[@corbits/xai-provider] publish-prep: semver deps + dist build

.gitignore

@@ -1,4 +1,5 @@
 node_modules/
+dist/
 .corbits/
 .DS_Store
 .env

.prettierignore

@@ -1,2 +1,3 @@
 node_modules
+dist
 bun.lock

AGENTS.md

@@ -16,7 +16,7 @@ reimplementing OAuth or the Responses wire protocol.
 
 ## Rules
 
-- Consume `@intx/*` (peer dependency) and the two `@corbits/*` dependencies (`github:` specifiers) as packages only — never vendor or fork them.
+- Consume `@intx/*` and the two `@corbits/*` packages (all peer dependencies) as packages only — never vendor or fork them.
 - Parse every trust boundary with arktype (JWT payload); never `as T` untrusted input.
 - `exactOptionalPropertyTypes` is on: omit optional keys, never assign `undefined` to them.
 - No product strings baked in; the x-grok-\* headers and user-agent are xAI wire requirements, not branding.
@@ -31,15 +31,23 @@ bun install
 bun run check    # typecheck + lint + format:check + test
 ```
 
-`@corbits/oauth-core` and `@corbits/openai-responses` resolve from their
-GitHub repos, so `bun install` needs those repos pushed. To work against an
-unpushed local checkout of either, `bun link` it here; a later `bun install`
-re-resolves from git and drops the link.
+`@corbits/oauth-core` and `@corbits/openai-responses` are peer dependencies
+(`^0.1.0`) — the host provides them. `devDependencies` mirrors the same
+`^0.1.0` npm ranges so installs are git-free. The siblings are still
+unpublished, so local `bun run check` verification temporarily swaps in
+`file:` stand-ins and reverts before commit — never commit stand-in paths or
+the lockfile churn they cause. To work against an unpushed local checkout of
+either, `bun link` it here.
 
 ## Distribution
 
-The package ships TypeScript source: `exports` points at `src/index.ts`,
-there is no build step and no `dist/`. Consumers install it with
-`bun add @corbits/xai-provider` and Bun runs the source as-is. `bun.lock`
-is committed; the two `@corbits/*` dependencies still resolve from their
-GitHub repos and switch to npm version ranges at publish time.
+The package ships compiled output: `bun run build` (`tsc -p
+tsconfig.build.json`, NodeNext, no sourcemaps) emits `dist/` (JS +
+declarations, tests excluded), and `prepack` rebuilds `dist/` on every pack.
+`exports` maps `.` to `dist` via the types/default pair (`main` agrees), so
+both Bun >= 1.2 and native Node >= 24 load the compiled output — no
+source-consumption condition. Only `dist` ships (`files` is dist-only). The
+two `@corbits/*` peers resolve from npm (`^0.1.0`), so installs are git-free.
+Relative imports in `src/` carry explicit `.js` suffixes so the emitted ESM
+runs under Node without a rewrite step — never add a build-time rewrite
+script or a bundler.

README.md

@@ -4,7 +4,7 @@ xAI Grok PKCE OAuth config and token mapping to slot into `@corbits/oauth-core`'
 
 ## Runtime support
 
-Bun >= 1.2 runs the published TypeScript source. Node >= 24 is an engines floor for tooling; native Node does not load this extensionless TypeScript source as-is. `@intx/inference` and `@intx/types` are peer dependencies and must resolve to the host's own copy.
+The published tarball ships compiled `dist/` (ESM + declarations), so both Bun >= 1.2 and Node >= 24 run it. `@intx/inference` and `@intx/types` are peer dependencies and must resolve to the host's own copy.
 
 ## Quickstart
 

package.json

@@ -6,36 +6,44 @@
   "author": "Sawyer Cutler <sawyer@dirtroad.dev>",
   "type": "module",
   "sideEffects": false,
+  "types": "./dist/index.d.ts",
+  "main": "./dist/index.js",
   "files": [
-    "src",
-    "!src/**/*.test.ts",
+    "dist",
     "README.md",
     "LICENSE"
   ],
   "publishConfig": {
     "access": "public"
   },
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
+    "build": "tsc -p tsconfig.build.json",
+    "prepack": "bun run build",
     "lint": "eslint .",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "test": "bun test",
     "check": "bun run typecheck && bun run lint && bun run format:check && bun run test"
   },
   "dependencies": {
-    "@corbits/oauth-core": "github:corbitsdev/corbits-oauth-core#3028f8604155eee63f5a1711f0d4022d7984e3f7",
-    "@corbits/openai-responses": "github:corbitsdev/corbits-openai-responses",
-    "arktype": "2.2.3"
+    "arktype": "^2.2.3"
   },
   "peerDependencies": {
+    "@corbits/oauth-core": "^0.1.0",
+    "@corbits/openai-responses": "^0.1.0",
     "@intx/inference": ">=0.4.0",
     "@intx/types": ">=0.4.0"
   },
   "devDependencies": {
+    "@corbits/oauth-core": "^0.1.0",
+    "@corbits/openai-responses": "^0.1.0",
     "@eslint/js": "9.34.0",
     "@intx/inference": "0.4.0",
     "@intx/types": "0.4.0",

src/index.ts

@@ -1,4 +1,4 @@
-export * from "./constants";
+export * from "./constants.js";
 
 export {
   xaiOAuthConfig,
@@ -7,9 +7,9 @@ export {
   refreshXaiTokens,
   xaiUserIdFromAccessToken,
   type XaiTokens,
-} from "./oauth";
+} from "./oauth.js";
 
 export {
   createXaiResponsesAdapter,
   xaiResponsesQuirks,
-} from "./responses-adapter";
+} from "./responses-adapter.js";

src/oauth.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { xaiUserIdFromAccessToken } from "./index";
+import { xaiUserIdFromAccessToken } from "./index.js";
 
 function jwtWithPayload(payload: unknown): string {
   const header = Buffer.from(JSON.stringify({ alg: "none" })).toString(

src/oauth.ts

@@ -15,7 +15,7 @@ import {
   XAI_SCOPES,
   XAI_TOKEN_TIMEOUT_MS,
   XAI_TOKEN_URL,
-} from "./constants";
+} from "./constants.js";
 
 /** Tokens issued by xAI's OAuth server: the shared base shape plus an `idToken`. */
 export type XaiTokens = BaseTokens & { idToken?: string };

src/responses-adapter.test.ts

@@ -2,7 +2,7 @@ import { BEARER_CREDENTIAL_SENTINEL } from "@intx/inference";
 import type { ConversationTurn, LastCycleSource } from "@intx/types/runtime";
 import { type } from "arktype";
 import { describe, expect, test } from "bun:test";
-import { createXaiResponsesAdapter } from "./index";
+import { createXaiResponsesAdapter } from "./index.js";
 
 // Pinned literally rather than imported: neither the CLI-proxy path nor the
 // client-identification header values are on the package's public surface,

src/responses-adapter.ts

@@ -11,7 +11,7 @@ import {
   XAI_SESSION_ID_OPTION,
   XAI_USER_AGENT,
   XAI_USER_ID_OPTION,
-} from "./constants";
+} from "./constants.js";
 
 // Mirrors the grok CLI's own /v1/responses request (captured live): the
 // system prompt rides as a leading `system` input message with plain string

tsconfig.build.json

@@ -0,0 +1,17 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "allowImportingTsExtensions": false,
+    "composite": false,
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "noEmit": false,
+    "declaration": true,
+    "declarationMap": false,
+    "sourceMap": false,
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"],
+  "exclude": ["src/**/*.test.ts"]
+}