agent-shim 8.14.0 → 8.15.0

package/dist/types/index.d.ts

@@ -3,9 +3,11 @@ import { z } from 'zod';
 import { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
 import * as net from 'node:net';
 import { Duplex } from 'node:stream';
+import * as _orpc_client from '@orpc/client';
 import * as zod_v4_core from 'zod/v4/core';
 import * as _orpc_server from '@orpc/server';
-import { RouterClient } from '@orpc/server';
+import { RouterClient, AnyRouter } from '@orpc/server';
+import { RPCLink } from '@orpc/client/fetch';
 
 /**
  * Every category a `~/.claude` entry can be classified into. `secret` is deliberately part of this list — it is a real classification the resolver acts on — but it is NOT part of `CategoryMapSchema`'s shape, because no configuration layer may ever toggle it. See OVERRIDABLE_CATEGORIES.
@@ -766,7 +768,8 @@ interface ClassifyResult {
 /** A layer's index in the assembled cascade. Strictly ascending in composition order: a higher id was composed later and therefore wins on the comparator's first rank. */
 type LayerId = number;
 /** Where a cascade layer came from. Purely descriptive — precedence is carried by `LayerId`, never by kind. */
-type LayerKind = "global-config" | "config-profile" | "directory-rule" | "portable" | "portable-local" | "cli-override";
+declare const LAYER_KINDS: readonly ["global-config", "config-profile", "directory-rule", "portable", "portable-local", "cli-override"];
+type LayerKind = (typeof LAYER_KINDS)[number];
 /** One composable layer of the cascade: its own category toggles and entries overrides, plus the entries key order captured at load time. */
 interface Layer {
     readonly id: LayerId;
@@ -837,17 +840,8 @@ interface CompiledRule {
     readonly matches: (relPath: string) => boolean;
 }
 /** How a decision was reached, for `agent-shim check`'s "which layer decided this" output. */
-type DecisionVia = 
-/** The unconditional pre-cascade floor: the path's real classification is `secret`. */
-"secret-floor"
-/** Nothing in the classification map recognises the path's top-level entry. */
- | "unclassified"
-/** An entries rule matched and its condition (if any) held. */
- | "entry-rule"
-/** No entries rule survived; a layer's category toggle decided it. */
- | "category-override"
-/** No entries rule and no category toggle; the shipped default for the category decided it. */
- | "category-default";
+declare const DECISION_VIAS: readonly ["secret-floor", "unclassified", "entry-rule", "category-override", "category-default"];
+type DecisionVia = (typeof DECISION_VIAS)[number];
 /** One entry's resolved sharing decision plus the reasoning behind it. */
 interface Decision {
     readonly relPath: string;
@@ -865,41 +859,11 @@ interface EliminatedRule {
     readonly failed: readonly string[];
 }
 /** Every diagnostic the resolver can raise. Codes are stable strings so `agent-shim check` and tests can assert on them. */
-type DiagnosticCode = 
-/** A profile's `extends` graph contains a cycle. */
-"EXTENDS_CYCLE"
-/** An `extends` entry names a profile that does not exist. */
- | "MISSING_PROFILE"
-/** An entries key was written under the `secret/` prefix. Rejected at compile time — `secret` can never be overridden by any layer. */
- | "SECRET_ENTRY_KEY"
-/** An entries key under some other prefix matched a path whose real classification is `secret`. Neutralised at resolve time by the floor check. */
- | "SECRET_PATH_NEUTRALISED"
-/** An entries key's declared category prefix disagrees with the real classification of a path it matched. */
- | "CATEGORY_PREFIX_MISMATCH"
-/** An entries key is not of the form `<category>/<path>`. The schema rejects these at parse time; this fires only for a layer built in code. */
- | "MALFORMED_ENTRY_KEY"
-/** An earlier layer's exact key lost to a later layer's glob. Correct per the comparator, but worth surfacing rather than resolving silently. */
- | "EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB"
-/** A `history/projects/` pattern's encoded form could plausibly correspond to more than one real path. */
- | "AMBIGUOUS_PROJECT_ENCODING"
-/** A `history/projects/` key's path fragment is neither home-rooted nor absolute, so it cannot be encoded. */
- | "UNROOTED_PROJECT_PATH"
-/** A `~/.claude` entry nothing in the classification map recognises. */
- | "UNCLASSIFIED_ENTRY"
-/** An empty `when: {}` object, which is vacuously true and therefore has no effect. */
- | "EMPTY_WHEN"
-/** The previous farm's manifest is missing or unreadable, so reconciliation ran in conservative mode. */
- | "FARM_MANIFEST_MISSING"
-/** A file Claude Code wrote into a materialised farm directory differs from the canonical copy of the same path. */
- | "RECONCILE_CONFLICT"
-/** Reconciliation proposed adopting a path whose real classification is `secret`. Refused: the secret floor applies to data moving into `~/.claude` exactly as it applies to data moving out. */
- | "RECONCILE_SECRET_BLOCKED"
-/** A previous launch was interrupted mid-swap and this launch completed or undid the half-finished work. */
- | "FARM_SWAP_RECOVERED"
-/** A superseded farm could not be discarded because it still held data the new farm has its own entry for, so it was left on disk for the user to look at. */
- | "FARM_PREVIOUS_RETAINED";
+declare const DIAGNOSTIC_CODES: readonly ["EXTENDS_CYCLE", "MISSING_PROFILE", "SECRET_ENTRY_KEY", "SECRET_PATH_NEUTRALISED", "CATEGORY_PREFIX_MISMATCH", "MALFORMED_ENTRY_KEY", "EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB", "AMBIGUOUS_PROJECT_ENCODING", "UNROOTED_PROJECT_PATH", "UNCLASSIFIED_ENTRY", "EMPTY_WHEN", "FARM_MANIFEST_MISSING", "RECONCILE_CONFLICT", "RECONCILE_SECRET_BLOCKED", "FARM_SWAP_RECOVERED", "FARM_PREVIOUS_RETAINED"];
+type DiagnosticCode = (typeof DIAGNOSTIC_CODES)[number];
 /** Severity of a diagnostic. An `error` means a configuration layer asked for something the tool refused to do. */
-type DiagnosticSeverity = "error" | "warning" | "info";
+declare const DIAGNOSTIC_SEVERITIES: readonly ["error", "warning", "info"];
+type DiagnosticSeverity = (typeof DIAGNOSTIC_SEVERITIES)[number];
 /** One structured diagnostic. */
 interface Diagnostic {
     readonly code: DiagnosticCode;
@@ -2222,6 +2186,14 @@ interface HeadroomSocketTrustPorts {
     /** Stats one path without following symlinks, or returns undefined when nothing is there. */
     readonly lstat: (target: string) => SocketPathStat | undefined;
 }
+/** Either a socket path the hop may dial, or the reason it must not: the two never appear together. */
+type HeadroomSocketTarget = {
+    readonly socketPath: string;
+    readonly refused?: never;
+} | {
+    readonly refused: string;
+    readonly socketPath?: never;
+};
 
 /**
  * A secondary pre-pipeline surface the listener answers under one path prefix: the typed Remote Control API. The listener owns only the dispatch (the prefix and the not-matched 404); the handle itself is whatever the door built, so this file stays independent of the API framework behind it.
@@ -2239,6 +2211,8 @@ interface PrePipelineApi {
  * The Remote Control operations as a typed oRPC API, so programmatic consumers (automation, a mobile or web client, another of this user's tools) get a generated type-safe client instead of hand-rolled HTTP. One procedure per existing operation, each wrapping the same operation the bespoke token-gated routes wrap (the routes stay: the CLI uses them), with inputs and outputs validating through the Zod schemas of `rcSchemas.ts`, which the operations' own values must satisfy, so contract and behaviour share one schema source and cannot drift apart silently.
  *
  * Mounted on the provider listener beside the bespoke namespace, authenticated by the same per-generation owner-only control token as a Bearer credential: a fresh random value per door start, written owner-only under the front door's state directory, and checked in constant time like every other capability the door accepts. `rc.subscribe` streams the client attachment's fan-out: every event the door's held stream produced, SSE-framed by oRPC's event iterator, each carrying its sequence number as the SSE event id so a consumer's own reconnect can resume exactly as the door's does.
+ *
+ * This module also owns the mount's router-agnostic plumbing, which the control-plane routers (`controlApi.ts`) serve on the same prefix under the same token: the control-token middleware (`doorApiAuth`), the node-handler builder (`doorApiNodeHandlerOf`) and the TLS-pinned client link (`frontDoorApiLink`).
  */
 /** The one path prefix the typed API is mounted under, answered before the routed pipeline like the bespoke control routes are. */
 declare const RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
@@ -2265,29 +2239,23 @@ interface RcApiDeps {
     /** The client attachment's fan-out, whose events the subscription yields. */
     readonly fanout: RcEventFanout;
 }
+/** The context every procedure on the door's typed API runs in: the request's own headers, which the control-token middleware reads the Bearer credential from. */
+interface DoorApiContext {
+    readonly headers: IncomingHttpHeaders;
+}
+/** Builds the middleware every procedure on the door's typed API sits behind, whichever router it belongs to: the per-generation owner-only control token, presented as a Bearer credential and checked in constant time like every other capability the door accepts. */
+declare function doorApiAuth(expectedToken: string): _orpc_server.BuilderWithMiddlewares<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, Schema<unknown, unknown>, Record<never, never>, Record<never, never>>;
 /** Builds the typed API's router: one procedure per operation, every one behind the control-token middleware. */
 declare function createRcApiRouter(deps: RcApiDeps): {
     rc: {
-        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
-            readonly headers: IncomingHttpHeaders;
-        } & Record<never, never>, {
-            readonly headers: IncomingHttpHeaders;
-        }, {
-            readonly headers: IncomingHttpHeaders;
-        }>, any, Schema<unknown, unknown>, zod.ZodObject<{
+        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
             sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
                 id: zod.ZodString;
                 createdAt: zod.ZodNumber;
                 lastSeenAt: zod.ZodNumber;
             }, zod_v4_core.$strict>>>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
-            readonly headers: IncomingHttpHeaders;
-        } & Record<never, never>, {
-            readonly headers: IncomingHttpHeaders;
-        }, {
-            readonly headers: IncomingHttpHeaders;
-        }>, any, zod.ZodObject<{
+        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             statuses: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
@@ -2311,13 +2279,7 @@ declare function createRcApiRouter(deps: RcApiDeps): {
                 lastSeenAt: zod.ZodNumber;
             }, zod_v4_core.$strict>>>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        pending: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
-            readonly headers: IncomingHttpHeaders;
-        } & Record<never, never>, {
-            readonly headers: IncomingHttpHeaders;
-        }, {
-            readonly headers: IncomingHttpHeaders;
-        }>, any, zod.ZodObject<{
+        pending: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             pending: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
@@ -2328,26 +2290,14 @@ declare function createRcApiRouter(deps: RcApiDeps): {
                 observedAt: zod.ZodNumber;
             }, zod_v4_core.$strict>>>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        send: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
-            readonly headers: IncomingHttpHeaders;
-        } & Record<never, never>, {
-            readonly headers: IncomingHttpHeaders;
-        }, {
-            readonly headers: IncomingHttpHeaders;
-        }>, any, zod.ZodObject<{
+        send: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
             session: zod.ZodString;
             text: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        answer: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
-            readonly headers: IncomingHttpHeaders;
-        } & Record<never, never>, {
-            readonly headers: IncomingHttpHeaders;
-        }, {
-            readonly headers: IncomingHttpHeaders;
-        }>, any, zod.ZodObject<{
+        answer: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             approve: zod.ZodBoolean;
@@ -2357,38 +2307,20 @@ declare function createRcApiRouter(deps: RcApiDeps): {
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        interrupt: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
-            readonly headers: IncomingHttpHeaders;
-        } & Record<never, never>, {
-            readonly headers: IncomingHttpHeaders;
-        }, {
-            readonly headers: IncomingHttpHeaders;
-        }>, any, zod.ZodObject<{
+        interrupt: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
             session: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        setModel: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
-            readonly headers: IncomingHttpHeaders;
-        } & Record<never, never>, {
-            readonly headers: IncomingHttpHeaders;
-        }, {
-            readonly headers: IncomingHttpHeaders;
-        }>, any, zod.ZodObject<{
+        setModel: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
             session: zod.ZodString;
             model: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        setPermissionMode: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
-            readonly headers: IncomingHttpHeaders;
-        } & Record<never, never>, {
-            readonly headers: IncomingHttpHeaders;
-        }, {
-            readonly headers: IncomingHttpHeaders;
-        }>, any, zod.ZodObject<{
+        setPermissionMode: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
             session: zod.ZodString;
             mode: zod.ZodEnum<{
                 default: "default";
@@ -2402,13 +2334,7 @@ declare function createRcApiRouter(deps: RcApiDeps): {
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        subscribe: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
-            readonly headers: IncomingHttpHeaders;
-        } & Record<never, never>, {
-            readonly headers: IncomingHttpHeaders;
-        }, {
-            readonly headers: IncomingHttpHeaders;
-        }>, any, zod.ZodObject<{
+        subscribe: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, any, Record<never, never>, Record<never, never>>;
     };
@@ -2416,197 +2342,854 @@ declare function createRcApiRouter(deps: RcApiDeps): {
 /** The typed API's router, as the CLI-side client's own type is derived from it. */
 type RcApiRouter = ReturnType<typeof createRcApiRouter>;
 /**
- * Builds the typed API's node handler, already bound to its mount prefix and context: the pre-pipeline surface the provider listener hands every request under `RC_ORPC_PATH_PREFIX`, answering with `matched: false` for a path under the prefix that names no procedure (which the listener itself answers as a 404). Request bodies are bounded by the same protocol cap the bespoke routes apply.
+ * Builds the node handler that serves one router of the door's typed API under the mount's one prefix: the pre-pipeline surface the provider listener hands every request under `RC_ORPC_PATH_PREFIX`, answering with `matched: false` for a path under the prefix that names no procedure (which the listener itself answers as a 404). Request bodies are bounded by the same protocol cap the bespoke routes apply. Every router the mount serves (Remote Control and the control plane) goes through this one builder, so the prefix, the context and the cap are stated once.
+ */
+declare function doorApiNodeHandlerOf(router: AnyRouter): PrePipelineApi;
+/**
+ * Builds the typed API's node handler for the Remote Control router alone: the pre-pipeline surface the provider listener hands every request under `RC_ORPC_PATH_PREFIX`.
  */
 declare function createRcApiNodeHandler(deps: RcApiDeps): PrePipelineApi;
 /** The typed API's client as the `frontdoor rc` verbs use it: every call presents the control token, over TLS trusting only the CA file the door's own state names. */
 type RcApiClient = RouterClient<RcApiRouter>;
+/** Builds the link every client of the door's typed API dials through: the door's address under the mount prefix, the per-generation control token on every call, and TLS trusting only the CA the door's own state names. */
+declare function frontDoorApiLink(port: number, ca: string, token: string): RPCLink<_orpc_client.ClientContext>;
 /** Builds the typed API's client for the door's provider listener: the same address, CA and per-generation control token the bespoke control client uses. */
 declare function frontDoorRcApiClient(port: number, ca: string, token: string): RcApiClient;
 
 /**
- * The self-hosted Remote Control service: the door serving, locally, the CCR surface it normally only observes (ExaDev/agent-shim#207). When the mode is on, a Claude Code session activates Remote Control against this surface and is controlled through it with no Anthropic credential anywhere: the door answers the session family itself instead of piping it to the real API host, so the `cse_` sessions, their sequence numbers, their worker and client streams and their event writes all live on this machine.
- *
- * The protocol spoken is exactly the one the door already speaks as a client, which is what makes this honest: every path, envelope, sequence rule and resume pair below is the shape the merged client-half machinery (`rcSessions.ts`, `rcStream.ts`, `connectEffects.ts`) dials the real host with, cross-checked against the CLI source (the 2.1.88 source-map dump behind the issue's spike) and live 2.1.289 envelopes captured through the interception rig. The transport is version-unstable (CCRv1 websocket to CCRv2 SSE plus POST within the 2.1.x line), so this surface pins what the rig's pinned CLI speaks and must be re-verified on upgrades; that standing caveat is issue #207's own.
- *
- * Division of the surface: the session family (`/v1/code/sessions...` and the `/v1/sessions` compatibility list) rides the routed pipeline as a `FrontDoorRoute`, so it flows through the same admission and middleware as any routed request and, above all, through the same observation wrapper that feeds the tracker (the door's own client half learns each session's credential precisely because the create is observed like any other exchange). The non-`/v1/` answers the CLI needs around activation (feature eval, profile, telemetry no-ops) and the OAuth refresh on the control-plane host have no pipeline to ride, so they are served by `local`, which the connect surface consults before routing or piping; that surface also takes over the control-plane host's terminated session as ordinary HTTP (it is normally byte-tapped) because answering `/v1/oauth/token` requires parsing it.
- *
- * The one network lever this uses is the bridge response's `api_base_url`: the protocol lets the server name where the worker dials, so the door names the API host it itself terminates, and the worker's `/worker/...` calls arrive straight back at this surface over the same interception that carried the create.
- *
- * Everything is in memory only and dies with the door process: sessions, events, worker JWTs. No credential this door authenticates against is ever written or logged by this module; the minting command owns the files.
- */
-/** The environment variable that turns the self-hosted Remote Control service on, read once at door start like the door's other mode selections: the door is one process serving every launch, so the mode is a property of the door, not of any one launch. Anything but `1` means off, the same exact-value vocabulary the capture toggle uses. */
-declare const RC_SELF_HOST_ENV = "AGENT_SHIM_FRONTDOOR_RC_SELF_HOST";
-/** Whether the environment asked for the self-hosted Remote Control service. */
-declare function rcSelfHostFromEnv(env: NodeJS.ProcessEnv): boolean;
-/** The full scope list the minting writes and the local refresh echoes: the CLI's own claude.ai login scope set (`CLAUDE_AI_OAUTH_SCOPES` in its source), whose `user:inference` and `user:profile` members are exactly the two the Remote Control gate demands. */
-declare const RC_SELF_HOST_SCOPE_LIST: readonly string[];
-/**
- * How long a minted worker JWT is good for. Not a fresh number: 46800 seconds is the `expires_in` the real bridge handed the live rig session (13 hours), so the local surface keeps the CLI's refresh cadence exactly where the real one put it.
- */
-declare const RC_SELF_HOST_WORKER_JWT_TTL_SECONDS = 46800;
-/**
- * How often the SSE streams send a keepalive comment. Not a fresh number: it is the protocol's own keepalive cadence (the 15 s comments the door's client-half parser documents from live captures), and it must beat the worker transport's 45 s liveness bound (`DIY` in the CLI source), which a 15 s cadence does with two comments to spare.
- */
-declare const RC_SELF_HOST_KEEPALIVE_MS = 15000;
+ * The Zod schema of `agent-shim check --json`'s output: one definition of the report's wire shape, so the JSON conversion (`checkReportToJson`, whose return type is this schema's inferred type, which makes the compiler prove the two agree) and every programmatic consumer of the report (the front door's `check.run` procedure above all) validate through the same source. A plain Zod leaf mirroring the shapes the report's own modules define; the vocabularies it switches on (layer kinds, decision routes, diagnostic codes and severities, decision sources) are imported as const arrays from those modules rather than restated here, so a vocabulary added there is a compile error here until this schema names it.
+ */
+/** Which credential a launch would use, as the report's own credential block states it. */
+declare const CHECK_CREDENTIAL_APPLIES: readonly ["provider", "identity", "stored-login"];
+/** Everything `agent-shim check` reports about one directory, as `check --json` prints it and the door's `check.run` procedure returns it. */
+declare const CheckReportJsonSchema: z.ZodObject<{
+    identity: z.ZodObject<{
+        name: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            "config-dir-escape-hatch": "config-dir-escape-hatch";
+            argv: "argv";
+            env: "env";
+            "directory-pin": "directory-pin";
+            "active-identity-file": "active-identity-file";
+            none: "none";
+        }>;
+    }, z.core.$strict>;
+    pool: z.ZodOptional<z.ZodObject<{
+        pool: z.ZodString;
+        directory: z.ZodString;
+        pick: z.ZodOptional<z.ZodString>;
+        candidates: z.ZodArray<z.ZodObject<{
+            identity: z.ZodString;
+            class: z.ZodEnum<{
+                unknown: "unknown";
+                scored: "scored";
+                "pay-per-use": "pay-per-use";
+                ineligible: "ineligible";
+            }>;
+            score: z.ZodOptional<z.ZodNumber>;
+            feasible: z.ZodBoolean;
+            blockedUntil: z.ZodOptional<z.ZodISODateTime>;
+            plan: z.ZodUnion<readonly [z.ZodObject<{
+                kind: z.ZodLiteral<"subscription">;
+                capacity: z.ZodNumber;
+                recognised: z.ZodBoolean;
+                tier: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"pay-per-use">;
+                tier: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>]>;
+            reasons: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+        missing: z.ZodArray<z.ZodString>;
+        earliestReturn: z.ZodOptional<z.ZodObject<{
+            identity: z.ZodString;
+            at: z.ZodISODateTime;
+        }, z.core.$strict>>;
+        stickyProblem: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    configProfile: z.ZodObject<{
+        name: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            "directory-rule": "directory-rule";
+            env: "env";
+            none: "none";
+            "cli-flag": "cli-flag";
+            "identity-default": "identity-default";
+            "global-default": "global-default";
+        }>;
+    }, z.core.$strict>;
+    layers: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        id: z.ZodInt;
+        kind: z.ZodEnum<{
+            "global-config": "global-config";
+            "config-profile": "config-profile";
+            "directory-rule": "directory-rule";
+            portable: "portable";
+            "portable-local": "portable-local";
+            "cli-override": "cli-override";
+        }>;
+        source: z.ZodString;
+    }, z.core.$strict>>>;
+    entries: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        shared: z.ZodBoolean;
+        via: z.ZodEnum<{
+            "secret-floor": "secret-floor";
+            unclassified: "unclassified";
+            "entry-rule": "entry-rule";
+            "category-override": "category-override";
+            "category-default": "category-default";
+        }>;
+        category: z.ZodNullable<z.ZodEnum<{
+            secret: "secret";
+            runtime: "runtime";
+            history: "history";
+            knowledge: "knowledge";
+            settings: "settings";
+        }>>;
+        rule: z.ZodOptional<z.ZodObject<{
+            key: z.ZodString;
+            layer: z.ZodInt;
+        }, z.core.$strict>>;
+        eliminated: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            failed: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>>;
+    }, z.core.$strict>>>;
+    projectEncodingAmbiguities: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        fragment: z.ZodString;
+        encoded: z.ZodString;
+        reason: z.ZodEnum<{
+            "lossy-characters": "lossy-characters";
+            "collides-with-sibling-pattern": "collides-with-sibling-pattern";
+        }>;
+        detail: z.ZodString;
+    }, z.core.$strict>>>;
+    diagnostics: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        code: z.ZodEnum<{
+            EXTENDS_CYCLE: "EXTENDS_CYCLE";
+            MISSING_PROFILE: "MISSING_PROFILE";
+            SECRET_ENTRY_KEY: "SECRET_ENTRY_KEY";
+            SECRET_PATH_NEUTRALISED: "SECRET_PATH_NEUTRALISED";
+            CATEGORY_PREFIX_MISMATCH: "CATEGORY_PREFIX_MISMATCH";
+            MALFORMED_ENTRY_KEY: "MALFORMED_ENTRY_KEY";
+            EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB: "EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB";
+            AMBIGUOUS_PROJECT_ENCODING: "AMBIGUOUS_PROJECT_ENCODING";
+            UNROOTED_PROJECT_PATH: "UNROOTED_PROJECT_PATH";
+            UNCLASSIFIED_ENTRY: "UNCLASSIFIED_ENTRY";
+            EMPTY_WHEN: "EMPTY_WHEN";
+            FARM_MANIFEST_MISSING: "FARM_MANIFEST_MISSING";
+            RECONCILE_CONFLICT: "RECONCILE_CONFLICT";
+            RECONCILE_SECRET_BLOCKED: "RECONCILE_SECRET_BLOCKED";
+            FARM_SWAP_RECOVERED: "FARM_SWAP_RECOVERED";
+            FARM_PREVIOUS_RETAINED: "FARM_PREVIOUS_RETAINED";
+        }>;
+        severity: z.ZodEnum<{
+            error: "error";
+            warning: "warning";
+            info: "info";
+        }>;
+        message: z.ZodString;
+        subject: z.ZodOptional<z.ZodString>;
+        layer: z.ZodOptional<z.ZodInt>;
+    }, z.core.$strict>>>;
+    ambientCredential: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        variable: z.ZodString;
+        message: z.ZodString;
+    }, z.core.$strict>]>;
+    keychain: z.ZodOptional<z.ZodObject<{
+        checked: z.ZodLiteral<true>;
+        found: z.ZodBoolean;
+        serviceName: z.ZodOptional<z.ZodString>;
+        note: z.ZodString;
+    }, z.core.$strict>>;
+    settingsExposure: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        file: z.ZodString;
+        envKeyNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        hookEventNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        hookCommandCount: z.ZodInt;
+    }, z.core.$strict>>>;
+    credential: z.ZodObject<{
+        applies: z.ZodEnum<{
+            identity: "identity";
+            provider: "provider";
+            "stored-login": "stored-login";
+        }>;
+        provider: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            name: z.ZodString;
+            credential: z.ZodObject<{
+                target: z.ZodEnum<{
+                    bearer: "bearer";
+                    apiKey: "apiKey";
+                    oauthToken: "oauthToken";
+                }>;
+                sources: z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                    kind: z.ZodLiteral<"env">;
+                    variable: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"file">;
+                    path: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"command">;
+                    program: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"op">;
+                    reference: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"keychain">;
+                    service: z.ZodString;
+                    account: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"literal">;
+                }, z.core.$strict>]>>>;
+                cache: z.ZodOptional<z.ZodObject<{
+                    ttl: z.ZodOptional<z.ZodString>;
+                    store: z.ZodOptional<z.ZodEnum<{
+                        file: "file";
+                        keychain: "keychain";
+                    }>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            cached: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                store: z.ZodEnum<{
+                    file: "file";
+                    keychain: "keychain";
+                }>;
+                status: z.ZodLiteral<"empty">;
+            }, z.core.$strict>, z.ZodObject<{
+                store: z.ZodEnum<{
+                    file: "file";
+                    keychain: "keychain";
+                }>;
+                status: z.ZodLiteral<"unreadable">;
+                reason: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                store: z.ZodEnum<{
+                    file: "file";
+                    keychain: "keychain";
+                }>;
+                status: z.ZodEnum<{
+                    fresh: "fresh";
+                    expired: "expired";
+                }>;
+                ageMs: z.ZodNumber;
+                expiresInMs: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            name: z.ZodString;
+            problem: z.ZodString;
+        }, z.core.$strict>]>>;
+        identity: z.ZodOptional<z.ZodObject<{
+            target: z.ZodEnum<{
+                bearer: "bearer";
+                apiKey: "apiKey";
+                oauthToken: "oauthToken";
+            }>;
+            sources: z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                kind: z.ZodLiteral<"env">;
+                variable: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"file">;
+                path: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"command">;
+                program: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"op">;
+                reference: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"keychain">;
+                service: z.ZodString;
+                account: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"literal">;
+            }, z.core.$strict>]>>>;
+            cache: z.ZodOptional<z.ZodObject<{
+                ttl: z.ZodOptional<z.ZodString>;
+                store: z.ZodOptional<z.ZodEnum<{
+                    file: "file";
+                    keychain: "keychain";
+                }>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        identityCached: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            store: z.ZodEnum<{
+                file: "file";
+                keychain: "keychain";
+            }>;
+            status: z.ZodLiteral<"empty">;
+        }, z.core.$strict>, z.ZodObject<{
+            store: z.ZodEnum<{
+                file: "file";
+                keychain: "keychain";
+            }>;
+            status: z.ZodLiteral<"unreadable">;
+            reason: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            store: z.ZodEnum<{
+                file: "file";
+                keychain: "keychain";
+            }>;
+            status: z.ZodEnum<{
+                fresh: "fresh";
+                expired: "expired";
+            }>;
+            ageMs: z.ZodNumber;
+            expiresInMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>>;
+    }, z.core.$strict>;
+    claudeVersion: z.ZodOptional<z.ZodObject<{
+        pinned: z.ZodOptional<z.ZodObject<{
+            version: z.ZodString;
+            source: z.ZodEnum<{
+                flag: "flag";
+                environment: "environment";
+                cascade: "cascade";
+            }>;
+            installed: z.ZodBoolean;
+        }, z.core.$strict>>;
+        highestInstalled: z.ZodOptional<z.ZodString>;
+        installed: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type CheckReportJson = z.output<typeof CheckReportJsonSchema>;
+
+/** What a cache stores for one credential: the token, when it was fetched, and the source that produced it (a non-secret descriptor, kept so `check` and the launch log can still say where the token came from). */
+declare const CachedCredentialSchema: z.ZodObject<{
+    token: z.ZodString;
+    fetchedAt: z.ZodNumber;
+    source: z.ZodUnion<readonly [z.ZodObject<{
+        env: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        file: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        interactive: z.ZodOptional<z.ZodBoolean>;
+        timeoutMs: z.ZodOptional<z.ZodInt>;
+        command: z.ZodTuple<[z.ZodString], z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        interactive: z.ZodOptional<z.ZodBoolean>;
+        timeoutMs: z.ZodOptional<z.ZodInt>;
+        op: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        interactive: z.ZodOptional<z.ZodBoolean>;
+        timeoutMs: z.ZodOptional<z.ZodInt>;
+        keychain: z.ZodObject<{
+            service: z.ZodString;
+            account: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        literal: z.ZodString;
+    }, z.core.$strict>]>;
+}, z.core.$strict>;
+type CachedCredential = z.infer<typeof CachedCredentialSchema>;
 /**
- * How long a session's events are retained for stream resume, and how long a streamless, trafficless session survives. One number serves both because one protocol constant derives them: the worker transport's reconnection budget is 600000 ms (`WIY` in the CLI source), so a resume can only ever name a cursor whose events are at most that old, and a worker that has been gone longer has given up by its own rules.
+ * Where cached credentials live, injected so resolution and its tests need neither the Keychain nor a real directory. `owner` names what the credential belongs to (`identity work`, `provider z`) and is the entry's key; `store` picks the backing store. `read` returns undefined for a missing or unreadable entry, since an entry that cannot be used is the same as no entry.
  */
-declare const RC_SELF_HOST_RETENTION_MS = 600000;
-/** The whole credential this door's self-hosted mode mints, read back for every authenticated call and never logged: the token pair the identity's Claude Code presents, beside the organisation the minting chose. */
-interface RcSelfHostCredentialRecord {
-    readonly accessToken: string;
-    readonly refreshToken: string;
-    readonly organizationUuid: string;
-    readonly accountUuid: string;
-}
-/** Everything the service needs, injected so the decision logic runs against fakes in unit tests. */
-interface RcSelfHostDeps {
-    readonly now: () => number;
-    /** Mints the session and event ids: a v4 UUID or better in production. */
-    readonly newUuid: () => string;
-    /** Mints opaque token material (the worker JWTs): cryptographically random in production. */
-    readonly randomToken: () => string;
-    /** The minted credential this door authenticates against, read fresh so a re-mint takes effect without restarting the door; undefined while none was ever minted, in which case every authenticated call is refused. */
-    readonly credentialRecord: () => RcSelfHostCredentialRecord | undefined;
-    readonly log?: (line: string) => void;
-}
-/** The self-hosted Remote Control service: the session-family route for the pipeline, and the local answers the connect surface consults before routing or piping. */
-interface RcSelfHostSurface {
-    /** The pipeline route serving the whole `/v1/code/sessions` family and the `/v1/sessions` compatibility list. */
-    readonly route: FrontDoorRoute;
-    /** The connect surface's local answers: which hosts it takes over as HTTP, and the requests it answers itself. */
-    readonly local: {
-        /** The hosts whose terminated sessions this surface needs parsed as HTTP (the control-plane host, normally byte-tapped). */
-        readonly parsesHost: (host: string) => boolean;
-        /** Serves one request locally; resolves false when the surface does not own the path, so routing or piping continues unchanged. */
-        readonly serve: (host: string, request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
-    };
-    /** Stops the service's timers and retires every open stream. The sessions themselves are unreachable the moment the door drops them. */
-    readonly close: () => void;
-}
-/** Creates the self-hosted Remote Control service. One per door process; everything it holds dies with it. */
-declare function createRcSelfHostSurface(deps: RcSelfHostDeps): RcSelfHostSurface;
-
-/** Where the door's own copy of the minted credential lives, under the door's state directory. */
-declare const RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
-/** The door's copy of the minted credential: the record `rcSelfHost.ts` reads fresh on every authenticated call. */
-declare const RC_SELF_HOST_RECORD_FILE = "credential.json";
-/** Everything the minting needs, injected so it runs against an in-memory fake filesystem in unit tests. */
-interface RcSelfHostMintDeps {
-    readonly fs: Pick<FarmFs, "readFileUtf8" | "writeFilePrivate" | "mkdirPrivate">;
-    /** The agent-shim identities directory (the mint writes inside `<identitiesDir>/<identity>/`). */
-    readonly identitiesDir: string;
-    /** The door's state directory (the record is written under `<frontdoorDir>/rc-selfhost/`). */
-    readonly frontdoorDir: string;
-    readonly identity: string;
-    /** Mints ids: a v4 UUID or better in production. */
-    readonly newUuid: () => string;
-    /** Mints token material: cryptographically random bytes in production. */
-    readonly randomToken: () => string;
-    /** Overwrite an existing credential that is not a previous mint of this door's. */
-    readonly force: boolean;
-    readonly now: () => number;
-}
-/** What the minting produced: names and shapes only, never a token. */
-interface RcSelfHostMintResult {
-    readonly identity: string;
-    readonly organizationUuid: string;
-    readonly credentialsFile: string;
-    readonly claudeJsonFile: string;
-    readonly recordFile: string;
-    /** Whether a previous mint of this door's was replaced. */
-    readonly replaced: boolean;
+interface CredentialCachePort {
+    readonly read: (store: CredentialCacheStore, owner: string) => CachedCredential | undefined;
+    readonly write: (store: CredentialCacheStore, owner: string, entry: CachedCredential) => void;
+    readonly remove: (store: CredentialCacheStore, owner: string) => void;
 }
-/** Reads the door's previously minted record, or undefined when none exists (or what exists does not parse). */
-declare function readRcSelfHostRecord(fs: Pick<FarmFs, "readFileUtf8">, frontdoorDir: string): RcSelfHostCredentialRecord | undefined;
 /**
- * Mints the local credential for one identity and records the door's copy. Refuses, unless `force`, when the identity already holds an OAuth credential this door did not mint (a real claude.ai login): overwriting one silently would sign the identity out, and the mode's own contract is that no Anthropic credential is in play at all.
+ * What the cache holds for one credential, without the token: whether there is an entry, how old it is, and whether it is still within the block's TTL. `expiresInMs` is absent for a block with no expiry.
  */
-declare function mintRcSelfHostCredential(deps: RcSelfHostMintDeps): RcSelfHostMintResult;
-
-/** The outcome of authenticating the listener a front-door state file names. */
-type ListenerVerdict = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
+type CachedCredentialState = {
+    readonly store: CredentialCacheStore;
+    readonly status: "empty";
+}
+/** The store cannot be read here (the keychain store configured on a platform without a Keychain): reported with its reason rather than failing the whole report. */
+ | {
+    readonly store: CredentialCacheStore;
+    readonly status: "unreadable";
     readonly reason: string;
+} | {
+    readonly store: CredentialCacheStore;
+    readonly status: "fresh" | "expired";
+    readonly ageMs: number;
+    readonly expiresInMs?: number;
 };
 
-/** Raised when the front door cannot be brought up in time or has recorded a fatal error: a routed launch has no other way to reach its provider, so it must fail rather than start a session that can never answer. */
-declare class FrontDoorStartError extends CliError {
-    constructor(message: string);
-}
-/** Every effect the ensure step performs, injected so it runs against fakes in tests. */
-interface EnsureFrontDoorPorts {
-    readonly fs: HeadroomFs;
-    /** Zombie-aware liveness (see `realIsProcessRunning`). */
-    readonly isRunning: (pid: number) => boolean;
-    readonly now: () => number;
-    readonly sleep: (ms: number) => void;
-    /** Spawns the detached front-door supervisor, returning its pid. */
-    readonly spawnSupervisor: (paths: LayoutPaths) => number;
-    /** Authenticates the provider listener on `port`: a TLS handshake chaining to agent-shim's CA and a healthy answer, with no capability sent (see `probeFrontDoorSync`). */
-    readonly verifyListener: (port: number) => ListenerVerdict;
-    /** Asks a running front-door supervisor to exit, without waiting for it to: the caller polls `isRunning`. Only ever called for a pid whose recorded listener has just authenticated as agent-shim's own. */
-    readonly stopSupervisor: (pid: number) => void;
+/** What reading one `file` source found: nothing at that path, or its contents and permission bits. `mode` is undefined on a platform with no POSIX permission bits (Windows), where the looseness check cannot apply. */
+type SecretFileRead = {
+    readonly found: false;
+} | {
+    readonly found: true;
+    readonly content: string;
+    readonly mode: number | undefined;
+};
+/** The outcome of one credential command. `stderr` is empty for an interactive run, whose stderr goes to the terminal so a person sees any prompt. */
+interface CredentialCommandResult {
+    readonly status: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly timedOut: boolean;
 }
 /**
- * Brings the front door up for this launch, or finds it serving, and registers this launcher pid in its session registry: the fact that keeps the door from idling out while this session lives, and the record that holds this launch's capability token. The same lock-and-poll coordination as headroom's and the old codex daemon's ensure: the exclusive-create start lock decides which of several concurrent launches spawns the one supervisor, everyone waits on state.json, and a lock whose holder died is removed and retried. Ready means state names a live supervisor and both listeners' ports, which the supervisor writes only after both have bound (and the provider listener has answered its own health probe).
- *
- * A live pid in state proves nothing about who holds the port it names: the door may have crashed and left the port to anyone, or the pid may have been reused by an unrelated process. So before anything is registered or returned, the provider listener is authenticated over TLS against agent-shim's CA. A listener that fails (wrong certificate, nothing answering, a bad answer) is treated as a stale or hostile owner: its pid is distrusted for the rest of this call and a replacement supervisor is spawned, which binds a free port when the sticky one is held and is then verified in turn. If a supervisor this call spawned also fails verification, the launch is refused naming the reason and the daemon log; no capability is written and no address is handed to the child.
+ * Everything resolving a credential needs from the outside world, injected so the resolver (and every launcher test) runs without `op`, the Keychain, real secret files or a terminal. `src/realPorts.ts` wires the real one; tests wire a fake.
  */
-declare function ensureFrontDoor(params: {
-    readonly paths: LayoutPaths;
-    readonly launcherPid: number;
-    readonly ports: EnsureFrontDoorPorts;
-}): {
-    readonly port: number;
-    readonly connectPort: number;
-    readonly token: string;
+interface CredentialPort {
+    /** Reads a `file` source's path (absolute or `~`-rooted). */
+    readonly readSecretFile: (filePath: string) => SecretFileRead;
+    /** Runs a command source's argv directly (no shell) under a timeout, capturing stdout. An interactive run inherits the terminal's stdin and stderr so a person can answer a prompt. */
+    readonly runCommand: (argv: readonly [string, ...string[]], options: {
+        readonly timeoutMs: number;
+        readonly interactive: boolean;
+    }) => CredentialCommandResult;
+    /** Whether a person can answer a prompt now: standard input is a terminal, or there is a desktop session to show a dialog in. */
+    readonly personPresent: () => boolean;
+    /** Where cached credentials live, used only for a credential block that asks for caching. Omit to resolve every launch from the sources. */
+    readonly cache?: CredentialCacheEnv;
+}
+/** One source as `check`, `doctor` and every `--json` output report it: its kind plus the same non-secret identifying detail `describeSource` prints. */
+type CredentialSourceSummary = {
+    readonly kind: "env";
+    readonly variable: string;
+} | {
+    readonly kind: "file";
+    readonly path: string;
+} | {
+    readonly kind: "command";
+    readonly program: string;
+} | {
+    readonly kind: "op";
+    readonly reference: string;
+} | {
+    readonly kind: "keychain";
+    readonly service: string;
+    readonly account?: string;
+} | {
+    readonly kind: "literal";
 };
-
-/** A bound front-door listener in this process, and how to stop it. */
-interface FrontDoorListenerHandle {
-    readonly port: number;
-    /** Stops accepting, ends every live connection, and resolves once the port is released. */
-    readonly close: () => Promise<void>;
+/** A credential block as it is reported: its effective target and each source's summary, in order. */
+interface CredentialSummary {
+    readonly target: CredentialTarget;
+    readonly sources: readonly CredentialSourceSummary[];
+    /** The block's cache setting when it asks for caching: how long a token is kept (absent for no expiry) and where. Carried as the config schema's own type, since the summary passes the parsed block's setting through unchanged. */
+    readonly cache?: CredentialCache;
 }
-/** Every effect the front-door supervisor performs, injected so its whole lifecycle runs against fakes: no real process, port, clock or listener in a unit test. */
-interface FrontDoorSupervisorPorts {
-    readonly fs: HeadroomFs;
-    readonly paths: LayoutPaths;
-    readonly ownPid: number;
+/** What caching a credential needs beyond the block's own `cache` setting: the port holding entries, the platform that picks the default store, and the clock the TTL is measured on. */
+interface CredentialCacheEnv {
+    readonly port: CredentialCachePort;
+    readonly platform: NodeJS.Platform;
     readonly now: () => number;
-    /** An event-loop-yielding wait, for the same reason headroom's is: nothing else would ever run between ticks. */
-    readonly sleep: (ms: number) => Promise<void>;
-    /** Zombie-aware liveness, the notion every coordination decision in this project uses. */
-    readonly isRunning: (pid: number) => boolean;
-    /**
-     * Starts the provider listener in this process on `preferredPort` (falling back to any free port when the sticky one is taken, decided at bind time rather than by a racy check-then-bind probe) and resolves once it has bound and answered its own health probe over TLS. This is the HTTPS listener every provider session's base URL points at, serving a loopback leaf signed by agent-shim's CA.
-     */
-    readonly startProviderListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
-    /**
-     * Starts the CONNECT surface in this process on `preferredPort` (same bind-time fallback): the TLS-terminating listener an OAuth session's HTTPS_PROXY points at. Bound before any state names it, so an OAuth launch never finds one listener up without the other.
-     */
-    readonly startConnectListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
+}
+
+/** Where a pinned Claude Code version came from, strongest first: the launch's own flag, then the environment, then the cascade. */
+declare const CLAUDE_VERSION_SOURCES: readonly ["flag", "environment", "cascade"];
+type ClaudeVersionSource = (typeof CLAUDE_VERSION_SOURCES)[number];
+/** The pinned version a launch runs, and which of the three forms named it. */
+interface PinnedClaudeVersion {
+    readonly version: string;
+    readonly source: ClaudeVersionSource;
+}
+
+/**
+ * The environment variables that authenticate Claude Code directly from the process environment, ahead of any stored identity credential. If any of these is set, every identity would silently authenticate as the same key/token/backend while it's set — defeating the entire premise of separate identities. Order here is also lookup order: `detectAmbientCredential` reports the first one found.
+ */
+declare const AMBIENT_CREDENTIAL_VARS: readonly ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY"];
+type AmbientCredentialVar = (typeof AMBIENT_CREDENTIAL_VARS)[number];
+/** Which guarded variable was found set, and to what. */
+interface AmbientCredentialDetection {
+    readonly variable: AmbientCredentialVar;
+}
+/** A credential this launch itself exports to the child: the variable it lands in and its value. */
+interface InjectedCredential {
+    readonly variable: CredentialTargetVar;
+    readonly token: string;
+}
+/**
+ * Detects whether any of `AMBIENT_CREDENTIAL_VARS` is set to a non-empty value in `env`, returning the first one found in declared order, or undefined when none are set.
+ *
+ * An empty string counts as unset, not set — confirmed load-bearing: one of Joe's real wrapper scripts (`o`, running Claude Code against OpenRouter) does `export ANTHROPIC_API_KEY=""` specifically to *clear* it so `ANTHROPIC_AUTH_TOKEN` takes effect instead, and this must never trip the guard.
+ *
+ * `injected`, when given, is the credential this launch exports for its own identity. Its variable holding exactly that value is not ambient: it is what a agent-shim launch of the same identity left in the environment of the session this one starts from (a `claude @work` run inside a `claude @work` session). The same variable holding any other value still counts.
+ */
+declare function detectAmbientCredential(env: Readonly<Record<string, string | undefined>>, injected?: InjectedCredential): AmbientCredentialDetection | undefined;
+/**
+ * Builds the exact refusal message: which variable was found, why it matters, and the two ways to opt in (a one-off env var, or a persistent per-identity setting). Mirrors the message documented in the project's README. `identityName` is included in the persistent-opt-in command when known; when no identity has been resolved yet (e.g. the `CLAUDE_CONFIG_DIR`-already-set escape hatch, or no identity resolved at all), a generic `<name>` placeholder is used instead, matching the README's own generic wording.
+ */
+declare function formatAmbientCredentialGuardMessage(variable: AmbientCredentialVar, identityName?: string): string;
+/** Inputs to the ambient-credential guard evaluation. */
+interface EvaluateAmbientCredentialGuardParams {
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /** The active identity's own `allowAmbientCredential` setting from its `identity.json`, or false when no identity is known. */
+    readonly allowAmbientCredential: boolean;
+    /** True when `AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1` is set for this one invocation. */
+    readonly allowAmbientCredentialOverride: boolean;
+    /** The active identity's name, for the message's persistent-opt-in command. Undefined when no identity is known. */
+    readonly identityName?: string;
     /**
-     * Starts the direct listener on `preferredPort` (same bind-time fallback): the same routes as the provider listener, minus the headroom hop, over plain HTTP because headroom is what connects to it. Headroom forwards routed traffic back here, which is what keeps the hop from looping, and the port is sticky like the others because headroom's allowlist admits its exact origin. It admits only the hop's own requests and holds no credential until it redeems one from the hop's custody.
+     * True when this launch routes through an API provider. The guard inspects the PARENT environment, before `buildEnv` runs; a provider launch has its `ANTHROPIC_AUTH_TOKEN` injected and its `ANTHROPIC_API_KEY` cleared by `buildEnv` itself, so an ambient credential in the parent environment never reaches the child and there is nothing left for this guard to protect against. Everything else about the guard (including `IdentitySchema.allowAmbientCredential`) is unchanged by this flag.
      */
-    readonly startDirectListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
-    readonly log: (line: string) => void;
+    readonly providerSelected?: boolean;
+    /** The launching identity's own credential, when its credential block resolved: see `detectAmbientCredential`. */
+    readonly injectedCredential?: InjectedCredential;
+}
+/** The result of one guard evaluation: either launch may proceed, or it must be refused with an explanatory message. */
+type AmbientCredentialGuardResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly variable: AmbientCredentialVar;
+    readonly message: string;
+};
+/**
+ * Evaluates the ambient-credential guard: refuses unless no guarded variable is set, or the active identity opted in (`allowAmbientCredential: true`), or this one invocation opted in (`AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1`), or a provider takes over the child's credential (see `providerSelected`).
+ *
+ * This guard is about credential isolation, not identity/config-dir selection — it must still run even when the `CLAUDE_CONFIG_DIR`-already-set escape hatch applies (callers pass `allowAmbientCredential: false` and no `identityName` in that case, since there is no active identity to consult).
+ */
+declare function evaluateAmbientCredentialGuard(params: EvaluateAmbientCredentialGuardParams): AmbientCredentialGuardResult;
+
+/** Which precedence rule produced an identity decision. */
+declare const IDENTITY_DECISION_SOURCES: readonly ["config-dir-escape-hatch", "argv", "env", "directory-pin", "active-identity-file", "none"];
+type IdentityDecisionSource = (typeof IDENTITY_DECISION_SOURCES)[number];
+/** Which precedence rule produced a configuration-profile decision. */
+declare const CONFIG_PROFILE_DECISION_SOURCES: readonly ["cli-flag", "env", "directory-rule", "identity-default", "global-default", "none"];
+type ConfigProfileDecisionSource = (typeof CONFIG_PROFILE_DECISION_SOURCES)[number];
+
+/** What `pool pick` reports: the ranking a launch from `directory` would act on right now. */
+declare const PoolPickReportSchema: z.ZodObject<{
+    pool: z.ZodString;
+    directory: z.ZodString;
+    pick: z.ZodOptional<z.ZodString>;
+    candidates: z.ZodArray<z.ZodObject<{
+        identity: z.ZodString;
+        class: z.ZodEnum<{
+            unknown: "unknown";
+            scored: "scored";
+            "pay-per-use": "pay-per-use";
+            ineligible: "ineligible";
+        }>;
+        score: z.ZodOptional<z.ZodNumber>;
+        feasible: z.ZodBoolean;
+        blockedUntil: z.ZodOptional<z.ZodISODateTime>;
+        plan: z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"subscription">;
+            capacity: z.ZodNumber;
+            recognised: z.ZodBoolean;
+            tier: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"pay-per-use">;
+            tier: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>;
+        reasons: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    missing: z.ZodArray<z.ZodString>;
+    earliestReturn: z.ZodOptional<z.ZodObject<{
+        identity: z.ZodString;
+        at: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    stickyProblem: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type PoolPickReport = z.infer<typeof PoolPickReportSchema>;
+
+/**
+ * Forward-only encoding of a real working directory into the single directory name Claude Code gives it under `~/.claude/projects/`.
+ *
+ * The encoding collapses the *entire* non-alphanumeric character class to `-`, not just the path separator: `.`, `_`, ` `, `@`, and `/` all become `-`, while letters and digits pass through with their case preserved. This was confirmed against a real installation's project directories, not assumed from the one `/`-becomes-`-` sample the README quotes.
+ *
+ * The encoding is therefore many-to-one: `~/work/clients/acme`, `~/work/clients-acme`, and `~/work-clients/acme` all produce the identical name. That makes it impossible to invert, so this module never tries: there is no decode function here, and `projects.test.ts` asserts the module's export list to keep it that way. Only the forward direction — real path to encoded name — is ever computed, and `detectEncodingAmbiguity` reports when a pattern's encoded form could plausibly correspond to more than one real path rather than resolving it silently.
+ */
+
+/** Why a pattern's encoded form might not identify the real path its author had in mind. */
+declare const ENCODING_AMBIGUITY_REASONS: readonly ["lossy-characters", "collides-with-sibling-pattern"];
+type EncodingAmbiguityReason = (typeof ENCODING_AMBIGUITY_REASONS)[number];
+/** One reported ambiguity in a `history/projects/` pattern. */
+interface EncodingAmbiguity {
+    readonly fragment: string;
+    readonly encoded: string;
+    readonly reason: EncodingAmbiguityReason;
+    readonly detail: string;
+}
+
+/** The result of looking up the macOS Keychain service name Claude Code is actually using for one identity's farm. */
+interface KeychainLookupResult {
+    readonly checked: true;
+    readonly found: boolean;
+    readonly serviceName?: string;
+    readonly note: string;
+}
+/** One file's reported settings exposure: names and counts only, never the underlying values. */
+interface SettingsExposureReport {
+    readonly file: string;
+    readonly envKeyNames: readonly string[];
+    readonly hookEventNames: readonly string[];
+    readonly hookCommandCount: number;
+}
+/** The provider the cascade selects for this directory, as the wiring layer loaded it: its definition, or why it could not be used (no such provider, an invalid or old-format file). */
+type CheckProviderInput = {
+    readonly name: string;
+    readonly definition: Provider;
+    readonly problem?: never;
+} | {
+    readonly name: string;
+    readonly definition?: never;
+    readonly problem: string;
+};
+/**
+ * Which credential a launch here would use, by source kind and target only: a selected provider's credential block always wins; otherwise the identity's own credential block; otherwise the login stored in the identity's directory.
+ */
+interface CredentialReport {
+    readonly applies: (typeof CHECK_CREDENTIAL_APPLIES)[number];
+    /** The selected provider's usable block (with what its cache holds), or why it could not be used; the two never appear together, exactly as `CheckProviderInput` states it. */
+    readonly provider?: {
+        readonly name: string;
+        readonly credential: CredentialSummary;
+        readonly cached?: CachedCredentialState;
+        readonly problem?: never;
+    } | {
+        readonly name: string;
+        readonly problem: string;
+        readonly credential?: never;
+        readonly cached?: never;
+    };
+    readonly identity?: CredentialSummary;
+    /** What the identity's own credential cache holds, when its block caches and the cache could be read. */
+    readonly identityCached?: CachedCredentialState;
+}
+/** Inputs to `runCheck` — everything already loaded/injected, exactly like the resolver core and the launcher: nothing in this function touches a real filesystem, git repository, clock, or environment itself. */
+interface RunCheckParams {
+    readonly cwd: string;
+    readonly home: string;
+    readonly claudeHome: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly branch?: string;
+    readonly branchDetached?: boolean;
+    readonly nowMs: number;
+    /** Used only to build the fact manifest by reading the canonical `~/.claude` tree — `runCheck` never mutates the farm and never spawns anything. */
+    readonly farmFs: FarmFs;
+    readonly cascade: CascadeInput;
+    readonly classification: {
+        readonly defaults: CategoryClassification;
+        readonly overlay?: CategoryClassificationOverlay;
+    };
+    readonly identityName?: string;
+    readonly identitySource: IdentityDecisionSource;
+    /** The pool the launch selected and how it ranks right now, when it named a pool instead of an identity; `identityName` is then the member it would pick. */
+    readonly poolPick?: PoolPickReport;
+    readonly configProfileName?: string;
+    readonly configProfileSource: ConfigProfileDecisionSource;
+    /** The resolved identity's own `identity.json`, when one was found. */
+    readonly identity?: Identity;
+    /** Raw `settings.json`/`settings.local.json` contents, keyed by filename, undefined when a file does not exist. */
+    readonly settingsFiles: Readonly<Record<string, string | undefined>>;
+    /** Runs `security find-generic-password` for the Keychain diagnostic. Omit to skip that diagnostic entirely (e.g. off macOS, or when no identity/farm root is known). */
+    readonly run?: RunPort;
+    /** The identity's own farm root — `security`'s lookup account. Required alongside `run` for the Keychain diagnostic to run at all. */
+    readonly farmRoot?: string;
+    /** `process.platform` in real use; the Keychain diagnostic only ever runs when this is `"darwin"`. */
+    readonly platform: string;
+    /** The provider a launch here would route through (`launch.provider` in the cascade), when one is selected. */
+    readonly provider?: CheckProviderInput;
+    /** The Claude Code versions installed here, oldest first. Omit to leave the Claude Code version out of the report; with it, `check` says which version a launch here runs and whether a pin is installed. */
+    readonly installedClaudeVersions?: readonly string[];
+    /** Where cached credentials live. Omit to skip reporting a credential cache's age; with it, a block that caches reports whether it holds an entry, how old it is and whether it has expired, never the token. */
+    readonly credentialCache?: CredentialCacheEnv;
+}
+/** Everything `agent-shim check` reports about one directory/identity, without touching the farm or spawning anything. */
+interface CheckReport {
+    readonly identityName?: string;
+    readonly identitySource: IdentityDecisionSource;
+    readonly poolPick?: PoolPickReport;
+    readonly configProfileName?: string;
+    readonly configProfileSource: ConfigProfileDecisionSource;
+    readonly resolved: ResolvedState;
+    readonly decisionLines: readonly string[];
+    readonly projectEncodingAmbiguities: readonly EncodingAmbiguity[];
+    readonly ambientCredential: AmbientCredentialGuardResult;
+    readonly keychain?: KeychainLookupResult;
+    readonly settingsExposure: readonly SettingsExposureReport[];
+    readonly credential: CredentialReport;
+    /** The Claude Code version a launch here would run, when the installed versions were given. */
+    readonly claudeVersion?: ClaudeVersionReport;
+}
+/** Which Claude Code version a launch would run: the pin and where it comes from, with whether it is installed, or the highest installed version when nothing pins one. */
+interface ClaudeVersionReport {
+    readonly pinned?: PinnedClaudeVersion & {
+        readonly installed: boolean;
+    };
+    readonly highestInstalled?: string;
+    readonly installed: readonly string[];
+}
+/**
+ * Resolves the full cascade for one directory/identity and reports everything `agent-shim check` documents: every entry's resolved state and which layer/condition decided it, any ambiguous `history/projects/` encoding in scope, and the three always-on diagnostics (ambient-credential exposure, macOS Keychain service name, settings-secrets exposure).
+ *
+ * Deliberately reuses the same cascade machinery a real launch uses — `resolveDecisions` and `buildEntryFacts` — rather than reimplementing any part of resolution. The one thing this function never does that a launch does is touch the farm or spawn anything: it only reads the canonical `~/.claude` tree to build the fact manifest resolution needs, and every other input (cascade, classification, settings file contents, the Keychain lookup) is handed in already loaded.
+ */
+declare function runCheck(params: RunCheckParams): CheckReport;
+/** Renders a full `CheckReport` as plain text lines, in the order `agent-shim check` prints them. */
+declare function formatCheckReport(report: CheckReport): string[];
+/**
+ * The `check --json` form of a report: every field the text form prints, as plain data (no `Map`s, no compiled matchers), so a script can read the same verdicts a person would.
+ */
+declare function checkReportToJson(report: CheckReport): CheckReportJson;
+/**
+ * Whether a report carries anything `check --strict` fails on: a resolver diagnostic of warning or error severity, an ambiguous `history/projects/` encoding, an ambient credential a launch would refuse, or a selected provider a launch could not use. Informational diagnostics and the settings-exposure advisory (names and counts only, for a person to review) never fail it.
+ */
+declare function checkReportHasWarnings(report: CheckReport): boolean;
+/** What `collectCheckReport` needs from its caller. */
+interface CollectCheckReportParams {
+    readonly paths: LayoutPaths;
+    /** The directory a launch would run in; resolved against the working directory by the caller. */
+    readonly cwd: string;
+    /** The identity to check, as `--identity` names it; absent means the identity a launch there would resolve. */
+    readonly identity?: string;
+    readonly env: NodeJS.ProcessEnv;
+}
+/**
+ * Resolves what a launch in `params.cwd` would share or hide, and why, against this machine: the edge adapter that reads the real filesystem, clock, git and keychain, resolves the identity, configuration profile and cascade exactly as a launch does, and hands the facts to the pure `runCheck`. Never touches the farm or spawns claude.
+ */
+declare function collectCheckReport(params: CollectCheckReportParams): CheckReport;
+
+declare const ClaudeShimStateSchema: z.ZodObject<{
+    targetPath: z.ZodString;
+    method: z.ZodEnum<{
+        hardlink: "hardlink";
+        copy: "copy";
+    }>;
+    installedAtMs: z.ZodNumber;
+}, z.core.$strict>;
+type ClaudeShimState = z.infer<typeof ClaudeShimStateSchema>;
+type PathShadowStatus = {
+    readonly status: "ok";
+} | {
+    readonly status: "not-on-path";
+} | {
+    readonly status: "shadowed";
+    readonly by: string;
+};
+
+/** The result of a successful discovery. */
+interface DiscoveredClaudeBinary {
+    /** Full path to the discovered `claude` executable. */
+    path: string;
+    /** Which strategy found it. */
+    source: "versions-dir" | "path-fallback";
+    /** The version string, when discovered via the versions directory. */
+    version?: string;
+}
+/** What a launch asks binary discovery for: nothing (the highest installed version) or an exact version. */
+interface ClaudeBinaryRequest {
+    readonly version?: string;
+}
+/** Discovers the real `claude` binary to spawn, for the version a launch asked for. Injected into the launcher so it never reads the filesystem or PATH itself. */
+type ClaudeBinaryResolver = (request?: Readonly<ClaudeBinaryRequest>) => DiscoveredClaudeBinary;
+
+declare const DOCTOR_SEVERITIES: readonly ["pass", "warn", "fail"];
+type DoctorSeverity = (typeof DOCTOR_SEVERITIES)[number];
+declare const DOCTOR_SECTIONS: readonly ["ambient-credential", "binary-discovery", "claude-shim", "path-resolution", "legacy-name", "config-profile", "identity", "pool", "provider", "keychain", "directory-rules", "global-config", "categories-local", "active-identity", "headroom"];
+type DoctorSection = (typeof DOCTOR_SECTIONS)[number];
+/** One line of `agent-shim doctor`'s report. `subject` names the identity/profile/rule the finding is about, when the section has more than one of those. */
+interface DoctorFinding {
+    readonly section: DoctorSection;
+    readonly subject?: string;
+    readonly severity: DoctorSeverity;
+    readonly message: string;
+}
+/** The full result of `runDoctor`. `ok` is false iff any finding is a `fail` — a `warn` never fails the report on its own. */
+interface DoctorReport {
+    readonly findings: readonly DoctorFinding[];
+    readonly ok: boolean;
+}
+/** One identity's raw `identity.json`, unparsed — `runDoctor` does its own JSON.parse/schema validation so one malformed file never aborts the rest of the report. */
+interface DoctorIdentityInput {
+    readonly name: string;
+    readonly path: string;
+    readonly raw: string | undefined;
+    /** The identity's own farm root (`identitiesDir/<name>`) — the account name the Keychain lookup uses. */
+    readonly farmRoot: string;
+}
+/** One configuration profile's raw `<name>.json`, unparsed. */
+interface DoctorConfigProfileInput {
+    readonly name: string;
+    readonly path: string;
+    readonly raw: string | undefined;
 }
-/** Options for `runFrontDoorSupervisor`. */
-interface RunFrontDoorSupervisorOptions {
-    /** Bounds the loop's iterations so a test can observe steady state; such a run returns `FRONTDOOR_SUPERVISOR_STILL_RUNNING`. */
-    readonly tickLimit?: number;
+/** One provider's raw `<name>.json`, unparsed. */
+interface DoctorProviderInput {
+    readonly name: string;
+    readonly path: string;
+    readonly raw: string | undefined;
+}
+/** A single optional top-level file `runDoctor` validates against a schema when present — absent is a legitimate, unconfigured state, not a failure. */
+interface DoctorFileInput {
+    readonly path: string;
+    readonly raw: string | undefined;
 }
+/** The outcome of resolving the real Claude Code binary, pre-resolved by the wiring layer since `discoverClaudeBinary` is not itself a parse-shaped pure operation and already has its own dedicated test coverage. */
+type DoctorBinaryDiscovery = {
+    readonly ok: true;
+    readonly binary: DiscoveredClaudeBinary;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
 /**
- * Runs the front-door supervisor: binds all three listeners (the HTTPS provider listener, the CONNECT surface and the plain-HTTP direct listener, each on its sticky port), records the serving state, and shuts down after `idleShutdownMinutes` with an empty session registry. Returns the exit code: 0 for an idle shutdown, 1 for a fatal start failure.
+ * Where a bare command name resolves for the two names this tool owns.
  *
- * The listeners live in this process, so there is no child to keep alive: a crash of this process is a crash of every routed session's door at once, and recovery is the next launch's ensure spawning a replacement on the same sticky ports, which is exactly the failure model the issue asks to settle with tests. Keeping the headroom daemon alive is the headroom supervisor's job, not this one's; the two daemons idle out independently.
+ * `ownExecutablePath` is this process's own PATH-visible location (`realOwnExecutablePath()`); `agentShim` is `findPathShadow`'s verdict for a bare `agent-shim` against the directory that executable lives in. `claude` is only populated when a shim is actually enabled — without one, a `claude` on PATH is Claude Code's own binary, which is not a shadow of anything.
  */
-declare function runFrontDoorSupervisor(idleShutdownMinutes: number, ports: FrontDoorSupervisorPorts, options?: RunFrontDoorSupervisorOptions): Promise<number>;
+interface DoctorPathResolution {
+    readonly ownExecutablePath: string;
+    readonly agentShim: PathShadowStatus;
+    readonly claude?: PathShadowStatus;
+}
+/** Everything `runDoctor` needs, all of it already loaded/injected — nothing in `runDoctor` itself reads a file, shells out, or touches the farm. */
+interface RunDoctorParams {
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /** The Claude Code versions installed here, oldest first. Omit to skip checking that a pinned version (`launch.claudeVersion`) is installed; with it, a profile, directory rule or global config pinning a version that is not installed is a warning. */
+    readonly installedClaudeVersions?: readonly string[];
+    /** Where cached credentials live. Omit to leave a credential cache's age out of the identity and provider findings; with it, a block that caches reports whether it holds an entry, how old it is and whether it has expired, never the token. */
+    readonly credentialCache?: CredentialCacheEnv;
+    readonly identities: readonly DoctorIdentityInput[];
+    readonly configProfiles: readonly DoctorConfigProfileInput[];
+    readonly providers: readonly DoctorProviderInput[];
+    readonly directoryRules: DoctorFileInput;
+    readonly globalConfig: DoctorFileInput;
+    readonly categoriesLocal: DoctorFileInput;
+    readonly activeIdentity: DoctorFileInput;
+    readonly binaryDiscovery: DoctorBinaryDiscovery;
+    /** Whether `agent-shim shim enable` has been run, and whether its recorded target still exists on disk — pre-resolved by the wiring layer, since checking a file's existence is real I/O, not a parse-shaped pure operation. */
+    readonly claudeShim: {
+        readonly state: ClaudeShimState | undefined;
+        readonly targetExists: boolean;
+    };
+    /** Which executables a bare `agent-shim` (and, when the shim is enabled, a bare `claude`) would actually run — pre-resolved by the wiring layer, since scanning PATH is real I/O. */
+    readonly pathResolution: DoctorPathResolution;
+    /** The resolved state root (`paths.root`), whose directory name says whether this installation still lives under the former `.claude-use` name. */
+    readonly rootPath: string;
+    /** Runs `security find-generic-password` for the per-identity Keychain check. Omit to skip that check entirely (e.g. off macOS). */
+    readonly run?: RunPort;
+    /** `process.platform` in real use; the Keychain check only ever runs when this is `"darwin"`. */
+    readonly platform: string;
+    /** The headroom daemon's state.json plus a zombie-aware liveness predicate for the pids it names (a defunct daemon serves nothing but still answers signal 0). Omit the raw text when the daemon has never run; that is a pass, not a failure. */
+    readonly headroom: {
+        readonly state: DoctorFileInput;
+        readonly isRunning: (pid: number) => boolean;
+    };
+}
+/**
+ * Audits the whole `~/.agent-shim` config graph for internal consistency: every identity, every configuration profile's own `extends` chain, every provider, `directory-rules.json`, `config.json`, `categories.local.json`, `active-identity`, plus real Claude Code binary discoverability and ambient-credential exposure.
+ *
+ * Deliberately identity/directory-agnostic, unlike `runCheck` — there is no single cascade to resolve `doctor` against, so it never touches settings-exposure (which only means anything relative to one resolved cascade).
+ *
+ * Every check aggregates rather than throws: a malformed file becomes one `fail` finding for that file, not an aborted report. This is the one place in the codebase that deliberately breaks the "throw a validation error and let it propagate" convention every other command relies on — `doctor`'s whole purpose is to survive a broken file and keep auditing everything else.
+ */
+declare function runDoctor(params: RunDoctorParams): DoctorReport;
+/** Renders a full `DoctorReport` as plain text lines, one section header at a time, in the order `agent-shim doctor` prints them. */
+declare function formatDoctorReport(report: DoctorReport): string[];
+/** What `collectDoctorReport` needs from its caller. */
+interface CollectDoctorReportParams {
+    readonly paths: LayoutPaths;
+    readonly env: NodeJS.ProcessEnv;
+}
+/**
+ * Audits the whole state root against this machine: the edge adapter that enumerates every identity, configuration profile and provider on disk, reads every top-level config file as raw text (never pre-parsing, so one malformed file cannot abort the report), discovers the real Claude Code binary and resolves where a bare command name runs from, and hands the facts to the pure `runDoctor`.
+ */
+declare function collectDoctorReport(params: CollectDoctorReportParams): DoctorReport;
 
 /** One routed request, appended to the usage log when its response has finished. */
 declare const UsageRecordSchema: z.ZodObject<{
@@ -2752,1093 +3335,2064 @@ declare const UsageSnapshotSchema: z.ZodObject<{
         }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
-type UsageSnapshot = z.infer<typeof UsageSnapshotSchema>;
+type UsageSnapshot = z.infer<typeof UsageSnapshotSchema>;
+
+/** The record held in one front-door session-registry file: the launcher's pid plus the per-launch capability token its child presents on every request. */
+declare const FrontDoorSessionSchema: z.ZodObject<{
+    pid: z.ZodNumber;
+    startedAt: z.ZodNumber;
+    token: z.ZodString;
+}, z.core.$strict>;
+type FrontDoorSession = z.infer<typeof FrontDoorSessionSchema>;
+/**
+ * The front-door supervisor's state.json under `<home>/frontdoor/`. Every field is optional because the file exists in stages, exactly like headroom's and the old codex daemon's: a fresh supervisor writes its own pid before the listener is up, and a shut-down front door leaves only the sticky `lastPort` and any `lastError` worth surfacing.
+ */
+declare const FrontDoorStateSchema: z.ZodObject<{
+    protocol: z.ZodOptional<z.ZodNumber>;
+    supervisorPid: z.ZodOptional<z.ZodNumber>;
+    port: z.ZodOptional<z.ZodNumber>;
+    lastPort: z.ZodOptional<z.ZodNumber>;
+    connectPort: z.ZodOptional<z.ZodNumber>;
+    lastConnectPort: z.ZodOptional<z.ZodNumber>;
+    directPort: z.ZodOptional<z.ZodNumber>;
+    lastDirectPort: z.ZodOptional<z.ZodNumber>;
+    lastError: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type FrontDoorState = z.infer<typeof FrontDoorStateSchema>;
+/** A registered launch as status and the idle decision see it: the pid and start time, never the token, so nothing that prints or serialises a session can leak the capability. */
+type FrontDoorSessionSummary = Pick<FrontDoorSession, "pid" | "startedAt">;
+
+/**
+ * The front door's read-only status: the data `agent-shim frontdoor status` prints and the door's own typed `frontdoor.status` procedure returns, collected without starting or stopping anything. Kept here, beside the state file and session registry it reads, so both the command layer and the typed API's schema layer share one shape and one collector with no dependency on the CLI's command wiring.
+ */
+/**
+ * The headroom daemon's socket as the hop may use it, read from the daemon's state on every routed request that needs the hop and authenticated each time: a new supervisor generation serves on a new path while this door keeps listening, and the hop must follow it (and answer 502 while the daemon is between restarts, or refuse a socket that fails the owner-only check). Undefined while no socket is recorded.
+ */
+declare function headroomSocketTarget(fsPort: HeadroomFs, trust: HeadroomSocketTrustPorts, paths: LayoutPaths): HeadroomSocketTarget | undefined;
+/** One session-registry entry plus whether its launcher is still running. */
+interface FrontDoorSessionStatus extends FrontDoorSessionSummary {
+    readonly alive: boolean;
+}
+/** Everything `agent-shim frontdoor status` reports, collected read-only: no process is started or stopped. */
+interface FrontDoorStatus {
+    readonly state: FrontDoorState;
+    readonly supervisorAlive: boolean;
+    readonly sessions: readonly FrontDoorSessionStatus[];
+    /** The headroom daemon's socket as the door's hop reads and authenticates it live: undefined when no socket is recorded, a refusal when the recorded one fails the owner-only check. */
+    readonly headroomSocket: HeadroomSocketTarget | undefined;
+    readonly logPath: string;
+    readonly logExists: boolean;
+}
+/** Collects the front door's read-only status. */
+declare function collectFrontDoorStatus(fsPort: HeadroomFs, socketTrust: HeadroomSocketTrustPorts, paths: LayoutPaths, isRunning: (pid: number) => boolean): FrontDoorStatus;
+/** Formats `agent-shim frontdoor status`, one line per entry. */
+declare function formatFrontDoorStatus(status: FrontDoorStatus, caCertPath: string): string[];
+
+/**
+ * The door's general control plane as a typed oRPC API: the read-only surfaces a programmatic consumer (automation, a dashboard, another of this user's tools) needs beyond Remote Control, one router per domain, every procedure behind the same per-generation control token as `rc.*` and validating through the Zod schemas of `controlSchemas.ts`.
+ *
+ * - `usage.*` reads the per-identity usage snapshots the door's own middleware writes, and reads a provider's quota windows the way every in-process consumer does (`effectiveWindow`: a window past its reset is empty and carries no status).
+ * - `frontdoor.*` returns what `agent-shim frontdoor status` returns: the supervisor state, its liveness, the session registry's launches and the headroom hop.
+ * - `check.run` and `doctor.run` return the reports `agent-shim check` and `agent-shim doctor` print, as data, `check.run` parameterised by an absolute directory path.
+ *
+ * Read-only by design: identity, configuration-profile, provider, pool and directory-rule management stay CLI-side, and adding writes over this mount is a decision of its own rather than a gap here. `createDoorApiNodeHandler` mounts these routers beside the Remote Control router on the one prefix the provider listener already serves, so a consumer dials one address with one token for the whole door.
+ */
+/** Everything the control-plane procedures need, injected so they serve against fakes in tests exactly as the door's real wiring serves against this machine. */
+interface ControlApiDeps {
+    /** This generation's control token: the same value the Remote Control router checks, since one mount serves both. */
+    readonly expectedToken: string;
+    /** Every identity's usage snapshot, as `listUsageSnapshots` reads them. */
+    readonly usageSnapshots: () => readonly UsageSnapshot[];
+    /** One identity's usage snapshot, as `readUsageSnapshot` reads it: undefined when the identity has none yet. */
+    readonly usageSnapshotOf: (identity: string) => UsageSnapshot | undefined;
+    /** The clock the window semantics read a recorded window at. */
+    readonly now: () => number;
+    /** The door's read-only status, as `collectFrontDoorStatus` collects it. */
+    readonly frontDoorStatus: () => FrontDoorStatus;
+    /** The check report for one directory, as `collectCheckReport` collects it. */
+    readonly checkReport: (path: string, identity?: string) => CheckReport;
+    /** The doctor report, as `collectDoctorReport` collects it. */
+    readonly doctorReport: () => DoctorReport;
+}
+/** Builds the control-plane routers: one procedure per read, every one behind the control-token middleware. */
+declare function createControlApiRouter(deps: ControlApiDeps): {
+    usage: {
+        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            snapshots: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                schemaVersion: zod.ZodLiteral<1>;
+                identity: zod.ZodString;
+                updatedAt: zod.ZodISODateTime;
+                account: zod.ZodOptional<zod.ZodObject<{
+                    accountUuid: zod.ZodOptional<zod.ZodString>;
+                    emailAddress: zod.ZodOptional<zod.ZodString>;
+                    displayName: zod.ZodOptional<zod.ZodString>;
+                    organizationUuid: zod.ZodOptional<zod.ZodString>;
+                    organizationName: zod.ZodOptional<zod.ZodString>;
+                    organizationType: zod.ZodOptional<zod.ZodString>;
+                    organizationRole: zod.ZodOptional<zod.ZodString>;
+                    workspaceRole: zod.ZodOptional<zod.ZodString>;
+                    billingType: zod.ZodOptional<zod.ZodString>;
+                    seatTier: zod.ZodOptional<zod.ZodString>;
+                    organizationRateLimitTier: zod.ZodOptional<zod.ZodString>;
+                    userRateLimitTier: zod.ZodOptional<zod.ZodString>;
+                    hasExtraUsageEnabled: zod.ZodOptional<zod.ZodBoolean>;
+                    subscriptionCreatedAt: zod.ZodOptional<zod.ZodString>;
+                    accountCreatedAt: zod.ZodOptional<zod.ZodString>;
+                }, zod_v4_core.$strict>>;
+                providers: zod.ZodRecord<zod.ZodString, zod.ZodObject<{
+                    lastRequestAt: zod.ZodISODateTime;
+                    lastStatus: zod.ZodNumber;
+                    lastModel: zod.ZodOptional<zod.ZodString>;
+                    rateLimit: zod.ZodOptional<zod.ZodObject<{
+                        observedAt: zod.ZodISODateTime;
+                        headers: zod.ZodRecord<zod.ZodString, zod.ZodString>;
+                        unified: zod.ZodOptional<zod.ZodObject<{
+                            status: zod.ZodOptional<zod.ZodString>;
+                            fiveHour: zod.ZodOptional<zod.ZodObject<{
+                                utilization: zod.ZodOptional<zod.ZodNumber>;
+                                resetsAt: zod.ZodOptional<zod.ZodISODateTime>;
+                                status: zod.ZodOptional<zod.ZodString>;
+                            }, zod_v4_core.$strict>>;
+                            sevenDay: zod.ZodOptional<zod.ZodObject<{
+                                utilization: zod.ZodOptional<zod.ZodNumber>;
+                                resetsAt: zod.ZodOptional<zod.ZodISODateTime>;
+                                status: zod.ZodOptional<zod.ZodString>;
+                            }, zod_v4_core.$strict>>;
+                            representativeClaim: zod.ZodOptional<zod.ZodString>;
+                            resetAt: zod.ZodOptional<zod.ZodISODateTime>;
+                            overageStatus: zod.ZodOptional<zod.ZodString>;
+                        }, zod_v4_core.$strict>>;
+                    }, zod_v4_core.$strict>>;
+                    lastLimit: zod.ZodOptional<zod.ZodObject<{
+                        kind: zod.ZodEnum<{
+                            "rate-limited": "rate-limited";
+                            "quota-exhausted": "quota-exhausted";
+                        }>;
+                        retryAfterSeconds: zod.ZodOptional<zod.ZodNumber>;
+                        resetAt: zod.ZodOptional<zod.ZodISODateTime>;
+                        window: zod.ZodOptional<zod.ZodString>;
+                        evidence: zod.ZodArray<zod.ZodString>;
+                        observedAt: zod.ZodISODateTime;
+                        status: zod.ZodNumber;
+                    }, zod_v4_core.$strict>>;
+                    quota: zod.ZodOptional<zod.ZodObject<{
+                        observedAt: zod.ZodISODateTime;
+                        source: zod.ZodString;
+                        level: zod.ZodOptional<zod.ZodString>;
+                        windows: zod.ZodArray<zod.ZodObject<{
+                            measures: zod.ZodString;
+                            periodMs: zod.ZodOptional<zod.ZodNumber>;
+                            period: zod.ZodOptional<zod.ZodString>;
+                            utilization: zod.ZodNumber;
+                            resetsAt: zod.ZodOptional<zod.ZodISODateTime>;
+                            limit: zod.ZodOptional<zod.ZodNumber>;
+                            used: zod.ZodOptional<zod.ZodNumber>;
+                            remaining: zod.ZodOptional<zod.ZodNumber>;
+                        }, zod_v4_core.$strict>>;
+                    }, zod_v4_core.$strict>>;
+                }, zod_v4_core.$strict>>;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        effectiveWindow: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            identity: zod.ZodString;
+            provider: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            identity: zod.ZodString;
+            provider: zod.ZodString;
+            observedAt: zod.ZodOptional<zod.ZodISODateTime>;
+            fiveHour: zod.ZodOptional<zod.ZodObject<{
+                reset: zod.ZodBoolean;
+                utilization: zod.ZodOptional<zod.ZodNumber>;
+                resetsAtMs: zod.ZodOptional<zod.ZodNumber>;
+                status: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>>;
+            sevenDay: zod.ZodOptional<zod.ZodObject<{
+                reset: zod.ZodBoolean;
+                utilization: zod.ZodOptional<zod.ZodNumber>;
+                resetsAtMs: zod.ZodOptional<zod.ZodNumber>;
+                status: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+    };
+    frontdoor: {
+        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            state: zod.ZodObject<{
+                protocol: zod.ZodOptional<zod.ZodNumber>;
+                supervisorPid: zod.ZodOptional<zod.ZodNumber>;
+                port: zod.ZodOptional<zod.ZodNumber>;
+                lastPort: zod.ZodOptional<zod.ZodNumber>;
+                connectPort: zod.ZodOptional<zod.ZodNumber>;
+                lastConnectPort: zod.ZodOptional<zod.ZodNumber>;
+                directPort: zod.ZodOptional<zod.ZodNumber>;
+                lastDirectPort: zod.ZodOptional<zod.ZodNumber>;
+                lastError: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>;
+            supervisorAlive: zod.ZodBoolean;
+            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                pid: zod.ZodInt;
+                startedAt: zod.ZodNumber;
+                alive: zod.ZodBoolean;
+            }, zod_v4_core.$strict>>>;
+            headroomSocket: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                socketPath: zod.ZodString;
+            }, zod_v4_core.$strict>, zod.ZodObject<{
+                refused: zod.ZodString;
+            }, zod_v4_core.$strict>]>>;
+            logPath: zod.ZodString;
+            logExists: zod.ZodBoolean;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        sessions: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                pid: zod.ZodInt;
+                startedAt: zod.ZodNumber;
+                alive: zod.ZodBoolean;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+    };
+    check: {
+        run: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            path: zod.ZodString;
+            identity: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            identity: zod.ZodObject<{
+                name: zod.ZodNullable<zod.ZodString>;
+                source: zod.ZodEnum<{
+                    "config-dir-escape-hatch": "config-dir-escape-hatch";
+                    argv: "argv";
+                    env: "env";
+                    "directory-pin": "directory-pin";
+                    "active-identity-file": "active-identity-file";
+                    none: "none";
+                }>;
+            }, zod_v4_core.$strict>;
+            pool: zod.ZodOptional<zod.ZodObject<{
+                pool: zod.ZodString;
+                directory: zod.ZodString;
+                pick: zod.ZodOptional<zod.ZodString>;
+                candidates: zod.ZodArray<zod.ZodObject<{
+                    identity: zod.ZodString;
+                    class: zod.ZodEnum<{
+                        unknown: "unknown";
+                        scored: "scored";
+                        "pay-per-use": "pay-per-use";
+                        ineligible: "ineligible";
+                    }>;
+                    score: zod.ZodOptional<zod.ZodNumber>;
+                    feasible: zod.ZodBoolean;
+                    blockedUntil: zod.ZodOptional<zod.ZodISODateTime>;
+                    plan: zod.ZodUnion<readonly [zod.ZodObject<{
+                        kind: zod.ZodLiteral<"subscription">;
+                        capacity: zod.ZodNumber;
+                        recognised: zod.ZodBoolean;
+                        tier: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"pay-per-use">;
+                        tier: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>]>;
+                    reasons: zod.ZodArray<zod.ZodString>;
+                }, zod_v4_core.$strict>>;
+                missing: zod.ZodArray<zod.ZodString>;
+                earliestReturn: zod.ZodOptional<zod.ZodObject<{
+                    identity: zod.ZodString;
+                    at: zod.ZodISODateTime;
+                }, zod_v4_core.$strict>>;
+                stickyProblem: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>>;
+            configProfile: zod.ZodObject<{
+                name: zod.ZodNullable<zod.ZodString>;
+                source: zod.ZodEnum<{
+                    "directory-rule": "directory-rule";
+                    env: "env";
+                    none: "none";
+                    "cli-flag": "cli-flag";
+                    "identity-default": "identity-default";
+                    "global-default": "global-default";
+                }>;
+            }, zod_v4_core.$strict>;
+            layers: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                id: zod.ZodInt;
+                kind: zod.ZodEnum<{
+                    "global-config": "global-config";
+                    "config-profile": "config-profile";
+                    "directory-rule": "directory-rule";
+                    portable: "portable";
+                    "portable-local": "portable-local";
+                    "cli-override": "cli-override";
+                }>;
+                source: zod.ZodString;
+            }, zod_v4_core.$strict>>>;
+            entries: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                path: zod.ZodString;
+                shared: zod.ZodBoolean;
+                via: zod.ZodEnum<{
+                    "secret-floor": "secret-floor";
+                    unclassified: "unclassified";
+                    "entry-rule": "entry-rule";
+                    "category-override": "category-override";
+                    "category-default": "category-default";
+                }>;
+                category: zod.ZodNullable<zod.ZodEnum<{
+                    secret: "secret";
+                    runtime: "runtime";
+                    history: "history";
+                    knowledge: "knowledge";
+                    settings: "settings";
+                }>>;
+                rule: zod.ZodOptional<zod.ZodObject<{
+                    key: zod.ZodString;
+                    layer: zod.ZodInt;
+                }, zod_v4_core.$strict>>;
+                eliminated: zod.ZodOptional<zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                    key: zod.ZodString;
+                    failed: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+                }, zod_v4_core.$strict>>>>;
+            }, zod_v4_core.$strict>>>;
+            projectEncodingAmbiguities: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                fragment: zod.ZodString;
+                encoded: zod.ZodString;
+                reason: zod.ZodEnum<{
+                    "lossy-characters": "lossy-characters";
+                    "collides-with-sibling-pattern": "collides-with-sibling-pattern";
+                }>;
+                detail: zod.ZodString;
+            }, zod_v4_core.$strict>>>;
+            diagnostics: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                code: zod.ZodEnum<{
+                    EXTENDS_CYCLE: "EXTENDS_CYCLE";
+                    MISSING_PROFILE: "MISSING_PROFILE";
+                    SECRET_ENTRY_KEY: "SECRET_ENTRY_KEY";
+                    SECRET_PATH_NEUTRALISED: "SECRET_PATH_NEUTRALISED";
+                    CATEGORY_PREFIX_MISMATCH: "CATEGORY_PREFIX_MISMATCH";
+                    MALFORMED_ENTRY_KEY: "MALFORMED_ENTRY_KEY";
+                    EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB: "EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB";
+                    AMBIGUOUS_PROJECT_ENCODING: "AMBIGUOUS_PROJECT_ENCODING";
+                    UNROOTED_PROJECT_PATH: "UNROOTED_PROJECT_PATH";
+                    UNCLASSIFIED_ENTRY: "UNCLASSIFIED_ENTRY";
+                    EMPTY_WHEN: "EMPTY_WHEN";
+                    FARM_MANIFEST_MISSING: "FARM_MANIFEST_MISSING";
+                    RECONCILE_CONFLICT: "RECONCILE_CONFLICT";
+                    RECONCILE_SECRET_BLOCKED: "RECONCILE_SECRET_BLOCKED";
+                    FARM_SWAP_RECOVERED: "FARM_SWAP_RECOVERED";
+                    FARM_PREVIOUS_RETAINED: "FARM_PREVIOUS_RETAINED";
+                }>;
+                severity: zod.ZodEnum<{
+                    error: "error";
+                    warning: "warning";
+                    info: "info";
+                }>;
+                message: zod.ZodString;
+                subject: zod.ZodOptional<zod.ZodString>;
+                layer: zod.ZodOptional<zod.ZodInt>;
+            }, zod_v4_core.$strict>>>;
+            ambientCredential: zod.ZodUnion<readonly [zod.ZodObject<{
+                ok: zod.ZodLiteral<true>;
+            }, zod_v4_core.$strict>, zod.ZodObject<{
+                ok: zod.ZodLiteral<false>;
+                variable: zod.ZodString;
+                message: zod.ZodString;
+            }, zod_v4_core.$strict>]>;
+            keychain: zod.ZodOptional<zod.ZodObject<{
+                checked: zod.ZodLiteral<true>;
+                found: zod.ZodBoolean;
+                serviceName: zod.ZodOptional<zod.ZodString>;
+                note: zod.ZodString;
+            }, zod_v4_core.$strict>>;
+            settingsExposure: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                file: zod.ZodString;
+                envKeyNames: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+                hookEventNames: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+                hookCommandCount: zod.ZodInt;
+            }, zod_v4_core.$strict>>>;
+            credential: zod.ZodObject<{
+                applies: zod.ZodEnum<{
+                    identity: "identity";
+                    provider: "provider";
+                    "stored-login": "stored-login";
+                }>;
+                provider: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                    name: zod.ZodString;
+                    credential: zod.ZodObject<{
+                        target: zod.ZodEnum<{
+                            bearer: "bearer";
+                            apiKey: "apiKey";
+                            oauthToken: "oauthToken";
+                        }>;
+                        sources: zod.ZodReadonly<zod.ZodArray<zod.ZodUnion<readonly [zod.ZodObject<{
+                            kind: zod.ZodLiteral<"env">;
+                            variable: zod.ZodString;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"file">;
+                            path: zod.ZodString;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"command">;
+                            program: zod.ZodString;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"op">;
+                            reference: zod.ZodString;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"keychain">;
+                            service: zod.ZodString;
+                            account: zod.ZodOptional<zod.ZodString>;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"literal">;
+                        }, zod_v4_core.$strict>]>>>;
+                        cache: zod.ZodOptional<zod.ZodObject<{
+                            ttl: zod.ZodOptional<zod.ZodString>;
+                            store: zod.ZodOptional<zod.ZodEnum<{
+                                file: "file";
+                                keychain: "keychain";
+                            }>>;
+                        }, zod_v4_core.$strict>>;
+                    }, zod_v4_core.$strict>;
+                    cached: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                        store: zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>;
+                        status: zod.ZodLiteral<"empty">;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        store: zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>;
+                        status: zod.ZodLiteral<"unreadable">;
+                        reason: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        store: zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>;
+                        status: zod.ZodEnum<{
+                            fresh: "fresh";
+                            expired: "expired";
+                        }>;
+                        ageMs: zod.ZodNumber;
+                        expiresInMs: zod.ZodOptional<zod.ZodNumber>;
+                    }, zod_v4_core.$strict>]>>;
+                }, zod_v4_core.$strict>, zod.ZodObject<{
+                    name: zod.ZodString;
+                    problem: zod.ZodString;
+                }, zod_v4_core.$strict>]>>;
+                identity: zod.ZodOptional<zod.ZodObject<{
+                    target: zod.ZodEnum<{
+                        bearer: "bearer";
+                        apiKey: "apiKey";
+                        oauthToken: "oauthToken";
+                    }>;
+                    sources: zod.ZodReadonly<zod.ZodArray<zod.ZodUnion<readonly [zod.ZodObject<{
+                        kind: zod.ZodLiteral<"env">;
+                        variable: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"file">;
+                        path: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"command">;
+                        program: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"op">;
+                        reference: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"keychain">;
+                        service: zod.ZodString;
+                        account: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"literal">;
+                    }, zod_v4_core.$strict>]>>>;
+                    cache: zod.ZodOptional<zod.ZodObject<{
+                        ttl: zod.ZodOptional<zod.ZodString>;
+                        store: zod.ZodOptional<zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>>;
+                    }, zod_v4_core.$strict>>;
+                }, zod_v4_core.$strict>>;
+                identityCached: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                    store: zod.ZodEnum<{
+                        file: "file";
+                        keychain: "keychain";
+                    }>;
+                    status: zod.ZodLiteral<"empty">;
+                }, zod_v4_core.$strict>, zod.ZodObject<{
+                    store: zod.ZodEnum<{
+                        file: "file";
+                        keychain: "keychain";
+                    }>;
+                    status: zod.ZodLiteral<"unreadable">;
+                    reason: zod.ZodString;
+                }, zod_v4_core.$strict>, zod.ZodObject<{
+                    store: zod.ZodEnum<{
+                        file: "file";
+                        keychain: "keychain";
+                    }>;
+                    status: zod.ZodEnum<{
+                        fresh: "fresh";
+                        expired: "expired";
+                    }>;
+                    ageMs: zod.ZodNumber;
+                    expiresInMs: zod.ZodOptional<zod.ZodNumber>;
+                }, zod_v4_core.$strict>]>>;
+            }, zod_v4_core.$strict>;
+            claudeVersion: zod.ZodOptional<zod.ZodObject<{
+                pinned: zod.ZodOptional<zod.ZodObject<{
+                    version: zod.ZodString;
+                    source: zod.ZodEnum<{
+                        flag: "flag";
+                        environment: "environment";
+                        cascade: "cascade";
+                    }>;
+                    installed: zod.ZodBoolean;
+                }, zod_v4_core.$strict>>;
+                highestInstalled: zod.ZodOptional<zod.ZodString>;
+                installed: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+            }, zod_v4_core.$strict>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+    };
+    doctor: {
+        run: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            ok: zod.ZodBoolean;
+            findings: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                section: zod.ZodEnum<{
+                    "global-config": "global-config";
+                    "config-profile": "config-profile";
+                    identity: "identity";
+                    provider: "provider";
+                    pool: "pool";
+                    keychain: "keychain";
+                    "ambient-credential": "ambient-credential";
+                    "binary-discovery": "binary-discovery";
+                    "claude-shim": "claude-shim";
+                    "path-resolution": "path-resolution";
+                    "legacy-name": "legacy-name";
+                    "directory-rules": "directory-rules";
+                    "categories-local": "categories-local";
+                    "active-identity": "active-identity";
+                    headroom: "headroom";
+                }>;
+                subject: zod.ZodOptional<zod.ZodString>;
+                severity: zod.ZodEnum<{
+                    pass: "pass";
+                    warn: "warn";
+                    fail: "fail";
+                }>;
+                message: zod.ZodString;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+    };
+};
+/** The control-plane routers, as the merged mount's and the client's own types are derived from them. */
+type ControlApiRouter = ReturnType<typeof createControlApiRouter>;
+/** The control plane alone as a client sees it: every call presents the control token, over TLS trusting only the CA file the door's own state names. */
+type ControlApiClient = RouterClient<ControlApiRouter>;
+/** Everything the door's whole typed API needs: the Remote Control operations and the control-plane reads, one deps object because one mount serves them under one token. */
+interface DoorApiDeps extends RcApiDeps, ControlApiDeps {
+}
+/** Builds the door's whole typed API: the Remote Control router and the control-plane routers beside it, one object for the one handler the provider listener mounts. */
+declare function createDoorApiRouter(deps: DoorApiDeps): {
+    usage: {
+        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            snapshots: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                schemaVersion: zod.ZodLiteral<1>;
+                identity: zod.ZodString;
+                updatedAt: zod.ZodISODateTime;
+                account: zod.ZodOptional<zod.ZodObject<{
+                    accountUuid: zod.ZodOptional<zod.ZodString>;
+                    emailAddress: zod.ZodOptional<zod.ZodString>;
+                    displayName: zod.ZodOptional<zod.ZodString>;
+                    organizationUuid: zod.ZodOptional<zod.ZodString>;
+                    organizationName: zod.ZodOptional<zod.ZodString>;
+                    organizationType: zod.ZodOptional<zod.ZodString>;
+                    organizationRole: zod.ZodOptional<zod.ZodString>;
+                    workspaceRole: zod.ZodOptional<zod.ZodString>;
+                    billingType: zod.ZodOptional<zod.ZodString>;
+                    seatTier: zod.ZodOptional<zod.ZodString>;
+                    organizationRateLimitTier: zod.ZodOptional<zod.ZodString>;
+                    userRateLimitTier: zod.ZodOptional<zod.ZodString>;
+                    hasExtraUsageEnabled: zod.ZodOptional<zod.ZodBoolean>;
+                    subscriptionCreatedAt: zod.ZodOptional<zod.ZodString>;
+                    accountCreatedAt: zod.ZodOptional<zod.ZodString>;
+                }, zod_v4_core.$strict>>;
+                providers: zod.ZodRecord<zod.ZodString, zod.ZodObject<{
+                    lastRequestAt: zod.ZodISODateTime;
+                    lastStatus: zod.ZodNumber;
+                    lastModel: zod.ZodOptional<zod.ZodString>;
+                    rateLimit: zod.ZodOptional<zod.ZodObject<{
+                        observedAt: zod.ZodISODateTime;
+                        headers: zod.ZodRecord<zod.ZodString, zod.ZodString>;
+                        unified: zod.ZodOptional<zod.ZodObject<{
+                            status: zod.ZodOptional<zod.ZodString>;
+                            fiveHour: zod.ZodOptional<zod.ZodObject<{
+                                utilization: zod.ZodOptional<zod.ZodNumber>;
+                                resetsAt: zod.ZodOptional<zod.ZodISODateTime>;
+                                status: zod.ZodOptional<zod.ZodString>;
+                            }, zod_v4_core.$strict>>;
+                            sevenDay: zod.ZodOptional<zod.ZodObject<{
+                                utilization: zod.ZodOptional<zod.ZodNumber>;
+                                resetsAt: zod.ZodOptional<zod.ZodISODateTime>;
+                                status: zod.ZodOptional<zod.ZodString>;
+                            }, zod_v4_core.$strict>>;
+                            representativeClaim: zod.ZodOptional<zod.ZodString>;
+                            resetAt: zod.ZodOptional<zod.ZodISODateTime>;
+                            overageStatus: zod.ZodOptional<zod.ZodString>;
+                        }, zod_v4_core.$strict>>;
+                    }, zod_v4_core.$strict>>;
+                    lastLimit: zod.ZodOptional<zod.ZodObject<{
+                        kind: zod.ZodEnum<{
+                            "rate-limited": "rate-limited";
+                            "quota-exhausted": "quota-exhausted";
+                        }>;
+                        retryAfterSeconds: zod.ZodOptional<zod.ZodNumber>;
+                        resetAt: zod.ZodOptional<zod.ZodISODateTime>;
+                        window: zod.ZodOptional<zod.ZodString>;
+                        evidence: zod.ZodArray<zod.ZodString>;
+                        observedAt: zod.ZodISODateTime;
+                        status: zod.ZodNumber;
+                    }, zod_v4_core.$strict>>;
+                    quota: zod.ZodOptional<zod.ZodObject<{
+                        observedAt: zod.ZodISODateTime;
+                        source: zod.ZodString;
+                        level: zod.ZodOptional<zod.ZodString>;
+                        windows: zod.ZodArray<zod.ZodObject<{
+                            measures: zod.ZodString;
+                            periodMs: zod.ZodOptional<zod.ZodNumber>;
+                            period: zod.ZodOptional<zod.ZodString>;
+                            utilization: zod.ZodNumber;
+                            resetsAt: zod.ZodOptional<zod.ZodISODateTime>;
+                            limit: zod.ZodOptional<zod.ZodNumber>;
+                            used: zod.ZodOptional<zod.ZodNumber>;
+                            remaining: zod.ZodOptional<zod.ZodNumber>;
+                        }, zod_v4_core.$strict>>;
+                    }, zod_v4_core.$strict>>;
+                }, zod_v4_core.$strict>>;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        effectiveWindow: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            identity: zod.ZodString;
+            provider: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            identity: zod.ZodString;
+            provider: zod.ZodString;
+            observedAt: zod.ZodOptional<zod.ZodISODateTime>;
+            fiveHour: zod.ZodOptional<zod.ZodObject<{
+                reset: zod.ZodBoolean;
+                utilization: zod.ZodOptional<zod.ZodNumber>;
+                resetsAtMs: zod.ZodOptional<zod.ZodNumber>;
+                status: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>>;
+            sevenDay: zod.ZodOptional<zod.ZodObject<{
+                reset: zod.ZodBoolean;
+                utilization: zod.ZodOptional<zod.ZodNumber>;
+                resetsAtMs: zod.ZodOptional<zod.ZodNumber>;
+                status: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+    };
+    frontdoor: {
+        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            state: zod.ZodObject<{
+                protocol: zod.ZodOptional<zod.ZodNumber>;
+                supervisorPid: zod.ZodOptional<zod.ZodNumber>;
+                port: zod.ZodOptional<zod.ZodNumber>;
+                lastPort: zod.ZodOptional<zod.ZodNumber>;
+                connectPort: zod.ZodOptional<zod.ZodNumber>;
+                lastConnectPort: zod.ZodOptional<zod.ZodNumber>;
+                directPort: zod.ZodOptional<zod.ZodNumber>;
+                lastDirectPort: zod.ZodOptional<zod.ZodNumber>;
+                lastError: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>;
+            supervisorAlive: zod.ZodBoolean;
+            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                pid: zod.ZodInt;
+                startedAt: zod.ZodNumber;
+                alive: zod.ZodBoolean;
+            }, zod_v4_core.$strict>>>;
+            headroomSocket: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                socketPath: zod.ZodString;
+            }, zod_v4_core.$strict>, zod.ZodObject<{
+                refused: zod.ZodString;
+            }, zod_v4_core.$strict>]>>;
+            logPath: zod.ZodString;
+            logExists: zod.ZodBoolean;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        sessions: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                pid: zod.ZodInt;
+                startedAt: zod.ZodNumber;
+                alive: zod.ZodBoolean;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+    };
+    check: {
+        run: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            path: zod.ZodString;
+            identity: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            identity: zod.ZodObject<{
+                name: zod.ZodNullable<zod.ZodString>;
+                source: zod.ZodEnum<{
+                    "config-dir-escape-hatch": "config-dir-escape-hatch";
+                    argv: "argv";
+                    env: "env";
+                    "directory-pin": "directory-pin";
+                    "active-identity-file": "active-identity-file";
+                    none: "none";
+                }>;
+            }, zod_v4_core.$strict>;
+            pool: zod.ZodOptional<zod.ZodObject<{
+                pool: zod.ZodString;
+                directory: zod.ZodString;
+                pick: zod.ZodOptional<zod.ZodString>;
+                candidates: zod.ZodArray<zod.ZodObject<{
+                    identity: zod.ZodString;
+                    class: zod.ZodEnum<{
+                        unknown: "unknown";
+                        scored: "scored";
+                        "pay-per-use": "pay-per-use";
+                        ineligible: "ineligible";
+                    }>;
+                    score: zod.ZodOptional<zod.ZodNumber>;
+                    feasible: zod.ZodBoolean;
+                    blockedUntil: zod.ZodOptional<zod.ZodISODateTime>;
+                    plan: zod.ZodUnion<readonly [zod.ZodObject<{
+                        kind: zod.ZodLiteral<"subscription">;
+                        capacity: zod.ZodNumber;
+                        recognised: zod.ZodBoolean;
+                        tier: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"pay-per-use">;
+                        tier: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>]>;
+                    reasons: zod.ZodArray<zod.ZodString>;
+                }, zod_v4_core.$strict>>;
+                missing: zod.ZodArray<zod.ZodString>;
+                earliestReturn: zod.ZodOptional<zod.ZodObject<{
+                    identity: zod.ZodString;
+                    at: zod.ZodISODateTime;
+                }, zod_v4_core.$strict>>;
+                stickyProblem: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>>;
+            configProfile: zod.ZodObject<{
+                name: zod.ZodNullable<zod.ZodString>;
+                source: zod.ZodEnum<{
+                    "directory-rule": "directory-rule";
+                    env: "env";
+                    none: "none";
+                    "cli-flag": "cli-flag";
+                    "identity-default": "identity-default";
+                    "global-default": "global-default";
+                }>;
+            }, zod_v4_core.$strict>;
+            layers: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                id: zod.ZodInt;
+                kind: zod.ZodEnum<{
+                    "global-config": "global-config";
+                    "config-profile": "config-profile";
+                    "directory-rule": "directory-rule";
+                    portable: "portable";
+                    "portable-local": "portable-local";
+                    "cli-override": "cli-override";
+                }>;
+                source: zod.ZodString;
+            }, zod_v4_core.$strict>>>;
+            entries: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                path: zod.ZodString;
+                shared: zod.ZodBoolean;
+                via: zod.ZodEnum<{
+                    "secret-floor": "secret-floor";
+                    unclassified: "unclassified";
+                    "entry-rule": "entry-rule";
+                    "category-override": "category-override";
+                    "category-default": "category-default";
+                }>;
+                category: zod.ZodNullable<zod.ZodEnum<{
+                    secret: "secret";
+                    runtime: "runtime";
+                    history: "history";
+                    knowledge: "knowledge";
+                    settings: "settings";
+                }>>;
+                rule: zod.ZodOptional<zod.ZodObject<{
+                    key: zod.ZodString;
+                    layer: zod.ZodInt;
+                }, zod_v4_core.$strict>>;
+                eliminated: zod.ZodOptional<zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                    key: zod.ZodString;
+                    failed: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+                }, zod_v4_core.$strict>>>>;
+            }, zod_v4_core.$strict>>>;
+            projectEncodingAmbiguities: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                fragment: zod.ZodString;
+                encoded: zod.ZodString;
+                reason: zod.ZodEnum<{
+                    "lossy-characters": "lossy-characters";
+                    "collides-with-sibling-pattern": "collides-with-sibling-pattern";
+                }>;
+                detail: zod.ZodString;
+            }, zod_v4_core.$strict>>>;
+            diagnostics: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                code: zod.ZodEnum<{
+                    EXTENDS_CYCLE: "EXTENDS_CYCLE";
+                    MISSING_PROFILE: "MISSING_PROFILE";
+                    SECRET_ENTRY_KEY: "SECRET_ENTRY_KEY";
+                    SECRET_PATH_NEUTRALISED: "SECRET_PATH_NEUTRALISED";
+                    CATEGORY_PREFIX_MISMATCH: "CATEGORY_PREFIX_MISMATCH";
+                    MALFORMED_ENTRY_KEY: "MALFORMED_ENTRY_KEY";
+                    EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB: "EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB";
+                    AMBIGUOUS_PROJECT_ENCODING: "AMBIGUOUS_PROJECT_ENCODING";
+                    UNROOTED_PROJECT_PATH: "UNROOTED_PROJECT_PATH";
+                    UNCLASSIFIED_ENTRY: "UNCLASSIFIED_ENTRY";
+                    EMPTY_WHEN: "EMPTY_WHEN";
+                    FARM_MANIFEST_MISSING: "FARM_MANIFEST_MISSING";
+                    RECONCILE_CONFLICT: "RECONCILE_CONFLICT";
+                    RECONCILE_SECRET_BLOCKED: "RECONCILE_SECRET_BLOCKED";
+                    FARM_SWAP_RECOVERED: "FARM_SWAP_RECOVERED";
+                    FARM_PREVIOUS_RETAINED: "FARM_PREVIOUS_RETAINED";
+                }>;
+                severity: zod.ZodEnum<{
+                    error: "error";
+                    warning: "warning";
+                    info: "info";
+                }>;
+                message: zod.ZodString;
+                subject: zod.ZodOptional<zod.ZodString>;
+                layer: zod.ZodOptional<zod.ZodInt>;
+            }, zod_v4_core.$strict>>>;
+            ambientCredential: zod.ZodUnion<readonly [zod.ZodObject<{
+                ok: zod.ZodLiteral<true>;
+            }, zod_v4_core.$strict>, zod.ZodObject<{
+                ok: zod.ZodLiteral<false>;
+                variable: zod.ZodString;
+                message: zod.ZodString;
+            }, zod_v4_core.$strict>]>;
+            keychain: zod.ZodOptional<zod.ZodObject<{
+                checked: zod.ZodLiteral<true>;
+                found: zod.ZodBoolean;
+                serviceName: zod.ZodOptional<zod.ZodString>;
+                note: zod.ZodString;
+            }, zod_v4_core.$strict>>;
+            settingsExposure: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                file: zod.ZodString;
+                envKeyNames: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+                hookEventNames: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+                hookCommandCount: zod.ZodInt;
+            }, zod_v4_core.$strict>>>;
+            credential: zod.ZodObject<{
+                applies: zod.ZodEnum<{
+                    identity: "identity";
+                    provider: "provider";
+                    "stored-login": "stored-login";
+                }>;
+                provider: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                    name: zod.ZodString;
+                    credential: zod.ZodObject<{
+                        target: zod.ZodEnum<{
+                            bearer: "bearer";
+                            apiKey: "apiKey";
+                            oauthToken: "oauthToken";
+                        }>;
+                        sources: zod.ZodReadonly<zod.ZodArray<zod.ZodUnion<readonly [zod.ZodObject<{
+                            kind: zod.ZodLiteral<"env">;
+                            variable: zod.ZodString;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"file">;
+                            path: zod.ZodString;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"command">;
+                            program: zod.ZodString;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"op">;
+                            reference: zod.ZodString;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"keychain">;
+                            service: zod.ZodString;
+                            account: zod.ZodOptional<zod.ZodString>;
+                        }, zod_v4_core.$strict>, zod.ZodObject<{
+                            kind: zod.ZodLiteral<"literal">;
+                        }, zod_v4_core.$strict>]>>>;
+                        cache: zod.ZodOptional<zod.ZodObject<{
+                            ttl: zod.ZodOptional<zod.ZodString>;
+                            store: zod.ZodOptional<zod.ZodEnum<{
+                                file: "file";
+                                keychain: "keychain";
+                            }>>;
+                        }, zod_v4_core.$strict>>;
+                    }, zod_v4_core.$strict>;
+                    cached: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                        store: zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>;
+                        status: zod.ZodLiteral<"empty">;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        store: zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>;
+                        status: zod.ZodLiteral<"unreadable">;
+                        reason: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        store: zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>;
+                        status: zod.ZodEnum<{
+                            fresh: "fresh";
+                            expired: "expired";
+                        }>;
+                        ageMs: zod.ZodNumber;
+                        expiresInMs: zod.ZodOptional<zod.ZodNumber>;
+                    }, zod_v4_core.$strict>]>>;
+                }, zod_v4_core.$strict>, zod.ZodObject<{
+                    name: zod.ZodString;
+                    problem: zod.ZodString;
+                }, zod_v4_core.$strict>]>>;
+                identity: zod.ZodOptional<zod.ZodObject<{
+                    target: zod.ZodEnum<{
+                        bearer: "bearer";
+                        apiKey: "apiKey";
+                        oauthToken: "oauthToken";
+                    }>;
+                    sources: zod.ZodReadonly<zod.ZodArray<zod.ZodUnion<readonly [zod.ZodObject<{
+                        kind: zod.ZodLiteral<"env">;
+                        variable: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"file">;
+                        path: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"command">;
+                        program: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"op">;
+                        reference: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"keychain">;
+                        service: zod.ZodString;
+                        account: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"literal">;
+                    }, zod_v4_core.$strict>]>>>;
+                    cache: zod.ZodOptional<zod.ZodObject<{
+                        ttl: zod.ZodOptional<zod.ZodString>;
+                        store: zod.ZodOptional<zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>>;
+                    }, zod_v4_core.$strict>>;
+                }, zod_v4_core.$strict>>;
+                identityCached: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                    store: zod.ZodEnum<{
+                        file: "file";
+                        keychain: "keychain";
+                    }>;
+                    status: zod.ZodLiteral<"empty">;
+                }, zod_v4_core.$strict>, zod.ZodObject<{
+                    store: zod.ZodEnum<{
+                        file: "file";
+                        keychain: "keychain";
+                    }>;
+                    status: zod.ZodLiteral<"unreadable">;
+                    reason: zod.ZodString;
+                }, zod_v4_core.$strict>, zod.ZodObject<{
+                    store: zod.ZodEnum<{
+                        file: "file";
+                        keychain: "keychain";
+                    }>;
+                    status: zod.ZodEnum<{
+                        fresh: "fresh";
+                        expired: "expired";
+                    }>;
+                    ageMs: zod.ZodNumber;
+                    expiresInMs: zod.ZodOptional<zod.ZodNumber>;
+                }, zod_v4_core.$strict>]>>;
+            }, zod_v4_core.$strict>;
+            claudeVersion: zod.ZodOptional<zod.ZodObject<{
+                pinned: zod.ZodOptional<zod.ZodObject<{
+                    version: zod.ZodString;
+                    source: zod.ZodEnum<{
+                        flag: "flag";
+                        environment: "environment";
+                        cascade: "cascade";
+                    }>;
+                    installed: zod.ZodBoolean;
+                }, zod_v4_core.$strict>>;
+                highestInstalled: zod.ZodOptional<zod.ZodString>;
+                installed: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+            }, zod_v4_core.$strict>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+    };
+    doctor: {
+        run: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            ok: zod.ZodBoolean;
+            findings: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                section: zod.ZodEnum<{
+                    "global-config": "global-config";
+                    "config-profile": "config-profile";
+                    identity: "identity";
+                    provider: "provider";
+                    pool: "pool";
+                    keychain: "keychain";
+                    "ambient-credential": "ambient-credential";
+                    "binary-discovery": "binary-discovery";
+                    "claude-shim": "claude-shim";
+                    "path-resolution": "path-resolution";
+                    "legacy-name": "legacy-name";
+                    "directory-rules": "directory-rules";
+                    "categories-local": "categories-local";
+                    "active-identity": "active-identity";
+                    headroom: "headroom";
+                }>;
+                subject: zod.ZodOptional<zod.ZodString>;
+                severity: zod.ZodEnum<{
+                    pass: "pass";
+                    warn: "warn";
+                    fail: "fail";
+                }>;
+                message: zod.ZodString;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+    };
+    rc: {
+        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                id: zod.ZodString;
+                createdAt: zod.ZodNumber;
+                lastSeenAt: zod.ZodNumber;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            session: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            statuses: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                workerState: zod.ZodOptional<zod.ZodObject<{
+                    value: zod.ZodString;
+                    observedAt: zod.ZodNumber;
+                }, zod_v4_core.$strict>>;
+                workerIdleSeconds: zod.ZodOptional<zod.ZodObject<{
+                    value: zod.ZodNumber;
+                    observedAt: zod.ZodNumber;
+                }, zod_v4_core.$strict>>;
+                pending: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                    sessionId: zod.ZodString;
+                    requestId: zod.ZodString;
+                    type: zod.ZodString;
+                    summary: zod.ZodString;
+                    observedAt: zod.ZodNumber;
+                }, zod_v4_core.$strict>>>;
+                id: zod.ZodString;
+                createdAt: zod.ZodNumber;
+                lastSeenAt: zod.ZodNumber;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        pending: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            session: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            pending: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                sessionId: zod.ZodString;
+                requestId: zod.ZodString;
+                type: zod.ZodString;
+                summary: zod.ZodString;
+                observedAt: zod.ZodNumber;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        send: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            session: zod.ZodString;
+            text: zod.ZodString;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        answer: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            session: zod.ZodString;
+            request: zod.ZodString;
+            approve: zod.ZodBoolean;
+            text: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            request: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        interrupt: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            session: zod.ZodString;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        setModel: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            session: zod.ZodString;
+            model: zod.ZodString;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        setPermissionMode: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            session: zod.ZodString;
+            mode: zod.ZodEnum<{
+                default: "default";
+                acceptEdits: "acceptEdits";
+                bypassPermissions: "bypassPermissions";
+                plan: "plan";
+                dontAsk: "dontAsk";
+                auto: "auto";
+            }>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        subscribe: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+            session: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, any, Record<never, never>, Record<never, never>>;
+    };
+};
+/** The door's whole typed API, as the client the door's own verbs and library consumers use is derived from it. */
+type DoorApiRouter = ReturnType<typeof createDoorApiRouter>;
+/**
+ * Builds the node handler for the door's whole typed API, Remote Control and control plane together: the pre-pipeline surface the provider listener hands every request under `RC_ORPC_PATH_PREFIX`.
+ */
+declare function createDoorApiNodeHandler(deps: DoorApiDeps): PrePipelineApi;
+/** The door's whole typed API as a client sees it: every call presents the control token, over TLS trusting only the CA file the door's own state names. */
+type DoorApiClient = RouterClient<DoorApiRouter>;
+/** Builds the client for the door's whole typed API: the same address, CA and per-generation control token the Remote Control client uses, with the control-plane procedures beside `rc.*`. */
+declare function frontDoorApiClient(port: number, ca: string, token: string): DoorApiClient;
+
+/**
+ * The Zod schemas of the door's general control plane: the usage snapshots a remote consumer reads, the front door's own status and session registry, the check report over a path, and the doctor report, each one the input or output of a procedure in `controlApi.ts`. Like `rcSchemas.ts` this module is a plain Zod leaf (nothing here imports oRPC), and every shape it asserts is one the implementation already defines: the usage snapshot and front-door state schemas are the store's and the registry's own, the check report's is `checkReportSchema.ts`'s (`CheckReportJsonSchema`, imported straight by the procedure), and the doctor vocabulary is `doctorReport.ts`'s own, so contract and behaviour share one source and a drift fails the procedures' own validation rather than shipping silently.
+ */
+/** Every usage snapshot on this machine, one per identity that has routed a request through the door. */
+declare const UsageListOutputSchema: z.ZodObject<{
+    snapshots: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        identity: z.ZodString;
+        updatedAt: z.ZodISODateTime;
+        account: z.ZodOptional<z.ZodObject<{
+            accountUuid: z.ZodOptional<z.ZodString>;
+            emailAddress: z.ZodOptional<z.ZodString>;
+            displayName: z.ZodOptional<z.ZodString>;
+            organizationUuid: z.ZodOptional<z.ZodString>;
+            organizationName: z.ZodOptional<z.ZodString>;
+            organizationType: z.ZodOptional<z.ZodString>;
+            organizationRole: z.ZodOptional<z.ZodString>;
+            workspaceRole: z.ZodOptional<z.ZodString>;
+            billingType: z.ZodOptional<z.ZodString>;
+            seatTier: z.ZodOptional<z.ZodString>;
+            organizationRateLimitTier: z.ZodOptional<z.ZodString>;
+            userRateLimitTier: z.ZodOptional<z.ZodString>;
+            hasExtraUsageEnabled: z.ZodOptional<z.ZodBoolean>;
+            subscriptionCreatedAt: z.ZodOptional<z.ZodString>;
+            accountCreatedAt: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        providers: z.ZodRecord<z.ZodString, z.ZodObject<{
+            lastRequestAt: z.ZodISODateTime;
+            lastStatus: z.ZodNumber;
+            lastModel: z.ZodOptional<z.ZodString>;
+            rateLimit: z.ZodOptional<z.ZodObject<{
+                observedAt: z.ZodISODateTime;
+                headers: z.ZodRecord<z.ZodString, z.ZodString>;
+                unified: z.ZodOptional<z.ZodObject<{
+                    status: z.ZodOptional<z.ZodString>;
+                    fiveHour: z.ZodOptional<z.ZodObject<{
+                        utilization: z.ZodOptional<z.ZodNumber>;
+                        resetsAt: z.ZodOptional<z.ZodISODateTime>;
+                        status: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>>;
+                    sevenDay: z.ZodOptional<z.ZodObject<{
+                        utilization: z.ZodOptional<z.ZodNumber>;
+                        resetsAt: z.ZodOptional<z.ZodISODateTime>;
+                        status: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>>;
+                    representativeClaim: z.ZodOptional<z.ZodString>;
+                    resetAt: z.ZodOptional<z.ZodISODateTime>;
+                    overageStatus: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            lastLimit: z.ZodOptional<z.ZodObject<{
+                kind: z.ZodEnum<{
+                    "rate-limited": "rate-limited";
+                    "quota-exhausted": "quota-exhausted";
+                }>;
+                retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+                resetAt: z.ZodOptional<z.ZodISODateTime>;
+                window: z.ZodOptional<z.ZodString>;
+                evidence: z.ZodArray<z.ZodString>;
+                observedAt: z.ZodISODateTime;
+                status: z.ZodNumber;
+            }, z.core.$strict>>;
+            quota: z.ZodOptional<z.ZodObject<{
+                observedAt: z.ZodISODateTime;
+                source: z.ZodString;
+                level: z.ZodOptional<z.ZodString>;
+                windows: z.ZodArray<z.ZodObject<{
+                    measures: z.ZodString;
+                    periodMs: z.ZodOptional<z.ZodNumber>;
+                    period: z.ZodOptional<z.ZodString>;
+                    utilization: z.ZodNumber;
+                    resetsAt: z.ZodOptional<z.ZodISODateTime>;
+                    limit: z.ZodOptional<z.ZodNumber>;
+                    used: z.ZodOptional<z.ZodNumber>;
+                    remaining: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+/** The windows query: one identity by name, and optionally the provider whose windows are wanted (`anthropic` for an OAuth session, the default). */
+declare const UsageWindowsInputSchema: z.ZodObject<{
+    identity: z.ZodString;
+    provider: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** One quota window as it stands now, exactly as `effectiveWindow` reads a recorded one: a window whose reset has passed is empty and carries no status, so every consumer agrees on what an old observation still means. */
+declare const EffectiveWindowSchema: z.ZodObject<{
+    reset: z.ZodBoolean;
+    utilization: z.ZodOptional<z.ZodNumber>;
+    resetsAtMs: z.ZodOptional<z.ZodNumber>;
+    status: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** One identity's effective windows for a provider: what the snapshot last observed, read at the door's own clock. Absent fields mean the snapshot observed nothing there. */
+declare const UsageWindowsOutputSchema: z.ZodObject<{
+    identity: z.ZodString;
+    provider: z.ZodString;
+    observedAt: z.ZodOptional<z.ZodISODateTime>;
+    fiveHour: z.ZodOptional<z.ZodObject<{
+        reset: z.ZodBoolean;
+        utilization: z.ZodOptional<z.ZodNumber>;
+        resetsAtMs: z.ZodOptional<z.ZodNumber>;
+        status: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    sevenDay: z.ZodOptional<z.ZodObject<{
+        reset: z.ZodBoolean;
+        utilization: z.ZodOptional<z.ZodNumber>;
+        resetsAtMs: z.ZodOptional<z.ZodNumber>;
+        status: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** One registered launch as the status surfaces list it: the launcher's pid and start time plus whether it is still running, never the session's capability token. */
+declare const FrontDoorSessionStatusSchema: z.ZodObject<{
+    pid: z.ZodInt;
+    startedAt: z.ZodNumber;
+    alive: z.ZodBoolean;
+}, z.core.$strict>;
+/** The headroom daemon's socket as the door's hop reads it: the path it may dial, or the reason it must not. The two never appear together. */
+declare const HeadroomSocketTargetSchema: z.ZodUnion<readonly [z.ZodObject<{
+    socketPath: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    refused: z.ZodString;
+}, z.core.$strict>]>;
+/** Everything the door's status procedure returns: the supervisor state file's own record, its liveness, the registered launches, the headroom hop, and the door's log. */
+declare const FrontDoorStatusOutputSchema: z.ZodObject<{
+    state: z.ZodObject<{
+        protocol: z.ZodOptional<z.ZodNumber>;
+        supervisorPid: z.ZodOptional<z.ZodNumber>;
+        port: z.ZodOptional<z.ZodNumber>;
+        lastPort: z.ZodOptional<z.ZodNumber>;
+        connectPort: z.ZodOptional<z.ZodNumber>;
+        lastConnectPort: z.ZodOptional<z.ZodNumber>;
+        directPort: z.ZodOptional<z.ZodNumber>;
+        lastDirectPort: z.ZodOptional<z.ZodNumber>;
+        lastError: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    supervisorAlive: z.ZodBoolean;
+    sessions: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        pid: z.ZodInt;
+        startedAt: z.ZodNumber;
+        alive: z.ZodBoolean;
+    }, z.core.$strict>>>;
+    headroomSocket: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        socketPath: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        refused: z.ZodString;
+    }, z.core.$strict>]>>;
+    logPath: z.ZodString;
+    logExists: z.ZodBoolean;
+}, z.core.$strict>;
+/** The session registry's live launches, as the door's sessions procedure returns them. */
+declare const FrontDoorSessionsOutputSchema: z.ZodObject<{
+    sessions: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        pid: z.ZodInt;
+        startedAt: z.ZodNumber;
+        alive: z.ZodBoolean;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+/** The check query: one absolute directory (the door has no working directory of the caller's to resolve a relative path against, so a relative one is refused rather than silently resolved somewhere else), and optionally the identity to check as `--identity` names it. */
+declare const CheckRunInputSchema: z.ZodObject<{
+    path: z.ZodString;
+    identity: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** One line of the doctor report: the section it belongs to, its severity, its message, and the identity/profile/rule it is about when there is one. */
+declare const DoctorFindingSchema: z.ZodObject<{
+    section: z.ZodEnum<{
+        "global-config": "global-config";
+        "config-profile": "config-profile";
+        identity: "identity";
+        provider: "provider";
+        pool: "pool";
+        keychain: "keychain";
+        "ambient-credential": "ambient-credential";
+        "binary-discovery": "binary-discovery";
+        "claude-shim": "claude-shim";
+        "path-resolution": "path-resolution";
+        "legacy-name": "legacy-name";
+        "directory-rules": "directory-rules";
+        "categories-local": "categories-local";
+        "active-identity": "active-identity";
+        headroom: "headroom";
+    }>;
+    subject: z.ZodOptional<z.ZodString>;
+    severity: z.ZodEnum<{
+        pass: "pass";
+        warn: "warn";
+        fail: "fail";
+    }>;
+    message: z.ZodString;
+}, z.core.$strict>;
+/** The doctor report as data: every finding and whether any of them failed. */
+declare const DoctorRunOutputSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    findings: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        section: z.ZodEnum<{
+            "global-config": "global-config";
+            "config-profile": "config-profile";
+            identity: "identity";
+            provider: "provider";
+            pool: "pool";
+            keychain: "keychain";
+            "ambient-credential": "ambient-credential";
+            "binary-discovery": "binary-discovery";
+            "claude-shim": "claude-shim";
+            "path-resolution": "path-resolution";
+            "legacy-name": "legacy-name";
+            "directory-rules": "directory-rules";
+            "categories-local": "categories-local";
+            "active-identity": "active-identity";
+            headroom: "headroom";
+        }>;
+        subject: z.ZodOptional<z.ZodString>;
+        severity: z.ZodEnum<{
+            pass: "pass";
+            warn: "warn";
+            fail: "fail";
+        }>;
+        message: z.ZodString;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
 
 /**
- * The read side of the usage store: pure over an injected filesystem, so the CLI, the library surface and tests all read the same way, and nothing here writes.
+ * The self-hosted Remote Control service: the door serving, locally, the CCR surface it normally only observes (ExaDev/agent-shim#207). When the mode is on, a Claude Code session activates Remote Control against this surface and is controlled through it with no Anthropic credential anywhere: the door answers the session family itself instead of piping it to the real API host, so the `cse_` sessions, their sequence numbers, their worker and client streams and their event writes all live on this machine.
+ *
+ * The protocol spoken is exactly the one the door already speaks as a client, which is what makes this honest: every path, envelope, sequence rule and resume pair below is the shape the merged client-half machinery (`rcSessions.ts`, `rcStream.ts`, `connectEffects.ts`) dials the real host with, cross-checked against the CLI source (the 2.1.88 source-map dump behind the issue's spike) and live 2.1.289 envelopes captured through the interception rig. The transport is version-unstable (CCRv1 websocket to CCRv2 SSE plus POST within the 2.1.x line), so this surface pins what the rig's pinned CLI speaks and must be re-verified on upgrades; that standing caveat is issue #207's own.
+ *
+ * Division of the surface: the session family (`/v1/code/sessions...` and the `/v1/sessions` compatibility list) rides the routed pipeline as a `FrontDoorRoute`, so it flows through the same admission and middleware as any routed request and, above all, through the same observation wrapper that feeds the tracker (the door's own client half learns each session's credential precisely because the create is observed like any other exchange). The non-`/v1/` answers the CLI needs around activation (feature eval, profile, telemetry no-ops) and the OAuth refresh on the control-plane host have no pipeline to ride, so they are served by `local`, which the connect surface consults before routing or piping; that surface also takes over the control-plane host's terminated session as ordinary HTTP (it is normally byte-tapped) because answering `/v1/oauth/token` requires parsing it.
+ *
+ * The one network lever this uses is the bridge response's `api_base_url`: the protocol lets the server name where the worker dials, so the door names the API host it itself terminates, and the worker's `/worker/...` calls arrive straight back at this surface over the same interception that carried the create.
+ *
+ * Everything is in memory only and dies with the door process: sessions, events, worker JWTs. No credential this door authenticates against is ever written or logged by this module; the minting command owns the files.
  */
-/** The filesystem reads the usage store's readers need. */
-type UsageReadFs = Pick<FarmFs, "readFileUtf8" | "readdir">;
-/** Raised for a snapshot file that exists but does not hold a snapshot of this schema version. */
-declare class UsageSnapshotError extends Error {
-    readonly file: string;
-    constructor(file: string, detail: string);
-}
-/** The path of an identity's snapshot. Throws for an invalid identity name, which could otherwise name a path outside the snapshots directory. */
-declare function snapshotPath(snapshotsDir: string, identity: string): string;
-/** Reads one identity's snapshot: undefined when it has none yet, `UsageSnapshotError` when the file is there but unreadable. */
-declare function readUsageSnapshot(fs: Pick<FarmFs, "readFileUtf8">, snapshotsDir: string, identity: string): UsageSnapshot | undefined;
-/** Reads every identity's snapshot, by identity name. */
-declare function listUsageSnapshots(fs: UsageReadFs, snapshotsDir: string): readonly UsageSnapshot[];
-
-/** A quota window as it stands at a given instant. */
-interface EffectiveWindow {
-    /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
-    readonly reset: boolean;
-    /** The fraction used: 0 for a reset window, otherwise what was last observed (a lower bound, since utilisation only rises within a window), or undefined when none was reported. */
-    readonly utilization?: number;
-    /** The reset instant, for a window that has not reset yet and reported one. */
-    readonly resetsAtMs?: number;
-    /** The window's own status, for a window that has not reset yet. */
-    readonly status?: string;
-}
-/** Reads a recorded window at `nowMs`: a window whose reset has passed is empty and carries no status, so every consumer agrees on what an old observation still means. */
-declare function effectiveWindow(window: Readonly<QuotaWindow>, nowMs: number): EffectiveWindow;
-
+/** The environment variable that turns the self-hosted Remote Control service on, read once at door start like the door's other mode selections: the door is one process serving every launch, so the mode is a property of the door, not of any one launch. Anything but `1` means off, the same exact-value vocabulary the capture toggle uses. */
+declare const RC_SELF_HOST_ENV = "AGENT_SHIM_FRONTDOOR_RC_SELF_HOST";
+/** Whether the environment asked for the self-hosted Remote Control service. */
+declare function rcSelfHostFromEnv(env: NodeJS.ProcessEnv): boolean;
+/** The full scope list the minting writes and the local refresh echoes: the CLI's own claude.ai login scope set (`CLAUDE_AI_OAUTH_SCOPES` in its source), whose `user:inference` and `user:profile` members are exactly the two the Remote Control gate demands. */
+declare const RC_SELF_HOST_SCOPE_LIST: readonly string[];
 /**
- * What an account's plan means for picking it: a subscription with a capacity relative to the smallest paid tier, or an account billed by use.
+ * How long a minted worker JWT is good for. Not a fresh number: 46800 seconds is the `expires_in` the real bridge handed the live rig session (13 hours), so the local surface keeps the CLI's refresh cadence exactly where the real one put it.
  */
-declare const PlanClassSchema: z.ZodUnion<readonly [z.ZodObject<{
-    kind: z.ZodLiteral<"subscription">;
-    capacity: z.ZodNumber;
-    recognised: z.ZodBoolean;
-    tier: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>, z.ZodObject<{
-    kind: z.ZodLiteral<"pay-per-use">;
-    tier: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>]>;
-type PlanClass = z.infer<typeof PlanClassSchema>;
+declare const RC_SELF_HOST_WORKER_JWT_TTL_SECONDS = 46800;
 /**
- * Classifies an account from the rate-limit tier of its stored login (`organizationRateLimitTier`, which decides the organisation's limits, then `userRateLimitTier`). The tier strings are free text on Anthropic's side, so only the shapes seen are read: a trailing `<n>x` is that multiple, a bare `pro` is 1, a `zero` tier is pay-per-use. Anything else is a subscription of unrecognised size, counted as 1 and marked so the ranking can say it guessed.
+ * How often the SSE streams send a keepalive comment. Not a fresh number: it is the protocol's own keepalive cadence (the 15 s comments the door's client-half parser documents from live captures), and it must beat the worker transport's 45 s liveness bound (`DIY` in the CLI source), which a 15 s cadence does with two comments to spare.
  */
-declare function planOf(account: AccountMetadata | undefined): PlanClass;
-
-/** Anthropic's longest prompt-cache lifetime (the one-hour tier): a conversation resumed within it still has a warm cache on the account that served it, and the cache is per organisation, so it is lost by switching. */
-declare const PROMPT_CACHE_TTL_MS: number;
-/** The state a member's ranking was built from. */
-interface PoolMember {
-    readonly identity: string;
-    /** The identity's usage snapshot, when it has one. */
-    readonly snapshot?: UsageSnapshot;
-    /** Why the member's recorded state could not be read (a corrupt or newer-schema snapshot, an unreadable login file), when that is the case. */
-    readonly readError?: string;
-    readonly account?: AccountMetadata;
-    /** The member's usage-log records from the current five-hour window on. */
-    readonly records: readonly UsageRecord[];
-}
-/** The member last picked for this directory, kept so a conversation stays on the account whose prompt cache is warm. */
-interface StickyPick {
-    readonly identity: string;
-    readonly at: string;
-}
-interface RankPoolInput {
-    readonly members: readonly PoolMember[];
-    readonly nowMs: number;
-    readonly sticky?: StickyPick;
-    /** True when the launch continues or resumes a conversation, which belongs on the account it started on whatever the cache lifetime. */
-    readonly resuming: boolean;
+declare const RC_SELF_HOST_KEEPALIVE_MS = 15000;
+/**
+ * How long a session's events are retained for stream resume, and how long a streamless, trafficless session survives. One number serves both because one protocol constant derives them: the worker transport's reconnection budget is 600000 ms (`WIY` in the CLI source), so a resume can only ever name a cursor whose events are at most that old, and a worker that has been gone longer has given up by its own rules.
+ */
+declare const RC_SELF_HOST_RETENTION_MS = 600000;
+/** The whole credential this door's self-hosted mode mints, read back for every authenticated call and never logged: the token pair the identity's Claude Code presents, beside the organisation the minting chose. */
+interface RcSelfHostCredentialRecord {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly organizationUuid: string;
+    readonly accountUuid: string;
 }
-/** In pick order. `scored` has usable quota data; `unknown` has none (never recorded, or unreadable); `pay-per-use` bills by use instead of drawing on a plan; `ineligible` is refused right now. */
-type CandidateClass = "scored" | "unknown" | "pay-per-use" | "ineligible";
-interface Candidate {
-    readonly identity: string;
-    readonly class: CandidateClass;
-    /** Plan-size-weighted remaining quota per hour until its reset: higher is more wasted if left unused. Present for `scored` only. */
-    readonly score?: number;
-    /** False when the five-hour window would run dry, at the observed pace, before it resets. A `scored` candidate that is not feasible ranks below every feasible one. */
-    readonly feasible: boolean;
-    /** When an `ineligible` candidate can be used again. */
-    readonly blockedUntilMs?: number;
-    readonly plan: PlanClass;
-    /** Human-readable facts behind the class and score, in the order they matter. */
-    readonly reasons: readonly string[];
+/** Everything the service needs, injected so the decision logic runs against fakes in unit tests. */
+interface RcSelfHostDeps {
+    readonly now: () => number;
+    /** Mints the session and event ids: a v4 UUID or better in production. */
+    readonly newUuid: () => string;
+    /** Mints opaque token material (the worker JWTs): cryptographically random in production. */
+    readonly randomToken: () => string;
+    /** The minted credential this door authenticates against, read fresh so a re-mint takes effect without restarting the door; undefined while none was ever minted, in which case every authenticated call is refused. */
+    readonly credentialRecord: () => RcSelfHostCredentialRecord | undefined;
+    readonly log?: (line: string) => void;
 }
-interface PoolRanking {
-    /** Every member, best first. */
-    readonly candidates: readonly Candidate[];
-    /** The member to launch on: the best one that is not refused. Undefined when every member is refused. */
-    readonly pick?: Candidate;
-    /** When nothing can be picked, the soonest any member comes back. */
-    readonly earliestReturn?: {
-        readonly identity: string;
-        readonly atMs: number;
+/** The self-hosted Remote Control service: the session-family route for the pipeline, and the local answers the connect surface consults before routing or piping. */
+interface RcSelfHostSurface {
+    /** The pipeline route serving the whole `/v1/code/sessions` family and the `/v1/sessions` compatibility list. */
+    readonly route: FrontDoorRoute;
+    /** The connect surface's local answers: which hosts it takes over as HTTP, and the requests it answers itself. */
+    readonly local: {
+        /** The hosts whose terminated sessions this surface needs parsed as HTTP (the control-plane host, normally byte-tapped). */
+        readonly parsesHost: (host: string) => boolean;
+        /** Serves one request locally; resolves false when the surface does not own the path, so routing or piping continues unchanged. */
+        readonly serve: (host: string, request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
     };
+    /** Stops the service's timers and retires every open stream. The sessions themselves are unreachable the moment the door drops them. */
+    readonly close: () => void;
 }
-/**
- * Ranks `members` for a launch.
- *
- * A member is `ineligible` while a window of its plan, or a refusal it last hit, still binds; it is `unknown` without recorded quota, `pay-per-use` when its usage bills by use, and otherwise `scored`. Scored members order by how much plan-size-weighted quota would expire unused per hour of runway, with any whose five-hour window would run dry at the observed pace (their own, or the person's pace on another member rescaled by plan size) placed behind those that would not. The member last picked for this directory then moves to the front if it is still usable and either the launch resumes a conversation or its prompt cache is still warm.
- */
-declare function rankPool(input: RankPoolInput): PoolRanking;
-
-/** What `pool pick` reports: the ranking a launch from `directory` would act on right now. */
-declare const PoolPickReportSchema: z.ZodObject<{
-    pool: z.ZodString;
-    directory: z.ZodString;
-    pick: z.ZodOptional<z.ZodString>;
-    candidates: z.ZodArray<z.ZodObject<{
-        identity: z.ZodString;
-        class: z.ZodEnum<{
-            unknown: "unknown";
-            "pay-per-use": "pay-per-use";
-            scored: "scored";
-            ineligible: "ineligible";
-        }>;
-        score: z.ZodOptional<z.ZodNumber>;
-        feasible: z.ZodBoolean;
-        blockedUntil: z.ZodOptional<z.ZodISODateTime>;
-        plan: z.ZodUnion<readonly [z.ZodObject<{
-            kind: z.ZodLiteral<"subscription">;
-            capacity: z.ZodNumber;
-            recognised: z.ZodBoolean;
-            tier: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>, z.ZodObject<{
-            kind: z.ZodLiteral<"pay-per-use">;
-            tier: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>;
-        reasons: z.ZodArray<z.ZodString>;
-    }, z.core.$strict>>;
-    missing: z.ZodArray<z.ZodString>;
-    earliestReturn: z.ZodOptional<z.ZodObject<{
-        identity: z.ZodString;
-        at: z.ZodISODateTime;
-    }, z.core.$strict>>;
-    stickyProblem: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-type PoolPickReport = z.infer<typeof PoolPickReportSchema>;
-
-/**
- * Ranks a pool exactly as a launch from `directory` would right now, without recording a pick. Shares `rankPoolFromStore` with the launcher, so what this prints is what a launch does.
- */
-declare function collectPoolPick(params: Readonly<{
-    paths: LayoutPaths;
-    fs: FsPort;
-    usageFs: FarmFs;
-    poolName: string;
-    pool: Pool;
-    directory: string;
-    nowMs: number;
-}>): PoolPickReport;
+/** Creates the self-hosted Remote Control service. One per door process; everything it holds dies with it. */
+declare function createRcSelfHostSurface(deps: RcSelfHostDeps): RcSelfHostSurface;
 
-/** Everything a `when` condition can be evaluated against, injected rather than read. */
-interface ConditionContext {
-    readonly nowMs: number;
-    /** Facts about the specific entry being decided. Absent when evaluating a rule-level condition that has no single entry (a directory rule's own `when`). */
-    readonly fact?: EntryFact;
-    /** The branch checked out at `cwd`, or undefined when `cwd` is not in a repository. */
-    readonly branch?: string;
-    /** True when the repository is in detached-HEAD state, in which case no `branch` condition can match. */
-    readonly branchDetached?: boolean;
-    readonly env: Readonly<Record<string, string | undefined>>;
+/** Where the door's own copy of the minted credential lives, under the door's state directory. */
+declare const RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
+/** The door's copy of the minted credential: the record `rcSelfHost.ts` reads fresh on every authenticated call. */
+declare const RC_SELF_HOST_RECORD_FILE = "credential.json";
+/** Everything the minting needs, injected so it runs against an in-memory fake filesystem in unit tests. */
+interface RcSelfHostMintDeps {
+    readonly fs: Pick<FarmFs, "readFileUtf8" | "writeFilePrivate" | "mkdirPrivate">;
+    /** The agent-shim identities directory (the mint writes inside `<identitiesDir>/<identity>/`). */
+    readonly identitiesDir: string;
+    /** The door's state directory (the record is written under `<frontdoorDir>/rc-selfhost/`). */
+    readonly frontdoorDir: string;
+    readonly identity: string;
+    /** Mints ids: a v4 UUID or better in production. */
+    readonly newUuid: () => string;
+    /** Mints token material: cryptographically random bytes in production. */
+    readonly randomToken: () => string;
+    /** Overwrite an existing credential that is not a previous mint of this door's. */
+    readonly force: boolean;
+    readonly now: () => number;
 }
-/** The result of evaluating one `when` object. */
-interface WhenEvaluation {
-    readonly passed: boolean;
-    /** Which condition fields were present and evaluated. */
-    readonly checked: readonly string[];
-    /** Which of those fields did not hold. Empty when `passed` is true. */
-    readonly failed: readonly string[];
+/** What the minting produced: names and shapes only, never a token. */
+interface RcSelfHostMintResult {
+    readonly identity: string;
+    readonly organizationUuid: string;
+    readonly credentialsFile: string;
+    readonly claudeJsonFile: string;
+    readonly recordFile: string;
+    /** Whether a previous mint of this door's was replaced. */
+    readonly replaced: boolean;
 }
-/** True when `branch` matches `pattern`. The pattern is glob-capable (`client/*`); a detached HEAD or a non-repository directory never matches. */
-declare function matchBranch(pattern: string, branch: string | undefined, detached?: boolean): boolean;
+/** Reads the door's previously minted record, or undefined when none exists (or what exists does not parse). */
+declare function readRcSelfHostRecord(fs: Pick<FarmFs, "readFileUtf8">, frontdoorDir: string): RcSelfHostCredentialRecord | undefined;
 /**
- * Evaluates a `when` object. Every present field must hold — conditions AND together within one object.
- *
- * An absent condition is vacuously true, so `when: {}` passes; `agent-shim check` warns about that rather than erroring, since an empty object is more likely a half-finished edit than an intentional statement.
- *
- * `newerThan`, `olderThan`, and `maxSizeBytes` read the subtree-aggregated facts (`latestMtimeMs`, `totalSizeBytes`), never the entry's own inode stat: a directory's own mtime does not change when a file three levels beneath it is rewritten, and its own size is a ~4KB inode figure that says nothing about what it contains.
+ * Mints the local credential for one identity and records the door's copy. Refuses, unless `force`, when the identity already holds an OAuth credential this door did not mint (a real claude.ai login): overwriting one silently would sign the identity out, and the mode's own contract is that no Anthropic credential is in play at all.
  */
-declare function evaluateWhen(when: WhenCondition | undefined, context: ConditionContext): WhenEvaluation;
+declare function mintRcSelfHostCredential(deps: RcSelfHostMintDeps): RcSelfHostMintResult;
 
-/** Raised when the daemon cannot be brought up in time, or reports a fatal `lastError`: a launch that asked for headroom must never silently fall back to a direct connection. */
-declare class HeadroomStartError extends CliError {
+/** The outcome of authenticating the listener a front-door state file names. */
+type ListenerVerdict = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+
+/** Raised when the front door cannot be brought up in time or has recorded a fatal error: a routed launch has no other way to reach its provider, so it must fail rather than start a session that can never answer. */
+declare class FrontDoorStartError extends CliError {
     constructor(message: string);
 }
 /** Every effect the ensure step performs, injected so it runs against fakes in tests. */
-interface EnsureHeadroomPorts {
+interface EnsureFrontDoorPorts {
     readonly fs: HeadroomFs;
-    /** Zombie-aware liveness: a supervisor or daemon that exited without being reaped still answers signal 0 as alive, but will never serve a request or write state, so it must read as dead here (see `realIsProcessRunning`). */
+    /** Zombie-aware liveness (see `realIsProcessRunning`). */
     readonly isRunning: (pid: number) => boolean;
     readonly now: () => number;
     readonly sleep: (ms: number) => void;
-    /** Spawns the detached supervisor process that owns the headroom daemon, returning its pid. */
+    /** Spawns the detached front-door supervisor, returning its pid. */
     readonly spawnSupervisor: (paths: LayoutPaths) => number;
+    /** Authenticates the provider listener on `port`: a TLS handshake chaining to agent-shim's CA and a healthy answer, with no capability sent (see `probeFrontDoorSync`). */
+    readonly verifyListener: (port: number) => ListenerVerdict;
+    /** Asks a running front-door supervisor to exit, without waiting for it to: the caller polls `isRunning`. Only ever called for a pid whose recorded listener has just authenticated as agent-shim's own. */
+    readonly stopSupervisor: (pid: number) => void;
 }
 /**
- * Brings the headroom daemon up for this launch, or finds it already running, and registers this launcher pid in its session registry (the fact that keeps the daemon alive and defers drift restarts until this launch is done).
- *
- * The exclusive-create start lock decides which of several concurrent launches spawns the one supervisor: its holder spawns and keeps waiting like everyone else, everyone else waits on the state file, and a lock whose holder has died is removed and retried. Readiness is "state names a live supervisor, a live headroom pid, and a socket path", which the supervisor only writes after its own `/readyz` probe over that socket has passed, so polling state alone never mistakes a bound-but-not-ready socket for a usable daemon.
+ * Brings the front door up for this launch, or finds it serving, and registers this launcher pid in its session registry: the fact that keeps the door from idling out while this session lives, and the record that holds this launch's capability token. The same lock-and-poll coordination as headroom's and the old codex daemon's ensure: the exclusive-create start lock decides which of several concurrent launches spawns the one supervisor, everyone waits on state.json, and a lock whose holder died is removed and retried. Ready means state names a live supervisor and both listeners' ports, which the supervisor writes only after both have bound (and the provider listener has answered its own health probe).
  *
- * Throws `HeadroomStartError` (naming the daemon log path and any recorded `lastError`) when the daemon is not up within `HEADROOM_START_TIMEOUT_MS`, or when a live supervisor has recorded a fatal error (a platform without unix sockets and a socket directory that fails the owner-only check are recorded this way, so the launch fails with the reason).
+ * A live pid in state proves nothing about who holds the port it names: the door may have crashed and left the port to anyone, or the pid may have been reused by an unrelated process. So before anything is registered or returned, the provider listener is authenticated over TLS against agent-shim's CA. A listener that fails (wrong certificate, nothing answering, a bad answer) is treated as a stale or hostile owner: its pid is distrusted for the rest of this call and a replacement supervisor is spawned, which binds a free port when the sticky one is held and is then verified in turn. If a supervisor this call spawned also fails verification, the launch is refused naming the reason and the daemon log; no capability is written and no address is handed to the child.
  */
-declare function ensureHeadroom(params: {
+declare function ensureFrontDoor(params: {
     readonly paths: LayoutPaths;
     readonly launcherPid: number;
-    readonly ports: EnsureHeadroomPorts;
-    /**
-     * The hash of the allowlist the daemon must have been started with for this launch to work, read fresh on every poll because the front door's address it contains can change while the launch waits. Given for a launch that routes a provider through headroom, whose requests come back to the front door's direct origin and are refused by a daemon that was started without it; absent for a launch that only needs Claude Code's own API, which every daemon admits.
-     */
-    readonly requiredAllowlistHash?: () => string;
+    readonly ports: EnsureFrontDoorPorts;
 }): {
-    readonly socketPath: string;
+    readonly port: number;
+    readonly connectPort: number;
+    readonly token: string;
 };
 
-/** The token-saving settings of the `headroom` config block, without its install and lifecycle fields (`source`, `idleShutdownMinutes`). */
-type HeadroomSettings = Pick<HeadroomGlobalConfig, "mode" | "targetRatio" | "ccr" | "rolloutChannel" | "interceptToolResults" | "readMaturation">;
-
-/** Everything the supervisor needs to run the daemon, resolved from the global config and the filesystem before it starts. */
-interface HeadroomSupervisorConfig {
-    /** The install spec as configured (`headroom.source`), already defaulted. */
-    readonly source: string;
-    /** `headroom.idleShutdownMinutes`, already defaulted. */
-    readonly idleShutdownMinutes: number;
-    /** The token-saving settings (`mode`, `targetRatio`, `ccr`, the rollout channel and its opt-ins), as configured; unset fields leave headroom on its own defaults. */
-    readonly settings: HeadroomSettings;
+/** A bound front-door listener in this process, and how to stop it. */
+interface FrontDoorListenerHandle {
+    readonly port: number;
+    /** Stops accepting, ends every live connection, and resolves once the port is released. */
+    readonly close: () => Promise<void>;
 }
-/** How the supervisor resolves the configured source against its defaults. */
-declare function resolveSupervisorConfig(configured: Readonly<HeadroomGlobalConfig>): HeadroomSupervisorConfig;
-/**
- * Every effect the supervisor performs, injected so the whole lifecycle is testable against fakes: no real process, port, clock, or HTTP call ever happens in a unit test.
- */
-interface SupervisorPorts {
+/** Every effect the front-door supervisor performs, injected so its whole lifecycle runs against fakes: no real process, port, clock or listener in a unit test. */
+interface FrontDoorSupervisorPorts {
     readonly fs: HeadroomFs;
     readonly paths: LayoutPaths;
     readonly ownPid: number;
     readonly now: () => number;
-    /**
-     * Waits `ms`, yielding to the event loop while it does. Deliberately NOT a synchronous Atomics.wait-style sleep: the real supervisor learns of its child's death through the ChildProcess exit event, and a blocking sleep would stop the event loop from ever delivering it (the exact failure that left an unreaped zombie answering liveness checks as alive).
-     */
+    /** An event-loop-yielding wait, for the same reason headroom's is: nothing else would ever run between ticks. */
     readonly sleep: (ms: number) => Promise<void>;
-    /**
-     * Zombie-aware liveness, and for a daemon this supervisor spawned, exit-event-backed: the implementation keeps the spawned ChildProcess handle, consumes its exit event (which is also what reaps it), and reports the pid as not running from that moment. A bare signal-0 check is not enough, because a defunct process still answers it.
-     */
+    /** Zombie-aware liveness, the notion every coordination decision in this project uses. */
     readonly isRunning: (pid: number) => boolean;
-    /** The platform facts and owner-only checks the daemon's socket directory is prepared and verified with (see `prepareHeadroomSocket`). */
-    readonly socketTrust: HeadroomSocketTrustPorts;
-    /**
-     * Starts `headroom proxy` serving on the unix socket `socketPath` (and on no TCP port) with the given allowlist, returning its pid. Output goes to the daemon log. The implementation must keep the ChildProcess handle and attach an exit listener (detaching the process is fine; unref'ing a child you still need events from is not, since without the listener nothing reaps it and it lingers as a zombie).
-     */
-    readonly spawnHeadroom: (socketPath: string, allowlist: readonly string[], settings: Readonly<HeadroomSettings>) => number;
-    /** Reads the headroom config block as it stands on disk now. The supervisor calls it every tick, so a changed `source` or setting is noticed while the daemon runs and applied by the same quiet-registry restart an allowlist change gets. */
-    readonly readConfig: () => HeadroomSupervisorConfig;
-    /** Stops a process the supervisor owns, escalating SIGTERM to SIGKILL on a bounded timeout (see `stopSupervisedProcess`). */
-    readonly stopProcess: (pid: number) => void;
-    /** True once `GET /readyz` over the unix socket succeeds. */
-    readonly ready: (socketPath: string) => Promise<boolean>;
-    /** Runs `uv tool install <spec>`, logging output to the daemon log. Returns ok=false with the error when `uv` is absent or the install fails. */
-    readonly install: (spec: string) => {
-        readonly ok: boolean;
-        readonly error?: string;
-    };
-    /** The installed `headroom --version` output, or undefined when the binary is not on PATH. */
-    readonly headroomVersion: () => string | undefined;
-    /** The commit the installed headroom was built from, as the install itself records it (`direct_url.json`), or undefined when it was not installed from a git source. */
-    readonly installedCommit: () => string | undefined;
-    readonly log: (line: string) => void;
-}
-/** Options for `runSupervisor`. */
-interface RunSupervisorOptions {
     /**
-     * Bounds the supervisor loop's iterations. The real supervisor runs until it exits on its own (idle shutdown or fatal error); a bounded run is how tests observe steady-state behaviour (drift deferral, restart-on-crash, pruning) without an infinite loop, and such a run returns `HEADROOM_SUPERVISOR_STILL_RUNNING` instead of an exit code.
+     * Starts the provider listener in this process on `preferredPort` (falling back to any free port when the sticky one is taken, decided at bind time rather than by a racy check-then-bind probe) and resolves once it has bound and answered its own health probe over TLS. This is the HTTPS listener every provider session's base URL points at, serving a loopback leaf signed by agent-shim's CA.
      */
-    readonly tickLimit?: number;
-}
-/**
- * Runs the headroom supervisor loop: install the daemon, start it, keep it alive (for crash or drift), and stop it after the configured idle period with an empty session registry. Returns the process exit code (0 for an idle shutdown, 1 for a fatal setup failure).
- *
- * Every effect flows through `ports`, so the whole loop is unit-testable with a fake clock, filesystem, and processes. The loop awaits its sleeps, which in the real implementation run on a timer: between ticks the event loop turns, the spawned child's exit event is delivered (and the child thereby reaped), and the next tick's liveness check reads the truth.
- */
-declare function runSupervisor(initialConfig: HeadroomSupervisorConfig, ports: SupervisorPorts, options?: RunSupervisorOptions): Promise<number>;
-
-/**
- * The environment variables that authenticate Claude Code directly from the process environment, ahead of any stored identity credential. If any of these is set, every identity would silently authenticate as the same key/token/backend while it's set — defeating the entire premise of separate identities. Order here is also lookup order: `detectAmbientCredential` reports the first one found.
- */
-declare const AMBIENT_CREDENTIAL_VARS: readonly ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY"];
-type AmbientCredentialVar = (typeof AMBIENT_CREDENTIAL_VARS)[number];
-/** Which guarded variable was found set, and to what. */
-interface AmbientCredentialDetection {
-    readonly variable: AmbientCredentialVar;
-}
-/** A credential this launch itself exports to the child: the variable it lands in and its value. */
-interface InjectedCredential {
-    readonly variable: CredentialTargetVar;
-    readonly token: string;
-}
-/**
- * Detects whether any of `AMBIENT_CREDENTIAL_VARS` is set to a non-empty value in `env`, returning the first one found in declared order, or undefined when none are set.
- *
- * An empty string counts as unset, not set — confirmed load-bearing: one of Joe's real wrapper scripts (`o`, running Claude Code against OpenRouter) does `export ANTHROPIC_API_KEY=""` specifically to *clear* it so `ANTHROPIC_AUTH_TOKEN` takes effect instead, and this must never trip the guard.
- *
- * `injected`, when given, is the credential this launch exports for its own identity. Its variable holding exactly that value is not ambient: it is what a agent-shim launch of the same identity left in the environment of the session this one starts from (a `claude @work` run inside a `claude @work` session). The same variable holding any other value still counts.
- */
-declare function detectAmbientCredential(env: Readonly<Record<string, string | undefined>>, injected?: InjectedCredential): AmbientCredentialDetection | undefined;
-/**
- * Builds the exact refusal message: which variable was found, why it matters, and the two ways to opt in (a one-off env var, or a persistent per-identity setting). Mirrors the message documented in the project's README. `identityName` is included in the persistent-opt-in command when known; when no identity has been resolved yet (e.g. the `CLAUDE_CONFIG_DIR`-already-set escape hatch, or no identity resolved at all), a generic `<name>` placeholder is used instead, matching the README's own generic wording.
- */
-declare function formatAmbientCredentialGuardMessage(variable: AmbientCredentialVar, identityName?: string): string;
-/** Inputs to the ambient-credential guard evaluation. */
-interface EvaluateAmbientCredentialGuardParams {
-    readonly env: Readonly<Record<string, string | undefined>>;
-    /** The active identity's own `allowAmbientCredential` setting from its `identity.json`, or false when no identity is known. */
-    readonly allowAmbientCredential: boolean;
-    /** True when `AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1` is set for this one invocation. */
-    readonly allowAmbientCredentialOverride: boolean;
-    /** The active identity's name, for the message's persistent-opt-in command. Undefined when no identity is known. */
-    readonly identityName?: string;
+    readonly startProviderListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
     /**
-     * True when this launch routes through an API provider. The guard inspects the PARENT environment, before `buildEnv` runs; a provider launch has its `ANTHROPIC_AUTH_TOKEN` injected and its `ANTHROPIC_API_KEY` cleared by `buildEnv` itself, so an ambient credential in the parent environment never reaches the child and there is nothing left for this guard to protect against. Everything else about the guard (including `IdentitySchema.allowAmbientCredential`) is unchanged by this flag.
-     */
-    readonly providerSelected?: boolean;
-    /** The launching identity's own credential, when its credential block resolved: see `detectAmbientCredential`. */
-    readonly injectedCredential?: InjectedCredential;
-}
-/** The result of one guard evaluation: either launch may proceed, or it must be refused with an explanatory message. */
-type AmbientCredentialGuardResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly variable: AmbientCredentialVar;
-    readonly message: string;
-};
-/**
- * Evaluates the ambient-credential guard: refuses unless no guarded variable is set, or the active identity opted in (`allowAmbientCredential: true`), or this one invocation opted in (`AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1`), or a provider takes over the child's credential (see `providerSelected`).
- *
- * This guard is about credential isolation, not identity/config-dir selection — it must still run even when the `CLAUDE_CONFIG_DIR`-already-set escape hatch applies (callers pass `allowAmbientCredential: false` and no `identityName` in that case, since there is no active identity to consult).
- */
-declare function evaluateAmbientCredentialGuard(params: EvaluateAmbientCredentialGuardParams): AmbientCredentialGuardResult;
-
-/** Raised by any operation that requires an identity to already exist, when it does not. */
-declare class IdentityNotFoundError extends CliError {
-    readonly name: string;
-    constructor(name: string);
-}
-/** Raised by `addIdentity` when an identity with the given name already has an `identity.json`. */
-declare class IdentityAlreadyExistsError extends CliError {
-    readonly identityName: string;
-    constructor(identityName: string);
-}
-/** Raised by `addIdentity` when `name` fails `IdentitySchema`'s own naming rule — it must start with a letter or number and may then contain letters, numbers, dots, hyphens, underscores, and at signs, so an email address names an identity directly while a *leading* `@` stays invalid (it would collide with the `@name` selector syntax's first-`@` split). */
-declare class InvalidIdentityNameError extends CliError {
-    readonly attemptedName: string;
-    constructor(attemptedName: string);
-}
-declare function identityExists(paths: LayoutPaths, name: string): boolean;
-/** Reads and validates one identity's `identity.json`, or undefined when it does not exist. */
-declare function readIdentity(paths: LayoutPaths, name: string): Identity | undefined;
-/**
- * Creates a new identity: validates `name` against `IdentitySchema`'s own naming rule and writes a fresh `identity.json` with `allowAmbientCredential: false` and no `defaultConfigProfile`.
- *
- * Throws `IdentityAlreadyExistsError` if an identity with this name already has an `identity.json` — `add` never silently overwrites an existing identity. Throws `InvalidIdentityNameError` when `name` fails `IdentitySchema`'s naming rule, rather than letting the underlying `ZodError` escape as an unhandled crash.
- */
-declare function addIdentity(paths: LayoutPaths, name: string): Identity;
-/**
- * Persists `name` as the active identity, written atomically as plain text (not JSON — this file is read by `decideIdentity` in `src/launcher/identity.ts` via a simple UTF-8 read-and-trim, matching the README's documented `~/.agent-shim/active-identity` file).
- *
- * `name` may be a `pool:<name>` selector, which makes launches pick a member of that pool. Throws `IdentityNotFoundError` when no identity with this name exists yet, and `PoolNotFoundError` for a pool that is not defined: selecting either would silently persist a name nothing else can ever load.
- */
-declare function useIdentity(paths: LayoutPaths, name: string): void;
-/** Reads the persisted active-identity file, or undefined when none is set. */
-declare function readActiveIdentity(paths: LayoutPaths): string | undefined;
-/**
- * Whether a directory name directly under `identitiesDir` names an actual identity, rather than one of agent-shim's own farm directories.
- *
- * `IdentitySchema` requires an identity name to start with a letter or digit, so a leading `.` can only be a resync's own bookkeeping: a `.<identity>.scratch.<suffix>` tree still being built, or a `.<identity>.previous.<suffix>` superseded farm retained for `agent-shim identity resolve-conflicts`. Neither is an identity, and neither should be reported as a broken one for lacking an `identity.json` a resync never put there.
- */
-declare function isIdentityDirectoryName(name: string): boolean;
-/** One identity as reported by `listIdentities`, whose `identity.json` parsed and validated cleanly. */
-interface IdentityListEntry {
-    readonly name: string;
-    readonly identity: Identity;
-    readonly isActive: boolean;
-    readonly problem?: never;
+     * Starts the CONNECT surface in this process on `preferredPort` (same bind-time fallback): the TLS-terminating listener an OAuth session's HTTPS_PROXY points at. Bound before any state names it, so an OAuth launch never finds one listener up without the other.
+     */
+    readonly startConnectListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
+    /**
+     * Starts the direct listener on `preferredPort` (same bind-time fallback): the same routes as the provider listener, minus the headroom hop, over plain HTTP because headroom is what connects to it. Headroom forwards routed traffic back here, which is what keeps the hop from looping, and the port is sticky like the others because headroom's allowlist admits its exact origin. It admits only the hop's own requests and holds no credential until it redeems one from the hop's custody.
+     */
+    readonly startDirectListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
+    /**
+     * Stops the Remote Control stream hub: persists every live attachment's sequence cursor synchronously, then frees the dials. Called exactly once on every exit the supervisor owns, after every listener it started is down (a live listener could still settle an observed Remote Control exchange, and the reconcile that follows would re-attach a stream the close had just ended) and before the final state write and the process's exit.
+     */
+    readonly closeRcStreamHub: () => void;
+    readonly log: (line: string) => void;
 }
-/** One identity whose `identity.json` is present but unreadable — malformed JSON, or valid JSON this version's `IdentitySchema` rejects. `problem` carries the reason, already flattened onto a single line. */
-interface UnreadableIdentityListEntry {
-    readonly name: string;
-    readonly identity?: never;
-    readonly isActive: boolean;
-    readonly problem: string;
+/** Options for `runFrontDoorSupervisor`. */
+interface RunFrontDoorSupervisorOptions {
+    /** Bounds the loop's iterations so a test can observe steady state; such a run returns `FRONTDOOR_SUPERVISOR_STILL_RUNNING`. */
+    readonly tickLimit?: number;
 }
-/** Either shape `listIdentities` can report, discriminated by which of `identity`/`problem` is present rather than by a tag field — the two are never simultaneously satisfiable. */
-type IdentityListing = IdentityListEntry | UnreadableIdentityListEntry;
 /**
- * Lists every identity under `identitiesDir`, marking which one (if any) is currently active.
+ * Runs the front-door supervisor: binds all three listeners (the HTTPS provider listener, the CONNECT surface and the plain-HTTP direct listener, each on its sticky port), records the serving state, and shuts down after `idleShutdownMinutes` with an empty session registry. Returns the exit code: 0 for an idle shutdown, 1 for a fatal start failure.
  *
- * One identity whose `identity.json` cannot be read is reported as its own `UnreadableIdentityListEntry` rather than aborting the whole listing. A single bad file blocking `identity list` outright is exactly the failure mode that hides every *other* identity from view at the moment the user most needs to see them — and the file need not even be corrupt to land here, since a name written by a newer agent-shim whose naming rule has since widened is rejected outright by an older binary's own copy of `IdentitySchema`.
- */
-declare function listIdentities(paths: LayoutPaths): readonly IdentityListing[];
-/**
- * Sets `identity`'s `defaultConfigProfile` field, or clears it when `profileName` is undefined. Throws `IdentityNotFoundError` when the identity does not exist. Whether the profile exists is the caller's concern: `identity set --default-profile` checks it first.
+ * The listeners live in this process, so there is no child to keep alive: a crash of this process is a crash of every routed session's door at once, and recovery is the next launch's ensure spawning a replacement on the same sticky ports, which is exactly the failure model the issue asks to settle with tests. Keeping the headroom daemon alive is the headroom supervisor's job, not this one's; the two daemons idle out independently.
  */
-declare function setDefaultConfigProfile(paths: LayoutPaths, identityName: string, profileName: string | undefined): Identity;
+declare function runFrontDoorSupervisor(idleShutdownMinutes: number, ports: FrontDoorSupervisorPorts, options?: RunFrontDoorSupervisorOptions): Promise<number>;
+
 /**
- * Patches `identity`'s `allowAmbientCredential` field. Throws `IdentityNotFoundError` when the identity does not exist.
+ * The read side of the usage store: pure over an injected filesystem, so the CLI, the library surface and tests all read the same way, and nothing here writes.
  */
-declare function setAllowAmbientCredential(paths: LayoutPaths, identityName: string, allow: boolean): Identity;
-/** The change `setIdentityCredential` makes: new sources and/or a new target for the credential block, or `false` to remove the block and return the identity to its stored login. */
-type IdentityCredentialChange = {
-    readonly sources?: readonly CredentialSource[];
-    readonly target?: CredentialTarget;
-    readonly cache?: CredentialCache | false;
-} | false;
+/** The filesystem reads the usage store's readers need. */
+type UsageReadFs = Pick<FarmFs, "readFileUtf8" | "readdir">;
+/** Raised for a snapshot file that exists but does not hold a snapshot of this schema version. */
+declare class UsageSnapshotError extends Error {
+    readonly file: string;
+    constructor(file: string, detail: string);
+}
+/** The path of an identity's snapshot. Throws for an invalid identity name, which could otherwise name a path outside the snapshots directory. */
+declare function snapshotPath(snapshotsDir: string, identity: string): string;
+/** Reads one identity's snapshot: undefined when it has none yet, `UsageSnapshotError` when the file is there but unreadable. */
+declare function readUsageSnapshot(fs: Pick<FarmFs, "readFileUtf8">, snapshotsDir: string, identity: string): UsageSnapshot | undefined;
+/** Reads every identity's snapshot, by identity name. */
+declare function listUsageSnapshots(fs: UsageReadFs, snapshotsDir: string): readonly UsageSnapshot[];
+
+/** A quota window as it stands at a given instant. */
+interface EffectiveWindow {
+    /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
+    readonly reset: boolean;
+    /** The fraction used: 0 for a reset window, otherwise what was last observed (a lower bound, since utilisation only rises within a window), or undefined when none was reported. */
+    readonly utilization?: number;
+    /** The reset instant, for a window that has not reset yet and reported one. */
+    readonly resetsAtMs?: number;
+    /** The window's own status, for a window that has not reset yet. */
+    readonly status?: string;
+}
+/** Reads a recorded window at `nowMs`: a window whose reset has passed is empty and carries no status, so every consumer agrees on what an old observation still means. */
+declare function effectiveWindow(window: Readonly<QuotaWindow>, nowMs: number): EffectiveWindow;
+
 /**
- * Sets, changes or removes `identityName`'s credential block. New `sources` replace the whole ordered list (the order is the meaning); a `target` alone keeps the existing sources, and so needs a credential block to exist already. Throws `IdentityNotFoundError` when the identity does not exist, and `UsageError` when only a target is given for an identity with no credential yet.
+ * What an account's plan means for picking it: a subscription with a capacity relative to the smallest paid tier, or an account billed by use.
  */
-declare function setIdentityCredential(paths: LayoutPaths, identityName: string, change: IdentityCredentialChange): Identity;
+declare const PlanClassSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"subscription">;
+    capacity: z.ZodNumber;
+    recognised: z.ZodBoolean;
+    tier: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"pay-per-use">;
+    tier: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+type PlanClass = z.infer<typeof PlanClassSchema>;
 /**
- * Deletes identity `name` entirely: its directory under `identitiesDir` (the farm, its `identity.json`, and whatever that farm holds unshared, credentials included), its resync lock, any scratch or superseded farm a resync left behind, and the active-identity selection when it names this identity. Data shared into `~/.claude` stays there, since the farm only ever symlinks to it. Throws `IdentityNotFoundError` when the identity does not exist.
+ * Classifies an account from the rate-limit tier of its stored login (`organizationRateLimitTier`, which decides the organisation's limits, then `userRateLimitTier`). The tier strings are free text on Anthropic's side, so only the shapes seen are read: a trailing `<n>x` is that multiple, a bare `pro` is 1, a `zero` tier is pay-per-use. Anything else is a subscription of unrecognised size, counted as 1 and marked so the ranking can say it guessed.
  */
-declare function removeIdentity(paths: LayoutPaths, name: string): void;
+declare function planOf(account: AccountMetadata | undefined): PlanClass;
 
-/** Raised by any operation that requires a configuration profile to already exist, when it does not. */
-declare class ProfileNotFoundError extends CliError {
-    readonly profileName: string;
-    constructor(profileName: string);
+/** Anthropic's longest prompt-cache lifetime (the one-hour tier): a conversation resumed within it still has a warm cache on the account that served it, and the cache is per organisation, so it is lost by switching. */
+declare const PROMPT_CACHE_TTL_MS: number;
+/** The state a member's ranking was built from. */
+interface PoolMember {
+    readonly identity: string;
+    /** The identity's usage snapshot, when it has one. */
+    readonly snapshot?: UsageSnapshot;
+    /** Why the member's recorded state could not be read (a corrupt or newer-schema snapshot, an unreadable login file), when that is the case. */
+    readonly readError?: string;
+    readonly account?: AccountMetadata;
+    /** The member's usage-log records from the current five-hour window on. */
+    readonly records: readonly UsageRecord[];
 }
-/** Raised by `createProfile` (`profile add`) when a profile with the given name already has a file. */
-declare class ProfileAlreadyExistsError extends CliError {
-    readonly profileName: string;
-    constructor(profileName: string);
+/** The member last picked for this directory, kept so a conversation stays on the account whose prompt cache is warm. */
+interface StickyPick {
+    readonly identity: string;
+    readonly at: string;
 }
-/** Raised when a `--category` patch names something other than one of the four overridable categories (e.g. `secret`, or a typo). */
-declare class InvalidCategoryNameError extends CliError {
-    readonly categoryName: string;
-    constructor(categoryName: string);
+interface RankPoolInput {
+    readonly members: readonly PoolMember[];
+    readonly nowMs: number;
+    readonly sticky?: StickyPick;
+    /** True when the launch continues or resumes a conversation, which belongs on the account it started on whatever the cache lifetime. */
+    readonly resuming: boolean;
 }
-/** True when a profile file exists for `name`, regardless of whether it validates. */
-declare function profileExists(paths: LayoutPaths, name: string): boolean;
-/** Reads and validates one configuration profile, or undefined when it does not exist. */
-declare function readProfile(paths: LayoutPaths, name: string): ConfigProfile | undefined;
-/**
- * Creates a new configuration profile, empty apart from the optional `extends` list and description. Throws `ProfileAlreadyExistsError` if a profile with this name already has a file, and `ConfigValidationError` when the result fails `ConfigProfileSchema` (e.g. an empty `--extends ""` name), rather than letting the underlying `ZodError` escape as an unhandled crash.
- */
-declare function createProfile(paths: LayoutPaths, name: string, extendsList?: readonly string[], description?: string): ConfigProfile;
-/** One profile as reported by `listProfiles`. */
-interface ProfileListEntry {
-    readonly name: string;
-    readonly profile: ConfigProfile;
+/** In pick order. `scored` has usable quota data; `unknown` has none (never recorded, or unreadable); `pay-per-use` bills by use instead of drawing on a plan; `ineligible` is refused right now. */
+type CandidateClass = "scored" | "unknown" | "pay-per-use" | "ineligible";
+interface Candidate {
+    readonly identity: string;
+    readonly class: CandidateClass;
+    /** Plan-size-weighted remaining quota per hour until its reset: higher is more wasted if left unused. Present for `scored` only. */
+    readonly score?: number;
+    /** False when the five-hour window would run dry, at the observed pace, before it resets. A `scored` candidate that is not feasible ranks below every feasible one. */
+    readonly feasible: boolean;
+    /** When an `ineligible` candidate can be used again. */
+    readonly blockedUntilMs?: number;
+    readonly plan: PlanClass;
+    /** Human-readable facts behind the class and score, in the order they matter. */
+    readonly reasons: readonly string[];
+}
+interface PoolRanking {
+    /** Every member, best first. */
+    readonly candidates: readonly Candidate[];
+    /** The member to launch on: the best one that is not refused. Undefined when every member is refused. */
+    readonly pick?: Candidate;
+    /** When nothing can be picked, the soonest any member comes back. */
+    readonly earliestReturn?: {
+        readonly identity: string;
+        readonly atMs: number;
+    };
 }
-/** Lists every configuration profile under `configProfilesDir` that has a valid `<name>.json`. */
-declare function listProfiles(paths: LayoutPaths): readonly ProfileListEntry[];
-/** Reads the user-global `~/.agent-shim/config.json`, or undefined when it does not exist. */
-declare function readGlobalConfig(paths: LayoutPaths): GlobalConfig | undefined;
-/** Sets the user-global default configuration profile in `~/.agent-shim/config.json`, creating the file if it doesn't exist yet. Whether the profile exists is the caller's concern: `profile use` checks it first. */
-declare function setGlobalDefaultProfile(paths: LayoutPaths, name: string): GlobalConfig;
-/**
- * Merges `patch` (from one or more `--category cat=bool` flags) into `profile`'s own `categories` object and writes it back.
- *
- * Throws `InvalidCategoryNameError` for any key that isn't one of the four overridable categories — `secret` can never be toggled by any configuration layer, this included.
- */
-declare function setProfileCategories(paths: LayoutPaths, name: string, patch: Readonly<Record<string, boolean>>): ConfigProfile;
 /**
- * Merges `patch` (from one or more `--entry "path"=bool` flags) into `profile`'s own `entries` object and writes it back.
+ * Ranks `members` for a launch.
  *
- * Key validity (the `<category>/<real-relative-path>` prefix requirement) is enforced by `ConfigProfileSchema`'s own `EntriesSchema` at write time — an invalid key surfaces as the usual `ConfigValidationError`.
+ * A member is `ineligible` while a window of its plan, or a refusal it last hit, still binds; it is `unknown` without recorded quota, `pay-per-use` when its usage bills by use, and otherwise `scored`. Scored members order by how much plan-size-weighted quota would expire unused per hour of runway, with any whose five-hour window would run dry at the observed pace (their own, or the person's pace on another member rescaled by plan size) placed behind those that would not. The member last picked for this directory then moves to the front if it is still usable and either the launch resumes a conversation or its prompt cache is still warm.
  */
-declare function setProfileEntries(paths: LayoutPaths, name: string, patch: Readonly<Record<string, boolean>>): ConfigProfile;
+declare function rankPool(input: RankPoolInput): PoolRanking;
+
 /**
- * Merges `patch` into `profile`'s own `launch` object and writes it back. A key present in `patch` with the value `undefined` removes that setting outright (a `--no-launch-provider`, say) rather than overwriting it, and a `launch` object left with no settings is removed too.
+ * Ranks a pool exactly as a launch from `directory` would right now, without recording a pick. Shares `rankPoolFromStore` with the launcher, so what this prints is what a launch does.
  */
-declare function setProfileLaunchFlags(paths: LayoutPaths, name: string, patch: Readonly<LaunchFlags>): ConfigProfile;
-/** Replaces `profile`'s own `extends` list and/or description; an empty list or an undefined description removes the field. */
-declare function setProfileMetadata(paths: LayoutPaths, name: string, patch: Readonly<{
-    extends?: readonly string[];
-    description?: string | false;
-}>): ConfigProfile;
-/** Deletes a configuration profile's file. Throws `ProfileNotFoundError` when it does not exist. Nothing that references it by name is rewritten; `agent-shim doctor` reports any identity default, directory rule or `extends` left pointing at it. */
-declare function removeProfile(paths: LayoutPaths, name: string): void;
+declare function collectPoolPick(params: Readonly<{
+    paths: LayoutPaths;
+    fs: FsPort;
+    usageFs: FarmFs;
+    poolName: string;
+    pool: Pool;
+    directory: string;
+    nowMs: number;
+}>): PoolPickReport;
 
-/** What a cache stores for one credential: the token, when it was fetched, and the source that produced it (a non-secret descriptor, kept so `check` and the launch log can still say where the token came from). */
-declare const CachedCredentialSchema: z.ZodObject<{
-    token: z.ZodString;
-    fetchedAt: z.ZodNumber;
-    source: z.ZodUnion<readonly [z.ZodObject<{
-        env: z.ZodString;
-    }, z.core.$strict>, z.ZodObject<{
-        file: z.ZodString;
-    }, z.core.$strict>, z.ZodObject<{
-        interactive: z.ZodOptional<z.ZodBoolean>;
-        timeoutMs: z.ZodOptional<z.ZodInt>;
-        command: z.ZodTuple<[z.ZodString], z.ZodString>;
-    }, z.core.$strict>, z.ZodObject<{
-        interactive: z.ZodOptional<z.ZodBoolean>;
-        timeoutMs: z.ZodOptional<z.ZodInt>;
-        op: z.ZodString;
-    }, z.core.$strict>, z.ZodObject<{
-        interactive: z.ZodOptional<z.ZodBoolean>;
-        timeoutMs: z.ZodOptional<z.ZodInt>;
-        keychain: z.ZodObject<{
-            service: z.ZodString;
-            account: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>;
-    }, z.core.$strict>, z.ZodObject<{
-        literal: z.ZodString;
-    }, z.core.$strict>]>;
-}, z.core.$strict>;
-type CachedCredential = z.infer<typeof CachedCredentialSchema>;
+/** Everything a `when` condition can be evaluated against, injected rather than read. */
+interface ConditionContext {
+    readonly nowMs: number;
+    /** Facts about the specific entry being decided. Absent when evaluating a rule-level condition that has no single entry (a directory rule's own `when`). */
+    readonly fact?: EntryFact;
+    /** The branch checked out at `cwd`, or undefined when `cwd` is not in a repository. */
+    readonly branch?: string;
+    /** True when the repository is in detached-HEAD state, in which case no `branch` condition can match. */
+    readonly branchDetached?: boolean;
+    readonly env: Readonly<Record<string, string | undefined>>;
+}
+/** The result of evaluating one `when` object. */
+interface WhenEvaluation {
+    readonly passed: boolean;
+    /** Which condition fields were present and evaluated. */
+    readonly checked: readonly string[];
+    /** Which of those fields did not hold. Empty when `passed` is true. */
+    readonly failed: readonly string[];
+}
+/** True when `branch` matches `pattern`. The pattern is glob-capable (`client/*`); a detached HEAD or a non-repository directory never matches. */
+declare function matchBranch(pattern: string, branch: string | undefined, detached?: boolean): boolean;
 /**
- * Where cached credentials live, injected so resolution and its tests need neither the Keychain nor a real directory. `owner` names what the credential belongs to (`identity work`, `provider z`) and is the entry's key; `store` picks the backing store. `read` returns undefined for a missing or unreadable entry, since an entry that cannot be used is the same as no entry.
+ * Evaluates a `when` object. Every present field must hold — conditions AND together within one object.
+ *
+ * An absent condition is vacuously true, so `when: {}` passes; `agent-shim check` warns about that rather than erroring, since an empty object is more likely a half-finished edit than an intentional statement.
+ *
+ * `newerThan`, `olderThan`, and `maxSizeBytes` read the subtree-aggregated facts (`latestMtimeMs`, `totalSizeBytes`), never the entry's own inode stat: a directory's own mtime does not change when a file three levels beneath it is rewritten, and its own size is a ~4KB inode figure that says nothing about what it contains.
  */
-interface CredentialCachePort {
-    readonly read: (store: CredentialCacheStore, owner: string) => CachedCredential | undefined;
-    readonly write: (store: CredentialCacheStore, owner: string, entry: CachedCredential) => void;
-    readonly remove: (store: CredentialCacheStore, owner: string) => void;
+declare function evaluateWhen(when: WhenCondition | undefined, context: ConditionContext): WhenEvaluation;
+
+/** Raised when the daemon cannot be brought up in time, or reports a fatal `lastError`: a launch that asked for headroom must never silently fall back to a direct connection. */
+declare class HeadroomStartError extends CliError {
+    constructor(message: string);
+}
+/** Every effect the ensure step performs, injected so it runs against fakes in tests. */
+interface EnsureHeadroomPorts {
+    readonly fs: HeadroomFs;
+    /** Zombie-aware liveness: a supervisor or daemon that exited without being reaped still answers signal 0 as alive, but will never serve a request or write state, so it must read as dead here (see `realIsProcessRunning`). */
+    readonly isRunning: (pid: number) => boolean;
+    readonly now: () => number;
+    readonly sleep: (ms: number) => void;
+    /** Spawns the detached supervisor process that owns the headroom daemon, returning its pid. */
+    readonly spawnSupervisor: (paths: LayoutPaths) => number;
 }
 /**
- * What the cache holds for one credential, without the token: whether there is an entry, how old it is, and whether it is still within the block's TTL. `expiresInMs` is absent for a block with no expiry.
+ * Brings the headroom daemon up for this launch, or finds it already running, and registers this launcher pid in its session registry (the fact that keeps the daemon alive and defers drift restarts until this launch is done).
+ *
+ * The exclusive-create start lock decides which of several concurrent launches spawns the one supervisor: its holder spawns and keeps waiting like everyone else, everyone else waits on the state file, and a lock whose holder has died is removed and retried. Readiness is "state names a live supervisor, a live headroom pid, and a socket path", which the supervisor only writes after its own `/readyz` probe over that socket has passed, so polling state alone never mistakes a bound-but-not-ready socket for a usable daemon.
+ *
+ * Throws `HeadroomStartError` (naming the daemon log path and any recorded `lastError`) when the daemon is not up within `HEADROOM_START_TIMEOUT_MS`, or when a live supervisor has recorded a fatal error (a platform without unix sockets and a socket directory that fails the owner-only check are recorded this way, so the launch fails with the reason).
  */
-type CachedCredentialState = {
-    readonly store: CredentialCacheStore;
-    readonly status: "empty";
-}
-/** The store cannot be read here (the keychain store configured on a platform without a Keychain): reported with its reason rather than failing the whole report. */
- | {
-    readonly store: CredentialCacheStore;
-    readonly status: "unreadable";
-    readonly reason: string;
-} | {
-    readonly store: CredentialCacheStore;
-    readonly status: "fresh" | "expired";
-    readonly ageMs: number;
-    readonly expiresInMs?: number;
+declare function ensureHeadroom(params: {
+    readonly paths: LayoutPaths;
+    readonly launcherPid: number;
+    readonly ports: EnsureHeadroomPorts;
+    /**
+     * The hash of the allowlist the daemon must have been started with for this launch to work, read fresh on every poll because the front door's address it contains can change while the launch waits. Given for a launch that routes a provider through headroom, whose requests come back to the front door's direct origin and are refused by a daemon that was started without it; absent for a launch that only needs Claude Code's own API, which every daemon admits.
+     */
+    readonly requiredAllowlistHash?: () => string;
+}): {
+    readonly socketPath: string;
 };
 
-/** What reading one `file` source found: nothing at that path, or its contents and permission bits. `mode` is undefined on a platform with no POSIX permission bits (Windows), where the looseness check cannot apply. */
-type SecretFileRead = {
-    readonly found: false;
-} | {
-    readonly found: true;
-    readonly content: string;
-    readonly mode: number | undefined;
-};
-/** The outcome of one credential command. `stderr` is empty for an interactive run, whose stderr goes to the terminal so a person sees any prompt. */
-interface CredentialCommandResult {
-    readonly status: number | null;
-    readonly stdout: string;
-    readonly stderr: string;
-    readonly timedOut: boolean;
+/** The token-saving settings of the `headroom` config block, without its install and lifecycle fields (`source`, `idleShutdownMinutes`). */
+type HeadroomSettings = Pick<HeadroomGlobalConfig, "mode" | "targetRatio" | "ccr" | "rolloutChannel" | "interceptToolResults" | "readMaturation">;
+
+/** Everything the supervisor needs to run the daemon, resolved from the global config and the filesystem before it starts. */
+interface HeadroomSupervisorConfig {
+    /** The install spec as configured (`headroom.source`), already defaulted. */
+    readonly source: string;
+    /** `headroom.idleShutdownMinutes`, already defaulted. */
+    readonly idleShutdownMinutes: number;
+    /** The token-saving settings (`mode`, `targetRatio`, `ccr`, the rollout channel and its opt-ins), as configured; unset fields leave headroom on its own defaults. */
+    readonly settings: HeadroomSettings;
 }
+/** How the supervisor resolves the configured source against its defaults. */
+declare function resolveSupervisorConfig(configured: Readonly<HeadroomGlobalConfig>): HeadroomSupervisorConfig;
 /**
- * Everything resolving a credential needs from the outside world, injected so the resolver (and every launcher test) runs without `op`, the Keychain, real secret files or a terminal. `src/realPorts.ts` wires the real one; tests wire a fake.
+ * Every effect the supervisor performs, injected so the whole lifecycle is testable against fakes: no real process, port, clock, or HTTP call ever happens in a unit test.
  */
-interface CredentialPort {
-    /** Reads a `file` source's path (absolute or `~`-rooted). */
-    readonly readSecretFile: (filePath: string) => SecretFileRead;
-    /** Runs a command source's argv directly (no shell) under a timeout, capturing stdout. An interactive run inherits the terminal's stdin and stderr so a person can answer a prompt. */
-    readonly runCommand: (argv: readonly [string, ...string[]], options: {
-        readonly timeoutMs: number;
-        readonly interactive: boolean;
-    }) => CredentialCommandResult;
-    /** Whether a person can answer a prompt now: standard input is a terminal, or there is a desktop session to show a dialog in. */
-    readonly personPresent: () => boolean;
-    /** Where cached credentials live, used only for a credential block that asks for caching. Omit to resolve every launch from the sources. */
-    readonly cache?: CredentialCacheEnv;
-}
-/** One source as `check`, `doctor` and every `--json` output report it: its kind plus the same non-secret identifying detail `describeSource` prints. */
-type CredentialSourceSummary = {
-    readonly kind: "env";
-    readonly variable: string;
-} | {
-    readonly kind: "file";
-    readonly path: string;
-} | {
-    readonly kind: "command";
-    readonly program: string;
-} | {
-    readonly kind: "op";
-    readonly reference: string;
-} | {
-    readonly kind: "keychain";
-    readonly service: string;
-    readonly account?: string;
-} | {
-    readonly kind: "literal";
-};
-/** A credential block as it is reported: its effective target and each source's summary, in order. */
-interface CredentialSummary {
-    readonly target: CredentialTarget;
-    readonly sources: readonly CredentialSourceSummary[];
-    /** The block's cache setting when it asks for caching: how long a token is kept (absent for no expiry) and where. */
-    readonly cache?: {
-        readonly ttl?: string;
-        readonly store?: string;
+interface SupervisorPorts {
+    readonly fs: HeadroomFs;
+    readonly paths: LayoutPaths;
+    readonly ownPid: number;
+    readonly now: () => number;
+    /**
+     * Waits `ms`, yielding to the event loop while it does. Deliberately NOT a synchronous Atomics.wait-style sleep: the real supervisor learns of its child's death through the ChildProcess exit event, and a blocking sleep would stop the event loop from ever delivering it (the exact failure that left an unreaped zombie answering liveness checks as alive).
+     */
+    readonly sleep: (ms: number) => Promise<void>;
+    /**
+     * Zombie-aware liveness, and for a daemon this supervisor spawned, exit-event-backed: the implementation keeps the spawned ChildProcess handle, consumes its exit event (which is also what reaps it), and reports the pid as not running from that moment. A bare signal-0 check is not enough, because a defunct process still answers it.
+     */
+    readonly isRunning: (pid: number) => boolean;
+    /** The platform facts and owner-only checks the daemon's socket directory is prepared and verified with (see `prepareHeadroomSocket`). */
+    readonly socketTrust: HeadroomSocketTrustPorts;
+    /**
+     * Starts `headroom proxy` serving on the unix socket `socketPath` (and on no TCP port) with the given allowlist, returning its pid. Output goes to the daemon log. The implementation must keep the ChildProcess handle and attach an exit listener (detaching the process is fine; unref'ing a child you still need events from is not, since without the listener nothing reaps it and it lingers as a zombie).
+     */
+    readonly spawnHeadroom: (socketPath: string, allowlist: readonly string[], settings: Readonly<HeadroomSettings>) => number;
+    /** Reads the headroom config block as it stands on disk now. The supervisor calls it every tick, so a changed `source` or setting is noticed while the daemon runs and applied by the same quiet-registry restart an allowlist change gets. */
+    readonly readConfig: () => HeadroomSupervisorConfig;
+    /** Stops a process the supervisor owns, escalating SIGTERM to SIGKILL on a bounded timeout (see `stopSupervisedProcess`). */
+    readonly stopProcess: (pid: number) => void;
+    /** True once `GET /readyz` over the unix socket succeeds. */
+    readonly ready: (socketPath: string) => Promise<boolean>;
+    /** Runs `uv tool install <spec>`, logging output to the daemon log. Returns ok=false with the error when `uv` is absent or the install fails. */
+    readonly install: (spec: string) => {
+        readonly ok: boolean;
+        readonly error?: string;
     };
+    /** The installed `headroom --version` output, or undefined when the binary is not on PATH. */
+    readonly headroomVersion: () => string | undefined;
+    /** The commit the installed headroom was built from, as the install itself records it (`direct_url.json`), or undefined when it was not installed from a git source. */
+    readonly installedCommit: () => string | undefined;
+    readonly log: (line: string) => void;
 }
-/** What caching a credential needs beyond the block's own `cache` setting: the port holding entries, the platform that picks the default store, and the clock the TTL is measured on. */
-interface CredentialCacheEnv {
-    readonly port: CredentialCachePort;
-    readonly platform: NodeJS.Platform;
-    readonly now: () => number;
+/** Options for `runSupervisor`. */
+interface RunSupervisorOptions {
+    /**
+     * Bounds the supervisor loop's iterations. The real supervisor runs until it exits on its own (idle shutdown or fatal error); a bounded run is how tests observe steady-state behaviour (drift deferral, restart-on-crash, pruning) without an infinite loop, and such a run returns `HEADROOM_SUPERVISOR_STILL_RUNNING` instead of an exit code.
+     */
+    readonly tickLimit?: number;
 }
+/**
+ * Runs the headroom supervisor loop: install the daemon, start it, keep it alive (for crash or drift), and stop it after the configured idle period with an empty session registry. Returns the process exit code (0 for an idle shutdown, 1 for a fatal setup failure).
+ *
+ * Every effect flows through `ports`, so the whole loop is unit-testable with a fake clock, filesystem, and processes. The loop awaits its sleeps, which in the real implementation run on a timer: between ticks the event loop turns, the spawned child's exit event is delivered (and the child thereby reaped), and the next tick's liveness check reads the truth.
+ */
+declare function runSupervisor(initialConfig: HeadroomSupervisorConfig, ports: SupervisorPorts, options?: RunSupervisorOptions): Promise<number>;
 
-/** Raised by any operation that requires a provider to already exist, when it does not. */
-declare class ProviderNotFoundError extends CliError {
+/** Raised by any operation that requires an identity to already exist, when it does not. */
+declare class IdentityNotFoundError extends CliError {
     readonly name: string;
     constructor(name: string);
 }
-/** Raised by `addProvider` when a provider with the given name already has a file. */
-declare class ProviderAlreadyExistsError extends CliError {
-    readonly providerName: string;
-    constructor(providerName: string);
+/** Raised by `addIdentity` when an identity with the given name already has an `identity.json`. */
+declare class IdentityAlreadyExistsError extends CliError {
+    readonly identityName: string;
+    constructor(identityName: string);
 }
-/**
- * Raised by `addProvider` when `name` fails the provider naming rule: the same rule `IdentitySchema` applies to identity names (start with a letter or number, then letters, numbers, dots, hyphens, underscores, and at signs). Keeping the two rules identical means a name that works for one works for the other, and neither vocabulary can ever produce a path segment that escapes `providers/` or `identities/`.
- */
-declare class InvalidProviderNameError extends CliError {
+/** Raised by `addIdentity` when `name` fails `IdentitySchema`'s own naming rule — it must start with a letter or number and may then contain letters, numbers, dots, hyphens, underscores, and at signs, so an email address names an identity directly while a *leading* `@` stays invalid (it would collide with the `@name` selector syntax's first-`@` split). */
+declare class InvalidIdentityNameError extends CliError {
     readonly attemptedName: string;
     constructor(attemptedName: string);
 }
-/** True when a provider file exists for `name`, regardless of whether it validates. */
-declare function providerExists(paths: LayoutPaths, name: string): boolean;
-/** What converting one old-format provider file involves: the old fields it uses, and the whole file rewritten in the current format. */
-interface LegacyProviderConversion {
-    readonly fields: readonly string[];
-    readonly replacement: Record<string, unknown>;
-}
-/** Raised when a provider file is still in the format before the credential block, naming the old fields and giving the exact replacement. */
-declare class LegacyProviderFileError extends CliError {
-    readonly filePath: string;
-    readonly conversion: LegacyProviderConversion;
-    constructor(filePath: string, conversion: LegacyProviderConversion);
-}
-/** Reads and validates one provider definition, or undefined when it does not exist. */
-declare function readProvider(paths: LayoutPaths, name: string): Provider | undefined;
-/** One provider definition as reported by `listProviders`. */
-interface ProviderListEntry {
+declare function identityExists(paths: LayoutPaths, name: string): boolean;
+/** Reads and validates one identity's `identity.json`, or undefined when it does not exist. */
+declare function readIdentity(paths: LayoutPaths, name: string): Identity | undefined;
+/**
+ * Creates a new identity: validates `name` against `IdentitySchema`'s own naming rule and writes a fresh `identity.json` with `allowAmbientCredential: false` and no `defaultConfigProfile`.
+ *
+ * Throws `IdentityAlreadyExistsError` if an identity with this name already has an `identity.json` — `add` never silently overwrites an existing identity. Throws `InvalidIdentityNameError` when `name` fails `IdentitySchema`'s naming rule, rather than letting the underlying `ZodError` escape as an unhandled crash.
+ */
+declare function addIdentity(paths: LayoutPaths, name: string): Identity;
+/**
+ * Persists `name` as the active identity, written atomically as plain text (not JSON — this file is read by `decideIdentity` in `src/launcher/identity.ts` via a simple UTF-8 read-and-trim, matching the README's documented `~/.agent-shim/active-identity` file).
+ *
+ * `name` may be a `pool:<name>` selector, which makes launches pick a member of that pool. Throws `IdentityNotFoundError` when no identity with this name exists yet, and `PoolNotFoundError` for a pool that is not defined: selecting either would silently persist a name nothing else can ever load.
+ */
+declare function useIdentity(paths: LayoutPaths, name: string): void;
+/** Reads the persisted active-identity file, or undefined when none is set. */
+declare function readActiveIdentity(paths: LayoutPaths): string | undefined;
+/**
+ * Whether a directory name directly under `identitiesDir` names an actual identity, rather than one of agent-shim's own farm directories.
+ *
+ * `IdentitySchema` requires an identity name to start with a letter or digit, so a leading `.` can only be a resync's own bookkeeping: a `.<identity>.scratch.<suffix>` tree still being built, or a `.<identity>.previous.<suffix>` superseded farm retained for `agent-shim identity resolve-conflicts`. Neither is an identity, and neither should be reported as a broken one for lacking an `identity.json` a resync never put there.
+ */
+declare function isIdentityDirectoryName(name: string): boolean;
+/** One identity as reported by `listIdentities`, whose `identity.json` parsed and validated cleanly. */
+interface IdentityListEntry {
     readonly name: string;
-    readonly provider: Provider;
-}
-/** Lists every provider under `providersDir` that has a valid `<name>.json`. A file that fails validation is skipped here; `provider list` is the place a broken definition gets surfaced, not a launch. */
-declare function listProviders(paths: LayoutPaths): readonly ProviderListEntry[];
-/** The credential targets a provider may use. */
-type ProviderCredentialTarget = (typeof PROVIDER_CREDENTIAL_TARGETS)[number];
-/** The kinds of provider. */
-type ProviderKind = (typeof PROVIDER_KINDS)[number];
-/** Where a provider sends its sessions, for display: an `http` provider's base URL, or the front door for a codex provider (whose address exists only at launch). */
-declare function describeProviderEndpoint(provider: Provider): string;
-/** Everything `addProvider` writes into a fresh provider file. `baseUrl` is required for an `http` provider and refused for a codex one; `codex` applies only to a codex provider. */
-interface AddProviderInput {
-    readonly kind?: ProviderKind;
-    readonly displayName: string;
-    readonly baseUrl?: string;
-    readonly sources: readonly CredentialSource[];
-    readonly target?: ProviderCredentialTarget;
-    readonly env?: Readonly<Record<string, string>>;
-    readonly codex?: CodexProviderConfig;
+    readonly identity: Identity;
+    readonly isActive: boolean;
+    readonly problem?: never;
 }
-/** Raised when a provider option does not fit the provider's kind: a base URL for a codex provider, a missing one for an http provider, or codex settings for an http provider. */
-declare class ProviderKindMismatchError extends UsageError {
-    constructor(message: string);
+/** One identity whose `identity.json` is present but unreadable — malformed JSON, or valid JSON this version's `IdentitySchema` rejects. `problem` carries the reason, already flattened onto a single line. */
+interface UnreadableIdentityListEntry {
+    readonly name: string;
+    readonly identity?: never;
+    readonly isActive: boolean;
+    readonly problem: string;
 }
+/** Either shape `listIdentities` can report, discriminated by which of `identity`/`problem` is present rather than by a tag field — the two are never simultaneously satisfiable. */
+type IdentityListing = IdentityListEntry | UnreadableIdentityListEntry;
+/**
+ * Lists every identity under `identitiesDir`, marking which one (if any) is currently active.
+ *
+ * One identity whose `identity.json` cannot be read is reported as its own `UnreadableIdentityListEntry` rather than aborting the whole listing. A single bad file blocking `identity list` outright is exactly the failure mode that hides every *other* identity from view at the moment the user most needs to see them — and the file need not even be corrupt to land here, since a name written by a newer agent-shim whose naming rule has since widened is rejected outright by an older binary's own copy of `IdentitySchema`.
+ */
+declare function listIdentities(paths: LayoutPaths): readonly IdentityListing[];
 /**
- * Creates a new provider definition. Throws `ProviderAlreadyExistsError` when a provider with this name already has a file, `InvalidProviderNameError` when `name` fails the naming rule, and `ConfigValidationError` when the assembled definition fails `ProviderSchema` (e.g. a `baseUrl` that is not a URL) rather than letting the underlying `ZodError` escape as an unhandled crash.
+ * Sets `identity`'s `defaultConfigProfile` field, or clears it when `profileName` is undefined. Throws `IdentityNotFoundError` when the identity does not exist. Whether the profile exists is the caller's concern: `identity set --default-profile` checks it first.
  */
-declare function addProvider(paths: LayoutPaths, name: string, input: AddProviderInput): Provider;
+declare function setDefaultConfigProfile(paths: LayoutPaths, identityName: string, profileName: string | undefined): Identity;
 /**
- * The fields `updateProvider` changes. `sources` replaces the whole ordered source list (a list is set, not patched, since its order is its meaning); `target` changes where the token goes and keeps the sources. `env` entries merge over the existing ones and `unsetEnv` keys are then deleted.
+ * Patches `identity`'s `allowAmbientCredential` field. Throws `IdentityNotFoundError` when the identity does not exist.
  */
-interface UpdateProviderInput {
-    readonly displayName?: string;
-    readonly baseUrl?: string;
+declare function setAllowAmbientCredential(paths: LayoutPaths, identityName: string, allow: boolean): Identity;
+/** The change `setIdentityCredential` makes: new sources and/or a new target for the credential block, or `false` to remove the block and return the identity to its stored login. */
+type IdentityCredentialChange = {
     readonly sources?: readonly CredentialSource[];
-    readonly target?: ProviderCredentialTarget;
-    /** A new cache block, or false to remove it; undefined leaves the existing one. */
+    readonly target?: CredentialTarget;
     readonly cache?: CredentialCache | false;
-    readonly env?: Readonly<Record<string, string>>;
-    readonly unsetEnv?: readonly string[];
-    /** Merged over a codex provider's existing settings: a field given here replaces that field, and `models` entries merge per tier. */
-    readonly codex?: CodexProviderConfig;
-}
+} | false;
 /**
- * Updates an existing provider definition in place. Throws `ProviderNotFoundError` when it does not exist, and `ConfigValidationError` when the updated definition fails `ProviderSchema`, leaving the file untouched.
+ * Sets, changes or removes `identityName`'s credential block. New `sources` replace the whole ordered list (the order is the meaning); a `target` alone keeps the existing sources, and so needs a credential block to exist already. Throws `IdentityNotFoundError` when the identity does not exist, and `UsageError` when only a target is given for an identity with no credential yet.
  */
-declare function updateProvider(paths: LayoutPaths, name: string, input: UpdateProviderInput): Provider;
-/** Deletes a provider definition. Throws `ProviderNotFoundError` when it does not exist. */
-declare function removeProvider(paths: LayoutPaths, name: string): void;
-
-/** Raised when a command names a pool that is not defined in the global config. */
-declare class PoolNotFoundError extends CliError {
-    readonly poolName: string;
-    constructor(poolName: string);
-}
-/** The pools defined in `~/.agent-shim/config.json`, by name. */
-declare function readPools(paths: LayoutPaths): Readonly<Record<string, Pool>>;
-/** The pool named `name`; throws `PoolNotFoundError` when none is defined. */
-declare function requirePool(paths: LayoutPaths, name: string): Pool;
-/** Defines a new pool. Throws `InvalidPoolNameError` for a name `PoolNameSchema` rejects and `PoolAlreadyExistsError` for one already defined. */
-declare function addPool(paths: LayoutPaths, name: string, identities: readonly string[]): Pool;
-/** Replaces an existing pool's members. Throws `PoolNotFoundError` when it is not defined. */
-declare function setPool(paths: LayoutPaths, name: string, identities: readonly string[]): Pool;
-/** Removes a pool. Throws `PoolNotFoundError` when it is not defined. Anything that selected it (an active-identity file, a directory rule) is left for `doctor` to report, as with a removed identity. */
-declare function removePool(paths: LayoutPaths, name: string): void;
+declare function setIdentityCredential(paths: LayoutPaths, identityName: string, change: IdentityCredentialChange): Identity;
+/**
+ * Deletes identity `name` entirely: its directory under `identitiesDir` (the farm, its `identity.json`, and whatever that farm holds unshared, credentials included), its resync lock, any scratch or superseded farm a resync left behind, and the active-identity selection when it names this identity. Data shared into `~/.claude` stays there, since the farm only ever symlinks to it. Throws `IdentityNotFoundError` when the identity does not exist.
+ */
+declare function removeIdentity(paths: LayoutPaths, name: string): void;
 
-/** Raised by `removeDirectoryRule`, `updateDirectoryRule` and `rule show` when no rule matches the given path exactly. */
-declare class DirectoryRuleNotFoundError extends CliError {
-    readonly rulePath: string;
-    constructor(rulePath: string);
-}
-/** Raised by `addDirectoryRule` when neither `--config-profile` nor `--identity` is given, and by `updateDirectoryRule` when an update would leave a rule that sets nothing at all: a rule that pins and overrides nothing would do nothing. */
-declare class DirectoryRuleMissingTargetError extends CliError {
-    constructor();
+/** Raised by any operation that requires a configuration profile to already exist, when it does not. */
+declare class ProfileNotFoundError extends CliError {
+    readonly profileName: string;
+    constructor(profileName: string);
 }
-/** Raised by `addDirectoryRule` when a rule for the exact path already exists: `rule add` creates, `rule set` updates. */
-declare class DirectoryRuleAlreadyExistsError extends CliError {
-    readonly rulePath: string;
-    constructor(rulePath: string);
+/** Raised by `createProfile` (`profile add`) when a profile with the given name already has a file. */
+declare class ProfileAlreadyExistsError extends CliError {
+    readonly profileName: string;
+    constructor(profileName: string);
 }
-/** Reads `~/.agent-shim/directory-rules.json`, or an empty rule set when the file does not exist yet. */
-declare function readDirectoryRules(paths: LayoutPaths): DirectoryRules;
-/** Validates and writes the whole `~/.agent-shim/directory-rules.json` file. Exported so `src/configure.ts` can update a single rule's `categories`/`entries` in place without duplicating this validate-then-write step. Throws `ConfigValidationError` when `rules` fails `DirectoryRulesSchema`, rather than letting the underlying `ZodError` escape as an unhandled crash. */
-declare function writeDirectoryRules(paths: LayoutPaths, rules: DirectoryRules): void;
-/** Lists every directory rule, in file order. */
-declare function listDirectoryRules(paths: LayoutPaths): readonly DirectoryRule[];
-/** Inputs to `addDirectoryRule` beyond the path itself. */
-interface AddDirectoryRuleOptions {
-    readonly configProfile?: string;
-    readonly identity?: string;
+/** Raised when a `--category` patch names something other than one of the four overridable categories (e.g. `secret`, or a typo). */
+declare class InvalidCategoryNameError extends CliError {
+    readonly categoryName: string;
+    constructor(categoryName: string);
 }
+/** True when a profile file exists for `name`, regardless of whether it validates. */
+declare function profileExists(paths: LayoutPaths, name: string): boolean;
+/** Reads and validates one configuration profile, or undefined when it does not exist. */
+declare function readProfile(paths: LayoutPaths, name: string): ConfigProfile | undefined;
 /**
- * Adds a new directory rule for `rulePath`. Throws `DirectoryRuleAlreadyExistsError` when a rule for that exact path already exists (`updateDirectoryRule` changes one), and `DirectoryRuleMissingTargetError` when neither `configProfile` nor `identity` is given, since a rule that pins neither would do nothing.
+ * Creates a new configuration profile, empty apart from the optional `extends` list and description. Throws `ProfileAlreadyExistsError` if a profile with this name already has a file, and `ConfigValidationError` when the result fails `ConfigProfileSchema` (e.g. an empty `--extends ""` name), rather than letting the underlying `ZodError` escape as an unhandled crash.
  */
-declare function addDirectoryRule(paths: LayoutPaths, rulePath: string, options: AddDirectoryRuleOptions): DirectoryRule;
-/** The fields `updateDirectoryRule` changes. A value of `false` removes that field from the rule. */
-interface UpdateDirectoryRuleOptions {
-    readonly configProfile?: string | false;
-    readonly identity?: string | false;
+declare function createProfile(paths: LayoutPaths, name: string, extendsList?: readonly string[], description?: string): ConfigProfile;
+/** One profile as reported by `listProfiles`. */
+interface ProfileListEntry {
+    readonly name: string;
+    readonly profile: ConfigProfile;
 }
+/** Lists every configuration profile under `configProfilesDir` that has a valid `<name>.json`. */
+declare function listProfiles(paths: LayoutPaths): readonly ProfileListEntry[];
+/** Reads the user-global `~/.agent-shim/config.json`, or undefined when it does not exist. */
+declare function readGlobalConfig(paths: LayoutPaths): GlobalConfig | undefined;
+/** Sets the user-global default configuration profile in `~/.agent-shim/config.json`, creating the file if it doesn't exist yet. Whether the profile exists is the caller's concern: `profile use` checks it first. */
+declare function setGlobalDefaultProfile(paths: LayoutPaths, name: string): GlobalConfig;
 /**
- * Updates the existing directory rule for `rulePath` in place, keeping its position in the file and every field not named. Throws `DirectoryRuleNotFoundError` when no rule matches that exact path, and `DirectoryRuleMissingTargetError` when the update would leave a rule that does nothing (remove it with `removeDirectoryRule` instead).
+ * Merges `patch` (from one or more `--category cat=bool` flags) into `profile`'s own `categories` object and writes it back.
+ *
+ * Throws `InvalidCategoryNameError` for any key that isn't one of the four overridable categories — `secret` can never be toggled by any configuration layer, this included.
  */
-declare function updateDirectoryRule(paths: LayoutPaths, rulePath: string, options: UpdateDirectoryRuleOptions): DirectoryRule;
-/** Removes the directory rule for `rulePath`. Throws `DirectoryRuleNotFoundError` when no rule matches that exact path. */
-declare function removeDirectoryRule(paths: LayoutPaths, rulePath: string): void;
-
-/** Where a pinned Claude Code version came from, strongest first: the launch's own flag, then the environment, then the cascade. */
-type ClaudeVersionSource = "flag" | "environment" | "cascade";
-/** The pinned version a launch runs, and which of the three forms named it. */
-interface PinnedClaudeVersion {
-    readonly version: string;
-    readonly source: ClaudeVersionSource;
-}
-
-/** Which precedence rule produced an identity decision. */
-type IdentityDecisionSource = 
-/** `CLAUDE_CONFIG_DIR` was already set: identity resolution is skipped entirely and the real binary uses whatever it already points to. */
-"config-dir-escape-hatch"
-/** A leading `@name` argv[0] positional, or its explicit form `--identity <name>`. */
- | "argv"
-/** The `AGENT_SHIM_IDENTITY` environment variable. */
- | "env"
-/** A directory rule pinning an identity to the current path. */
- | "directory-pin"
-/** The persisted `~/.agent-shim/active-identity` file. */
- | "active-identity-file"
-/** Nothing resolved an identity at all — a bare launch with no active identity. */
- | "none";
-/** Which precedence rule produced a configuration-profile decision. */
-type ConfigProfileDecisionSource = 
-/** An explicit `--config-profile` CLI flag. */
-"cli-flag"
-/** The `AGENT_SHIM_CONFIG_PROFILE` environment variable. */
- | "env"
-/** A directory rule's `configProfile` selection for `$PWD`. */
- | "directory-rule"
-/** The active identity's own declared `defaultConfigProfile`. */
- | "identity-default"
-/** The user-global `~/.agent-shim/config.json` default. */
- | "global-default"
-/** Nothing resolved a configuration profile at all. */
- | "none";
-
+declare function setProfileCategories(paths: LayoutPaths, name: string, patch: Readonly<Record<string, boolean>>): ConfigProfile;
 /**
- * Forward-only encoding of a real working directory into the single directory name Claude Code gives it under `~/.claude/projects/`.
- *
- * The encoding collapses the *entire* non-alphanumeric character class to `-`, not just the path separator: `.`, `_`, ` `, `@`, and `/` all become `-`, while letters and digits pass through with their case preserved. This was confirmed against a real installation's project directories, not assumed from the one `/`-becomes-`-` sample the README quotes.
+ * Merges `patch` (from one or more `--entry "path"=bool` flags) into `profile`'s own `entries` object and writes it back.
  *
- * The encoding is therefore many-to-one: `~/work/clients/acme`, `~/work/clients-acme`, and `~/work-clients/acme` all produce the identical name. That makes it impossible to invert, so this module never tries: there is no decode function here, and `projects.test.ts` asserts the module's export list to keep it that way. Only the forward direction — real path to encoded name — is ever computed, and `detectEncodingAmbiguity` reports when a pattern's encoded form could plausibly correspond to more than one real path rather than resolving it silently.
+ * Key validity (the `<category>/<real-relative-path>` prefix requirement) is enforced by `ConfigProfileSchema`'s own `EntriesSchema` at write time — an invalid key surfaces as the usual `ConfigValidationError`.
  */
+declare function setProfileEntries(paths: LayoutPaths, name: string, patch: Readonly<Record<string, boolean>>): ConfigProfile;
+/**
+ * Merges `patch` into `profile`'s own `launch` object and writes it back. A key present in `patch` with the value `undefined` removes that setting outright (a `--no-launch-provider`, say) rather than overwriting it, and a `launch` object left with no settings is removed too.
+ */
+declare function setProfileLaunchFlags(paths: LayoutPaths, name: string, patch: Readonly<LaunchFlags>): ConfigProfile;
+/** Replaces `profile`'s own `extends` list and/or description; an empty list or an undefined description removes the field. */
+declare function setProfileMetadata(paths: LayoutPaths, name: string, patch: Readonly<{
+    extends?: readonly string[];
+    description?: string | false;
+}>): ConfigProfile;
+/** Deletes a configuration profile's file. Throws `ProfileNotFoundError` when it does not exist. Nothing that references it by name is rewritten; `agent-shim doctor` reports any identity default, directory rule or `extends` left pointing at it. */
+declare function removeProfile(paths: LayoutPaths, name: string): void;
 
-/** Why a pattern's encoded form might not identify the real path its author had in mind. */
-type EncodingAmbiguityReason = 
-/** The literal portion contains a character other than `/` that encodes to `-`, so a sibling path differing only in that character encodes identically. */
-"lossy-characters"
-/** Two different patterns in the same configuration encode to the identical form. */
- | "collides-with-sibling-pattern";
-/** One reported ambiguity in a `history/projects/` pattern. */
-interface EncodingAmbiguity {
-    readonly fragment: string;
-    readonly encoded: string;
-    readonly reason: EncodingAmbiguityReason;
-    readonly detail: string;
-}
-
-/** The result of looking up the macOS Keychain service name Claude Code is actually using for one identity's farm. */
-interface KeychainLookupResult {
-    readonly checked: true;
-    readonly found: boolean;
-    readonly serviceName?: string;
-    readonly note: string;
+/** Raised by any operation that requires a provider to already exist, when it does not. */
+declare class ProviderNotFoundError extends CliError {
+    readonly name: string;
+    constructor(name: string);
 }
-/** One file's reported settings exposure: names and counts only, never the underlying values. */
-interface SettingsExposureReport {
-    readonly file: string;
-    readonly envKeyNames: readonly string[];
-    readonly hookEventNames: readonly string[];
-    readonly hookCommandCount: number;
+/** Raised by `addProvider` when a provider with the given name already has a file. */
+declare class ProviderAlreadyExistsError extends CliError {
+    readonly providerName: string;
+    constructor(providerName: string);
 }
-/** The provider the cascade selects for this directory, as the wiring layer loaded it: its definition, or why it could not be used (no such provider, an invalid or old-format file). */
-type CheckProviderInput = {
-    readonly name: string;
-    readonly definition: Provider;
-    readonly problem?: never;
-} | {
-    readonly name: string;
-    readonly definition?: never;
-    readonly problem: string;
-};
 /**
- * Which credential a launch here would use, by source kind and target only: a selected provider's credential block always wins; otherwise the identity's own credential block; otherwise the login stored in the identity's directory.
+ * Raised by `addProvider` when `name` fails the provider naming rule: the same rule `IdentitySchema` applies to identity names (start with a letter or number, then letters, numbers, dots, hyphens, underscores, and at signs). Keeping the two rules identical means a name that works for one works for the other, and neither vocabulary can ever produce a path segment that escapes `providers/` or `identities/`.
  */
-interface CredentialReport {
-    readonly applies: "provider" | "identity" | "stored-login";
-    readonly provider?: {
-        readonly name: string;
-        readonly credential?: CredentialSummary;
-        readonly problem?: string;
-        readonly cached?: CachedCredentialState;
-    };
-    readonly identity?: CredentialSummary;
-    /** What the identity's own credential cache holds, when its block caches and the cache could be read. */
-    readonly identityCached?: CachedCredentialState;
-}
-/** Inputs to `runCheck` — everything already loaded/injected, exactly like the resolver core and the launcher: nothing in this function touches a real filesystem, git repository, clock, or environment itself. */
-interface RunCheckParams {
-    readonly cwd: string;
-    readonly home: string;
-    readonly claudeHome: string;
-    readonly env: Readonly<Record<string, string | undefined>>;
-    readonly branch?: string;
-    readonly branchDetached?: boolean;
-    readonly nowMs: number;
-    /** Used only to build the fact manifest by reading the canonical `~/.claude` tree — `runCheck` never mutates the farm and never spawns anything. */
-    readonly farmFs: FarmFs;
-    readonly cascade: CascadeInput;
-    readonly classification: {
-        readonly defaults: CategoryClassification;
-        readonly overlay?: CategoryClassificationOverlay;
-    };
-    readonly identityName?: string;
-    readonly identitySource: IdentityDecisionSource;
-    /** The pool the launch selected and how it ranks right now, when it named a pool instead of an identity; `identityName` is then the member it would pick. */
-    readonly poolPick?: PoolPickReport;
-    readonly configProfileName?: string;
-    readonly configProfileSource: ConfigProfileDecisionSource;
-    /** The resolved identity's own `identity.json`, when one was found. */
-    readonly identity?: Identity;
-    /** Raw `settings.json`/`settings.local.json` contents, keyed by filename, undefined when a file does not exist. */
-    readonly settingsFiles: Readonly<Record<string, string | undefined>>;
-    /** Runs `security find-generic-password` for the Keychain diagnostic. Omit to skip that diagnostic entirely (e.g. off macOS, or when no identity/farm root is known). */
-    readonly run?: RunPort;
-    /** The identity's own farm root — `security`'s lookup account. Required alongside `run` for the Keychain diagnostic to run at all. */
-    readonly farmRoot?: string;
-    /** `process.platform` in real use; the Keychain diagnostic only ever runs when this is `"darwin"`. */
-    readonly platform: string;
-    /** The provider a launch here would route through (`launch.provider` in the cascade), when one is selected. */
-    readonly provider?: CheckProviderInput;
-    /** The Claude Code versions installed here, oldest first. Omit to leave the Claude Code version out of the report; with it, `check` says which version a launch here runs and whether a pin is installed. */
-    readonly installedClaudeVersions?: readonly string[];
-    /** Where cached credentials live. Omit to skip reporting a credential cache's age; with it, a block that caches reports whether it holds an entry, how old it is and whether it has expired, never the token. */
-    readonly credentialCache?: CredentialCacheEnv;
+declare class InvalidProviderNameError extends CliError {
+    readonly attemptedName: string;
+    constructor(attemptedName: string);
 }
-/** Everything `agent-shim check` reports about one directory/identity, without touching the farm or spawning anything. */
-interface CheckReport {
-    readonly identityName?: string;
-    readonly identitySource: IdentityDecisionSource;
-    readonly poolPick?: PoolPickReport;
-    readonly configProfileName?: string;
-    readonly configProfileSource: ConfigProfileDecisionSource;
-    readonly resolved: ResolvedState;
-    readonly decisionLines: readonly string[];
-    readonly projectEncodingAmbiguities: readonly EncodingAmbiguity[];
-    readonly ambientCredential: AmbientCredentialGuardResult;
-    readonly keychain?: KeychainLookupResult;
-    readonly settingsExposure: readonly SettingsExposureReport[];
-    readonly credential: CredentialReport;
-    /** The Claude Code version a launch here would run, when the installed versions were given. */
-    readonly claudeVersion?: ClaudeVersionReport;
+/** True when a provider file exists for `name`, regardless of whether it validates. */
+declare function providerExists(paths: LayoutPaths, name: string): boolean;
+/** What converting one old-format provider file involves: the old fields it uses, and the whole file rewritten in the current format. */
+interface LegacyProviderConversion {
+    readonly fields: readonly string[];
+    readonly replacement: Record<string, unknown>;
 }
-/** Which Claude Code version a launch would run: the pin and where it comes from, with whether it is installed, or the highest installed version when nothing pins one. */
-interface ClaudeVersionReport {
-    readonly pinned?: PinnedClaudeVersion & {
-        readonly installed: boolean;
-    };
-    readonly highestInstalled?: string;
-    readonly installed: readonly string[];
+/** Raised when a provider file is still in the format before the credential block, naming the old fields and giving the exact replacement. */
+declare class LegacyProviderFileError extends CliError {
+    readonly filePath: string;
+    readonly conversion: LegacyProviderConversion;
+    constructor(filePath: string, conversion: LegacyProviderConversion);
+}
+/** Reads and validates one provider definition, or undefined when it does not exist. */
+declare function readProvider(paths: LayoutPaths, name: string): Provider | undefined;
+/** One provider definition as reported by `listProviders`. */
+interface ProviderListEntry {
+    readonly name: string;
+    readonly provider: Provider;
+}
+/** Lists every provider under `providersDir` that has a valid `<name>.json`. A file that fails validation is skipped here; `provider list` is the place a broken definition gets surfaced, not a launch. */
+declare function listProviders(paths: LayoutPaths): readonly ProviderListEntry[];
+/** The credential targets a provider may use. */
+type ProviderCredentialTarget = (typeof PROVIDER_CREDENTIAL_TARGETS)[number];
+/** The kinds of provider. */
+type ProviderKind = (typeof PROVIDER_KINDS)[number];
+/** Where a provider sends its sessions, for display: an `http` provider's base URL, or the front door for a codex provider (whose address exists only at launch). */
+declare function describeProviderEndpoint(provider: Provider): string;
+/** Everything `addProvider` writes into a fresh provider file. `baseUrl` is required for an `http` provider and refused for a codex one; `codex` applies only to a codex provider. */
+interface AddProviderInput {
+    readonly kind?: ProviderKind;
+    readonly displayName: string;
+    readonly baseUrl?: string;
+    readonly sources: readonly CredentialSource[];
+    readonly target?: ProviderCredentialTarget;
+    readonly env?: Readonly<Record<string, string>>;
+    readonly codex?: CodexProviderConfig;
+}
+/** Raised when a provider option does not fit the provider's kind: a base URL for a codex provider, a missing one for an http provider, or codex settings for an http provider. */
+declare class ProviderKindMismatchError extends UsageError {
+    constructor(message: string);
 }
 /**
- * Resolves the full cascade for one directory/identity and reports everything `agent-shim check` documents: every entry's resolved state and which layer/condition decided it, any ambiguous `history/projects/` encoding in scope, and the three always-on diagnostics (ambient-credential exposure, macOS Keychain service name, settings-secrets exposure).
- *
- * Deliberately reuses the same cascade machinery a real launch uses — `resolveDecisions` and `buildEntryFacts` — rather than reimplementing any part of resolution. The one thing this function never does that a launch does is touch the farm or spawn anything: it only reads the canonical `~/.claude` tree to build the fact manifest resolution needs, and every other input (cascade, classification, settings file contents, the Keychain lookup) is handed in already loaded.
- */
-declare function runCheck(params: RunCheckParams): CheckReport;
-/** Renders a full `CheckReport` as plain text lines, in the order `agent-shim check` prints them. */
-declare function formatCheckReport(report: CheckReport): string[];
-/**
- * The `check --json` form of a report: every field the text form prints, as plain data (no `Map`s, no compiled matchers), so a script can read the same verdicts a person would.
+ * Creates a new provider definition. Throws `ProviderAlreadyExistsError` when a provider with this name already has a file, `InvalidProviderNameError` when `name` fails the naming rule, and `ConfigValidationError` when the assembled definition fails `ProviderSchema` (e.g. a `baseUrl` that is not a URL) rather than letting the underlying `ZodError` escape as an unhandled crash.
  */
-declare function checkReportToJson(report: CheckReport): Record<string, unknown>;
+declare function addProvider(paths: LayoutPaths, name: string, input: AddProviderInput): Provider;
 /**
- * Whether a report carries anything `check --strict` fails on: a resolver diagnostic of warning or error severity, an ambiguous `history/projects/` encoding, an ambient credential a launch would refuse, or a selected provider a launch could not use. Informational diagnostics and the settings-exposure advisory (names and counts only, for a person to review) never fail it.
+ * The fields `updateProvider` changes. `sources` replaces the whole ordered source list (a list is set, not patched, since its order is its meaning); `target` changes where the token goes and keeps the sources. `env` entries merge over the existing ones and `unsetEnv` keys are then deleted.
  */
-declare function checkReportHasWarnings(report: CheckReport): boolean;
-/** What `collectCheckReport` needs from its caller. */
-interface CollectCheckReportParams {
-    readonly paths: LayoutPaths;
-    /** The directory a launch would run in; resolved against the working directory by the caller. */
-    readonly cwd: string;
-    /** The identity to check, as `--identity` names it; absent means the identity a launch there would resolve. */
-    readonly identity?: string;
-    readonly env: NodeJS.ProcessEnv;
+interface UpdateProviderInput {
+    readonly displayName?: string;
+    readonly baseUrl?: string;
+    readonly sources?: readonly CredentialSource[];
+    readonly target?: ProviderCredentialTarget;
+    /** A new cache block, or false to remove it; undefined leaves the existing one. */
+    readonly cache?: CredentialCache | false;
+    readonly env?: Readonly<Record<string, string>>;
+    readonly unsetEnv?: readonly string[];
+    /** Merged over a codex provider's existing settings: a field given here replaces that field, and `models` entries merge per tier. */
+    readonly codex?: CodexProviderConfig;
 }
 /**
- * Resolves what a launch in `params.cwd` would share or hide, and why, against this machine: the edge adapter that reads the real filesystem, clock, git and keychain, resolves the identity, configuration profile and cascade exactly as a launch does, and hands the facts to the pure `runCheck`. Never touches the farm or spawns claude.
+ * Updates an existing provider definition in place. Throws `ProviderNotFoundError` when it does not exist, and `ConfigValidationError` when the updated definition fails `ProviderSchema`, leaving the file untouched.
  */
-declare function collectCheckReport(params: CollectCheckReportParams): CheckReport;
-
-declare const ClaudeShimStateSchema: z.ZodObject<{
-    targetPath: z.ZodString;
-    method: z.ZodEnum<{
-        hardlink: "hardlink";
-        copy: "copy";
-    }>;
-    installedAtMs: z.ZodNumber;
-}, z.core.$strict>;
-type ClaudeShimState = z.infer<typeof ClaudeShimStateSchema>;
-type PathShadowStatus = {
-    readonly status: "ok";
-} | {
-    readonly status: "not-on-path";
-} | {
-    readonly status: "shadowed";
-    readonly by: string;
-};
+declare function updateProvider(paths: LayoutPaths, name: string, input: UpdateProviderInput): Provider;
+/** Deletes a provider definition. Throws `ProviderNotFoundError` when it does not exist. */
+declare function removeProvider(paths: LayoutPaths, name: string): void;
 
-/** The result of a successful discovery. */
-interface DiscoveredClaudeBinary {
-    /** Full path to the discovered `claude` executable. */
-    path: string;
-    /** Which strategy found it. */
-    source: "versions-dir" | "path-fallback";
-    /** The version string, when discovered via the versions directory. */
-    version?: string;
-}
-/** What a launch asks binary discovery for: nothing (the highest installed version) or an exact version. */
-interface ClaudeBinaryRequest {
-    readonly version?: string;
+/** Raised when a command names a pool that is not defined in the global config. */
+declare class PoolNotFoundError extends CliError {
+    readonly poolName: string;
+    constructor(poolName: string);
 }
-/** Discovers the real `claude` binary to spawn, for the version a launch asked for. Injected into the launcher so it never reads the filesystem or PATH itself. */
-type ClaudeBinaryResolver = (request?: Readonly<ClaudeBinaryRequest>) => DiscoveredClaudeBinary;
+/** The pools defined in `~/.agent-shim/config.json`, by name. */
+declare function readPools(paths: LayoutPaths): Readonly<Record<string, Pool>>;
+/** The pool named `name`; throws `PoolNotFoundError` when none is defined. */
+declare function requirePool(paths: LayoutPaths, name: string): Pool;
+/** Defines a new pool. Throws `InvalidPoolNameError` for a name `PoolNameSchema` rejects and `PoolAlreadyExistsError` for one already defined. */
+declare function addPool(paths: LayoutPaths, name: string, identities: readonly string[]): Pool;
+/** Replaces an existing pool's members. Throws `PoolNotFoundError` when it is not defined. */
+declare function setPool(paths: LayoutPaths, name: string, identities: readonly string[]): Pool;
+/** Removes a pool. Throws `PoolNotFoundError` when it is not defined. Anything that selected it (an active-identity file, a directory rule) is left for `doctor` to report, as with a removed identity. */
+declare function removePool(paths: LayoutPaths, name: string): void;
 
-type DoctorSeverity = "pass" | "warn" | "fail";
-type DoctorSection = "ambient-credential" | "binary-discovery" | "claude-shim" | "path-resolution" | "legacy-name" | "config-profile" | "identity" | "pool" | "provider" | "keychain" | "directory-rules" | "global-config" | "categories-local" | "active-identity" | "headroom";
-/** One line of `agent-shim doctor`'s report. `subject` names the identity/profile/rule the finding is about, when the section has more than one of those. */
-interface DoctorFinding {
-    readonly section: DoctorSection;
-    readonly subject?: string;
-    readonly severity: DoctorSeverity;
-    readonly message: string;
-}
-/** The full result of `runDoctor`. `ok` is false iff any finding is a `fail` — a `warn` never fails the report on its own. */
-interface DoctorReport {
-    readonly findings: readonly DoctorFinding[];
-    readonly ok: boolean;
-}
-/** One identity's raw `identity.json`, unparsed — `runDoctor` does its own JSON.parse/schema validation so one malformed file never aborts the rest of the report. */
-interface DoctorIdentityInput {
-    readonly name: string;
-    readonly path: string;
-    readonly raw: string | undefined;
-    /** The identity's own farm root (`identitiesDir/<name>`) — the account name the Keychain lookup uses. */
-    readonly farmRoot: string;
-}
-/** One configuration profile's raw `<name>.json`, unparsed. */
-interface DoctorConfigProfileInput {
-    readonly name: string;
-    readonly path: string;
-    readonly raw: string | undefined;
-}
-/** One provider's raw `<name>.json`, unparsed. */
-interface DoctorProviderInput {
-    readonly name: string;
-    readonly path: string;
-    readonly raw: string | undefined;
+/** Raised by `removeDirectoryRule`, `updateDirectoryRule` and `rule show` when no rule matches the given path exactly. */
+declare class DirectoryRuleNotFoundError extends CliError {
+    readonly rulePath: string;
+    constructor(rulePath: string);
 }
-/** A single optional top-level file `runDoctor` validates against a schema when present — absent is a legitimate, unconfigured state, not a failure. */
-interface DoctorFileInput {
-    readonly path: string;
-    readonly raw: string | undefined;
+/** Raised by `addDirectoryRule` when neither `--config-profile` nor `--identity` is given, and by `updateDirectoryRule` when an update would leave a rule that sets nothing at all: a rule that pins and overrides nothing would do nothing. */
+declare class DirectoryRuleMissingTargetError extends CliError {
+    constructor();
 }
-/** The outcome of resolving the real Claude Code binary, pre-resolved by the wiring layer since `discoverClaudeBinary` is not itself a parse-shaped pure operation and already has its own dedicated test coverage. */
-type DoctorBinaryDiscovery = {
-    readonly ok: true;
-    readonly binary: DiscoveredClaudeBinary;
-} | {
-    readonly ok: false;
-    readonly message: string;
-};
-/**
- * Where a bare command name resolves for the two names this tool owns.
- *
- * `ownExecutablePath` is this process's own PATH-visible location (`realOwnExecutablePath()`); `agentShim` is `findPathShadow`'s verdict for a bare `agent-shim` against the directory that executable lives in. `claude` is only populated when a shim is actually enabled — without one, a `claude` on PATH is Claude Code's own binary, which is not a shadow of anything.
- */
-interface DoctorPathResolution {
-    readonly ownExecutablePath: string;
-    readonly agentShim: PathShadowStatus;
-    readonly claude?: PathShadowStatus;
+/** Raised by `addDirectoryRule` when a rule for the exact path already exists: `rule add` creates, `rule set` updates. */
+declare class DirectoryRuleAlreadyExistsError extends CliError {
+    readonly rulePath: string;
+    constructor(rulePath: string);
 }
-/** Everything `runDoctor` needs, all of it already loaded/injected — nothing in `runDoctor` itself reads a file, shells out, or touches the farm. */
-interface RunDoctorParams {
-    readonly env: Readonly<Record<string, string | undefined>>;
-    /** The Claude Code versions installed here, oldest first. Omit to skip checking that a pinned version (`launch.claudeVersion`) is installed; with it, a profile, directory rule or global config pinning a version that is not installed is a warning. */
-    readonly installedClaudeVersions?: readonly string[];
-    /** Where cached credentials live. Omit to leave a credential cache's age out of the identity and provider findings; with it, a block that caches reports whether it holds an entry, how old it is and whether it has expired, never the token. */
-    readonly credentialCache?: CredentialCacheEnv;
-    readonly identities: readonly DoctorIdentityInput[];
-    readonly configProfiles: readonly DoctorConfigProfileInput[];
-    readonly providers: readonly DoctorProviderInput[];
-    readonly directoryRules: DoctorFileInput;
-    readonly globalConfig: DoctorFileInput;
-    readonly categoriesLocal: DoctorFileInput;
-    readonly activeIdentity: DoctorFileInput;
-    readonly binaryDiscovery: DoctorBinaryDiscovery;
-    /** Whether `agent-shim shim enable` has been run, and whether its recorded target still exists on disk — pre-resolved by the wiring layer, since checking a file's existence is real I/O, not a parse-shaped pure operation. */
-    readonly claudeShim: {
-        readonly state: ClaudeShimState | undefined;
-        readonly targetExists: boolean;
-    };
-    /** Which executables a bare `agent-shim` (and, when the shim is enabled, a bare `claude`) would actually run — pre-resolved by the wiring layer, since scanning PATH is real I/O. */
-    readonly pathResolution: DoctorPathResolution;
-    /** The resolved state root (`paths.root`), whose directory name says whether this installation still lives under the former `.claude-use` name. */
-    readonly rootPath: string;
-    /** Runs `security find-generic-password` for the per-identity Keychain check. Omit to skip that check entirely (e.g. off macOS). */
-    readonly run?: RunPort;
-    /** `process.platform` in real use; the Keychain check only ever runs when this is `"darwin"`. */
-    readonly platform: string;
-    /** The headroom daemon's state.json plus a zombie-aware liveness predicate for the pids it names (a defunct daemon serves nothing but still answers signal 0). Omit the raw text when the daemon has never run; that is a pass, not a failure. */
-    readonly headroom: {
-        readonly state: DoctorFileInput;
-        readonly isRunning: (pid: number) => boolean;
-    };
+/** Reads `~/.agent-shim/directory-rules.json`, or an empty rule set when the file does not exist yet. */
+declare function readDirectoryRules(paths: LayoutPaths): DirectoryRules;
+/** Validates and writes the whole `~/.agent-shim/directory-rules.json` file. Exported so `src/configure.ts` can update a single rule's `categories`/`entries` in place without duplicating this validate-then-write step. Throws `ConfigValidationError` when `rules` fails `DirectoryRulesSchema`, rather than letting the underlying `ZodError` escape as an unhandled crash. */
+declare function writeDirectoryRules(paths: LayoutPaths, rules: DirectoryRules): void;
+/** Lists every directory rule, in file order. */
+declare function listDirectoryRules(paths: LayoutPaths): readonly DirectoryRule[];
+/** Inputs to `addDirectoryRule` beyond the path itself. */
+interface AddDirectoryRuleOptions {
+    readonly configProfile?: string;
+    readonly identity?: string;
 }
 /**
- * Audits the whole `~/.agent-shim` config graph for internal consistency: every identity, every configuration profile's own `extends` chain, every provider, `directory-rules.json`, `config.json`, `categories.local.json`, `active-identity`, plus real Claude Code binary discoverability and ambient-credential exposure.
- *
- * Deliberately identity/directory-agnostic, unlike `runCheck` — there is no single cascade to resolve `doctor` against, so it never touches settings-exposure (which only means anything relative to one resolved cascade).
- *
- * Every check aggregates rather than throws: a malformed file becomes one `fail` finding for that file, not an aborted report. This is the one place in the codebase that deliberately breaks the "throw a validation error and let it propagate" convention every other command relies on — `doctor`'s whole purpose is to survive a broken file and keep auditing everything else.
+ * Adds a new directory rule for `rulePath`. Throws `DirectoryRuleAlreadyExistsError` when a rule for that exact path already exists (`updateDirectoryRule` changes one), and `DirectoryRuleMissingTargetError` when neither `configProfile` nor `identity` is given, since a rule that pins neither would do nothing.
  */
-declare function runDoctor(params: RunDoctorParams): DoctorReport;
-/** Renders a full `DoctorReport` as plain text lines, one section header at a time, in the order `agent-shim doctor` prints them. */
-declare function formatDoctorReport(report: DoctorReport): string[];
-/** What `collectDoctorReport` needs from its caller. */
-interface CollectDoctorReportParams {
-    readonly paths: LayoutPaths;
-    readonly env: NodeJS.ProcessEnv;
+declare function addDirectoryRule(paths: LayoutPaths, rulePath: string, options: AddDirectoryRuleOptions): DirectoryRule;
+/** The fields `updateDirectoryRule` changes. A value of `false` removes that field from the rule. */
+interface UpdateDirectoryRuleOptions {
+    readonly configProfile?: string | false;
+    readonly identity?: string | false;
 }
 /**
- * Audits the whole state root against this machine: the edge adapter that enumerates every identity, configuration profile and provider on disk, reads every top-level config file as raw text (never pre-parsing, so one malformed file cannot abort the report), discovers the real Claude Code binary and resolves where a bare command name runs from, and hands the facts to the pure `runDoctor`.
+ * Updates the existing directory rule for `rulePath` in place, keeping its position in the file and every field not named. Throws `DirectoryRuleNotFoundError` when no rule matches that exact path, and `DirectoryRuleMissingTargetError` when the update would leave a rule that does nothing (remove it with `removeDirectoryRule` instead).
  */
-declare function collectDoctorReport(params: CollectDoctorReportParams): DoctorReport;
+declare function updateDirectoryRule(paths: LayoutPaths, rulePath: string, options: UpdateDirectoryRuleOptions): DirectoryRule;
+/** Removes the directory rule for `rulePath`. Throws `DirectoryRuleNotFoundError` when no rule matches that exact path. */
+declare function removeDirectoryRule(paths: LayoutPaths, rulePath: string): void;
 
 /** What a launch's one-off command-line/environment overrides resolve to: the `cliOverride` layer `src/resolve/walk.ts`'s `assembleCascade` composes last, so it beats every other layer. */
 interface CliOverride {
@@ -3986,5 +5540,5 @@ interface PrepareClaudeLaunchOptions {
  */
 declare function prepareClaudeLaunch(options: PrepareClaudeLaunchOptions): LaunchPlan;
 
-export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_REQUEST_PARSE_CAP_BYTES, RC_SELF_HOST_ENV, RC_SELF_HOST_KEEPALIVE_MS, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE, RC_SELF_HOST_RETENTION_MS, RC_SELF_HOST_SCOPE_LIST, RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, ROUTED_PATH_PREFIX, RcPermissionModeSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcInterruptPayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectPoolPick, createLeafCache, createProfile, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcSelfHostSurface, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, effectiveWindow, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcApiClient, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isRcPermissionMode, lateRcEventDial, lateRcStreamDial, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, matchBranch, mintLeaf, mintRcSelfHostCredential, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, rcSelfHostFromEnv, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readRcSelfHostRecord, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runLauncher, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, spawnClaude, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
-export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectLocalSurface, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcCredentialStore, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcSelfHostCredentialRecord, RcSelfHostDeps, RcSelfHostMintResult, RcSelfHostSurface, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunLauncherParams, RunSupervisorOptions, SpawnClaudeParams, SseParsedEvent, StickyPick, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation };
+export { AMBIENT_CREDENTIAL_VARS, CHECK_CREDENTIAL_APPLIES, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CheckReportJsonSchema, CheckRunInputSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, DoctorFindingSchema, DoctorRunOutputSchema, EXIT_FAILURE, EXIT_USAGE, EffectiveWindowSchema, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorSessionStatusSchema, FrontDoorSessionsOutputSchema, FrontDoorStartError, FrontDoorStateSchema, FrontDoorStatusOutputSchema, GlobalConfigSchema, HeadroomSocketTargetSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_REQUEST_PARSE_CAP_BYTES, RC_SELF_HOST_ENV, RC_SELF_HOST_KEEPALIVE_MS, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE, RC_SELF_HOST_RETENTION_MS, RC_SELF_HOST_SCOPE_LIST, RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, ROUTED_PATH_PREFIX, RcPermissionModeSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, UsageError, UsageListOutputSchema, UsageSnapshotError, UsageSnapshotSchema, UsageWindowsInputSchema, UsageWindowsOutputSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcInterruptPayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectFrontDoorStatus, collectPoolPick, createControlApiRouter, createDoorApiNodeHandler, createDoorApiRouter, createLeafCache, createProfile, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcSelfHostSurface, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, doorApiAuth, doorApiNodeHandlerOf, effectiveWindow, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, formatFrontDoorStatus, forwardableHeaders, frontDoorApiClient, frontDoorApiLink, frontDoorRcApiClient, frontDoorRcControl, generateCa, headroomSocketTarget, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isRcPermissionMode, lateRcEventDial, lateRcStreamDial, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, matchBranch, mintLeaf, mintRcSelfHostCredential, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, rcSelfHostFromEnv, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readRcSelfHostRecord, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runLauncher, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, spawnClaude, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
+export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CheckReportJson, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectLocalSurface, ConnectServerConfig, ConnectServerHandle, ConnectTarget, ControlApiClient, ControlApiDeps, ControlApiRouter, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, DoorApiClient, DoorApiContext, DoorApiDeps, DoorApiRouter, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSessionStatus, FrontDoorStatus, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcCredentialStore, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcSelfHostCredentialRecord, RcSelfHostDeps, RcSelfHostMintResult, RcSelfHostSurface, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunLauncherParams, RunSupervisorOptions, SpawnClaudeParams, SseParsedEvent, StickyPick, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation };