agent-shim 8.15.0 → 8.17.0

package/dist/index.mjs

@@ -253,6 +253,7 @@ var ProviderEnvSchema = z.record(z.string().min(1), z.string()).refine((env) =>
   message: `env may not set ${RESERVED_PROVIDER_ENV_KEYS.join(", ")}: the credential block's target sets one and agent-shim removes the others`
 });
 var CODEX_EFFORTS = ["none", "low", "medium", "high"];
+var CODEX_LOGINS = ["codex-cli", "chatgpt-sign-in"];
 var CODEX_DEFAULT_TIER_MODELS = Object.freeze({
   fable: "gpt-5.6-sol",
   opus: "gpt-5.6-sol",
@@ -270,7 +271,9 @@ var CodexProviderConfigSchema = z.strictObject({
     haiku: z.string().min(1).optional()
   }).optional(),
   /** The reasoning effort used when the request's own `output_config.effort` is not one the backend accepts. */
-  effort: z.enum(CODEX_EFFORTS).optional()
+  effort: z.enum(CODEX_EFFORTS).optional(),
+  /** Which login the upstream call is made with; see `CODEX_LOGINS`. */
+  login: z.enum(CODEX_LOGINS).optional()
 });
 var HttpProviderSchema = z.strictObject({
   $schema: z.string().optional(),
@@ -2759,8 +2762,11 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    pruneDeadFrontDoorSessions(fs12, paths.frontdoorSessionsDir, ports.isRunning);
-    if (listFrontDoorSessions(fs12, paths.frontdoorSessionsDir).length === 0) {
+    const listed = listFrontDoorSessions(fs12, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs12, paths.frontdoorSessionsDir, ports.isRunning);
+    ports.observeLaunchRegistry(listed, pruned);
+    const prunedPids = new Set(pruned);
+    if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
@@ -4982,7 +4988,7 @@ function frontDoorRcApiClient(port, ca, token) {
 }
 
 // src/frontdoor/controlApi.ts
-import { createORPCClient as createORPCClient2, ORPCError as ORPCError2 } from "@orpc/client";
+import { createORPCClient as createORPCClient2, ORPCError as ORPCError3 } from "@orpc/client";
 
 // src/checkReport.ts
 import os5 from "node:os";
@@ -5332,6 +5338,7 @@ function buildLayoutPaths(root) {
     frontdoorCaCertFile: path14.join(root, "frontdoor", "ca", "ca.pem"),
     frontdoorCaKeyFile: path14.join(root, "frontdoor", "ca", "ca.key"),
     frontdoorCaBundlesDir: path14.join(root, "frontdoor", "ca", "bundles"),
+    chatgptSignInFile: path14.join(root, "codex", "chatgpt-sign-in.json"),
     frontdoorStateFile: path14.join(root, "frontdoor", "state.json"),
     frontdoorLockFile: path14.join(root, "frontdoor", "start.lock"),
     frontdoorControlTokenFile: path14.join(root, "frontdoor", "control-token"),
@@ -6767,7 +6774,7 @@ var ProviderKindMismatchError = class extends UsageError {
   }
 };
 function isEmptyCodexConfig(config) {
-  return config === void 0 || config.defaultModel === void 0 && config.effort === void 0 && (config.models === void 0 || Object.keys(config.models).length === 0);
+  return config === void 0 || config.defaultModel === void 0 && config.effort === void 0 && config.login === void 0 && (config.models === void 0 || Object.keys(config.models).length === 0);
 }
 function addProvider(paths, name, input) {
   if (providerExists(paths, name)) {
@@ -8435,7 +8442,7 @@ var CheckReportJsonSchema = z14.strictObject({
 
 // src/frontdoor/controlSchemas.ts
 import path27 from "node:path";
-import { z as z16 } from "zod";
+import { z as z19 } from "zod";
 
 // src/claudeShim.ts
 import fs8 from "node:fs";
@@ -8639,6 +8646,85 @@ function removeIdentity(paths, name) {
 // src/doctorReport.ts
 import fs10 from "node:fs";
 import path26 from "node:path";
+
+// src/codex/siwcStore.ts
+import { z as z18 } from "zod";
+
+// src/codex/auth.ts
+import { z as z16 } from "zod";
+var AuthFileSchema = z16.looseObject({
+  tokens: z16.looseObject({
+    access_token: z16.string().optional(),
+    refresh_token: z16.string().optional(),
+    id_token: z16.string().optional(),
+    account_id: z16.string().optional()
+  }).nullish(),
+  last_refresh: z16.string().optional()
+});
+var TokenGrantSchema = z16.looseObject({
+  access_token: z16.string().min(1).optional(),
+  refresh_token: z16.string().min(1).optional(),
+  id_token: z16.string().min(1).optional(),
+  account_id: z16.string().min(1).optional()
+});
+var CodexAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodexAuthError";
+  }
+};
+
+// src/codex/siwc.ts
+import { z as z17 } from "zod";
+var SIWC_RESOURCE = "https://api.openai.com/v1";
+var SIWC_RESPONSES_URL = `${SIWC_RESOURCE}/responses`;
+var SIWC_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var TokenResponseSchema = z17.looseObject({
+  access_token: z17.string().min(1),
+  refresh_token: z17.string().min(1).optional(),
+  id_token: z17.string().min(1).optional(),
+  expires_in: z17.number().positive(),
+  scope: z17.string().optional()
+});
+var JwtHeaderSchema = z17.looseObject({ alg: z17.string(), kid: z17.string().optional() });
+var IdTokenClaimsSchema = z17.looseObject({
+  iss: z17.string(),
+  sub: z17.string().min(1),
+  aud: z17.union([z17.string(), z17.array(z17.string())]),
+  exp: z17.number(),
+  nonce: z17.string().optional(),
+  email: z17.string().optional()
+});
+var JwksSchema = z17.object({ keys: z17.array(z17.looseObject({ kid: z17.string().optional(), kty: z17.string() })) });
+
+// src/codex/siwcStore.ts
+var SiwcGrantSchema = z18.strictObject({
+  clientId: z18.string().min(1),
+  sub: z18.string().min(1),
+  email: z18.string().optional(),
+  idToken: z18.string().min(1),
+  accessToken: z18.string().min(1),
+  refreshToken: z18.string().min(1),
+  scopes: z18.array(z18.string()).readonly(),
+  /** When the access token stops working, in milliseconds since the epoch. */
+  expiresAt: z18.number()
+});
+var SiwcFileSchema = z18.strictObject({ registeredClientId: z18.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
+function parseSiwcFile(raw, filePath) {
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    throw new CodexAuthError(`${filePath} is not valid JSON: run \`agent-shim codex login\` again`);
+  }
+  const parsed = SiwcFileSchema.safeParse(json);
+  if (!parsed.success) {
+    throw new CodexAuthError(`${filePath} is not a Sign in with ChatGPT file: run \`agent-shim codex login\` again`);
+  }
+  return parsed.data;
+}
+
+// src/doctorReport.ts
 var DOCTOR_SEVERITIES = ["pass", "warn", "fail"];
 var DOCTOR_SECTIONS = [
   "ambient-credential",
@@ -8729,7 +8815,21 @@ function cacheClause(cacheEnv, owner, block) {
   const state = describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block.cache, nowMs: cacheEnv.now() });
   return { text: `; ${formatCachedCredentialState(state)}`, unreadable: state.status === "unreadable" };
 }
-function pushProvider(push, entry, cacheEnv) {
+function signInProblem(signIn) {
+  if (signIn.raw === void 0) {
+    return "nobody is signed in: run `agent-shim codex login`.";
+  }
+  try {
+    const grant = parseSiwcFile(signIn.raw, signIn.path).grant;
+    if (grant === void 0) {
+      return "nobody is signed in: run `agent-shim codex login`.";
+    }
+    return grant.scopes.includes(SIWC_PLAN_SCOPE) ? void 0 : "the login was not given permission to use your ChatGPT plan: run `agent-shim codex login` again and allow it.";
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+function pushProvider(push, entry, cacheEnv, signIn) {
   if (entry.raw === void 0) {
     push("provider", "fail", `${entry.path} is missing.`, entry.name);
     return;
@@ -8756,6 +8856,12 @@ function pushProvider(push, entry, cacheEnv) {
   if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
     push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
   }
+  if (signIn !== void 0 && isCodexProvider(validated2.data) && validated2.data.codex?.login === "chatgpt-sign-in") {
+    const problem = signInProblem(signIn);
+    if (problem !== void 0) {
+      push("provider", "warn", `${entry.name} uses the Sign in with ChatGPT login, but ${problem}`, entry.name);
+    }
+  }
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
@@ -8880,7 +8986,7 @@ function runDoctor(params) {
     return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
   };
   for (const entry of params.providers) {
-    pushProvider(push, entry, params.credentialCache);
+    pushProvider(push, entry, params.credentialCache, params.chatgptSignIn);
   }
   if (params.platform !== "darwin" || params.run === void 0) {
     push("keychain", "pass", "Skipped (not macOS).");
@@ -9122,6 +9228,7 @@ function collectDoctorReport(params) {
   const report = runDoctor({
     env: params.env,
     credentialCache: realCredentialCacheEnv(paths),
+    chatgptSignIn: { path: paths.chatgptSignInFile, raw: realFsPort.readFileUtf8(paths.chatgptSignInFile) },
     installedClaudeVersions: realInstalledClaudeVersions(),
     identities,
     configProfiles,
@@ -9158,60 +9265,121 @@ function collectDoctorReport(params) {
 }
 
 // src/frontdoor/controlSchemas.ts
-var UsageListOutputSchema = z16.strictObject({ snapshots: z16.readonly(z16.array(UsageSnapshotSchema)) });
-var UsageWindowsInputSchema = z16.strictObject({
-  identity: z16.string().min(1),
-  provider: z16.string().min(1).optional()
+var UsageListOutputSchema = z19.strictObject({ snapshots: z19.readonly(z19.array(UsageSnapshotSchema)) });
+var UsageWindowsInputSchema = z19.strictObject({
+  identity: z19.string().min(1),
+  provider: z19.string().min(1).optional()
 });
-var EffectiveWindowSchema = z16.strictObject({
+var EffectiveWindowSchema = z19.strictObject({
   /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
-  reset: z16.boolean(),
+  reset: z19.boolean(),
   /** The fraction used: 0 for a reset window, otherwise what was last observed, absent when none was reported. */
-  utilization: z16.number().optional(),
+  utilization: z19.number().optional(),
   /** The reset instant, for a window that has not reset yet and reported one. */
-  resetsAtMs: z16.number().optional(),
+  resetsAtMs: z19.number().optional(),
   /** The window's own status, for a window that has not reset yet. */
-  status: z16.string().optional()
+  status: z19.string().optional()
 });
-var UsageWindowsOutputSchema = z16.strictObject({
-  identity: z16.string(),
-  provider: z16.string(),
+var UsageWindowsOutputSchema = z19.strictObject({
+  identity: z19.string(),
+  provider: z19.string(),
   /** When the rate-limit state the windows come from was observed. */
-  observedAt: z16.iso.datetime().optional(),
+  observedAt: z19.iso.datetime().optional(),
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
-var FrontDoorSessionStatusSchema = z16.strictObject({
-  pid: z16.int().positive(),
-  startedAt: z16.number(),
-  alive: z16.boolean()
+var FrontDoorSessionStatusSchema = z19.strictObject({
+  pid: z19.int().positive(),
+  startedAt: z19.number(),
+  alive: z19.boolean()
 });
-var HeadroomSocketTargetSchema = z16.union([z16.strictObject({ socketPath: z16.string() }), z16.strictObject({ refused: z16.string() })]);
-var FrontDoorStatusOutputSchema = z16.strictObject({
+var HeadroomSocketTargetSchema = z19.union([z19.strictObject({ socketPath: z19.string() }), z19.strictObject({ refused: z19.string() })]);
+var FrontDoorStatusOutputSchema = z19.strictObject({
   state: FrontDoorStateSchema,
-  supervisorAlive: z16.boolean(),
-  sessions: z16.readonly(z16.array(FrontDoorSessionStatusSchema)),
+  supervisorAlive: z19.boolean(),
+  sessions: z19.readonly(z19.array(FrontDoorSessionStatusSchema)),
   headroomSocket: HeadroomSocketTargetSchema.optional(),
-  logPath: z16.string(),
-  logExists: z16.boolean()
+  logPath: z19.string(),
+  logExists: z19.boolean()
 });
-var FrontDoorSessionsOutputSchema = z16.strictObject({ sessions: z16.readonly(z16.array(FrontDoorSessionStatusSchema)) });
-var CheckRunInputSchema = z16.strictObject({
-  path: z16.string().min(1),
-  identity: z16.string().min(1).optional()
+var FrontDoorSessionsOutputSchema = z19.strictObject({ sessions: z19.readonly(z19.array(FrontDoorSessionStatusSchema)) });
+var CheckRunInputSchema = z19.strictObject({
+  path: z19.string().min(1),
+  identity: z19.string().min(1).optional()
 }).refine((input) => path27.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var DoctorFindingSchema = z16.strictObject({
-  section: z16.enum(DOCTOR_SECTIONS),
-  subject: z16.string().optional(),
-  severity: z16.enum(DOCTOR_SEVERITIES),
-  message: z16.string()
+var DoctorFindingSchema = z19.strictObject({
+  section: z19.enum(DOCTOR_SECTIONS),
+  subject: z19.string().optional(),
+  severity: z19.enum(DOCTOR_SEVERITIES),
+  message: z19.string()
 });
-var DoctorRunOutputSchema = z16.strictObject({
+var DoctorRunOutputSchema = z19.strictObject({
   /** False exactly when any finding is a `fail`; a `warn` never fails the report on its own. */
-  ok: z16.boolean(),
-  findings: z16.readonly(z16.array(DoctorFindingSchema))
+  ok: z19.boolean(),
+  findings: z19.readonly(z19.array(DoctorFindingSchema))
+});
+
+// src/frontdoor/eventsApi.ts
+import { ORPCError as ORPCError2 } from "@orpc/client";
+import { eventIterator as eventIterator2, withEventMeta as withEventMeta2 } from "@orpc/server";
+
+// src/frontdoor/eventSchemas.ts
+import { z as z20 } from "zod";
+var DOOR_EVENT_SOURCE_RC = "rc";
+var LAUNCH_EVENT_SOURCE = "launch";
+var DoorEventSchema = z20.strictObject({
+  source: z20.string().min(1),
+  /** A positive integer because the backbone's counters start at one and only ever increase. */
+  sequence: z20.number().int().positive(),
+  payload: z20.unknown()
+});
+var DoorEventSourceQuerySchema = z20.strictObject({
+  sources: z20.array(z20.string().min(1)).min(1).optional()
+});
+var LaunchLifecycleEventSchema = z20.strictObject({
+  kind: z20.enum(["registered", "pruned", "ended"]),
+  pid: z20.number().int().positive(),
+  startedAt: z20.number(),
+  observedAt: z20.number()
 });
 
+// src/frontdoor/eventsApi.ts
+function createEventsApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    events: {
+      subscribe: authed.input(DoorEventSourceQuerySchema).output(eventIterator2(DoorEventSchema)).handler(async function* ({ input, signal }) {
+        if (input.sources !== void 0) {
+          const live = deps.events.sources();
+          const unknown = input.sources.filter((source) => !live.includes(source));
+          if (unknown.length > 0) {
+            throw new ORPCError2("NOT_FOUND", { message: `the door publishes no event source named ${unknown.map((source) => `"${source}"`).join(", ")}; the live sources are ${live.map((source) => `"${source}"`).join(", ")}` });
+          }
+        }
+        const stream = deps.events.stream(input.sources);
+        const ended = new Promise((resolve) => {
+          signal?.addEventListener("abort", () => {
+            resolve();
+          }, { once: true });
+        });
+        try {
+          for (; ; ) {
+            signal?.throwIfAborted();
+            const next = await Promise.race([stream.next(), ended.then(() => ({ value: void 0, done: true }))]);
+            if (next.done === true) {
+              signal?.throwIfAborted();
+              return;
+            }
+            yield withEventMeta2(next.value, { id: String(next.value.sequence) });
+          }
+        } finally {
+          stream.close();
+        }
+      })
+    }
+  };
+}
+
 // src/frontdoor/controlApi.ts
 function createControlApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
@@ -9221,7 +9389,7 @@ function createControlApiRouter(deps) {
       effectiveWindow: authed.input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
         const snapshot = deps.usageSnapshotOf(input.identity);
         if (snapshot === void 0) {
-          throw new ORPCError2("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
+          throw new ORPCError3("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
         }
         const provider = input.provider ?? ANTHROPIC_PROVIDER;
         const rateLimit = snapshot.providers[provider]?.rateLimit;
@@ -9250,7 +9418,7 @@ function createControlApiRouter(deps) {
   };
 }
 function createDoorApiRouter(deps) {
-  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps) };
+  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps), ...createEventsApiRouter(deps) };
 }
 function createDoorApiNodeHandler(deps) {
   return doorApiNodeHandlerOf(createDoorApiRouter(deps));
@@ -9312,6 +9480,148 @@ function formatFrontDoorStatus(status, caCertPath) {
   return lines;
 }
 
+// src/frontdoor/eventHub.ts
+var DOOR_EVENT_BUFFER_EVENTS = 100;
+function createDoorEventHub() {
+  const sequences = /* @__PURE__ */ new Map();
+  const registered = /* @__PURE__ */ new Set();
+  const every = /* @__PURE__ */ new Set();
+  const bySource = /* @__PURE__ */ new Map();
+  const deliver = (event) => {
+    for (const listener of every) {
+      listener(event);
+    }
+    for (const listener of bySource.get(event.source) ?? []) {
+      listener(event);
+    }
+  };
+  const publish = (source, payload) => {
+    const sequence2 = (sequences.get(source) ?? 0) + 1;
+    sequences.set(source, sequence2);
+    deliver({ source, sequence: sequence2, payload });
+  };
+  const addListener = (sources, listener) => {
+    if (sources === void 0) {
+      every.add(listener);
+      return () => {
+        every.delete(listener);
+      };
+    }
+    const listenersFor = (source) => {
+      const listeners = bySource.get(source) ?? /* @__PURE__ */ new Set();
+      bySource.set(source, listeners);
+      return listeners;
+    };
+    const detachers = sources.map((source) => {
+      const listeners = listenersFor(source);
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+        if (listeners.size === 0) {
+          bySource.delete(source);
+        }
+      };
+    });
+    return () => {
+      for (const detach of detachers) {
+        detach();
+      }
+    };
+  };
+  return {
+    publisher: (source) => {
+      registered.add(source);
+      return {
+        source,
+        publish: (payload) => {
+          publish(source, payload);
+        }
+      };
+    },
+    subscribe: addListener,
+    stream: (sources) => {
+      const queue = [];
+      let wake;
+      let closed = false;
+      const detach = addListener(sources, (event) => {
+        if (queue.length >= DOOR_EVENT_BUFFER_EVENTS) {
+          queue.shift();
+        }
+        queue.push(event);
+        wake?.();
+      });
+      return {
+        next: async () => {
+          for (; ; ) {
+            const event = queue.shift();
+            if (event !== void 0) {
+              return { value: event, done: false };
+            }
+            if (closed) {
+              return { value: void 0, done: true };
+            }
+            await new Promise((resolve) => {
+              wake = resolve;
+            });
+          }
+        },
+        close: () => {
+          closed = true;
+          detach();
+          wake?.();
+        }
+      };
+    },
+    sources: () => [...registered].sort()
+  };
+}
+function rcFanoutOnDoorHub(fanout, hub) {
+  const publisher = hub.publisher(DOOR_EVENT_SOURCE_RC);
+  return {
+    publish: (event) => {
+      fanout.publish(event);
+      publisher.publish(event);
+    },
+    subscribe: (session, listener) => fanout.subscribe(session, listener)
+  };
+}
+
+// src/frontdoor/launchEvents.ts
+function createLaunchEventPublisher(hub, now) {
+  const publisher = hub.publisher(LAUNCH_EVENT_SOURCE);
+  let known;
+  return {
+    observe: (sessions, pruned) => {
+      const previous = known;
+      const listed = new Map(sessions.map((session) => [session.pid, session]));
+      const prunedSet = new Set(pruned);
+      known = new Map([...listed].filter(([pid]) => !prunedSet.has(pid)));
+      if (previous === void 0) {
+        return;
+      }
+      const emit = (kind, pid, startedAt) => {
+        publisher.publish({ kind, pid, startedAt, observedAt: now() });
+      };
+      for (const pid of pruned) {
+        const session = listed.get(pid);
+        if (session !== void 0) {
+          emit("pruned", pid, session.startedAt);
+        }
+      }
+      for (const [pid, session] of previous) {
+        if (!listed.has(pid) && !prunedSet.has(pid)) {
+          emit("ended", pid, session.startedAt);
+        }
+      }
+      for (const [pid, session] of listed) {
+        if (!previous.has(pid) && !prunedSet.has(pid)) {
+          emit("registered", pid, session.startedAt);
+        }
+      }
+    }
+  };
+}
+
 // src/frontdoor/rcStream.ts
 var RC_STREAM_EVENT_NAME = "client_event";
 var SSE_BYTE_ORDER_MARK = 65279;
@@ -11397,6 +11707,8 @@ export {
   CredentialCacheSchema,
   CredentialSchema,
   CredentialSourceSchema,
+  DOOR_EVENT_BUFFER_EVENTS,
+  DOOR_EVENT_SOURCE_RC,
   DirectoryRuleAlreadyExistsError,
   DirectoryRuleMissingTargetError,
   DirectoryRuleNotFoundError,
@@ -11404,6 +11716,8 @@ export {
   DirectoryRulesSchema,
   DoctorFindingSchema,
   DoctorRunOutputSchema,
+  DoorEventSchema,
+  DoorEventSourceQuerySchema,
   EXIT_FAILURE,
   EXIT_USAGE,
   EffectiveWindowSchema,
@@ -11423,6 +11737,8 @@ export {
   InvalidCategoryNameError,
   InvalidIdentityNameError,
   InvalidProviderNameError,
+  LAUNCH_EVENT_SOURCE,
+  LaunchLifecycleEventSchema,
   LaunchRefusedError,
   LegacyProviderFileError,
   PROMPT_CACHE_TTL_MS,
@@ -11486,6 +11802,9 @@ export {
   createControlApiRouter,
   createDoorApiNodeHandler,
   createDoorApiRouter,
+  createDoorEventHub,
+  createEventsApiRouter,
+  createLaunchEventPublisher,
   createLeafCache,
   createProfile,
   createRcApiNodeHandler,
@@ -11544,6 +11863,7 @@ export {
   providerExists,
   rankPool,
   rcEventWriteResultFromAnswer,
+  rcFanoutOnDoorHub,
   rcObserverAsPassthrough,
   rcSelfHostFromEnv,
   readActiveIdentity,