decolua/9router · error

xai discovery ${field} is invalid: ${err.message}

Error message

xai discovery ${field} is invalid: ${err.message}

What it means

Thrown when a discovery URL field is non-empty but cannot be parsed by the URL constructor. The underlying URL parser message is embedded, e.g. 'Invalid URL'. This guarantees downstream code only works with structurally valid absolute URLs.

Source

Thrown at src/lib/oauth/services/xai.js:34

 *  2. Bind loopback server on 127.0.0.1:56121, path /callback
 *  3. PKCE S256 with 96-byte verifier
 *  4. Exchange code with form-urlencoded body
 *  5. id_token email decode (no signature verify, mirrors Go)
 */

const BASE64_BLOCK_SIZE = 4;

let cachedDiscovery = null;

export function validateOAuthEndpoint(rawUrl, field) {
  const value = String(rawUrl || "").trim();
  if (!value) throw new Error(`xai discovery ${field} is empty`);

  let parsed;
  try {
    parsed = new URL(value);
  } catch (err) {
    throw new Error(`xai discovery ${field} is invalid: ${err.message}`);
  }

  if (parsed.protocol !== "https:") {
    throw new Error(`xai discovery ${field} must use https: ${value}`);
  }

  const host = parsed.hostname.toLowerCase().trim();
  if (host !== "x.ai" && !host.endsWith(".x.ai")) {
    throw new Error(`xai discovery ${field} host ${host} is not on x.ai`);
  }

  return value;
}

/**
 * Discover authorization + token endpoints. Cached process-wide.
 */
export async function discoverEndpoints() {

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Read the embedded err.message and the field name to locate the malformed value.
2. Ensure the value is a full absolute URL including https:// scheme.
3. Trim whitespace/newlines copied into env or config values.
4. Run new URL(value) yourself in a REPL to reproduce the parser complaint before fixing.

Example fix

// before
XAI_TOKEN_URL=/api/oauth/token
// after
XAI_TOKEN_URL=https://x.ai/api/oauth/token

function isParsableUrl(u) {
  try { new URL(String(u || '').trim()); return true; } catch { return false; }
}
if (!isParsableUrl(cfg.tokenUrl)) throw new Error(`xAI tokenUrl not a valid absolute URL: ${cfg.tokenUrl}`);

function isValidUrl(u) {
  if (typeof u !== 'string') return false;
  try { new URL(u.trim()); return true; } catch { return false; }
}

When it happens

Trigger: Field contains a relative path ('/oauth/token'), a placeholder ('your-auth-url-here'), or a malformed string (missing scheme, stray spaces mid-URL, typo like 'https//x.ai').

Common situations: Hand-edited env values with typos; copy-pasting URLs with trailing control characters; template placeholders left un-substituted in config files.

Related errors

• Missing xAI authorization code
• xai discovery ${field} is empty
• xai discovery ${field} must use https: ${value}
• xai discovery ${field} host ${host} is not on x.ai
• Missing Zed callback URL

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/8ff5081dfdc2afe2. Report an issue: GitHub.