@rynfar/meridian 1.72.0 → 1.74.0

package/dist/proxy/organizationName.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The organization an account belongs to, as Anthropic names it.
+ *
+ * `GET /api/oauth/profile` answers `organization.name` — the human label for
+ * the account behind a profile. A fleet whose profiles are called `work2` and
+ * `corp3` is told apart by that label and by nothing else on the card.
+ *
+ * WHERE IT IS KEPT. `.credentials.json` already holds `subscriptionType` and
+ * `rateLimitTier`, so it looks like the natural home — but those are Claude
+ * Code's OWN keys. Meridian writes that file to be indistinguishable from one
+ * `claude login` wrote, and a Meridian-invented key breaks that deliberately;
+ * worse, Claude Code rewrites the file on its next refresh and would drop the
+ * key, so it would not even survive. This is Meridian's own file, beside
+ * settings.json, and neither objection applies to it.
+ *
+ * WHY IT IS CACHED. The render path must not make an authenticated round trip
+ * per profile: two pages poll `/profiles/list` every 10s and a fleet is a dozen
+ * accounts, which is a dozen requests to Anthropic every ten seconds for a
+ * string that changes approximately never. So reads are synchronous and
+ * cache-only, and a stale entry is refreshed in the background — the response
+ * never waits on the network.
+ *
+ * Leaf module — no imports from server.ts or session/.
+ */
+import { type CredentialStore } from "./tokenRefresh";
+/** How old an entry may get before a background refresh is worth making. */
+export declare const ORGANIZATION_REFRESH_AFTER_MS: number;
+/** Floor between two lookups for one profile, successful or not, so an
+ *  unreachable Anthropic cannot be retried once per 10s poll forever. */
+export declare const ORGANIZATION_RETRY_AFTER_MS: number;
+export interface OrganizationRecord {
+    name: string;
+    fetchedAt: number;
+}
+/**
+ * Read a record map out of whatever the file actually holds. Hand-editable and
+ * written by other versions, so an entry that is not a usable name is dropped
+ * rather than served.
+ */
+export declare function readOrganizations(raw: unknown): Record<string, OrganizationRecord>;
+/**
+ * Pull the name out of an `/api/oauth/profile` body.
+ *
+ * Nullable in principle even though every account measured has one, so an
+ * absent name yields null and the caller renders nothing rather than "unknown".
+ */
+export declare function extractOrganizationName(body: unknown): string | null;
+export declare function organizationNeedsRefresh(record: OrganizationRecord | undefined, now: number, refreshAfterMs?: number): boolean;
+/** Every organization on record, keyed by profile id. */
+export declare function organizationNames(): Record<string, OrganizationRecord>;
+export declare function rememberOrganizationName(profileId: string, name: string): void;
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/**
+ * Best-effort lookup for one account. Never throws and never fails its caller:
+ * a profile whose organization is unknown is strictly better than a page that
+ * will not render.
+ */
+export declare function fetchOrganizationName(store: CredentialStore, fetchImpl?: FetchLike): Promise<string | null>;
+export declare function enableOrganizationLookup(): void;
+export interface RefreshOrganizationOpts {
+    claudeConfigDir?: string;
+    store?: CredentialStore;
+    fetchImpl?: FetchLike;
+    retryAfterMs?: number;
+}
+/** Learn one profile's organization in the background. Returns immediately. */
+export declare function refreshOrganizationNameSoon(profileId: string, opts?: RefreshOrganizationOpts): void;
+/** Reset module state — for testing only. */
+export declare function resetOrganizationLookupForTesting(): void;
+export {};
+//# sourceMappingURL=organizationName.d.ts.map

package/dist/proxy/organizationName.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationName.d.ts","sourceRoot":"","sources":["../../src/proxy/organizationName.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAIpF,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B,QAAsB,CAAA;AAEhE;yEACyE;AACzE,eAAO,MAAM,2BAA2B,QAAgB,CAAA;AAcxD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAalF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASpE;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,GAAG,EAAE,MAAM,EACX,cAAc,GAAE,MAAsC,GACrD,OAAO,CAGT;AAID,yDAAyD;AACzD,wBAAgB,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAQtE;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAS9E;AAID,KAAK,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEzE;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,SAA4B,GACtC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBxB;AAWD,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAKD,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,uBAA4B,GAAG,IAAI,CAsBvG;AAED,6CAA6C;AAC7C,wBAAgB,iCAAiC,IAAI,IAAI,CAIxD"}

package/dist/proxy/passthroughEarlyStop.d.ts

@@ -113,6 +113,16 @@ export interface CompleteToolResultContinuationOptions {
      */
     allowTrailingSystemReminder?: boolean;
 }
+/**
+ * Detect mid-conversation effort metadata system messages (e.g. pi >= 0.85.0
+ * Persistent Claude thinking effort). These carry effort metadata in
+ * `output_config` with empty content and no tool ids or text instructions.
+ */
+export declare function isMidConvoEffortSystemMessage(message: {
+    role?: unknown;
+    content?: unknown;
+    output_config?: unknown;
+} | null | undefined): boolean;
 /**
  * Verify that a resumed tool-result delta settles exactly the tool calls at the
  * stored assistant checkpoint, then coalesce queued user turns into one SDK

package/dist/proxy/passthroughEarlyStop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passthroughEarlyStop.d.ts","sourceRoot":"","sources":["../../src/proxy/passthroughEarlyStop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAYH,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACrB,6EAA6E;IAC7E,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACrB;yEACqE;IACrE,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,0EAA0E;IAC1E,KAAK,EAAE,OAAO,CAAA;CACf;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAEzD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,UAAU,CAAA;IAChB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,gBAAgB,GAAE,MAA2B,GAC5C,KAAK,IAAI,sBAAsB,CAQjC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,OAAO,EAChB,gBAAgB,GAAE,MAA2B,GAC5C,IAAI,CAON;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,OAAO,EAChB,gBAAgB,GAAE,MAA2B,GAC5C,IAAI,CAoBN;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAQjF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAM5E;AAED;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,EACtD,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,OAAO,CAAC,EAAE,qCAAqC,GAC9C,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,GAAG,SAAS,CAuFzD;AAED,oFAAoF;AACpF,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,EACtD,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,OAAO,CAAC,EAAE,qCAAqC,GAC9C,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,GAAG,SAAS,CAoBzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,gBAAgB,EACzB,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,GACtC,OAAO,CAOT;AAED,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAE1F;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAMlE;AAED,qEAAqE;AACrE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtB;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,oBAAoB,EAAE,OAAO,CAAA;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,mBAAmB,EAAE,OAAO,CAAA;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,oEAAoE;IACpE,WAAW,EAAE,OAAO,CAAA;CACrB,GAAG,sBAAsB,CAMzB"}
+{"version":3,"file":"passthroughEarlyStop.d.ts","sourceRoot":"","sources":["../../src/proxy/passthroughEarlyStop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAYH,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACrB,6EAA6E;IAC7E,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACrB;yEACqE;IACrE,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,0EAA0E;IAC1E,KAAK,EAAE,OAAO,CAAA;CACf;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAEzD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,UAAU,CAAA;IAChB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,gBAAgB,GAAE,MAA2B,GAC5C,KAAK,IAAI,sBAAsB,CAQjC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,OAAO,EAChB,gBAAgB,GAAE,MAA2B,GAC5C,IAAI,CAON;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,OAAO,EAChB,gBAAgB,GAAE,MAA2B,GAC5C,IAAI,CAoBN;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAQjF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAM5E;AAED;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GACzF,OAAO,CAcT;AAED;;;;;GAKG;AACH,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,EACtD,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,OAAO,CAAC,EAAE,qCAAqC,GAC9C,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,GAAG,SAAS,CA2FzD;AAED,oFAAoF;AACpF,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,EACtD,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,OAAO,CAAC,EAAE,qCAAqC,GAC9C,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,GAAG,SAAS,CAoBzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,gBAAgB,EACzB,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,GACtC,OAAO,CAOT;AAED,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAE1F;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAMlE;AAED,qEAAqE;AACrE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtB;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,oBAAoB,EAAE,OAAO,CAAA;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,mBAAmB,EAAE,OAAO,CAAA;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,oEAAoE;IACpE,WAAW,EAAE,OAAO,CAAA;CACrB,GAAG,sBAAsB,CAMzB"}

package/dist/proxy/planAllowance.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Plan → coding-allotment multiplier.
+ *
+ * Anthropic sizes a plan's Claude Code allotment as a multiple of the Pro
+ * baseline — 5x, 20x, 6.25x — and that number, not the plan name, is what says
+ * how much work an account can actually do. Two accounts both reporting
+ * `Plan: max` can differ by 4x in capacity, so a page that shows only the plan
+ * cannot tell the user which account has room left.
+ *
+ * The multiplier is derived from the raw strings the profile endpoint returns
+ * — `seatTier` for a Team account, `rateLimitTier` otherwise — rather than
+ * from `subscriptionType`, because that field is too coarse: it collapses Max
+ * 5x and Max 20x into the single word `max`, and Team Standard and Team
+ * Premium into `team`. `subscriptionType` names the family and is used for the
+ * size only as a fallback for the one tier it pins unambiguously.
+ *
+ * An unrecognized tier yields null rather than a default, which is the whole
+ * point of the field: rendering `1x` for an account that is really 20x is
+ * worse than rendering nothing, because a reader acts on it.
+ *
+ * This is a leaf module — pure, no I/O, no imports.
+ */
+export interface PlanAllowance {
+    /** Multiplier as displayed, e.g. `"20x"`. Null when the tier is unknown. */
+    multiplier: string | null;
+    /**
+     * The same value as a number, so callers can weight or rank accounts without
+     * re-parsing the label. Null whenever `multiplier` is.
+     */
+    weight: number | null;
+    /** Tier label, e.g. `"Personal Max"`. Null when the tier is unknown. */
+    label: string | null;
+    /**
+     * Which side of Anthropic's pricing the account sits on — `"Personal"`,
+     * `"Team"` or `"Enterprise"`. Separate from `planName` because the two are
+     * answered by different fields and either can be known without the other: an
+     * account whose family is declared but whose tier is unrecognized still has
+     * a trustworthy family.
+     */
+    accountType: string | null;
+    /**
+     * The plan WITHIN that family, in the vocabulary of Anthropic's own pricing
+     * page: `"Max 20x"`, `"Max 5x"`, `"Pro"`, `"Free"` for personal accounts and
+     * `"Premium seat"` / `"Standard seat"` for Team ones.
+     *
+     * Null when the family is known but the plan is not — which is the common
+     * case for a Team seat with no `seat_tier`, since its `rate_limit_tier`
+     * reports the underlying bucket rather than the seat.
+     */
+    planName: string | null;
+}
+/**
+ * Reduce a raw tier string to the form the table below is keyed by.
+ *
+ * Anthropic prefixes the wire value (`default_claude_max_20x`) and separates
+ * words with underscores; the same tier also appears bare (`max_20x`) in
+ * places, and `team_tier_1` is the wire spelling of what the pricing page
+ * calls Team Premium. Normalizing first means one entry per tier instead of
+ * one per spelling.
+ */
+export declare function normalizeRateLimitTier(raw: string | null | undefined): string | null;
+/**
+ * Derive the allowance from whatever plan fields a credential file carries.
+ *
+ * Both arguments are optional because both are optional on disk: a profile
+ * written before the plan was persisted has neither, and one written by an
+ * older Meridian has only `subscriptionType`. Every unknown case returns the
+ * same all-null shape, so callers can render conditionally on one field.
+ */
+export declare function planAllowance(fields: {
+    rateLimitTier?: string | null;
+    seatTier?: string | null;
+    subscriptionType?: string | null;
+} | null | undefined): PlanAllowance;
+//# sourceMappingURL=planAllowance.d.ts.map

package/dist/proxy/planAllowance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planAllowance.d.ts","sourceRoot":"","sources":["../../src/proxy/planAllowance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;OAGG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B;;;;;;;;OAQG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AA4BD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CASpF;AAwED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,CAkBnC"}

package/dist/proxy/probes.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Liveness and readiness as two DIFFERENT questions, because the existing
+ * `/health` answers a third one and is wrong when used as either.
+ *
+ * `/health` verifies the ACTIVE profile's auth: it spawns `claude auth status`
+ * and returns 503 when that profile is logged out. As a liveness probe that is
+ * a restart loop waiting to happen - a logged-out account is not fixed by
+ * killing the process, and a supervisor pointed at it will keep killing a
+ * perfectly healthy proxy until somebody re-authenticates. As a readiness probe
+ * it is wrong in the other direction: it inspects one profile out of however
+ * many are configured, and its own catch-all answers `degraded` with status
+ * **200**, so an instance that cannot verify auth at all reads as ready.
+ *
+ * So:
+ *
+ *   /livez   is this PROCESS still turning - would a restart help?
+ *   /readyz  should traffic be sent to THIS instance rather than another?
+ *
+ * Named after kube-apiserver's own endpoints, and shaped like them - plain
+ * text `ok`, with `?verbose` listing every check - so a Kubernetes probe, a
+ * Caddy `health_uri` and a person with curl all read the same thing.
+ */
+export type ProbeKind = "livez" | "readyz";
+export interface ProbeCheck {
+    readonly name: string;
+    readonly ok: boolean;
+    /** Why it failed. Absent when it passed. */
+    readonly detail?: string;
+}
+export interface ProbeReport {
+    readonly ok: boolean;
+    readonly checks: readonly ProbeCheck[];
+}
+/**
+ * Liveness passes unconditionally, and that is the design rather than a stub.
+ *
+ * Reaching this function at all means the event loop is turning and the HTTP
+ * server is answering, which is the entire question. Every dependency added
+ * here - a subprocess, a credential file, a reachable upstream - is another
+ * way for this process to be killed over somebody else's outage, and a
+ * liveness probe that restarts a working process is strictly worse than no
+ * liveness probe at all.
+ */
+export declare function livenessReport(): ProbeReport;
+export interface ReadinessInput {
+    /** Profiles this instance would actually serve from. */
+    readonly profileCount: number;
+    /** Whether a Claude executable resolves for this instance. */
+    readonly claudeExecutableResolved: boolean;
+}
+/**
+ * Readiness admits only checks that are PER-INSTANCE.
+ *
+ * The point of readiness is to move traffic somewhere better, so a check that
+ * two instances fail together cannot move it anywhere - it can only take every
+ * instance out at once and turn a clear error into a 502. That is why the
+ * credentials are deliberately not checked here even though a proxy with no
+ * usable token serves nothing: instances share those files, so an outage of
+ * them is not a reason to prefer one instance over another, and the honest
+ * answer to the caller is the provider's own 401 rather than a gateway error.
+ *
+ * What remains is genuinely local to one process:
+ *
+ *   profiles           an instance whose configuration and whose
+ *                      `profiles.json` are both empty has no account to serve
+ *                      from, while a neighbour reading a populated one is
+ *                      fine. In a container that is entirely per-instance: the
+ *                      file lives under that container's own HOME, so a
+ *                      missing mount takes exactly one replica out.
+ *   claude-executable  resolved from `MERIDIAN_CLAUDE_PATH`, this install's
+ *                      own `node_modules`, or its platform package - all
+ *                      per-instance, and without one no request can be served
+ *                      (#478).
+ */
+export declare function readinessReport(input: ReadinessInput): ProbeReport;
+/**
+ * kube-apiserver's own output shape: `[+]name ok` per check, a verdict line,
+ * and a bare `ok` when everything passed and nobody asked for detail.
+ *
+ * The terse form is the one a load balancer polls every few seconds, so it
+ * stays two bytes; the failing form names the checks that failed even without
+ * `?verbose`, because a 503 nobody can explain is a 503 somebody disables.
+ */
+export declare function renderProbe(kind: ProbeKind, report: ProbeReport, verbose: boolean): string;
+//# sourceMappingURL=probes.d.ts.map

package/dist/proxy/probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probes.d.ts","sourceRoot":"","sources":["../../src/proxy/probes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAA;AAE1C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;CACvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAED,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAgBlE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAS1F"}

package/dist/proxy/profileCli.d.ts

@@ -1,17 +1,27 @@
 /**
  * CLI commands for profile management.
  *
- * Browser-login profiles are stored under ~/.config/meridian/profiles/{id}/
+ * Browser-login profiles are stored under <config dir>/profiles/{id}/
  * — each directory is a standalone CLAUDE_CONFIG_DIR with its own OAuth
  * tokens. OAuth-token profiles (added via `--oauth-token`) live entirely in
  * profiles.json — no per-profile config dir.
  *
  * This is a leaf module — no imports from server.ts or session/.
  */
+import { type OAuthPlanFields } from "./oauthPlan";
 import type { ProfileConfig } from "./profiles";
+import { type CredentialsFile } from "./tokenRefresh";
 export declare const OAUTH_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 export declare const OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 export declare const OAUTH_REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
+/**
+ * Pure: is this ID safe to use as a profile name?
+ *
+ * A profile ID becomes a directory name under PROFILES_DIR, so anything
+ * carrying a path separator or a `..` segment would escape that directory.
+ * Restricting to plain identifiers keeps IDs both safe and shell-friendly.
+ */
+export declare function isValidProfileId(id: string): boolean;
 interface AuthLoginOptions {
     headless?: boolean;
 }
@@ -24,9 +34,29 @@ interface ParsedAuthorizationCode {
     code: string;
     state?: string;
 }
+interface OAuthTokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    expires_in?: number;
+    expires_at?: number;
+    scope?: string;
+}
 export declare function buildAuthLoginEnv(configDir: string | undefined, _options?: AuthLoginOptions, baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export declare function createManualOAuthSession(scopes?: string[]): ManualOAuthSession;
 export declare function parseAuthorizationCodeInput(input: string): ParsedAuthorizationCode | null;
+type CompleteOAuthTokenResponse = OAuthTokenResponse & {
+    refresh_token: string;
+};
+/**
+ * Build the record a login writes to disk.
+ *
+ * Split out so the on-disk shape is directly assertable: the defect this closes
+ * was a field missing from this object literal, which no test of the
+ * surrounding prompt/fetch I/O would have caught. Plan fields spread in only
+ * when known — `subscriptionType: undefined` would write a null-ish key into a
+ * file the real CLI also parses.
+ */
+export declare function buildLoginCredentials(tokenData: CompleteOAuthTokenResponse, plan: OAuthPlanFields, now?: number): CredentialsFile;
 export declare function profileAdd(id: string, options?: AuthLoginOptions): Promise<void>;
 export declare function profileAddOauthToken(id: string, tokenArg: string | undefined): Promise<void>;
 export declare function profileList(): void;
@@ -41,7 +71,29 @@ export declare function profileList(): void;
  */
 export declare function dirsToRemoveOnProfileRemove(profile: ProfileConfig, profilesDir: string): string[];
 export declare function profileRemove(id: string): void;
+export declare function profileRename(from: string, to: string): void;
 export declare function profileSwitch(id: string): Promise<void>;
+export type ProfileLoginPlan = {
+    action: "create";
+} | {
+    action: "reject-invalid-id";
+} | {
+    action: "reject-oauth-token";
+} | {
+    action: "login";
+    profile: ProfileConfig;
+};
+/**
+ * Pure: decide what `meridian profile login <id>` should do.
+ *
+ * An unknown ID is a request to create that profile, not an error — the ID is
+ * validated first because only this branch turns it into a directory. A profile
+ * that already exists is never re-validated: it was written by an earlier `add`
+ * (or by hand), and login must keep working on it either way.
+ *
+ * Caller performs the login itself — this returns the decision only.
+ */
+export declare function planProfileLogin(id: string, profiles: ProfileConfig[]): ProfileLoginPlan;
 export declare function profileLogin(id: string, options?: AuthLoginOptions): Promise<void>;
 export declare function profileHelp(): void;
 export {};

package/dist/proxy/profileCli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profileCli.d.ts","sourceRoot":"","sources":["../../src/proxy/profileCli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO/C,eAAO,MAAM,eAAe,+CAA+C,CAAA;AAC3E,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,kBAAkB,oDAAoD,CAAA;AAkBnF,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,UAAU,kBAAkB;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,UAAU,uBAAuB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAUD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,GAAE,gBAAqB,EAC/B,OAAO,GAAE,MAAM,CAAC,UAAwB,GACvC,MAAM,CAAC,UAAU,CAInB;AAMD,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAe9E;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAiBzF;AAiHD,wBAAsB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwG1F;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BlG;AAED,wBAAgB,WAAW,IAAI,IAAI,CAsBlC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAUjG;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAyB9C;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB7D;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkD5F;AAoED,wBAAgB,WAAW,IAAI,IAAI,CAsBlC"}
+{"version":3,"file":"profileCli.d.ts","sourceRoot":"","sources":["../../src/proxy/profileCli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAY/C,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGpF,eAAO,MAAM,eAAe,+CAA+C,CAAA;AAC3E,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,kBAAkB,oDAAoD,CAAA;AAsBnF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEpD;AAOD,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,UAAU,kBAAkB;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,UAAU,uBAAuB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,UAAU,kBAAkB;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,GAAE,gBAAqB,EAC/B,OAAO,GAAE,MAAM,CAAC,UAAwB,GACvC,MAAM,CAAC,UAAU,CAInB;AAMD,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAe9E;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAiBzF;AAuDD,KAAK,0BAA0B,GAAG,kBAAkB,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAA;AAMhF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,0BAA0B,EACrC,IAAI,EAAE,eAAe,EACrB,GAAG,GAAE,MAAmB,GACvB,eAAe,CAUjB;AAmFD,wBAAsB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyG1F;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BlG;AAED,wBAAgB,WAAW,IAAI,IAAI,CAyBlC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAUjG;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAyB9C;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAmB5D;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB7D;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,mBAAmB,CAAA;CAAE,GAC/B;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAA;AAE/C;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAKxF;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2D5F;AAoED,wBAAgB,WAAW,IAAI,IAAI,CAyBlC"}

package/dist/proxy/profileHealth.d.ts

@@ -0,0 +1,127 @@
+/**
+ * What we know, right now, about accounts that have just been refused.
+ *
+ * Two stores, both in-memory and both deliberately not persisted - this is
+ * observability and routing hygiene, not durable truth. After a restart the
+ * next refusal re-establishes everything.
+ *
+ * `SpentStore` holds the latest refusal per profile, so a UI can say "this
+ * account is refusing" alongside the cached percentages instead of replacing
+ * them. Measured on the live fleet: an account rendered `5h 67% / 7d 7%` while
+ * every request through it was being refused, because those percentages are a
+ * snapshot of the last successful read and a refusal never touched them.
+ *
+ * `FailoverEventLog` is a bounded, monotonically numbered event ring so an
+ * external supervisor (vibeterm's account switcher) can poll for refusals and
+ * failovers. It exists because `claudeLog("profile.failover", …)` went to the
+ * log and nowhere else, and because `/telemetry/requests` - the obvious place
+ * to look - is a 500-row ring with no cursor, so a poller cannot tell "nothing
+ * happened" from "it scrolled past between polls". The `since` cursor here is
+ * the fix for exactly that.
+ *
+ * Leaf module: no I/O, no imports from server.ts. Clocks are injectable so the
+ * tests do not depend on wall time.
+ */
+import type { LimitDiagnosis } from "./limitDetection";
+export interface SpentRecord {
+    profileId: string;
+    /** When the refusal was observed (epoch ms). */
+    at: number;
+    diagnosis: LimitDiagnosis;
+    /** When this account is expected to serve again, when known. */
+    until: number | null;
+    /** Truncated raw SDK message - the operator's evidence for the verdict. */
+    message: string;
+}
+/**
+ * Latest refusal per profile, dropped on read once it expires (the same
+ * read-time expiry `ProfileExhaustion` uses, so the two never disagree about
+ * whether an account is currently in trouble).
+ */
+export declare class SpentStore {
+    private readonly now;
+    private readonly records;
+    constructor(now?: () => number);
+    /**
+     * Record a refusal. A later record always replaces an earlier one: unlike an
+     * exhaustion mark (where a longer cooldown must win), the newest refusal is
+     * by definition the best description of the account's current state.
+     */
+    record(profileId: string, diagnosis: LimitDiagnosis, message: string): SpentRecord;
+    get(profileId: string): SpentRecord | undefined;
+    /** Live records only - expired ones are dropped on read. */
+    snapshot(): SpentRecord[];
+    clear(): void;
+}
+/**
+ * `refused`        - an account said no. Emitted in every routing mode, so an
+ *                    exhausted account is visible even when nothing failed over.
+ * `failover`       - a request was re-issued on another account and succeeded,
+ *                    so the client never saw the refusal.
+ * `pool_exhausted` - every candidate refused; the client got the error.
+ */
+export type FailoverEventKind = "refused" | "failover" | "pool_exhausted";
+export interface FailoverEvent {
+    /** Monotonic, starts at 1, never reused. The `since` cursor. */
+    seq: number;
+    at: number;
+    kind: FailoverEventKind;
+    /** The account that refused. */
+    profile: string;
+    /** The account that served the request instead, for `failover`. */
+    servedBy: string | null;
+    reason: string;
+    /** Routing mode in effect when this happened. */
+    routing: string;
+    sessionKey: string | null;
+    /**
+     * True when this refusal happened on an internal re-proxy hop, meaning the
+     * client did not see it. A `refused` event with `internalHop: false` is one
+     * the connected agent actually received.
+     */
+    internalHop: boolean;
+    until: number | null;
+    limit: LimitDiagnosis | null;
+}
+export interface FailoverEventPage {
+    events: FailoverEvent[];
+    /**
+     * Cursor for the next poll. The seq of the LAST RETURNED event, or the
+     * requested `since` when nothing was returned - never the ring's newest seq,
+     * because a page truncated by `limit` would then skip the remainder.
+     */
+    nextSince: number;
+    oldestSeq: number;
+    latestSeq: number;
+    /**
+     * True when events between the requested `since` and the oldest retained one
+     * were evicted, so the caller knows it missed some rather than believing it
+     * has seen everything.
+     */
+    dropped: boolean;
+    capacity: number;
+}
+/**
+ * Bounded ring of refusal/failover events, oldest-first on read.
+ *
+ * Capacity is generous relative to the event rate (one per refusal, not one per
+ * request), so a consumer polling every few seconds cannot outrun it; `dropped`
+ * exists for the case where a consumer was away long enough that it did.
+ */
+export declare class FailoverEventLog {
+    private readonly capacity;
+    private readonly now;
+    private readonly events;
+    private seq;
+    constructor(capacity?: number, now?: () => number);
+    append(event: Omit<FailoverEvent, "seq" | "at"> & {
+        at?: number;
+    }): FailoverEvent;
+    /**
+     * Events strictly after `since`, oldest-first. `since = 0` returns everything
+     * retained, which is what a consumer starting cold wants.
+     */
+    since(since: number, limit?: number): FailoverEventPage;
+    clear(): void;
+}
+//# sourceMappingURL=profileHealth.d.ts.map

package/dist/proxy/profileHealth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profileHealth.d.ts","sourceRoot":"","sources":["../../src/proxy/profileHealth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEtD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,cAAc,CAAA;IACzB,gEAAgE;IAChE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAA;CAChB;AAWD;;;;GAIG;AACH,qBAAa,UAAU;IAGT,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;gBAE5B,GAAG,GAAE,MAAM,MAAiB;IAEzD;;;;OAIG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW;IAiBlF,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAU/C,4DAA4D;IAC5D,QAAQ,IAAI,WAAW,EAAE;IASzB,KAAK,IAAI,IAAI;CAGd;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAA;AAEzE,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,iBAAiB,CAAA;IACvB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,mEAAmE;IACnE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAKD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAKzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,GAAG,CAAI;gBAGI,QAAQ,GAAE,MAA+B,EACzC,GAAG,GAAE,MAAM,MAAiB;IAG/C,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa;IAOjF;;;OAGG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAA2B,GAAG,iBAAiB;IAkB3E,KAAK,IAAI,IAAI;CAId"}

package/dist/proxy/profileRename.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Profile renaming.
+ *
+ * A rename has to move everything that names a profile: its entry in
+ * profiles.json and, when its credentials live under
+ * ~/.config/meridian/profiles/<id>, the credential directory itself. Renaming
+ * the entry alone would leave the profile pointing at a directory that is no
+ * longer its own — an account logged out by a cosmetic change — so both are
+ * planned together and applied as one step that either happens or does not.
+ *
+ * The old name survives as an ALIAS on the renamed profile. It is a redirect,
+ * not a second name: after `x` is renamed to `y`, `x-meridian-profile: x` is
+ * served by `y`, and the moment `x` is claimed again — by `profile add x`, or
+ * by renaming something else to `x` — the redirect is dropped.
+ *
+ * Chains are collapsed on write. Renaming x→y and later y→z leaves z holding
+ * both "x" and "y", so resolution is a single lookup and no alias can dangle
+ * at an intermediate name that no longer exists.
+ *
+ * This is a leaf module — no imports from server.ts or session/.
+ */
+import type { ProfileConfig } from "./profiles";
+export declare function isValidProfileId(id: string): boolean;
+export declare function defaultProfilesDir(): string;
+export declare function defaultProfilesConfigFile(): string;
+export declare function loadProfileConfigFrom(file: string): ProfileConfig[];
+export declare function saveProfileConfigTo(file: string, profiles: ProfileConfig[]): void;
+/**
+ * Drop `name` from every profile's alias list — a real profile is claiming the
+ * name, so the redirect has to stop. Profiles with nothing to drop are
+ * returned as-is.
+ */
+export declare function reclaimAlias(profiles: ProfileConfig[], name: string): ProfileConfig[];
+export interface ProfileRenamePlan {
+    /** The complete profile list as it should be written to disk. */
+    profiles: ProfileConfig[];
+    /** Credential directory to move, when this profile keeps one under profilesDir. */
+    dirMove?: {
+        from: string;
+        to: string;
+    };
+    /** Aliases the renamed profile ends up carrying, chains already collapsed. */
+    aliases: string[];
+}
+export type ProfileRenameResult = {
+    ok: true;
+    plan: ProfileRenamePlan;
+} | {
+    ok: false;
+    error: string;
+    hint?: string;
+};
+/**
+ * Pure: decide what a rename would change. Refuses rather than corrupting —
+ * an unknown source, an occupied target, or a name the charset rejects each
+ * come back as an error with nothing planned.
+ */
+export declare function planProfileRename(profiles: ProfileConfig[], from: string, to: string, profilesDir: string): ProfileRenameResult;
+export interface ApplyProfileRenameOptions {
+    /** Directory holding per-profile credential dirs. Defaults to the real one. */
+    profilesDir?: string;
+    /** profiles.json path. Defaults to the real one. */
+    configFile?: string;
+}
+export type ApplyProfileRenameResult = {
+    ok: true;
+    from: string;
+    to: string;
+    aliases: string[];
+    profiles: ProfileConfig[];
+} | {
+    ok: false;
+    error: string;
+    hint?: string;
+};
+/**
+ * Apply a rename to disk: credentials first, then the profile list, then the
+ * active pointer. If the profile list cannot be written the credential move is
+ * undone, so the profile is never left naming a directory that moved out from
+ * under it.
+ */
+export declare function applyProfileRename(from: string, to: string, options?: ApplyProfileRenameOptions): ApplyProfileRenameResult;
+//# sourceMappingURL=profileRename.d.ts.map

package/dist/proxy/profileRename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profileRename.d.ts","sourceRoot":"","sources":["../../src/proxy/profileRename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAK/C,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CASnE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CAGjF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CASrF;AAED,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,mFAAmF;IACnF,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/C;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,aAAa,EAAE,EACzB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,mBAAmB,CA2CrB;AAED,MAAM,WAAW,yBAAyB;IACxC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE,GACpF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,yBAA8B,GACtC,wBAAwB,CAwD1B"}