@rynfar/meridian 1.72.0 → 1.73.0

package/dist/proxy/authDiscovery.d.ts

@@ -0,0 +1,52 @@
+/**
+ * What Anthropic told us during authentication, rendered safe to log.
+ *
+ * Three payloads decide what Meridian knows about an account — the token
+ * endpoint's response, `GET /api/oauth/profile`, and `claude auth status` —
+ * and none of them is currently observable. When a field is absent, or renamed,
+ * or Anthropic starts returning a plan tier nobody has seen before, the only
+ * symptom downstream is a profile that reads `unknown`, with nothing in any log
+ * to say whether the field was missing from the response or dropped on the way
+ * to disk. That distinction is the whole of the diagnosis.
+ *
+ * The obstacle is that two of those payloads carry credentials, so they cannot
+ * simply be logged. `logger.ts`'s `sanitize()` redacts by key name, which is
+ * the wrong polarity here: it protects the names somebody already thought of,
+ * and a field discovered tomorrow is by definition not one of them.
+ *
+ * So this inverts it. Every string is redacted to its length unless its key is
+ * on an allow-list of values known to carry no secret. A new field is therefore
+ * reported by NAME and TYPE — enough to see it arrived and to decide what it is
+ * — while its contents stay out of the log until somebody deliberately adds it
+ * to the list.
+ *
+ * This is a leaf module — pure, no imports.
+ */
+/**
+ * String-valued keys whose contents are safe to print.
+ *
+ * Every one is either a duration, a timestamp, an enum Anthropic publishes, or
+ * the scope list that already appears in plaintext in the authorize URL. A key
+ * that identifies a person or an organization is deliberately absent: `email`,
+ * `email_address`, `name`, `display_name` and `uuid` are all reported by length
+ * only, because a debug log is routinely pasted into an issue.
+ */
+export declare const SAFE_AUTH_STRING_KEYS: ReadonlySet<string>;
+/**
+ * Render a parsed auth response as a loggable field map.
+ *
+ * The shape mirrors the payload rather than flattening it, so a nested
+ * `organization.rate_limit_tier` reads the same way in the log as it does in
+ * Anthropic's documentation and in the code that consumes it.
+ */
+export declare function describeAuthFields(payload: unknown): unknown;
+/**
+ * The keys a payload actually carried, nested ones included, as dotted paths.
+ *
+ * Logged alongside the described payload because it is the line worth grepping:
+ * comparing two logins reduces to comparing two key lists, which answers "did
+ * this account's response even contain the field" without reading the values at
+ * all.
+ */
+export declare function authFieldPaths(payload: unknown, prefix?: string): string[];
+//# sourceMappingURL=authDiscovery.d.ts.map

package/dist/proxy/authDiscovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authDiscovery.d.ts","sourceRoot":"","sources":["../../src/proxy/authDiscovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAepD,CAAA;AA0BF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAK,GAAG,MAAM,EAAE,CAStE"}

package/dist/proxy/credentialsMode.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Read-only credential mode — `MERIDIAN_CREDENTIALS_READONLY`.
+ *
+ * Lets a second Meridian instance run beside a production one against the
+ * SAME credential files without being able to corrupt them. When set, the
+ * instance never initiates a token refresh and never writes a credential; it
+ * re-reads credentials from disk so refreshes performed by the OTHER instance
+ * are picked up.
+ *
+ * The hazard this exists for: two instances holding the same OAuth refresh
+ * token. Meridian refreshes proactively on boot and on a 45s cadence. If
+ * Anthropic rotates the refresh token on use, whichever instance refreshes
+ * first invalidates the other's copy, and recovery is an interactive
+ * `claude login` per account.
+ *
+ * Sharing is not a choice the operator makes, which is why this is the only
+ * defence rather than one layer of several. `MERIDIAN_CONFIG_DIR` relocates
+ * `settings.json` and nothing else: `profiles.json` is a module-level constant
+ * in `profiles.ts`, so every instance on a machine reads the same profile
+ * list, pointing at the same `claudeConfigDir` credential directories. There
+ * is no supported way to give a second instance a different profile set, so
+ * any second instance holds the first one's real accounts from the moment it
+ * boots. This flag is what stops it writing to them.
+ *
+ * Env var rather than a settings key on purpose: settings are editable from
+ * the web UI, and switching this on for the production instance by accident
+ * would silently stop it refreshing its own tokens. The systemd unit is
+ * already where the two instances differ.
+ *
+ * Leaf module — no imports from server.ts or session/.
+ */
+/**
+ * Whether this instance is forbidden from refreshing or writing credentials.
+ *
+ * Resolved per call rather than frozen at import time, matching
+ * `settings.ts`'s treatment of MERIDIAN_CONFIG_DIR: module-level credential
+ * stores are constructed at import, so a value captured then would be fixed
+ * before any test (or embedding host) could set it.
+ */
+export declare function isCredentialsReadOnly(): boolean;
+/**
+ * Report a refused credential write, loudly, and return false so the caller
+ * takes its existing write-failed path.
+ *
+ * Deliberately `console.error` and not `claudeLog`: the latter is gated behind
+ * OPENCODE_CLAUDE_PROVIDER_DEBUG, so in a normal deployment it prints nothing.
+ *
+ * Why failing LOUDLY beats failing safe here: this refusal is the backstop for
+ * a write path nobody thought of. Silently swallowing it would leave an
+ * operator believing the guarantee held while some future call site quietly
+ * did nothing — and the failure it is protecting against (a corrupted token
+ * file that a production instance depends on, costing an interactive
+ * `claude login` across every account, including borrowed ones) is expensive
+ * and manual to recover from. A noisy log that turns out to be benign costs a
+ * grep; a silent one costs the fleet. If this line ever appears, the correct
+ * response is to find the call site and gate it upstream of the store.
+ *
+ * @param operation  short label for the call site (e.g. "oauth-refresh")
+ * @param target     store identity — a path or keychain service, NEVER a value
+ */
+export declare function refuseCredentialWrite(operation: string, target: string): false;
+/**
+ * Announce the mode once at startup, unmistakably.
+ *
+ * An instance silently in read-only mode when you thought it was normal is a
+ * confusing bug — tokens quietly stop being refreshed. An instance loudly in
+ * it is self-documenting.
+ *
+ * Not gated on `silent`, unlike the rest of the startup output: MERIDIAN_SILENT
+ * suppresses routine chatter, and this is not routine — it is a non-default
+ * operating mode that changes what the process is allowed to do. One line,
+ * once, and only when the flag is actually set.
+ */
+export declare function logCredentialsModeBanner(): void;
+/** Reset the once-per-process banner — for testing only. */
+export declare function resetCredentialsModeBanner(): void;
+//# sourceMappingURL=credentialsMode.d.ts.map

package/dist/proxy/credentialsMode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialsMode.d.ts","sourceRoot":"","sources":["../../src/proxy/credentialsMode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAO9E;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAQ/C;AAED,4DAA4D;AAC5D,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}

package/dist/proxy/design.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"design.d.ts","sourceRoot":"","sources":["../../src/proxy/design.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AASrD,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhG,eAAO,MAAM,aAAa,UAA4C,CAAA;AACtE,eAAO,MAAM,sBAAsB,8BAA8B,CAAA;AAMjE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IACvC,KAAK,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,MAAiC,GAAG,gBAAgB,CAmBpG;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAE3F;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyCzB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;KAAE,CAAA;IAClE,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC3D,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgBlC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC/C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxB;AAaD,gFAAgF;AAChF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzG;AAKD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,CAAA;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,KAAK,IAAI;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD,0DAA0D;IAC1D,QAAQ,IAAI;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,gBAAgB,CAAA;IACvB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACnG,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,GAAG,WAAW,CAwFd"}
+{"version":3,"file":"design.d.ts","sourceRoot":"","sources":["../../src/proxy/design.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAUrD,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhG,eAAO,MAAM,aAAa,UAA4C,CAAA;AACtE,eAAO,MAAM,sBAAsB,8BAA8B,CAAA;AAMjE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IACvC,KAAK,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,MAAiC,GAAG,gBAAgB,CA6BpG;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAE3F;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkDzB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;KAAE,CAAA;IAClE,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC3D,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgBlC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC/C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxB;AAaD,gFAAgF;AAChF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzG;AAKD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,CAAA;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,KAAK,IAAI;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD,0DAA0D;IAC1D,QAAQ,IAAI;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,gBAAgB,CAAA;IACvB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACnG,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,GAAG,WAAW,CAwFd"}

package/dist/proxy/followActive.d.ts

@@ -0,0 +1,262 @@
+/**
+ * Follow-the-active-profile mode — `MERIDIAN_FOLLOW_ACTIVE`.
+ *
+ * Makes a development instance take its active profile from ANOTHER Meridian
+ * instance instead of from its own `settings.json`, so the two serve from the
+ * same account and a side-by-side comparison is like-for-like.
+ *
+ * The problem it solves: `MERIDIAN_CONFIG_DIR` relocates `settings.json` and
+ * nothing else, so a second instance keeps its own `activeProfile`. Whatever
+ * moves the primary's active profile — a UI click, the CLI, an external fleet
+ * scheduler — has no effect on the second instance, which quietly serves from
+ * a different account. Measured on one box: the primary was on one profile
+ * while the dev instance served the same instant from another.
+ *
+ * What this changes: exactly ONE input to `resolveProfile` — the active
+ * profile. The precedence chain around it is untouched, so an explicit
+ * `x-meridian-profile` header still wins, and sticky/priority routing behave
+ * as they always did (priority mode does not consult the active profile at
+ * all for unpinned requests, so follow mode is a no-op there).
+ *
+ * Degradation is the design constraint, not an afterthought. The followed
+ * instance is polled in the background and the last good value is cached; the
+ * request path never waits on the network. If the followed instance is down,
+ * slow, or answers rubbish, the last known value keeps being served — and if
+ * there has never been a good value, the local active profile is used. A dev
+ * convenience must not be able to take an instance offline.
+ *
+ * Leaf module — no imports from server.ts, session/ or profiles.ts.
+ */
+/**
+ * Poll cadence. The followed value changes on the order of minutes (a human
+ * clicking, or a scheduler rotating accounts), so a fetch per request would be
+ * absurd; 10s bounds the divergence window without making the followed
+ * instance do meaningful work — `/profiles/list` serves its auth status from a
+ * 60s cache that the instance's own 45s keepalive already keeps warm.
+ */
+export declare const FOLLOW_POLL_INTERVAL_MS = 10000;
+/** Per-poll timeout. Short: a slow followed instance must not accumulate polls. */
+export declare const FOLLOW_FETCH_TIMEOUT_MS = 2000;
+/**
+ * How long a value may go unconfirmed before it is REPORTED stale.
+ *
+ * Staleness deliberately does not change routing. Falling back to the local
+ * value after a timeout would silently split the comparison exactly when you
+ * are least likely to notice, and the local value is not more correct — it is
+ * just different. A stale-but-known followed value remains the best available
+ * answer to "what is the primary on?"; the dev instance's own `activeProfile`
+ * is arbitrary. So a stale value is still followed, and is flagged as stale
+ * everywhere the mode is surfaced.
+ */
+export declare const FOLLOW_STALE_AFTER_MS = 120000;
+export type FollowTarget = {
+    kind: "off";
+} | {
+    kind: "on";
+    url: string;
+} | {
+    kind: "invalid";
+    raw: string;
+    message: string;
+};
+/**
+ * Parse the env var value into a normalized base URL.
+ *
+ * A bare `host:port` is accepted and assumed to be http, because that is what
+ * anyone types first and `new URL()` would otherwise read `127.0.0.1` as a
+ * scheme. Trailing slashes are stripped so callers can concatenate paths.
+ *
+ * A malformed value yields "invalid" rather than throwing: the caller warns
+ * and runs without follow mode. Refusing to start on a typo would take an
+ * instance offline, which is the one outcome this feature must never cause.
+ */
+export declare function parseFollowTarget(raw: string | undefined): FollowTarget;
+/**
+ * Whether a follow target addresses the instance doing the following.
+ *
+ * Self-follow is a deadlock, not a harmless no-op: the instance would follow
+ * its own active profile (so the value never changes) while refusing local
+ * writes (so nothing can change it), leaving the profile frozen forever. It is
+ * also the realistic typo — copying the wrong port out of a unit file.
+ */
+export declare function isSelfTarget(url: string, selfHost: string, selfPort: number): boolean;
+/**
+ * Extract `activeProfile` from a `/profiles/list` body.
+ *
+ * Deliberately paranoid about the shape. The followed instance may be a
+ * different version, a different program listening on a recycled port, or an
+ * error page — "answers rubbish" is one of the failure modes this must
+ * survive, and a non-string or absurdly long value must be treated as no
+ * value at all rather than routed to.
+ */
+export declare function readActiveProfile(body: unknown): string | undefined;
+/** A profile the followed instance has, and where its credentials live. */
+export interface FollowedProfile {
+    id: string;
+    /** Absolute CLAUDE_CONFIG_DIR, on a filesystem both instances can read. */
+    credentialDir: string;
+}
+export interface FollowedRoster {
+    /** Profiles this instance can serve by pointing at the same directory. */
+    adoptable: FollowedProfile[];
+    /** Profiles it cannot, because their credentials are an inline secret. */
+    unadoptable: string[];
+}
+/**
+ * Extract the profile roster from a `/profiles/list` body.
+ *
+ * Following one scalar is not enough. `MERIDIAN_CONFIG_DIR` gives a second
+ * instance its own `profiles.json` — that is the whole point of it — so the
+ * two rosters diverge the moment an account is added to either. The followed
+ * value then names a profile this instance does not have, `decideFollowedProfile`
+ * returns "unknown-profile", and the dev instance serves from an unrelated
+ * account: exactly the divergence follow mode exists to prevent. Measured on
+ * one box, a profile added to the primary was still absent from the follower
+ * minutes later, and its traffic 429'd against the wrong account.
+ *
+ * Adoptability is decided by the SENDER, which is the only side that can. A
+ * profile authenticated by a file both instances can read crosses as a path; a
+ * profile authenticated by an inline API key or OAuth token cannot cross at
+ * all, because the secret must not leave the process that holds it. The sender
+ * reports the second kind by id alone so this instance can say why an account
+ * it can see is one it cannot serve.
+ *
+ * Returns undefined — distinct from an empty roster — when the body carries no
+ * roster information at all. `credentialDir` is emitted for EVERY profile, null
+ * included, so its total absence means the followed instance predates this and
+ * cannot answer the question. Guessing "nothing is adoptable" there would warn
+ * about accounts that are merely unreported.
+ */
+export declare function readFollowedRoster(body: unknown): FollowedRoster | undefined;
+export interface FollowState {
+    /** Last value successfully read, and when it was last CONFIRMED by a poll. */
+    lastGood?: {
+        profileId: string;
+        at: number;
+    };
+    /**
+     * Last roster successfully read. Kept across a failed poll for the same
+     * reason `lastGood` is: a followed instance that has gone quiet has not
+     * withdrawn its accounts, and dropping them would strand every session
+     * pinned to one.
+     */
+    lastRoster?: {
+        roster: FollowedRoster;
+        at: number;
+    };
+    /** When the most recent poll completed, successful or not. */
+    lastPollAt?: number;
+    /** Most recent poll failure. Cleared on the next success. */
+    lastError?: {
+        message: string;
+        at: number;
+    };
+}
+export type FollowOutcome = {
+    follow: true;
+    profileId: string;
+    stale: boolean;
+} | {
+    follow: false;
+    reason: "no-value" | "unknown-profile";
+    followedValue?: string;
+};
+/**
+ * Decide whether the followed value should be used, given what this instance
+ * actually has. Pure — the whole point is that every branch is testable
+ * without a second instance running.
+ *
+ * `unknown-profile` is a fallback, not a resolution: routing to a profile this
+ * instance does not have would resolve to "first configured profile" deeper in
+ * `resolveProfile` and silently serve from an unrelated account. Using the
+ * local choice and saying so is the smaller surprise.
+ */
+export declare function decideFollowedProfile(state: FollowState, availableIds: readonly string[], now: number, staleAfterMs?: number): FollowOutcome;
+/**
+ * The followed instance's base URL, or undefined when not following.
+ *
+ * Resolved per call rather than frozen at import time, matching `settings.ts`'s
+ * treatment of MERIDIAN_CONFIG_DIR — a value captured at import would be fixed
+ * before any test (or embedding host) could set it. Parsing is memoized on the
+ * raw string so the request path does not build a URL object per call.
+ */
+export declare function followTarget(): {
+    url: string;
+} | undefined;
+/** Whether this instance takes its active profile from another one. */
+export declare function isFollowEnabled(): boolean;
+/**
+ * The follow decision for a given profile list, or undefined when not
+ * following. Called on the request path — synchronous, cache-only, no I/O.
+ */
+export declare function followedActiveProfile(availableIds: readonly string[]): FollowOutcome | undefined;
+/**
+ * Profiles contributed by the followed instance. Called on the request path
+ * through `getEffectiveProfiles` — synchronous, cache-only, no I/O.
+ *
+ * Empty until the first successful poll, so an instance whose followed peer is
+ * down starts with its own profiles rather than none.
+ */
+export declare function adoptedProfiles(): readonly FollowedProfile[];
+/** Follow state as surfaced by `/profiles/list`. Undefined when not following. */
+export interface FollowStatus {
+    /** Base URL of the followed instance. */
+    url: string;
+    /** Value actually in effect, or null when falling back to the local one. */
+    activeProfile: string | null;
+    /** Last value read from the followed instance, even if unusable here. */
+    followedValue: string | null;
+    /** Why the followed value is not in effect, when it isn't. */
+    reason: "no-value" | "unknown-profile" | null;
+    /** Followed value has not been confirmed recently — still in effect. */
+    stale: boolean;
+    /** When the followed value was last confirmed. */
+    lastSyncedAt: number | null;
+    /** Most recent poll failure, if the last poll failed. */
+    lastError: string | null;
+    /** Profile ids taken from the followed instance and served here. */
+    adoptedProfiles: string[];
+    /** Profile ids it has that cannot be adopted, so a UI can say why. */
+    unadoptableProfiles: string[];
+    /** When the roster was last confirmed, or null if never read. */
+    rosterSyncedAt: number | null;
+}
+export declare function followStatus(availableIds: readonly string[]): FollowStatus | undefined;
+/**
+ * Read the followed instance's active profile once and update the cache.
+ *
+ * Never throws and never clears a good value on failure: a failed poll leaves
+ * the last known value in place, which is what "degrade, never fail" means
+ * here. Exported so tests can drive it without a timer.
+ */
+export declare function pollFollowedActiveProfile(): Promise<void>;
+/**
+ * Arm the background poll. Idempotent.
+ *
+ * `self` is the address this instance actually bound (the configured port may
+ * be 0), used only for the self-follow guard.
+ */
+export declare function startFollowPolling(self?: {
+    host: string;
+    port: number;
+}): void;
+/** Stop the background poll. Idempotent. */
+export declare function stopFollowPolling(): void;
+/**
+ * Announce the mode once at startup.
+ *
+ * Not gated on `silent`, matching the treatment of other non-default operating
+ * modes: MERIDIAN_SILENT suppresses routine chatter, and this is not routine —
+ * it changes where a core piece of this instance's state comes from. An
+ * instance silently following another is exactly the hour-long confusion this
+ * line exists to prevent.
+ *
+ * @param routingMode current routing mode, so the one combination where follow
+ *   mode does nothing useful says so instead of being discovered the hard way.
+ */
+export declare function logFollowBanner(routingMode?: string): void;
+/** Reset all module state — for testing only. */
+export declare function resetFollowActive(): void;
+/** Seed the cache directly — for testing only. */
+export declare function setFollowStateForTesting(next: FollowState): void;
+//# sourceMappingURL=followActive.d.ts.map

package/dist/proxy/followActive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"followActive.d.ts","sourceRoot":"","sources":["../../src/proxy/followActive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAE7C,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,OAAQ,CAAA;AAE5C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,SAAU,CAAA;AAO5C,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAiBvE;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUrF;AAID;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAOnE;AAOD,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,0EAA0E;IAC1E,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAuB5E;AAiDD,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6DAA6D;IAC7D,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5C;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAErF;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,WAAW,EAClB,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,GAAG,EAAE,MAAM,EACX,YAAY,GAAE,MAA8B,GAC3C,aAAa,CASf;AAaD;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAmB1D;AAED,uEAAuE;AACvE,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,GAAG,SAAS,CAGhG;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,SAAS,eAAe,EAAE,CAG5D;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAA;IACX,4EAA4E;IAC5E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,yEAAyE;IACzE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,UAAU,GAAG,iBAAiB,GAAG,IAAI,CAAA;IAC7C,wEAAwE;IACxE,KAAK,EAAE,OAAO,CAAA;IACd,kDAAkD;IAClD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,yDAAyD;IACzD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,oEAAoE;IACpE,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B,iEAAiE;IACjE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,GAAG,SAAS,CAiBtF;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CA8C/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe9E;AAED,4CAA4C;AAC5C,wBAAgB,iBAAiB,IAAI,IAAI,CAIxC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAgB1D;AAED,iDAAiD;AACjD,wBAAgB,iBAAiB,IAAI,IAAI,CASxC;AAED,kDAAkD;AAClD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAEhE"}

package/dist/proxy/limitDetection.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Which allowance did Anthropic just refuse?
+ *
+ * An account that has run out keeps reporting healthy percentages: measured on
+ * the live fleet, `corp4` rendered `5h 67% / 7d 7%` on /profiles at the same
+ * minute its requests were being refused. The cached numbers are a snapshot of
+ * the last successful read; a refusal is news that arrives later and never
+ * overwrites them. So the refusal has to be recorded and reported on its own
+ * terms, next to the cached numbers rather than instead of them.
+ *
+ * This module answers only the "which bucket, and when does it reset" part.
+ * It is a leaf module and every function here is pure - the stores that hold
+ * the answers live in profileHealth.ts.
+ *
+ * Evidence ladder, best source first. The distinction that matters to a reader
+ * of the UI is `reported` (Anthropic said so) versus inferred (we worked it
+ * out from stale numbers), so every diagnosis carries it explicitly:
+ *
+ *   1. `sdk_event`     - the SDK's own `rate_limit_event` said `rejected` and
+ *                        named `rateLimitType`. Unambiguous.
+ *   2. `error_message` - the CLI's prose names the window. Measured live:
+ *                        "You've hit your session limit · resets 12:30am
+ *                        (America/Chicago)" - that is both the bucket (Claude
+ *                        Code calls the 5-hour window a "session") and a real
+ *                        reset clock, so it is worth parsing rather than
+ *                        discarding.
+ *   3. `cached_usage`  - nothing said which, so deduce from the last-read
+ *                        windows: whichever is nearest its limit, or, when the
+ *                        weekly windows are nowhere near theirs, the 5-hour one
+ *                        by elimination.
+ *   4. `unknown`       - say so rather than guessing a bucket.
+ *
+ * There are no `anthropic-ratelimit-*` response headers to read here: Meridian
+ * reaches Anthropic through the Claude Agent SDK subprocess, never over HTTP it
+ * can see, so `rate_limit_event` IS this proxy's structured form of those
+ * headers and tier 1 above is the header check.
+ */
+/** How the bucket was determined. See the ladder in the module doc. */
+export type LimitSource = "sdk_event" | "error_message" | "cached_usage" | "unknown";
+export interface LimitDiagnosis {
+    /** Anthropic's window key ("five_hour", "seven_day", "seven_day_opus", …),
+     *  or null when nothing identified it. */
+    bucket: string | null;
+    /** True when Anthropic named the bucket; false when we deduced it. Drives
+     *  the "(guess)" marking in the UI. */
+    reported: boolean;
+    source: LimitSource;
+    /** Epoch ms the window reopens, when known. */
+    resetsAt: number | null;
+    /** One line explaining the verdict, rendered as the badge's tooltip. */
+    rationale: string;
+}
+export interface ParsedLimitWording {
+    bucket: string | null;
+    /** The qualifier as written, kept for the rationale so an unrecognized one
+     *  ("daily", "monthly") still tells the reader what the CLI said. */
+    qualifier: string | null;
+    clock: string | null;
+    zone: string | null;
+}
+/**
+ * Pull the bucket and reset clock out of an SDK error message. Returns nulls
+ * for anything it cannot read - this never throws on unfamiliar prose, because
+ * the CLI's wording has changed three times already (#764, #787).
+ */
+export declare function parseLimitWording(errMsg: string): ParsedLimitWording;
+/**
+ * Resolve "resets 12:30am (America/Chicago)" to an instant: the next time that
+ * wall clock occurs in that zone.
+ *
+ * The offset is read twice - once at `now`, then again at the candidate - so a
+ * reset that lands on the far side of a DST boundary resolves to the right
+ * instant rather than being an hour out.
+ *
+ * Returns null for an unparseable clock or unknown zone. Only ever looks one
+ * day ahead, so the result is bounded to ~24h from `now`: the CLI prints a
+ * clock time with no date, and a value further out than that would be a
+ * misreading, not information.
+ */
+export declare function resolveResetClock(clock: string, zone: string | null | undefined, now: number): number | null;
+export interface SdkLimitEvidence {
+    rateLimitType?: string;
+    status?: string;
+    utilization?: number | null;
+    resetsAt?: number | null;
+    observedAt: number;
+}
+export interface CachedWindow {
+    type: string;
+    utilization: number | null;
+    resetsAt: number | null;
+}
+export interface DiagnoseLimitInput {
+    /** Raw SDK error text, before `classifyError` replaces it with proxy prose. */
+    message: string;
+    now: number;
+    /** This profile's SDK rate-limit entries (rateLimitStore.getAll). */
+    sdkEntries?: readonly SdkLimitEvidence[];
+    /** This profile's last-read OAuth usage windows. */
+    windows?: readonly CachedWindow[];
+}
+/**
+ * Decide which allowance was refused, and say how confident that is.
+ *
+ * Never throws and always returns a diagnosis - an "unknown" verdict is a
+ * useful thing to render ("refusing, cause unknown") and far better than
+ * silently attributing the refusal to whichever window happened to look busiest.
+ */
+export declare function diagnoseLimit(input: DiagnoseLimitInput): LimitDiagnosis;
+//# sourceMappingURL=limitDetection.d.ts.map

package/dist/proxy/limitDetection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limitDetection.d.ts","sourceRoot":"","sources":["../../src/proxy/limitDetection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,uEAAuE;AACvE,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,eAAe,GAAG,cAAc,GAAG,SAAS,CAAA;AAEpF,MAAM,WAAW,cAAc;IAC7B;8CAC0C;IAC1C,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;2CACuC;IACvC,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,WAAW,CAAA;IACnB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAA;CAClB;AAiCD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;yEACqE;IACrE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAiBpE;AAsDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB5G;AASD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,qEAAqE;IACrE,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACxC,oDAAoD;IACpD,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CAClC;AAQD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,cAAc,CAgEvE"}

package/dist/proxy/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/proxy/models.ts"],"names":[],"mappings":"AAAA;;GAEG;AAsBH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAA;AAEzG;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AACvD,eAAO,MAAM,oBAAoB,kBAAkB,CAAA;AACnD,eAAO,MAAM,sBAAsB,oBAAoB,CAAA;AACvD,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AAEvD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAM3F;AACD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAuCD,oEAAoE;AACpE,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAkBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CA6EtK;AAoGD;;;;;;;;;;;GAWG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAEzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI,CAKN;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAIlG;AAED;;aAEa;AACb,wBAAgB,+BAA+B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAUxE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,CAKpE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAE9D;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,mCAAmC,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAK7F;AAaD;gFACgF;AAChF,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAOzH;AAWD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAiE1I;AAID;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAC9B,KAAK,GACL,SAAS,GACT,kBAAkB,GAClB,aAAa,GACb,eAAe,CAAA;AAEnB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,sBAAsB,CAAA;CAC/B;AAKD;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClD,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;CACf,CAAA;AA4HD;;;;;;;;;GASG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,GAAE,YAA2B,GAChC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAYtC;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,GAAE,YAA2B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,YAA2B,GAChC,oBAAoB,GAAG,IAAI,CAQ7B;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,IAAI,oBAAoB,GAAG,IAAI,CAE7E;AAED,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,CAAC,CAqBpE;AAED,2CAA2C;AAC3C,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED,kDAAkD;AAClD,wBAAgB,2BAA2B,IAAI,IAAI,CAOlD;AAED;;6DAE6D;AAC7D,wBAAgB,qBAAqB,IAAI,IAAI,CAO5C;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG/D"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/proxy/models.ts"],"names":[],"mappings":"AAAA;;GAEG;AA0BH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAA;AAEzG;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AACvD,eAAO,MAAM,oBAAoB,kBAAkB,CAAA;AACnD,eAAO,MAAM,sBAAsB,oBAAoB,CAAA;AACvD,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AAEvD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAM3F;AACD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAqED,oEAAoE;AACpE,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAkBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CA6EtK;AAoGD;;;;;;;;;;;GAWG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAEzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI,CAKN;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAIlG;AAED;;aAEa;AACb,wBAAgB,+BAA+B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAUxE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,CAKpE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAE9D;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,mCAAmC,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAK7F;AAcD;gFACgF;AAChF,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAOzH;AAWD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA2F1I;AAID;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAC9B,KAAK,GACL,SAAS,GACT,kBAAkB,GAClB,aAAa,GACb,eAAe,CAAA;AAEnB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,sBAAsB,CAAA;CAC/B;AAKD;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClD,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;CACf,CAAA;AA4HD;;;;;;;;;GASG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,GAAE,YAA2B,GAChC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAYtC;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,GAAE,YAA2B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,YAA2B,GAChC,oBAAoB,GAAG,IAAI,CAQ7B;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,IAAI,oBAAoB,GAAG,IAAI,CAE7E;AAED,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,CAAC,CAqBpE;AAED,2CAA2C;AAC3C,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED,kDAAkD;AAClD,wBAAgB,2BAA2B,IAAI,IAAI,CAQlD;AAED;;6DAE6D;AAC7D,wBAAgB,qBAAqB,IAAI,IAAI,CAO5C;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG/D"}

package/dist/proxy/oauthPlan.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The account's plan, as Anthropic reports it for a given access token.
+ *
+ * Shared by the two moments a plan can be learned: an interactive login, which
+ * has just minted a token, and a token refresh, which has just minted another.
+ * It lives in its own module rather than in profileCli.ts because profileCli
+ * already imports tokenRefresh for the credential store, so the refresh path
+ * importing back would close a cycle.
+ *
+ * This is a leaf module — one authenticated GET, no imports.
+ */
+interface OAuthProfileResponse {
+    organization?: {
+        organization_type?: string | null;
+        rate_limit_tier?: string | null;
+        seat_tier?: string | null;
+    } | null;
+}
+export interface OAuthPlanFields {
+    subscriptionType?: string;
+    rateLimitTier?: string;
+    /**
+     * Which seat a Team member holds, and the ONLY field that separates a
+     * Premium seat from a Standard one. Measured across twelve live accounts:
+     * every Premium seat reports `rate_limit_tier: "default_claude_max_5x"` —
+     * byte-identical to what a personal Max 5x reports — and a Standard seat
+     * reports `default_raven`, a codename naming no published allotment. So the
+     * rate-limit tier can size neither kind of Team seat: one because it lies
+     * and one because it says nothing. Null on every personal account.
+     */
+    seatTier?: string;
+}
+/**
+ * Translate Anthropic's wire `organization_type` into the vocabulary the Claude
+ * CLI writes on disk — the wire value is prefixed (`claude_max`), the stored one
+ * is not (`max`). Mirroring the CLI's own mapping is what keeps a credential
+ * file Meridian writes indistinguishable from one `claude login` wrote, which
+ * matters because `claude auth status` reads it back and is what ultimately
+ * feeds `/profiles/list`, `/health` and the `max`-only branch of `/v1/models`.
+ *
+ * An unrecognized or absent type yields undefined so the caller omits the key,
+ * rather than inventing a plan for an account it could not identify.
+ */
+export declare function subscriptionTypeFromOrganizationType(organizationType: string | null | undefined): string | undefined;
+export declare function extractPlanFields(profile: OAuthProfileResponse | null | undefined): OAuthPlanFields;
+/**
+ * Whether a stored credential is still missing plan information.
+ *
+ * Either field being absent counts, because they answer different questions
+ * and arrive from different writers: `claude login` records `subscriptionType`
+ * but not always `rateLimitTier`, and only `rateLimitTier` distinguishes Max 5x
+ * from Max 20x. Requiring both means a file half-filled by the CLI still gets
+ * completed.
+ */
+export declare function planFieldsMissing(fields: OAuthPlanFields | null | undefined): boolean;
+/**
+ * Best-effort plan lookup for a valid access token. Never throws and never
+ * fails its caller: a profile whose plan is unknown is strictly better than no
+ * profile at all, and every consumer already treats it as optional.
+ */
+export declare function fetchOAuthPlanFields(accessToken: string): Promise<OAuthPlanFields>;
+export {};
+//# sourceMappingURL=oauthPlan.d.ts.map

package/dist/proxy/oauthPlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthPlan.d.ts","sourceRoot":"","sources":["../../src/proxy/oauthPlan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkBH,UAAU,oBAAoB;IAC5B,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACjC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC1B,GAAG,IAAI,CAAA;CACT;AAED,MAAM,WAAW,eAAe;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAClD,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,MAAM,GAAG,SAAS,CAQpB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,GAAG,eAAe,CASnG;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErF;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAuCxF"}