pullfrog 0.1.65 → 0.1.67

package/dist/utils/xaiOAuth.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Pure-stdlib (fetch) xAI/Grok OAuth: device-code login + refresh.
+ *
+ * Lives here (not in a CLI module) so the Next.js server side can import it
+ * via pullfrog/internal without dragging in node:child_process. Used by:
+ *   - action/commands/auth.ts   (`pullfrog auth grok` device-code login)
+ *   - action/utils/codexHome.ts (materialize into opencode's auth.json)
+ *   - utils/xaiSecretRotation.ts (server-side rotation at run-context)
+ *
+ * We talk to xAI's OAuth endpoints directly rather than shelling out to the
+ * Grok CLI the way `auth codex` shells out to `codex login`. The Grok CLI is
+ * a curl|bash install that nothing else in the flow needs, and the device
+ * grant is ~60 lines of fetch — requiring a second CLI to obtain a
+ * credential opencode consumes natively would be gratuitous.
+ *
+ * See wiki/grok-auth.md.
+ */
+export interface XaiAuthBody {
+    auth_mode: "grok";
+    tokens: {
+        access_token: string;
+        refresh_token: string;
+    };
+    last_refresh?: string;
+    /**
+     * ISO timestamp of an `invalid_grant` rejection. xAI rotates the refresh
+     * token on every use, so a rejection is PERMANENT until the user re-runs
+     * `pullfrog auth grok`. Without the latch the server re-issues the same
+     * doomed refresh on every run, each holding a Postgres row lock across an
+     * external call — the failure mode measured for Codex in
+     * [#1101](https://github.com/pullfrog/app/issues/1101). Cleared implicitly:
+     * `pullfrog auth grok` and `PUT /api/runtime/secret` write a fresh blob
+     * without it, which re-arms rotation.
+     */
+    refresh_rejected_at?: string;
+}
+/** Public Grok-CLI OAuth client. Identical to the `oidc_client_id` the Grok
+ * CLI writes into its own `~/.grok/auth.json` and to opencode's XaiAuthPlugin
+ * CLIENT_ID — one chain, so a token minted here refreshes anywhere. */
+export declare const XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+export declare const XAI_OAUTH_TOKEN_URL = "https://auth.x.ai/oauth2/token";
+export declare const XAI_DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code";
+export declare const XAI_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/** `api:access` is the scope that lets the subscription token authorize
+ * api.x.ai — without it the credential logs in but cannot infer. */
+export declare const XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+/** force one refresh round-trip against xAI. returns the rotated blob; does
+ * NOT persist — the caller writes it back wherever the token lives.
+ *
+ * The 10s timeout matters server-side: `maybeRotateXaiSecret` holds a DB row
+ * lock across this call, so the cap keeps us inside the enclosing transaction
+ * budget and guarantees queued callers get a turn. Real latency is sub-second. */
+export declare function refreshXaiAuthBody(body: XaiAuthBody): Promise<XaiAuthBody>;
+/** parse + validate a stored Grok blob. returns null on any shape mismatch —
+ * caller treats null as "no grok auth". */
+export declare function parseXaiAuthBody(raw: string): XaiAuthBody | null;
+/** serialize to the canonical stored form. */
+export declare function stringifyXaiAuthBody(body: XaiAuthBody): string;
+export interface XaiDeviceCode {
+    deviceCode: string;
+    userCode: string;
+    /** pre-filled URL when xAI supplies one, else the bare verification URL. */
+    verificationUrl: string;
+    intervalMs: number;
+    expiresAtMs: number;
+}
+/** RFC 8628 step 1: ask xAI for a device code. The user approves in a browser
+ * on any device — no loopback callback server, so this works unchanged from a
+ * container, an SSH session, or a locked-down workstation. */
+export declare function startXaiDeviceAuth(): Promise<XaiDeviceCode>;
+/** RFC 8628 step 2: long-poll the token endpoint until the user approves.
+ * Honors the spec's `authorization_pending` / `slow_down` back-off. Resolves
+ * with the minted chain, or throws on denial / expiry. */
+export declare function pollXaiDeviceAuth(device: XaiDeviceCode): Promise<XaiAuthBody>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",