLLM OpenAI-compatible auth docs, prompts for a bearer token,
+ * and returns a stored key value. Local no-auth servers need no login.
+ */
+export async function loginVllm(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error(`${PROVIDER_ID} login requires onPrompt callback`);
+	}
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: `Paste the API key configured with vLLM's --api-key option. Local no-auth servers at ${DEFAULT_LOCAL_BASE_URL} are discovered automatically and do not need /login.`,
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your vLLM API key",
+		placeholder: "vLLM API key",
+		allowEmpty: false,
+	});
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("vLLM API key is required; local no-auth servers are discovered automatically");
+	}
+	return trimmed;
+}

package/src/utils/oauth/xai.ts

@@ -0,0 +1,246 @@
+/** xAI OAuth flow (Grok account login). */
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const XAI_OAUTH_ISSUER = "https://auth.x.ai";
+export const XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
+export const XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+export const XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+const XAI_OAUTH_CALLBACK_PORT = 56121;
+const XAI_OAUTH_CALLBACK_PATH = "/callback";
+const XAI_OAUTH_REFRESH_SKEW_MS = 2 * 60 * 1000;
+const TOKEN_REQUEST_TIMEOUT_MS = 30_000;
+
+interface XaiDiscovery {
+	authorizationEndpoint: string;
+	tokenEndpoint: string;
+}
+
+interface XaiDiscoveryPayload {
+	authorization_endpoint?: unknown;
+	token_endpoint?: unknown;
+}
+
+interface XaiTokenPayload {
+	access_token?: unknown;
+	refresh_token?: unknown;
+	expires_in?: unknown;
+	id_token?: unknown;
+	token_type?: unknown;
+}
+
+export interface XaiOAuthFlowOptions {
+	extraAuthorizeParams?: Readonly<Record<string, string>>;
+}
+
+export interface XaiOAuthRefreshOptions {
+	signal?: AbortSignal;
+	extraTokenParams?: Readonly<Record<string, string>>;
+}
+
+interface XaiJwtPayload {
+	sub?: unknown;
+	email?: unknown;
+	[key: string]: unknown;
+}
+
+function requestSignal(signal: AbortSignal | undefined): AbortSignal {
+	const timeoutSignal = AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS);
+	return signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+}
+
+function addNonOverridingParams(
+	target: URLSearchParams | Record<string, string>,
+	params: Readonly<Record<string, string>>,
+): void {
+	for (const [key, value] of Object.entries(params)) {
+		if (key.length === 0 || value.length === 0) continue;
+		if (target instanceof URLSearchParams) {
+			if (!target.has(key)) target.set(key, value);
+		} else if (!(key in target)) {
+			target[key] = value;
+		}
+	}
+}
+
+function isAbortSignal(value: AbortSignal | XaiOAuthRefreshOptions | undefined): value is AbortSignal {
+	return value instanceof AbortSignal;
+}
+
+function resolveRefreshOptions(options: AbortSignal | XaiOAuthRefreshOptions | undefined): XaiOAuthRefreshOptions {
+	return isAbortSignal(options) ? { signal: options } : (options ?? {});
+}
+
+function validateXaiEndpoint(rawUrl: string): string {
+	const parsed = new URL(rawUrl);
+	const host = parsed.hostname.toLowerCase();
+	if (parsed.protocol !== "https:" || (host !== "x.ai" && !host.endsWith(".x.ai"))) {
+		throw new Error(`xAI OAuth discovery returned an unexpected endpoint: ${rawUrl}`);
+	}
+	return parsed.toString();
+}
+
+export async function discoverXaiOAuthEndpoints(signal?: AbortSignal): Promise<XaiDiscovery> {
+	const response = await fetch(XAI_OAUTH_DISCOVERY_URL, {
+		headers: { Accept: "application/json" },
+		signal: requestSignal(signal),
+	});
+	if (!response.ok) {
+		throw new Error(`xAI OAuth discovery failed: ${response.status} ${await response.text()}`);
+	}
+
+	const payload = (await response.json()) as XaiDiscoveryPayload;
+	if (typeof payload.authorization_endpoint !== "string" || typeof payload.token_endpoint !== "string") {
+		throw new Error("xAI OAuth discovery response missing authorization/token endpoints");
+	}
+
+	return {
+		authorizationEndpoint: validateXaiEndpoint(payload.authorization_endpoint),
+		tokenEndpoint: validateXaiEndpoint(payload.token_endpoint),
+	};
+}
+
+function decodeJwtPayload(token: string): XaiJwtPayload | undefined {
+	const parts = token.split(".");
+	const payload = parts[1];
+	if (parts.length !== 3 || !payload) return undefined;
+	try {
+		return JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as XaiJwtPayload;
+	} catch {
+		return undefined;
+	}
+}
+
+function getTokenIdentity(accessToken: string, idToken: string | undefined): { accountId?: string; email?: string } {
+	const payload = (idToken ? decodeJwtPayload(idToken) : undefined) ?? decodeJwtPayload(accessToken);
+	const accountId = typeof payload?.sub === "string" && payload.sub.length > 0 ? payload.sub : undefined;
+	const email =
+		typeof payload?.email === "string" && payload.email.length > 0 ? payload.email.toLowerCase() : undefined;
+	return { accountId, email };
+}
+
+async function postXaiToken(
+	tokenEndpoint: string,
+	body: Record<string, string>,
+	signal?: AbortSignal,
+): Promise<XaiTokenPayload> {
+	const response = await fetch(tokenEndpoint, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded",
+		},
+		body: new URLSearchParams(body).toString(),
+		signal: requestSignal(signal),
+	});
+	if (!response.ok) {
+		throw new Error(`xAI token request failed: ${response.status} ${await response.text()}`);
+	}
+	return (await response.json()) as XaiTokenPayload;
+}
+
+function credentialsFromTokenPayload(payload: XaiTokenPayload, refreshFallback = ""): OAuthCredentials {
+	if (typeof payload.access_token !== "string" || payload.access_token.length === 0) {
+		throw new Error("xAI token response did not include an access token");
+	}
+	const refresh =
+		typeof payload.refresh_token === "string" && payload.refresh_token.length > 0
+			? payload.refresh_token
+			: refreshFallback;
+	if (!refresh) {
+		throw new Error("xAI token response did not include a refresh token");
+	}
+	const expiresIn =
+		typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) ? payload.expires_in : 3600;
+	const idToken = typeof payload.id_token === "string" ? payload.id_token : undefined;
+	const { accountId, email } = getTokenIdentity(payload.access_token, idToken);
+	return {
+		refresh,
+		access: payload.access_token,
+		expires: Date.now() + expiresIn * 1000 - XAI_OAUTH_REFRESH_SKEW_MS,
+		accountId,
+		email,
+	};
+}
+
+export class XaiOAuthFlow extends OAuthCallbackFlow {
+	#verifier = "";
+	#discovery: XaiDiscovery | undefined;
+	#extraAuthorizeParams: Readonly<Record<string, string>>;
+
+	constructor(ctrl: OAuthController, options: XaiOAuthFlowOptions = {}) {
+		super(ctrl, {
+			preferredPort: XAI_OAUTH_CALLBACK_PORT,
+			callbackPath: XAI_OAUTH_CALLBACK_PATH,
+			callbackHostname: "127.0.0.1",
+			callbackBindHostname: "127.0.0.1",
+			redirectUri: `http://127.0.0.1:${XAI_OAUTH_CALLBACK_PORT}${XAI_OAUTH_CALLBACK_PATH}`,
+		} satisfies OAuthCallbackFlowOptions);
+		this.#extraAuthorizeParams = options.extraAuthorizeParams ?? {};
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		const pkce = await generatePKCE();
+		this.#verifier = pkce.verifier;
+		this.#discovery = await discoverXaiOAuthEndpoints(this.ctrl.signal);
+		const params = new URLSearchParams({
+			response_type: "code",
+			client_id: XAI_OAUTH_CLIENT_ID,
+			redirect_uri: redirectUri,
+			scope: XAI_OAUTH_SCOPE,
+			code_challenge: pkce.challenge,
+			code_challenge_method: "S256",
+			state,
+			nonce: crypto.randomUUID(),
+		});
+		addNonOverridingParams(params, this.#extraAuthorizeParams);
+		return {
+			url: `${this.#discovery.authorizationEndpoint}?${params.toString()}`,
+			instructions:
+				"Complete xAI/Grok login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
+		};
+	}
+
+	async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+		if (!this.#verifier) {
+			throw new Error("xAI OAuth PKCE verifier was not initialized");
+		}
+		const discovery = this.#discovery ?? (await discoverXaiOAuthEndpoints(this.ctrl.signal));
+		const tokenPayload = await postXaiToken(
+			discovery.tokenEndpoint,
+			{
+				grant_type: "authorization_code",
+				client_id: XAI_OAUTH_CLIENT_ID,
+				code,
+				redirect_uri: redirectUri,
+				code_verifier: this.#verifier,
+			},
+			this.ctrl.signal,
+		);
+		return credentialsFromTokenPayload(tokenPayload);
+	}
+}
+
+export async function loginXai(ctrl: OAuthController, options?: XaiOAuthFlowOptions): Promise<OAuthCredentials> {
+	return new XaiOAuthFlow(ctrl, options).login();
+}
+
+export async function refreshXaiToken(
+	refreshToken: string,
+	options?: AbortSignal | XaiOAuthRefreshOptions,
+): Promise<OAuthCredentials> {
+	if (!refreshToken) {
+		throw new Error("xAI credentials are expired and do not include a refresh token");
+	}
+	const { signal, extraTokenParams = {} } = resolveRefreshOptions(options);
+	const discovery = await discoverXaiOAuthEndpoints(signal);
+	const body = {
+		grant_type: "refresh_token",
+		client_id: XAI_OAUTH_CLIENT_ID,
+		refresh_token: refreshToken,
+	};
+	addNonOverridingParams(body, extraTokenParams);
+	const tokenPayload = await postXaiToken(discovery.tokenEndpoint, body, signal);
+	return credentialsFromTokenPayload(tokenPayload, refreshToken);
+}