@rynfar/meridian 1.71.1 → 1.73.0

package/dist/{cli-khhjyk04.js → cli-chsp880k.js}

@@ -1,3 +1,8 @@
+import {
+  envBool,
+  init_env
+} from "./cli-1jstkdj9.js";
+
 // src/proxy/tokenRefresh.ts
 import { execFile as execFileCb } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -68,6 +73,141 @@ var claudeLog = (event, extra) => {
   console.debug(`[opencode-claude-code-provider] ${JSON.stringify(payload)}`);
 };
 
+// src/proxy/credentialsMode.ts
+init_env();
+function isCredentialsReadOnly() {
+  return envBool("CREDENTIALS_READONLY");
+}
+function refuseCredentialWrite(operation, target) {
+  console.error(`[PROXY] REFUSED credential write (${operation} → ${target}): ` + `MERIDIAN_CREDENTIALS_READONLY is set, so this instance must not modify credentials. ` + `If this is unexpected, the calling code path is missing a read-only guard.`);
+  return false;
+}
+var bannerLogged = false;
+function logCredentialsModeBanner() {
+  if (bannerLogged || !isCredentialsReadOnly())
+    return;
+  bannerLogged = true;
+  console.warn(`[PROXY] CREDENTIALS READ-ONLY MODE (MERIDIAN_CREDENTIALS_READONLY): ` + `this instance will not refresh or write OAuth credentials. ` + `Token rotation is another instance's job; credentials are re-read from disk.`);
+}
+
+// src/proxy/authDiscovery.ts
+var SAFE_AUTH_STRING_KEYS = new Set([
+  "token_type",
+  "expires_at",
+  "expires_in",
+  "refresh_token_expires_at",
+  "refresh_token_expires_in",
+  "scope",
+  "scopes",
+  "organization_type",
+  "rate_limit_tier",
+  "billing_type",
+  "subscriptionType",
+  "rateLimitTier",
+  "seat_tier",
+  "seatTier"
+]);
+function describeValue(key, value) {
+  if (value === null || value === undefined)
+    return value;
+  if (typeof value === "string") {
+    return SAFE_AUTH_STRING_KEYS.has(key) ? value : `[string len=${value.length}]`;
+  }
+  if (typeof value === "number" || typeof value === "boolean")
+    return value;
+  if (Array.isArray(value))
+    return value.map((item) => describeValue(key, item));
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = describeValue(k, v);
+    }
+    return out;
+  }
+  return `[${typeof value}]`;
+}
+function describeAuthFields(payload) {
+  return describeValue("", payload);
+}
+function authFieldPaths(payload, prefix = "") {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload))
+    return [];
+  const paths = [];
+  for (const [key, value] of Object.entries(payload)) {
+    const path = prefix ? `${prefix}.${key}` : key;
+    paths.push(path);
+    paths.push(...authFieldPaths(value, path));
+  }
+  return paths;
+}
+
+// src/proxy/oauthPlan.ts
+var OAUTH_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+function subscriptionTypeFromOrganizationType(organizationType) {
+  switch (organizationType) {
+    case "claude_max":
+      return "max";
+    case "claude_pro":
+      return "pro";
+    case "claude_team":
+      return "team";
+    case "claude_enterprise":
+      return "enterprise";
+    default:
+      return;
+  }
+}
+function extractPlanFields(profile) {
+  const subscriptionType = subscriptionTypeFromOrganizationType(profile?.organization?.organization_type);
+  const rateLimitTier = profile?.organization?.rate_limit_tier;
+  const seatTier = profile?.organization?.seat_tier;
+  return {
+    ...subscriptionType ? { subscriptionType } : {},
+    ...rateLimitTier ? { rateLimitTier } : {},
+    ...seatTier ? { seatTier } : {}
+  };
+}
+function planFieldsMissing(fields) {
+  return !fields?.subscriptionType || !fields?.rateLimitTier && !fields?.seatTier;
+}
+async function fetchOAuthPlanFields(accessToken) {
+  let response;
+  try {
+    response = await fetch(OAUTH_PROFILE_URL, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+        "Cache-Control": "no-cache"
+      },
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch (err) {
+    claudeLog("auth.profile_request_failed", { error: String(err) });
+    console.warn(`[meridian] Could not read the account plan: ${err instanceof Error ? err.message : err}`);
+    return {};
+  }
+  if (!response.ok) {
+    claudeLog("auth.profile_bad_response", { status: response.status });
+    console.warn(`[meridian] Could not read the account plan (${response.status}).`);
+    return {};
+  }
+  let profile;
+  try {
+    profile = await response.json();
+  } catch (err) {
+    claudeLog("auth.profile_parse_failed", { error: String(err) });
+    console.warn(`[meridian] Account plan response was not valid JSON: ${err instanceof Error ? err.message : err}`);
+    return {};
+  }
+  const plan = extractPlanFields(profile);
+  claudeLog("auth.profile_discovered", {
+    fields: authFieldPaths(profile),
+    payload: describeAuthFields(profile),
+    plan
+  });
+  return plan;
+}
+
 // src/proxy/tokenRefresh.ts
 var execFile = promisify(execFileCb);
 var OAUTH_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
@@ -85,6 +225,17 @@ function configDirToKeychainService(claudeConfigDir) {
 function configDirToCredentialsFile(claudeConfigDir) {
   return join(resolve(claudeConfigDir), ".credentials.json");
 }
+function guardCredentialWrites(store) {
+  return {
+    ...store,
+    async write(credentials) {
+      if (isCredentialsReadOnly()) {
+        return refuseCredentialWrite("credential-store", store.refreshKey ?? "unknown-store");
+      }
+      return store.write(credentials);
+    }
+  };
+}
 function serializeCredentials(credentials) {
   return JSON.stringify(credentials);
 }
@@ -101,7 +252,7 @@ function parseKeychainValue(raw) {
 }
 var keychainWasHexByService = new Map;
 function buildMacosStore(serviceName) {
-  return {
+  return guardCredentialWrites({
     refreshKey: `keychain:${serviceName}`,
     async read() {
       try {
@@ -128,12 +279,12 @@ function buildMacosStore(serviceName) {
         return false;
       }
     }
-  };
+  });
 }
 var macosStore = buildMacosStore(KEYCHAIN_SERVICE);
 function buildFileStore(filePath) {
   const absPath = resolve(filePath);
-  return {
+  return guardCredentialWrites({
     refreshKey: `file:${absPath}`,
     async read() {
       try {
@@ -155,7 +306,7 @@ function buildFileStore(filePath) {
         return false;
       }
     }
-  };
+  });
 }
 var fileStore = buildFileStore(CREDENTIALS_FILE);
 function createPlatformCredentialStore(opts) {
@@ -170,10 +321,25 @@ function createPlatformCredentialStore(opts) {
 function credentialsFilePathForProfile(claudeConfigDir) {
   return claudeConfigDir ? configDirToCredentialsFile(claudeConfigDir) : CREDENTIALS_FILE;
 }
+async function readStoredCredentialPresence(store) {
+  let credentials;
+  try {
+    credentials = await store.read();
+  } catch {
+    return "unknown";
+  }
+  if (!credentials)
+    return "unknown";
+  const accessToken = credentials.claudeAiOauth?.accessToken;
+  return typeof accessToken === "string" && accessToken.length > 0 ? "present" : "absent";
+}
 var inflightRefreshByKey = new Map;
 var inflightRefreshByStore = new WeakMap;
 async function refreshOAuthToken(store) {
   const s = store ?? createPlatformCredentialStore();
+  if (isCredentialsReadOnly()) {
+    return refuseCredentialWrite("oauth-refresh", s.refreshKey ?? "unknown-store");
+  }
   const refreshKey = s.refreshKey;
   if (refreshKey) {
     const inflight2 = inflightRefreshByKey.get(refreshKey);
@@ -244,10 +410,18 @@ async function doRefresh(store) {
     expiresAt,
     ...refreshTokenExpiresAt ? { refreshTokenExpiresAt } : {}
   };
+  const backfilled = planFieldsMissing(credentials.claudeAiOauth) ? await fetchOAuthPlanFields(tokenData.access_token) : {};
+  if (backfilled.subscriptionType || backfilled.rateLimitTier) {
+    credentials.claudeAiOauth = { ...backfilled, ...credentials.claudeAiOauth };
+  }
   const written = await store.write(credentials);
   if (!written)
     return false;
-  claudeLog("token_refresh.success", { expiresAt, refreshTokenExpiresAt });
+  claudeLog("token_refresh.success", {
+    expiresAt,
+    refreshTokenExpiresAt,
+    backfilledPlan: Object.keys(backfilled)
+  });
   return true;
 }
 async function ensureFreshToken(store, bufferMs = 5 * 60 * 1000) {
@@ -258,6 +432,8 @@ async function ensureFreshToken(store, bufferMs = 5 * 60 * 1000) {
     return false;
   if (expiresAt - Date.now() > bufferMs)
     return true;
+  if (isCredentialsReadOnly())
+    return false;
   return refreshOAuthToken(s);
 }
 var DEFAULT_RENEWAL_WARN_DAYS = 3;
@@ -265,20 +441,20 @@ function resolveRenewalWarnDays(raw) {
   const parsed = raw ? Number(raw) : NaN;
   return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_RENEWAL_WARN_DAYS;
 }
-var RENEWAL_EXPIRY_TTL_MS = 5 * 60000;
-var renewalExpiryCache = new Map;
-var renewalExpiryInflight = new Map;
+var CREDENTIAL_FACTS_TTL_MS = 5 * 60000;
+var credentialFactsCache = new Map;
+var credentialFactsInflight = new Map;
 function resetAuthRenewalCache() {
-  renewalExpiryCache.clear();
-  renewalExpiryInflight.clear();
+  credentialFactsCache.clear();
+  credentialFactsInflight.clear();
 }
-async function readRefreshTokenExpiry(s) {
+async function readCredentialFacts(s) {
   const key = s.refreshKey;
   if (key) {
-    const cached = renewalExpiryCache.get(key);
-    if (cached && Date.now() - cached.at < RENEWAL_EXPIRY_TTL_MS)
+    const cached = credentialFactsCache.get(key);
+    if (cached && Date.now() - cached.at < CREDENTIAL_FACTS_TTL_MS)
       return cached.value;
-    const inflight = renewalExpiryInflight.get(key);
+    const inflight = credentialFactsInflight.get(key);
     if (inflight)
       return inflight;
   }
@@ -287,25 +463,40 @@ async function readRefreshTokenExpiry(s) {
     try {
       credentials = await s.read();
     } catch {
-      return;
+      return {};
     }
-    const value = credentials?.claudeAiOauth?.refreshTokenExpiresAt;
+    const oauth = credentials?.claudeAiOauth;
+    const value = {
+      refreshTokenExpiresAt: oauth?.refreshTokenExpiresAt,
+      subscriptionType: oauth?.subscriptionType,
+      rateLimitTier: oauth?.rateLimitTier,
+      seatTier: oauth?.seatTier
+    };
     if (key)
-      renewalExpiryCache.set(key, { value, at: Date.now() });
+      credentialFactsCache.set(key, { value, at: Date.now() });
     return value;
   })();
   if (!key)
     return read;
-  renewalExpiryInflight.set(key, read);
+  credentialFactsInflight.set(key, read);
   try {
     return await read;
   } finally {
-    renewalExpiryInflight.delete(key);
+    credentialFactsInflight.delete(key);
   }
 }
+async function getStoredPlanFields(store) {
+  const s = store ?? createPlatformCredentialStore();
+  const { subscriptionType, rateLimitTier, seatTier } = await readCredentialFacts(s);
+  return {
+    ...subscriptionType ? { subscriptionType } : {},
+    ...rateLimitTier ? { rateLimitTier } : {},
+    ...seatTier ? { seatTier } : {}
+  };
+}
 async function getAuthRenewalStatus(store, warnDays = DEFAULT_RENEWAL_WARN_DAYS) {
   const s = store ?? createPlatformCredentialStore();
-  const refreshTokenExpiresAt = await readRefreshTokenExpiry(s);
+  const { refreshTokenExpiresAt } = await readCredentialFacts(s);
   if (!refreshTokenExpiresAt)
     return { renewalRequiredSoon: false };
   const msRemaining = refreshTokenExpiresAt - Date.now();
@@ -320,6 +511,8 @@ var scheduledRefreshTimer = null;
 var scheduledRefreshActive = false;
 var scheduledRefreshGeneration = 0;
 function startBackgroundRefresh(store, bufferMs = 5 * 60 * 1000, failureRetryMs = 5 * 60 * 1000) {
+  if (isCredentialsReadOnly())
+    return;
   if (scheduledRefreshActive)
     return;
   scheduledRefreshActive = true;
@@ -374,4 +567,4 @@ function resetInflightRefresh() {
   inflightRefreshByKey.clear();
 }
 
-export { withClaudeLogContext, claudeLog, configDirToKeychainService, configDirToCredentialsFile, serializeCredentials, createPlatformCredentialStore, credentialsFilePathForProfile, refreshOAuthToken, ensureFreshToken, DEFAULT_RENEWAL_WARN_DAYS, resolveRenewalWarnDays, resetAuthRenewalCache, getAuthRenewalStatus, startBackgroundRefresh, stopBackgroundRefresh, isBackgroundRefreshActive, resetInflightRefresh };
+export { withClaudeLogContext, claudeLog, isCredentialsReadOnly, refuseCredentialWrite, logCredentialsModeBanner, describeAuthFields, authFieldPaths, fetchOAuthPlanFields, configDirToKeychainService, configDirToCredentialsFile, serializeCredentials, createPlatformCredentialStore, credentialsFilePathForProfile, readStoredCredentialPresence, refreshOAuthToken, ensureFreshToken, DEFAULT_RENEWAL_WARN_DAYS, resolveRenewalWarnDays, resetAuthRenewalCache, getStoredPlanFields, getAuthRenewalStatus, startBackgroundRefresh, stopBackgroundRefresh, isBackgroundRefreshActive, resetInflightRefresh };