pullfrog 0.1.65 → 0.1.66

package/dist/internal/index.d.ts

@@ -22,3 +22,5 @@ export { createLeapingProgressComment, deleteProgressCommentApi, getProgressComm
 export type { RunStatusCheckConclusion, RunStatusCheckOctokit, } from "../utils/runStatusCheck.ts";
 export { APPROVAL_CHECK_NAME, createRunStatusCheck, finalizeRunStatusCheck, RUN_STATUS_CHECK_NAME, runStatusCheckNeedsFinalizing, } from "../utils/runStatusCheck.ts";
 export { isValidTimeString, parseTimeString, TIMEOUT_DISABLED, } from "../utils/time.ts";
+export type { XaiAuthBody } from "../utils/xaiOAuth.ts";
+export { parseXaiAuthBody, refreshXaiAuthBody, stringifyXaiAuthBody, } from "../utils/xaiOAuth.ts";

package/dist/internal.js

@@ -221,6 +221,11 @@ var providers = {
   xai: provider({
     displayName: "xAI",
     envVars: ["XAI_API_KEY"],
+    // CLI-only, like CODEX_AUTH_JSON: a Grok subscription chain minted by
+    // `pullfrog auth grok`. Excluded from every paste/prompt surface because
+    // the refresh token rotates on every use, so a hand-pasted blob is stale
+    // the moment it is saved. See wiki/grok-auth.md.
+    managedCredentials: ["GROK_AUTH_JSON"],
     models: {
       grok: {
         displayName: "Grok",
@@ -464,7 +469,13 @@ var providers = {
       },
       "kimi-k2": {
         displayName: "Kimi K2",
-        resolve: "opencode/kimi-k2.7-code",
+        // k2.7-code is UNDEPLOYED on Zen — still listed in /zen/v1/models, but
+        // the endpoint answers 400 `[NOT_FOUND] Model not found, inaccessible,
+        // and/or not deployed` (measured 2026-08-28; k2.6 200 on the same key).
+        // opencode-go is no escape: its own kimi-k2 resolves to the SAME model
+        // id. k2.6 is the newest build Zen will actually serve, and the mirror
+        // guard permits the step down because k2.7-code is in ZEN_UNDEPLOYED.
+        resolve: "opencode/kimi-k2.6",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
       },
       // slug pins the m2 line for DB stability; resolve tracks the current m2.7.
@@ -1541,17 +1552,48 @@ function stripExistingFooter(body) {
   return body.substring(0, dividerIndex).trimEnd();
 }
 
-// utils/codexOAuth.ts
-var CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-var CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
+// utils/oauthShared.ts
 var OAuthInvalidGrantError = class extends Error {
   status;
-  constructor(status, body) {
-    super(`Codex token refresh failed: ${status} ${body}`);
+  /** whether the provider said this refresh chain is permanently unusable, so
+   * the rotation core may latch it out of use until the user re-mints. */
+  chainIsDead;
+  constructor(provider2, status, body, chainIsDead) {
+    super(`${provider2} token refresh failed: ${status} ${body}`);
     this.name = "OAuthInvalidGrantError";
     this.status = status;
+    this.chainIsDead = chainIsDead;
   }
 };
+function parseOAuthErrorBody(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed && typeof parsed === "object") return parsed;
+  } catch {
+  }
+  return null;
+}
+function decodeJwtExpMs(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) return null;
+  return payload.exp * 1e3;
+}
+
+// utils/codexOAuth.ts
+var CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+var CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
+function codexChainIsDead(body) {
+  const err = parseOAuthErrorBody(body)?.error;
+  if (!err || typeof err !== "object") return false;
+  return "code" in err && err.code === "token_expired";
+}
 async function refreshCodexAuthBody(body) {
   const response = await fetch(CODEX_OAUTH_TOKEN_URL, {
     method: "POST",
@@ -1566,7 +1608,7 @@ async function refreshCodexAuthBody(body) {
   if (!response.ok) {
     const text = await response.text().catch(() => "");
     if (response.status >= 400 && response.status < 500) {
-      throw new OAuthInvalidGrantError(response.status, text);
+      throw new OAuthInvalidGrantError("Codex", response.status, text, codexChainIsDead(text));
     }
     throw new Error(`Codex token refresh failed: ${response.status} ${text}`);
   }
@@ -1584,18 +1626,6 @@ async function refreshCodexAuthBody(body) {
     last_refresh: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-function decodeJwtExpMs(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  let payload;
-  try {
-    payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-  } catch {
-    return null;
-  }
-  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) return null;
-  return payload.exp * 1e3;
-}
 function parseCodexAuthBody(raw) {
   let parsed;
   try {
@@ -1869,7 +1899,12 @@ function disableCheckLine(owner, repo) {
   const url = `https://pullfrog.com/console/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}#auto-review-prs`;
   return `
 
-[Turn off this check \u2192](${url}) \u2014 it reports run status only and gates nothing unless you required it in branch protection.`;
+This check reports run status only and gates nothing unless you required it in branch protection. [Turn off the run status check \u2192](${url})`;
+}
+function logsLine(detailsUrl) {
+  return detailsUrl ? `
+
+[View the run logs \u2192](${detailsUrl})` : "";
 }
 var TERMINAL_OUTPUT = {
   success: {
@@ -1878,7 +1913,7 @@ var TERMINAL_OUTPUT = {
   },
   failure: {
     title: "Pullfrog run failed",
-    summary: "The Pullfrog run failed. See the run logs for details."
+    summary: "The Pullfrog run failed."
   },
   cancelled: {
     title: "Pullfrog run cancelled",
@@ -1886,11 +1921,11 @@ var TERMINAL_OUTPUT = {
   },
   timed_out: {
     title: "Pullfrog run timed out",
-    summary: "The Pullfrog run exceeded its timeout. See the run logs for details."
+    summary: "The Pullfrog run exceeded its timeout."
   },
   action_required: {
     title: "Pullfrog run needs attention",
-    summary: "The Pullfrog run stopped and needs attention. See the run logs for details."
+    summary: "The Pullfrog run stopped and needs attention."
   },
   neutral: {
     title: "Pullfrog run finished",
@@ -1906,8 +1941,11 @@ function terminalOutput(params) {
   const review = params.reviewUrl ? `
 
 [View the review Pullfrog posted \u2192](${params.reviewUrl})` : "";
-  const disable = params.conclusion === "success" ? "" : disableCheckLine(params.owner, params.repo);
-  return { title: base.title, summary: base.summary + review + disable };
+  if (params.conclusion === "success") return { title: base.title, summary: base.summary + review };
+  return {
+    title: base.title,
+    summary: base.summary + logsLine(params.detailsUrl) + review + disableCheckLine(params.owner, params.repo)
+  };
 }
 async function createRunStatusCheck(params) {
   const existing = await params.octokit.rest.checks.listForRef({
@@ -1944,6 +1982,7 @@ async function finalizeRunStatusCheck(params) {
       conclusion: params.conclusion,
       owner: params.owner,
       repo: params.repo,
+      detailsUrl: params.detailsUrl,
       reviewUrl: params.reviewUrl
     })
   };
@@ -1977,6 +2016,69 @@ function parseTimeString(input) {
 function isValidTimeString(input) {
   return parseTimeString(input) !== null;
 }
+
+// utils/xaiOAuth.ts
+var XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+var XAI_OAUTH_TOKEN_URL = "https://auth.x.ai/oauth2/token";
+function xaiChainIsDead(body) {
+  return parseOAuthErrorBody(body)?.error === "invalid_grant";
+}
+async function refreshXaiAuthBody(body) {
+  const response = await fetch(XAI_OAUTH_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: body.tokens.refresh_token,
+      client_id: XAI_OAUTH_CLIENT_ID
+    }).toString(),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    if (response.status >= 400 && response.status < 500) {
+      throw new OAuthInvalidGrantError("Grok", response.status, text, xaiChainIsDead(text));
+    }
+    throw new Error(`Grok token refresh failed: ${response.status} ${text}`);
+  }
+  const tokens = await response.json();
+  return {
+    auth_mode: "grok",
+    tokens: {
+      access_token: tokens.access_token,
+      // xAI rotates on every use, but tolerate a server that echoes nothing
+      // rather than writing an empty refresh token that bricks the chain.
+      refresh_token: tokens.refresh_token || body.tokens.refresh_token
+    },
+    last_refresh: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function parseXaiAuthBody(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const v = parsed;
+  if (v.auth_mode !== "grok") return null;
+  const tokens = v.tokens;
+  if (!tokens || typeof tokens !== "object") return null;
+  const t = tokens;
+  if (typeof t.access_token !== "string" || t.access_token.length === 0) return null;
+  if (typeof t.refresh_token !== "string" || t.refresh_token.length === 0) return null;
+  return {
+    auth_mode: "grok",
+    ...typeof v.refresh_rejected_at === "string" ? { refresh_rejected_at: v.refresh_rejected_at } : {},
+    tokens: { access_token: t.access_token, refresh_token: t.refresh_token },
+    ...typeof v.last_refresh === "string" ? { last_refresh: v.last_refresh } : {}
+  };
+}
+function stringifyXaiAuthBody(body) {
+  return `${JSON.stringify(body, null, 2)}
+`;
+}
 export {
   APPROVAL_CHECK_NAME,
   AUTO_EFFICIENT,
@@ -2024,9 +2126,11 @@ export {
   parseEffortPosition,
   parseModel,
   parseTimeString,
+  parseXaiAuthBody,
   providers,
   pullfrogMcpName,
   refreshCodexAuthBody,
+  refreshXaiAuthBody,
   resolveAutoTier,
   resolveCliModel,
   resolveDisplayAlias,
@@ -2038,6 +2142,7 @@ export {
   rungLabel,
   rungPosition,
   stringifyCodexAuthBody,
+  stringifyXaiAuthBody,
   stripExistingFooter,
   truncateAtLineBoundary,
   updateProgressComment,

package/dist/utils/codexHome.d.ts

@@ -33,6 +33,27 @@ export interface InstalledCodexAuth {
  * `process.env.XDG_DATA_HOME` so every opencode subprocess discovers the
  * auth.json; no refresh, no DB interaction. */
 export declare function installCodexAuth(): InstalledCodexAuth | null;
+export interface InstalledXaiAuth {
+    /** absolute path of the auth.json we wrote — the post-hook diffs it. */
+    authPath: string;
+    /** value to set as XDG_DATA_HOME for the OpenCode subprocess. */
+    xdgDataHome: string;
+    /** refresh_token at materialization time. opencode's XaiAuthPlugin rotates
+     * in-process on a long run, so the post-hook compares against this to decide
+     * whether anything needs writing back. */
+    originalRefresh: string;
+}
+/** materialize GROK_AUTH_JSON from env into opencode's auth.json.
+ *
+ * opencode ships xAI Grok OAuth natively (`XaiAuthPlugin`, added upstream
+ * 2026-05-21, present in our pinned 1.18.5) against the same public
+ * Grok-CLI OAuth client we mint with, so the stored chain drops straight in.
+ * The plugin sends the token to `api.x.ai/v1` — it deliberately sets no
+ * baseURL — so there is no CLI proxy and no client-version header in play.
+ *
+ * returns null when the env var is absent or malformed; caller treats null as
+ * "no grok subscription auth, fall through to XAI_API_KEY". */
+export declare function installXaiAuth(): InstalledXaiAuth | null;
 export interface InstalledCodexHome {
     /** value to set as CODEX_HOME for the codex subprocess. holds auth.json,
      * config.toml and the session rollouts the resume path reads. */

package/dist/utils/codexOAuth.d.ts

@@ -1,5 +1,5 @@
 /**
- * Pure-stdlib (fetch + Buffer) Codex OAuth refresh + JWT exp decoding.
+ * Pure-stdlib (fetch) Codex OAuth refresh.
  *
  * Lives here (not in codexAuth.ts) so the Next.js server side can import it
  * via pullfrog/internal without dragging in node:child_process / spawn /
@@ -9,6 +9,8 @@
  *
  * See wiki/codex-auth.md for the end-to-end refresh lifecycle.
  */
+import { decodeJwtExpMs, OAuthInvalidGrantError } from "./oauthShared.ts";
+export { decodeJwtExpMs, OAuthInvalidGrantError };
 export interface CodexAuthBody {
     auth_mode: "chatgpt";
     tokens: {
@@ -19,8 +21,10 @@ export interface CodexAuthBody {
     };
     last_refresh?: string;
     /**
-     * ISO timestamp of an `invalid_grant` rejection. OpenAI rotates the refresh
-     * token on every use, so a rejection is PERMANENT — without a latch the
+     * ISO timestamp of a rejection OpenAI attributed to the token itself
+     * (`error.code: "token_expired"` — it does not emit RFC 6749's
+     * `invalid_grant` here). OpenAI rotates the refresh
+     * token on every use, so such a rejection is PERMANENT — without a latch the
      * server re-issued the identical doomed refresh on every run (455 futile
      * round trips in 7 days, one per run, each holding a Postgres row lock across
      * a 10s external call). Cleared implicitly: `pullfrog auth codex` and
@@ -35,13 +39,6 @@ export interface CodexAuthBody {
  * refreshed against this client_id. */
 export declare const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export declare const CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
-/** thrown when the OAuth provider rejects the refresh token (4xx). callers
- * can distinguish "race-lost / token revoked" from network errors via
- * `instanceof OAuthInvalidGrantError`. */
-export declare class OAuthInvalidGrantError extends Error {
-    readonly status: number;
-    constructor(status: number, body: string);
-}
 /** force one refresh round-trip against the OAuth provider. returns the
  * rotated Codex-shaped blob (the auth.json body verbatim). does NOT persist
  * — caller is responsible for writing back to wherever the token lives.
@@ -54,16 +51,6 @@ export declare class OAuthInvalidGrantError extends Error {
  * always releases and queued callers get a turn instead of timing out on
  * the tx wrapper. Real OAuth latency is sub-second; 10s is generous. */
 export declare function refreshCodexAuthBody(body: CodexAuthBody): Promise<CodexAuthBody>;
-/** decode the access_token's JWT payload and return its `exp` claim in ms
- * since epoch. returns null if the token isn't a parseable JWT or has no
- * `exp` claim — caller falls back to "treat as expired".
- *
- * We don't verify the JWT signature (we'd need OpenAI's JWKS); we're only
- * using the claim as a freshness hint. The actual auth check happens
- * server-side at OpenAI when the token is used — trusting a fake JWT here
- * would just delay the inevitable 401 from OpenAI. No security boundary
- * at this decode step. */
-export declare function decodeJwtExpMs(token: string): number | null;
 /** parse + validate a Codex auth.json body from its JSON-string form.
  * returns null on any shape mismatch — caller treats as "no codex auth". */
 export declare function parseCodexAuthBody(raw: string): CodexAuthBody | null;

package/dist/utils/codexRefreshDetect.d.ts

@@ -0,0 +1,44 @@
+/** One provider's post-run writeback plan, handed from the opencode harness to
+ * `entryPost.ts` via `core.saveState`. Type-only across that boundary, so it
+ * does not violate entryPost's stdlib-only import rule. */
+export interface OAuthWriteback {
+    /** Pullfrog secret to PUT the rotated chain back into. */
+    secretName: "CODEX_AUTH_JSON" | "GROK_AUTH_JSON";
+    /** opencode auth.json provider key this chain lives under. */
+    provider: "openai" | "xai";
+    authPath: string;
+    originalRefresh: string;
+    /** codex only — opencode's auth entry has no slot for it. see below. */
+    originalIdToken?: string | undefined;
+}
+/** Detect a mid-run Codex OAuth rotation from an on-disk auth.json and render
+ * it in the Codex CLI shape the Pullfrog secret store holds. Returns null when
+ * the file carries no usable OAuth entry or the refresh token is unchanged from
+ * `originalRefresh`. Lives in its own module so `entryPost.ts` can import it
+ * without pulling in `codexHome.ts` (which imports `./cli.ts` and node fs
+ * helpers).
+ *
+ * Two on-disk shapes reach here, one per harness:
+ *   - codex CLI  — `{auth_mode, tokens: {id_token, access_token, refresh_token}}`,
+ *     already the storage shape, so it round-trips verbatim.
+ *   - opencode   — `{openai: {type: "oauth", access, refresh, accountId}}`, which
+ *     has no slot for `id_token`. The caller passes the pre-run value through
+ *     `originalIdToken` so the rotated blob keeps it: the codex CLI REFUSES an
+ *     auth.json without `tokens.id_token` (`missing field 'id_token'`), so
+ *     dropping it here would silently disqualify the account from ever running
+ *     on the codex harness. `id_token` is an identity claim that a refresh does
+ *     not rotate — the server-side `refreshCodexAuthBody` carries the old one
+ *     forward the same way. */
+export declare function detectCodexRefresh(params: {
+    authFileContent: string;
+    originalRefresh: string;
+    originalIdToken?: string | undefined;
+}): string | null;
+/** Detect a mid-run Grok OAuth rotation and render it in the storage shape.
+ * Simpler than the Codex twin: opencode's `xai` entry carries the whole chain,
+ * there is no second on-disk shape to reconcile and no identity claim to
+ * re-attach. Returns null when the entry is missing or unrotated. */
+export declare function detectXaiRefresh(params: {
+    authFileContent: string;
+    originalRefresh: string;
+}): string | null;

package/dist/utils/github.d.ts

@@ -42,6 +42,12 @@ export type GitHubAppPermissions = {
 };
 type AcquireTokenOptions = {
     repos?: string[] | undefined;
+    /**
+     * handle to the server-persisted cross-repo grant, required whenever `repos`
+     * names anything beyond the primary. the server bounds the request against
+     * the sets IT stored, so this cannot widen the token by itself.
+     */
+    xrepoGrant?: string | undefined;
     permissions?: GitHubAppPermissions;
     /**
      * stashed OIDC credentials for minting after restricted mode deletes

package/dist/utils/oauthShared.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Provider-agnostic OAuth primitives shared by the Codex and Grok chains.
+ * Pure stdlib (Buffer) so both the action runtime and the Next.js server can
+ * import it via pullfrog/internal.
+ *
+ * Both chains mint JWT access tokens whose `exp` we read as a freshness hint,
+ * and both rotate their refresh token on every use — so both need the same
+ * "the provider rejected this permanently" signal.
+ */
+/**
+ * Thrown when an OAuth provider rejects a refresh token (4xx).
+ *
+ * `chainIsDead` is decided by the CALLER, because the two providers we talk to
+ * disagree about how to say it and only the caller knows its own dialect:
+ * xAI answers RFC 6749 (`{"error":"invalid_grant"}`) while OpenAI nests an
+ * object and discriminates on `error.code` (`token_expired`). A rejection we
+ * cannot classify — a CDN error page in front of the token endpoint, say — is
+ * NOT dead: latching there would retire every customer's working credential
+ * over a transient edge event.
+ */
+export declare class OAuthInvalidGrantError extends Error {
+    readonly status: number;
+    /** whether the provider said this refresh chain is permanently unusable, so
+     * the rotation core may latch it out of use until the user re-mints. */
+    readonly chainIsDead: boolean;
+    constructor(provider: string, status: number, body: string, chainIsDead: boolean);
+}
+/** parse a token-endpoint error body, or null when it is not a JSON object.
+ * Each provider's refresh reads its own discriminator out of the result. */
+export declare function parseOAuthErrorBody(body: string): Record<string, unknown> | null;
+/** decode a JWT payload's `exp` claim and return it in ms since epoch.
+ * returns null if the token isn't a parseable JWT or has no `exp` claim —
+ * caller falls back to "treat as expired".
+ *
+ * We don't verify the signature (we'd need the issuer's JWKS); we're only
+ * using the claim as a freshness hint. The real auth check happens at the
+ * provider when the token is used, so trusting a forged JWT here would just
+ * delay the inevitable 401. No security boundary at this decode step. */
+export declare function decodeJwtExpMs(token: string): number | null;

package/dist/utils/payload.d.ts

@@ -19,6 +19,7 @@ export declare const JsonPayload: import("arktype/internal/variants/object.ts").
         write: string[];
         unavailable?: string[];
     } | undefined;
+    xrepoGrant?: string | undefined;
     timeout?: string | undefined;
     progressComment?: {
         id: string;
@@ -66,6 +67,7 @@ export declare function resolvePayload(resolvedPromptInput: ResolvedPromptInput,
         write: string[];
         unavailable?: string[];
     } | undefined;
+    xrepoGrant: string | undefined;
     timeout: string | undefined;
     cwd: string | undefined;
     progressComment: {

package/dist/utils/token.d.ts

@@ -29,6 +29,12 @@ type ResolveTokensParams = {
     push: PushPermission;
     authorPermission: AuthorPermission | undefined;
     xrepo?: XrepoConfig | undefined;
+    /**
+     * handle to the cross-repo grant the server persisted for this run. required
+     * alongside `xrepo`: the mint endpoint refuses a `repos` list without one,
+     * because the runner's list is attacker-controlled on a manual dispatch.
+     */
+    xrepoGrant?: string | undefined;
     /**
      * OIDC credentials stashed by main.ts before the restricted-mode env wipe —
      * the mid-run MCP token refresh mints from this snapshot (#891). null when

package/dist/utils/xaiOAuth.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Pure-stdlib (fetch) xAI/Grok OAuth: device-code login + refresh.
+ *
+ * Lives here (not in a CLI module) so the Next.js server side can import it
+ * via pullfrog/internal without dragging in node:child_process. Used by:
+ *   - action/commands/auth.ts   (`pullfrog auth grok` device-code login)
+ *   - action/utils/codexHome.ts (materialize into opencode's auth.json)
+ *   - utils/xaiSecretRotation.ts (server-side rotation at run-context)
+ *
+ * We talk to xAI's OAuth endpoints directly rather than shelling out to the
+ * Grok CLI the way `auth codex` shells out to `codex login`. The Grok CLI is
+ * a curl|bash install that nothing else in the flow needs, and the device
+ * grant is ~60 lines of fetch — requiring a second CLI to obtain a
+ * credential opencode consumes natively would be gratuitous.
+ *
+ * See wiki/grok-auth.md.
+ */
+export interface XaiAuthBody {
+    auth_mode: "grok";
+    tokens: {
+        access_token: string;
+        refresh_token: string;
+    };
+    last_refresh?: string;
+    /**
+     * ISO timestamp of an `invalid_grant` rejection. xAI rotates the refresh
+     * token on every use, so a rejection is PERMANENT until the user re-runs
+     * `pullfrog auth grok`. Without the latch the server re-issues the same
+     * doomed refresh on every run, each holding a Postgres row lock across an
+     * external call — the failure mode measured for Codex in
+     * [#1101](https://github.com/pullfrog/app/issues/1101). Cleared implicitly:
+     * `pullfrog auth grok` and `PUT /api/runtime/secret` write a fresh blob
+     * without it, which re-arms rotation.
+     */
+    refresh_rejected_at?: string;
+}
+/** Public Grok-CLI OAuth client. Identical to the `oidc_client_id` the Grok
+ * CLI writes into its own `~/.grok/auth.json` and to opencode's XaiAuthPlugin
+ * CLIENT_ID — one chain, so a token minted here refreshes anywhere. */
+export declare const XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+export declare const XAI_OAUTH_TOKEN_URL = "https://auth.x.ai/oauth2/token";
+export declare const XAI_DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code";
+export declare const XAI_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/** `api:access` is the scope that lets the subscription token authorize
+ * api.x.ai — without it the credential logs in but cannot infer. */
+export declare const XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+/** force one refresh round-trip against xAI. returns the rotated blob; does
+ * NOT persist — the caller writes it back wherever the token lives.
+ *
+ * The 10s timeout matters server-side: `maybeRotateXaiSecret` holds a DB row
+ * lock across this call, so the cap keeps us inside the enclosing transaction
+ * budget and guarantees queued callers get a turn. Real latency is sub-second. */
+export declare function refreshXaiAuthBody(body: XaiAuthBody): Promise<XaiAuthBody>;
+/** parse + validate a stored Grok blob. returns null on any shape mismatch —
+ * caller treats null as "no grok auth". */
+export declare function parseXaiAuthBody(raw: string): XaiAuthBody | null;
+/** serialize to the canonical stored form. */
+export declare function stringifyXaiAuthBody(body: XaiAuthBody): string;
+export interface XaiDeviceCode {
+    deviceCode: string;
+    userCode: string;
+    /** pre-filled URL when xAI supplies one, else the bare verification URL. */
+    verificationUrl: string;
+    intervalMs: number;
+    expiresAtMs: number;
+}
+/** RFC 8628 step 1: ask xAI for a device code. The user approves in a browser
+ * on any device — no loopback callback server, so this works unchanged from a
+ * container, an SSH session, or a locked-down workstation. */
+export declare function startXaiDeviceAuth(): Promise<XaiDeviceCode>;
+/** RFC 8628 step 2: long-poll the token endpoint until the user approves.
+ * Honors the spec's `authorization_pending` / `slow_down` back-off. Resolves
+ * with the minted chain, or throws on denial / expiry. */
+export declare function pollXaiDeviceAuth(device: XaiDeviceCode): Promise<XaiAuthBody>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.65",
+  "version": "0.1.66",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",