agent-shim 8.30.0 → 8.32.0

package/dist/index.mjs

@@ -2729,6 +2729,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   try {
     http3 = await ports.startProviderListener(lastPort);
   } catch (error) {
+    ports.doorHealth.listenerFailed("provider", error instanceof Error ? error.message : String(error));
     return fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousSticky !== void 0 && http3.port !== previousSticky) {
@@ -2741,6 +2742,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     connect3 = await ports.startConnectListener(lastConnectPort);
   } catch (error) {
     await http3.close();
+    ports.doorHealth.listenerFailed("connect", error instanceof Error ? error.message : String(error));
     return fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
@@ -2754,6 +2756,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   } catch (error) {
     await connect3.close();
     await http3.close();
+    ports.doorHealth.listenerFailed("direct", error instanceof Error ? error.message : String(error));
     return fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
@@ -2761,6 +2764,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   }
   lastDirectPort = direct.port;
   writeFrontDoorState(fs12, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http3.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  ports.doorHealth.generation({ providerPort: http3.port, connectPort: connect3.port, directPort: direct.port });
   fs12.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http3.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
@@ -2773,11 +2777,13 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     const listed = listFrontDoorSessions(fs12, paths.frontdoorSessionsDir);
     const pruned = pruneDeadFrontDoorSessions(fs12, paths.frontdoorSessionsDir, ports.isRunning);
     ports.observeLaunchRegistry(listed, pruned);
+    ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
     if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
+        ports.doorHealth.idleShutdown();
         await direct.close();
         await connect3.close();
         await http3.close();
@@ -5037,7 +5043,7 @@ import { Agent as Agent3, fetch as undiciFetch } from "undici";
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.30.0",
+  version: "8.32.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6219,10 +6225,10 @@ function windowBlockedUntil(windows) {
   const resets = windows.flatMap((window) => window.status === "rejected" && window.resetsAtMs !== void 0 ? [window.resetsAtMs] : []);
   return resets.length === 0 ? void 0 : Math.max(...resets);
 }
-function fiveHourBurn(records) {
+function windowBurn(records, which) {
   const points = [];
   for (const record of records) {
-    const window = record.rateLimitHeaders === void 0 ? void 0 : parseUnifiedRateLimit(record.rateLimitHeaders)?.fiveHour;
+    const window = record.rateLimitHeaders === void 0 ? void 0 : parseUnifiedRateLimit(record.rateLimitHeaders)?.[which];
     if (window?.utilization !== void 0 && window.resetsAt !== void 0) {
       points.push({ resetsAt: window.resetsAt, point: { atMs: Date.parse(record.at), utilization: window.utilization } });
     }
@@ -6316,11 +6322,16 @@ function assessIdentity(member, nowMs) {
   const score = remaining * plan.capacity / (untilResetMs / MS_PER_HOUR);
   const fiveRemaining = five?.utilization === void 0 ? void 0 : Math.max(0, 1 - five.utilization);
   const fiveUntil = five?.resetsAtMs === void 0 ? FIVE_HOUR_WINDOW_MS : Math.max(five.resetsAtMs - nowMs, MS_PER_SECOND4);
-  const burn = fiveHourBurn(member.records);
+  const burn = windowBurn(member.records, "fiveHour");
+  const sevenRemaining = seven?.utilization === void 0 ? void 0 : Math.max(0, 1 - seven.utilization);
+  const sevenUntil = seven?.resetsAtMs === void 0 ? SEVEN_DAY_WINDOW_MS : Math.max(seven.resetsAtMs - nowMs, MS_PER_SECOND4);
+  const sevenDayBurn = windowBurn(member.records, "sevenDay");
   return {
     candidate: { ...base, class: "scored", score, reasons: [...windowReasons.map((reason, index) => index === windowReasons.length - 1 ? `${reason}${observedAgo}` : reason), ...planReasons] },
     ...fiveRemaining === void 0 ? {} : { fiveHour: { remaining: fiveRemaining, untilResetMs: fiveUntil } },
-    ...burn === void 0 ? {} : { burn }
+    ...burn === void 0 ? {} : { burn },
+    ...sevenRemaining === void 0 ? {} : { sevenDay: { remaining: sevenRemaining, untilResetMs: sevenUntil } },
+    ...sevenDayBurn === void 0 ? {} : { sevenDayBurn }
   };
 }
 function rankPool(input) {
@@ -6331,14 +6342,27 @@ function rankPool(input) {
   const candidates = assessments.map((assessment) => {
     const { candidate, fiveHour, burn } = assessment;
     const pace = burn ?? (sharedDemand === void 0 ? void 0 : sharedDemand / capacityOf(candidate.plan));
-    if (candidate.class !== "scored" || fiveHour === void 0 || pace === void 0) {
+    const { sevenDay, sevenDayBurn } = assessment;
+    if (candidate.class !== "scored") {
       return { ...candidate, feasible: true };
     }
-    const runsDryInMs = fiveHour.remaining / pace;
-    if (runsDryInMs >= fiveHour.untilResetMs) {
+    const drySpots = [];
+    if (fiveHour !== void 0 && pace !== void 0) {
+      const runsDryInMs = fiveHour.remaining / pace;
+      if (runsDryInMs < fiveHour.untilResetMs) {
+        drySpots.push(`5h window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(fiveHour.untilResetMs)}`);
+      }
+    }
+    if (sevenDay !== void 0 && sevenDayBurn !== void 0) {
+      const runsDryInMs = sevenDay.remaining / sevenDayBurn;
+      if (runsDryInMs < sevenDay.untilResetMs) {
+        drySpots.push(`7d window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(sevenDay.untilResetMs)}`);
+      }
+    }
+    if (drySpots.length === 0) {
       return { ...candidate, feasible: true };
     }
-    return { ...candidate, feasible: false, reasons: [`5h window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(fiveHour.untilResetMs)}`, ...candidate.reasons] };
+    return { ...candidate, feasible: false, reasons: [...drySpots, ...candidate.reasons] };
   });
   const ordered = input.preference === "listed" ? [...candidates] : [...candidates].sort(
     (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(right.feasible) - Number(left.feasible) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
@@ -6346,7 +6370,8 @@ function rankPool(input) {
   const sticky = input.sticky;
   const stickyIndex = sticky === void 0 ? -1 : ordered.findIndex((candidate) => candidate.identity === sticky.identity);
   const stickyCandidate = ordered[stickyIndex];
-  if (sticky !== void 0 && stickyCandidate?.class === "scored" && stickyCandidate.feasible) {
+  const keepSticky = stickyCandidate?.class === "scored" && stickyCandidate.feasible;
+  if (sticky !== void 0 && keepSticky) {
     const ageMs = nowMs - Date.parse(sticky.at);
     const warm = ageMs <= PROMPT_CACHE_TTL_MS;
     if (input.resuming || warm) {
@@ -6355,12 +6380,14 @@ function rankPool(input) {
       ordered.unshift({ ...stickyCandidate, reasons: [why, ...stickyCandidate.reasons] });
     }
   }
+  const movedOff = sticky !== void 0 && input.resuming && !keepSticky ? { identity: sticky.identity, reason: stickyCandidate?.reasons[0] ?? "no longer among the pool's members" } : void 0;
   const pick = ordered.find((candidate) => candidate.class !== "ineligible");
   const returns = ordered.flatMap((candidate) => candidate.blockedUntilMs === void 0 ? [] : [{ identity: candidate.identity, atMs: candidate.blockedUntilMs }]);
   const earliestReturn = returns.length === 0 ? void 0 : returns.reduce((soonest, entry) => entry.atMs < soonest.atMs ? entry : soonest);
   return {
     candidates: ordered,
-    ...pick === void 0 ? { ...earliestReturn === void 0 ? {} : { earliestReturn } } : { pick }
+    ...pick === void 0 ? { ...earliestReturn === void 0 ? {} : { earliestReturn } } : { pick },
+    ...movedOff === void 0 || pick === void 0 ? {} : { movedOff }
   };
 }
 
@@ -6618,6 +6645,7 @@ function collectPoolPick(params) {
     candidates: ranking.candidates.map(candidateView),
     missing: missing.map(({ identity }) => identity),
     ...ranking.earliestReturn === void 0 ? {} : { earliestReturn: { identity: ranking.earliestReturn.identity, at: new Date(ranking.earliestReturn.atMs).toISOString() } },
+    ...ranking.movedOff === void 0 ? {} : { movedOff: ranking.movedOff },
     ...sticky.problem === void 0 ? {} : { stickyProblem: sticky.problem }
   };
 }
@@ -8889,6 +8917,8 @@ var PoolPickReportSchema = z13.strictObject({
   missing: z13.array(z13.string()),
   /** When nothing can be picked, the soonest any member returns. */
   earliestReturn: z13.strictObject({ identity: z13.string(), at: z13.iso.datetime() }).optional(),
+  /** The member a resumed conversation started on but moved off, and why, when the ranking could not keep it. */
+  movedOff: z13.strictObject({ identity: z13.string(), reason: z13.string() }).optional(),
   /** Why the last-pick record could not be read, when that is the case. */
   stickyProblem: z13.string().optional()
 });
@@ -9899,6 +9929,9 @@ import { eventIterator as eventIterator2, withEventMeta as withEventMeta2 } from
 import { z as z20 } from "zod";
 var DOOR_EVENT_SOURCE_RC = "rc";
 var LAUNCH_EVENT_SOURCE = "launch";
+var USAGE_EVENT_SOURCE = "usage";
+var DOOR_HEALTH_EVENT_SOURCE = "door";
+var QUOTA_EXPIRING_EVENT_SOURCE = "quota-expiring";
 var DoorEventSchema = z20.strictObject({
   source: z20.string().min(1),
   /** A positive integer because the backbone's counters start at one and only ever increase. */
@@ -9914,6 +9947,20 @@ var LaunchLifecycleEventSchema = z20.strictObject({
   startedAt: z20.number(),
   observedAt: z20.number()
 });
+var DoorHealthEventSchema = z20.discriminatedUnion("kind", [
+  z20.strictObject({ kind: z20.literal("generation"), pid: z20.number().int().positive(), providerPort: z20.number().int().positive(), connectPort: z20.number().int().positive(), directPort: z20.number().int().positive(), observedAt: z20.number() }),
+  z20.strictObject({ kind: z20.literal("listenerFailed"), pid: z20.number().int().positive(), listener: z20.enum(["provider", "connect", "direct"]), message: z20.string(), observedAt: z20.number() }),
+  z20.strictObject({ kind: z20.literal("idleShutdown"), pid: z20.number().int().positive(), observedAt: z20.number() })
+]);
+var QuotaExpiringEventSchema = z20.strictObject({
+  identity: z20.string().min(1),
+  provider: z20.string().min(1),
+  window: z20.enum(["fiveHour", "sevenDay"]),
+  /** The fraction of the window already used when it was seen expiring, always below one because a fully used window has nothing left to spend. */
+  utilization: z20.number().min(0).max(1),
+  resetsAt: z20.iso.datetime(),
+  observedAt: z20.number()
+});
 
 // src/frontdoor/eventsApi.ts
 var EVENTS_API_TAG = "events";
@@ -10222,6 +10269,81 @@ function createLaunchEventPublisher(hub, now) {
   };
 }
 
+// src/frontdoor/doorHealthEvents.ts
+function createDoorHealthPublisher(hub, now, pid) {
+  const publisher = hub.publisher(DOOR_HEALTH_EVENT_SOURCE);
+  return {
+    generation: (ports) => {
+      publisher.publish({ kind: "generation", pid, providerPort: ports.providerPort, connectPort: ports.connectPort, directPort: ports.directPort, observedAt: now() });
+    },
+    listenerFailed: (listener, message) => {
+      publisher.publish({ kind: "listenerFailed", pid, listener, message, observedAt: now() });
+    },
+    idleShutdown: () => {
+      publisher.publish({ kind: "idleShutdown", pid, observedAt: now() });
+    }
+  };
+}
+
+// src/frontdoor/quotaExpiringEvents.ts
+var MS_PER_HOUR2 = 36e5;
+var MS_PER_DAY2 = 864e5;
+var FIVE_HOUR_WINDOW_HOURS = 5;
+var SEVEN_DAY_WINDOW_DAYS = 7;
+var FIVE_HOUR_WINDOW_MS2 = FIVE_HOUR_WINDOW_HOURS * MS_PER_HOUR2;
+var SEVEN_DAY_WINDOW_MS2 = SEVEN_DAY_WINDOW_DAYS * MS_PER_DAY2;
+var FINAL_SPAN_DENOMINATOR = 30;
+var QUOTA_EXPIRING_WINDOW_FRACTION = 1 / FINAL_SPAN_DENOMINATOR;
+function createQuotaExpiringPublisher(hub, deps) {
+  const publisher = hub.publisher(QUOTA_EXPIRING_EVENT_SOURCE);
+  const latest = /* @__PURE__ */ new Map();
+  for (const snapshot of deps.seed) {
+    latest.set(snapshot.identity, snapshot);
+  }
+  hub.subscribe([USAGE_EVENT_SOURCE], (event) => {
+    const snapshot = UsageSnapshotSchema.parse(event.payload);
+    latest.set(snapshot.identity, snapshot);
+  });
+  const announced = /* @__PURE__ */ new Set();
+  const windowsOf = (snapshot) => {
+    const views = [];
+    for (const provider of Object.keys(snapshot.providers).sort()) {
+      const unified = snapshot.providers[provider]?.rateLimit?.unified;
+      const fiveHour = unified?.fiveHour;
+      if (fiveHour?.utilization !== void 0 && fiveHour.resetsAt !== void 0) {
+        views.push({ provider, view: { window: "fiveHour", spanMs: FIVE_HOUR_WINDOW_MS2, utilization: fiveHour.utilization, resetsAtMs: Date.parse(fiveHour.resetsAt) } });
+      }
+      const sevenDay = unified?.sevenDay;
+      if (sevenDay?.utilization !== void 0 && sevenDay.resetsAt !== void 0) {
+        views.push({ provider, view: { window: "sevenDay", spanMs: SEVEN_DAY_WINDOW_MS2, utilization: sevenDay.utilization, resetsAtMs: Date.parse(sevenDay.resetsAt) } });
+      }
+    }
+    return views;
+  };
+  return {
+    check: () => {
+      const now = deps.now();
+      for (const identity of [...latest.keys()].sort()) {
+        const snapshot = latest.get(identity);
+        if (snapshot === void 0) {
+          continue;
+        }
+        for (const { provider, view } of windowsOf(snapshot)) {
+          if (view.utilization >= 1 || view.resetsAtMs <= now || view.resetsAtMs - now >= view.spanMs * QUOTA_EXPIRING_WINDOW_FRACTION) {
+            continue;
+          }
+          const key = `${identity}:${provider}:${view.window}:${String(view.resetsAtMs)}`;
+          if (announced.has(key)) {
+            continue;
+          }
+          announced.add(key);
+          publisher.publish({ identity, provider, window: view.window, utilization: view.utilization, resetsAt: new Date(view.resetsAtMs).toISOString(), observedAt: now });
+        }
+      }
+    }
+  };
+}
+
 // src/frontdoor/rcLiveUsage.ts
 var RC_RATE_LIMIT_EVENT_TYPE = "rate_limit_event";
 function isRecord5(value) {
@@ -12543,10 +12665,11 @@ function resolvePoolLaunch(params) {
     if (graph.ranking.candidates.length === 0) {
       return { ok: false, message: `agent-shim: no member of pool "${poolName}" is an existing identity.` };
     }
-    const { pick, earliestReturn } = graph.ranking;
+    const { pick, earliestReturn, movedOff } = graph.ranking;
     if (pick !== void 0) {
       recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick.identity, nowMs);
-      return { ok: true, identity: pick.identity, explanation: `pool ${poolName}: ${pick.reasons.slice(0, REASONS_LOGGED).join("; ")}` };
+      const move = movedOff === void 0 ? "" : `moved off ${movedOff.identity} (${movedOff.reason}); `;
+      return { ok: true, identity: pick.identity, explanation: `pool ${poolName}: ${move}${pick.reasons.slice(0, REASONS_LOGGED).join("; ")}` };
     }
     if (earliestReturn === void 0) {
       return { ok: false, message: `agent-shim: no member of pool "${poolName}" can be picked.` };
@@ -13214,6 +13337,7 @@ export {
   CredentialSourceSchema,
   DOOR_EVENT_BUFFER_EVENTS,
   DOOR_EVENT_SOURCE_RC,
+  DOOR_HEALTH_EVENT_SOURCE,
   DirectoryRuleAlreadyExistsError,
   DirectoryRuleMissingTargetError,
   DirectoryRuleNotFoundError,
@@ -13223,6 +13347,7 @@ export {
   DoctorRunOutputSchema,
   DoorEventSchema,
   DoorEventSourceQuerySchema,
+  DoorHealthEventSchema,
   EXIT_FAILURE,
   EXIT_USAGE,
   EffectiveWindowSchema,
@@ -13259,6 +13384,8 @@ export {
   ProviderKindMismatchError,
   ProviderNotFoundError,
   ProviderSchema,
+  QUOTA_EXPIRING_EVENT_SOURCE,
+  QuotaExpiringEventSchema,
   RC_CONTEXT_USAGE_DETAILS,
   RC_IDLE_EXPIRY_MS,
   RC_ORPC_PATH_PREFIX,
@@ -13286,6 +13413,7 @@ export {
   RcRateLimitWindowSchema,
   RcStreamEnvelopeSchema,
   RcStreamEventSchema,
+  USAGE_EVENT_SOURCE,
   UsageError,
   UsageListOutputSchema,
   UsageLiveOutputSchema,
@@ -13331,10 +13459,12 @@ export {
   createDoorApiNodeHandler,
   createDoorApiRouter,
   createDoorEventHub,
+  createDoorHealthPublisher,
   createEventsApiRouter,
   createLaunchEventPublisher,
   createLeafCache,
   createProfile,
+  createQuotaExpiringPublisher,
   createRcApiNodeHandler,
   createRcApiRouter,
   createRcControlHandler,

package/dist/types/index.d.ts

@@ -2816,6 +2816,10 @@ declare const CheckReportJsonSchema: z.ZodObject<{
             identity: z.ZodString;
             at: z.ZodISODateTime;
         }, z.core.$strict>>;
+        movedOff: z.ZodOptional<z.ZodObject<{
+            identity: z.ZodString;
+            reason: z.ZodString;
+        }, z.core.$strict>>;
         stickyProblem: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     configProfile: z.ZodObject<{
@@ -3293,6 +3297,10 @@ declare const PoolPickReportSchema: z.ZodObject<{
         identity: z.ZodString;
         at: z.ZodISODateTime;
     }, z.core.$strict>>;
+    movedOff: z.ZodOptional<z.ZodObject<{
+        identity: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strict>>;
     stickyProblem: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 type PoolPickReport = z.infer<typeof PoolPickReportSchema>;
@@ -3760,6 +3768,12 @@ type UsageSnapshot = z.infer<typeof UsageSnapshotSchema>;
 declare const DOOR_EVENT_SOURCE_RC = "rc";
 /** The source tag every launch lifecycle event carries: the registry's own register, prune and end moments, the first publisher the door itself owns. */
 declare const LAUNCH_EVENT_SOURCE = "launch";
+/** The source tag every usage change event carries: one event per usage snapshot the door writes, the durable fact a quota consumer diffs or reads windows from. */
+declare const USAGE_EVENT_SOURCE = "usage";
+/** The source tag every door health event carries: the supervisor's own state transitions, the moments a consumer of the door needs to know the door itself changed. */
+declare const DOOR_HEALTH_EVENT_SOURCE = "door";
+/** The source tag every expiring-quota event carries: an identity whose unused window allowance is about to reset, computed from the same snapshots the usage source keeps fresh. */
+declare const QUOTA_EXPIRING_EVENT_SOURCE = "quota-expiring";
 /** One event on the door's backbone, exactly as the subscription yields it: the source that published it, the sequence the backbone assigned that source, and the publisher's own payload carried verbatim for the consumer to narrow. */
 declare const DoorEventSchema: z.ZodObject<{
     source: z.ZodString;
@@ -3789,6 +3803,54 @@ declare const LaunchLifecycleEventSchema: z.ZodObject<{
 }, z.core.$strict>;
 /** One launch lifecycle event, as the TypeScript the publisher emits and its consumers handle. */
 type LaunchLifecycleEvent = z.output<typeof LaunchLifecycleEventSchema>;
+/**
+ * One door health event: the supervisor's own state transitions, observed at the moment they happened in this process. `generation` is the door fully serving (every listener bound and the state file naming it); `listenerFailed` is a start failure that ends the generation, naming which listener and why; `idleShutdown` is the door closing itself with an empty session registry.
+ */
+declare const DoorHealthEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"generation">;
+    pid: z.ZodNumber;
+    providerPort: z.ZodNumber;
+    connectPort: z.ZodNumber;
+    directPort: z.ZodNumber;
+    observedAt: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"listenerFailed">;
+    pid: z.ZodNumber;
+    listener: z.ZodEnum<{
+        provider: "provider";
+        connect: "connect";
+        direct: "direct";
+    }>;
+    message: z.ZodString;
+    observedAt: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"idleShutdown">;
+    pid: z.ZodNumber;
+    observedAt: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+/** One door health event, as the TypeScript the publisher emits and its consumers handle. */
+type DoorHealthEvent = z.output<typeof DoorHealthEventSchema>;
+/**
+ * One expiring-quota event: an identity's window with allowance still unspent that is about to reset, published once when the window enters its final span (so a scheduler can spend what would otherwise be lost, the moment spending it is still possible). `resetsAt` is the window's own reset instant; `observedAt` is when the door's tick saw it cross.
+ */
+declare const QuotaExpiringEventSchema: z.ZodObject<{
+    identity: z.ZodString;
+    provider: z.ZodString;
+    window: z.ZodEnum<{
+        fiveHour: "fiveHour";
+        sevenDay: "sevenDay";
+    }>;
+    utilization: z.ZodNumber;
+    resetsAt: z.ZodISODateTime;
+    observedAt: z.ZodNumber;
+}, z.core.$strict>;
+/** One expiring-quota event, as the TypeScript the publisher emits and its consumers handle. */
+type QuotaExpiringEvent = z.output<typeof QuotaExpiringEventSchema>;
+/**
+ * The usage source's payload: the snapshot the door just wrote, verbatim, so a consumer sees the quota change or reset in the payload itself rather than the door guessing which of the two a write was. The snapshot schema is the payload schema (identity, observed instant, every provider's state with its windows), the one definition `usage --json` readers already share.
+ */
+/** One usage change event, as the TypeScript the publisher emits and its consumers handle: the written snapshot itself, so the snapshot's own schema (`UsageSnapshotSchema`) is this payload's schema rather than a renamed copy. */
+type UsageChangeEvent = UsageSnapshot;
 
 /**
  * The door's event backbone: the publisher/subscriber machinery the Remote Control client stream's fan-out first proved, generalised so any door-wide source can publish and any consumer can subscribe once instead of each source growing its own channel. A publisher registers under a source tag and publishes payloads; the backbone stamps each event with its source's own monotonic sequence and delivers to every matching subscriber synchronously, in publication order. A source that carries its own ordering on the wire (the Remote Control envelope's per-session `sequence_num`, the number its resume rule resumes after) keeps it inside the payload, verbatim: the backbone's sequence is deliberately not any protocol's number.
@@ -4186,6 +4248,10 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     identity: zod.ZodString;
                     at: zod.ZodISODateTime;
                 }, zod_v4_core.$strict>>;
+                movedOff: zod.ZodOptional<zod.ZodObject<{
+                    identity: zod.ZodString;
+                    reason: zod.ZodString;
+                }, zod_v4_core.$strict>>;
                 stickyProblem: zod.ZodOptional<zod.ZodString>;
             }, zod_v4_core.$strict>>;
             configProfile: zod.ZodObject<{
@@ -4503,6 +4569,10 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                 identity: zod.ZodString;
                 at: zod.ZodISODateTime;
             }, zod_v4_core.$strict>>;
+            movedOff: zod.ZodOptional<zod.ZodObject<{
+                identity: zod.ZodString;
+                reason: zod.ZodString;
+            }, zod_v4_core.$strict>>;
             stickyProblem: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
     };
@@ -4759,6 +4829,10 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     identity: zod.ZodString;
                     at: zod.ZodISODateTime;
                 }, zod_v4_core.$strict>>;
+                movedOff: zod.ZodOptional<zod.ZodObject<{
+                    identity: zod.ZodString;
+                    reason: zod.ZodString;
+                }, zod_v4_core.$strict>>;
                 stickyProblem: zod.ZodOptional<zod.ZodString>;
             }, zod_v4_core.$strict>>;
             configProfile: zod.ZodObject<{
@@ -5076,6 +5150,10 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 identity: zod.ZodString;
                 at: zod.ZodISODateTime;
             }, zod_v4_core.$strict>>;
+            movedOff: zod.ZodOptional<zod.ZodObject<{
+                identity: zod.ZodString;
+                reason: zod.ZodString;
+            }, zod_v4_core.$strict>>;
             stickyProblem: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
     };
@@ -5571,6 +5649,36 @@ interface LaunchEventPublisher {
 /** Creates the launch lifecycle publisher. One per door process, fed by the supervisor's tick. */
 declare function createLaunchEventPublisher(hub: DoorEventHub, now: () => number): LaunchEventPublisher;
 
+/**
+ * The door health publisher: the supervisor's own state transitions as backbone events, so a consumer of the door learns the door itself changed and not only its sessions. The publisher emits nothing of its own: the supervisor tells it the moments it already lives through (every listener bound, a start failure that ends the generation, the idle shutdown), each published the moment it happens rather than at a tick, because these are process facts, not registry facts diffed between observations.
+ */
+/** Everything the door health publisher needs: the backbone it publishes on and the clock its events are observed at. */
+interface DoorHealthPublisher {
+    /** Publishes the generation event: every listener bound, the state file naming this supervisor, the door fully serving. */
+    readonly generation: (ports: {
+        readonly providerPort: number;
+        readonly connectPort: number;
+        readonly directPort: number;
+    }) => void;
+    /** Publishes the start failure that ends the generation, naming which listener and why. */
+    readonly listenerFailed: (listener: "provider" | "connect" | "direct", message: string) => void;
+    /** Publishes the idle shutdown: the door closing itself with an empty session registry. */
+    readonly idleShutdown: () => void;
+}
+/** Creates the door health publisher. One per door process, fed by the supervisor. */
+declare function createDoorHealthPublisher(hub: DoorEventHub, now: () => number, pid: number): DoorHealthPublisher;
+
+/** Everything the expiring-quota publisher needs: the backbone (its usage source keeps the snapshots fresh), the snapshots as they stand at assembly, and the clock the tick reads. */
+interface QuotaExpiringPublisher {
+    /** Checks every held window against the clock and publishes each one newly inside its final span. Idempotent within one span; cheap enough for the supervisor's every tick. */
+    readonly check: () => void;
+}
+/** Creates the expiring-quota publisher. One per door process, checked on the supervisor's tick. */
+declare function createQuotaExpiringPublisher(hub: DoorEventHub, deps: {
+    readonly seed: readonly UsageSnapshot[];
+    readonly now: () => number;
+}): QuotaExpiringPublisher;
+
 /**
  * The rate-limit facts one client read stream event carries, or undefined when the event is not a `rate_limit_event` this module can read: a payload of another type, a payload without the family's own one required field, or one whose `rate_limit_info` does not parse. An envelope the door cannot read is one it knows nothing about, never a failure, exactly as the stream's own parser treats an envelope it cannot read. Exported because the renderers (`frontdoor rc watch`, the web client's twin) narrow the same payload through the same one definition.
  */
@@ -5859,6 +5967,14 @@ interface FrontDoorSupervisorPorts {
      * Reports one tick's session-registry facts to the door's event backbone: the sessions the tick's listing saw (taken before the prune, so a pruned launch's record is still there to name its start time) and the pids the tick's prune removed. The launch lifecycle publisher turns the diff between ticks into source-tagged events; the listing is also this loop's own idle input, so the two read one fact instead of two.
      */
     readonly observeLaunchRegistry: (sessions: readonly FrontDoorSessionSummary[], pruned: readonly number[]) => void;
+    /**
+     * Publishes the supervisor's own state transitions to the door's event backbone: the generation serving, a start failure that ends it, the idle shutdown. Fed the moments the supervisor already lives through, published as they happen rather than at a tick, because these are process facts.
+     */
+    readonly doorHealth: DoorHealthPublisher;
+    /**
+     * Checks the expiring-quota windows against the clock, once per tick: the publisher holds the snapshots the usage source keeps fresh, so this costs arithmetic, never a file read.
+     */
+    readonly checkQuotaExpiry: () => void;
     readonly log: (line: string) => void;
 }
 /** Options for `runFrontDoorSupervisor`. */
@@ -5973,7 +6089,7 @@ interface Candidate {
     readonly class: CandidateClass;
     /** Plan-size-weighted remaining quota per hour until its reset: higher is more wasted if left unused. Present for `scored` only. */
     readonly score?: number;
-    /** False when the five-hour window would run dry, at the observed pace, before it resets. A `scored` candidate that is not feasible ranks below every feasible one. */
+    /** False when a quota window would run dry, at the observed pace, before it resets (the five-hour at its own or the rescaled shared pace, the seven-day at its own). A `scored` candidate that is not feasible ranks below every feasible one. */
     readonly feasible: boolean;
     /** When an `ineligible` candidate can be used again. */
     readonly blockedUntilMs?: number;
@@ -5991,11 +6107,16 @@ interface PoolRanking {
         readonly identity: string;
         readonly atMs: number;
     };
+    /** The member a resumed or continued conversation started on but moved off, and why, when a launch that resumes could not keep it. One sentence for the launch decision line and `check`. */
+    readonly movedOff?: {
+        readonly identity: string;
+        readonly reason: string;
+    };
 }
 /**
  * Ranks `members` for a launch.
  *
- * A member is `ineligible` while a window of its plan, or a refusal it last hit, still binds; it is `unknown` without recorded quota, `pay-per-use` when its usage bills by use, and otherwise `scored`. Scored members order by how much plan-size-weighted quota would expire unused per hour of runway, with any whose five-hour window would run dry at the observed pace (their own, or the person's pace on another member rescaled by plan size) placed behind those that would not. The member last picked for this directory then moves to the front if it is still usable and either the launch resumes a conversation or its prompt cache is still warm.
+ * A member is `ineligible` while a window of its plan, or a refusal it last hit, still binds; it is `unknown` without recorded quota, `pay-per-use` when its usage bills by use, and otherwise `scored`. Scored members order by how much plan-size-weighted quota would expire unused per hour of runway, with any whose five-hour window would run dry at the observed pace (their own, or the person's pace on another member rescaled by plan size) or whose seven-day window would run dry at its own observed pace placed behind those that would not. The member last picked for this directory then moves to the front if it still serves on plan quota and is not projected to run dry, and either the launch resumes a conversation or its prompt cache is still warm; a resumed conversation that cannot keep its member re-ranks and continues on the pick, with the move named in `movedOff`.
  *
  * How members are ordered depends on `preference`. The default, "score", is the order above: class first, then feasibility, then score, with ties by name. "listed" keeps the order of `members`, which callers build in pool member order, so member order, not class, decides: an `unknown` (no usage recorded) or `pay-per-use` member can be picked before a later `scored` one, which is the list owner's stated preference, and a `scored` member that is not feasible keeps its place and its reason line rather than being demoted. In both modes the pick is the first non-`ineligible` candidate, `earliestReturn` still reports the soonest returning refused member, and the sticky-pick promotion applies unchanged.
  */
@@ -6597,5 +6718,5 @@ interface PrepareClaudeLaunchOptions {
  */
 declare function prepareClaudeLaunch(options: PrepareClaudeLaunchOptions): LaunchPlan;
 
-export { AMBIENT_CREDENTIAL_VARS, CHECK_CREDENTIAL_APPLIES, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CheckReportJsonSchema, CheckRunInputSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DOOR_EVENT_BUFFER_EVENTS, DOOR_EVENT_SOURCE_RC, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, DoctorFindingSchema, DoctorRunOutputSchema, DoorEventSchema, DoorEventSourceQuerySchema, EXIT_FAILURE, EXIT_USAGE, EffectiveWindowSchema, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorSessionStatusSchema, FrontDoorSessionsOutputSchema, FrontDoorStartError, FrontDoorStateSchema, FrontDoorStatusOutputSchema, GlobalConfigSchema, HeadroomSocketTargetSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LAUNCH_EVENT_SOURCE, LaunchLifecycleEventSchema, LaunchRefusedError, LegacyProviderFileError, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_CONTEXT_USAGE_DETAILS, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_READ_FILE_ENCODINGS, RC_REQUEST_PARSE_CAP_BYTES, RC_SELF_HOST_ENV, RC_SELF_HOST_KEEPALIVE_MS, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE, RC_SELF_HOST_RETENTION_MS, RC_SELF_HOST_SCOPE_LIST, RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, RC_WEB_FETCH_ALLOW_PRIVATE_ENV, RC_WEB_FETCH_DEADLINE_MS, RC_WEB_FETCH_MAX_BYTES, RC_WEB_FETCH_MAX_REDIRECTS, ROUTED_PATH_PREFIX, RcLiveRateLimitSchema, RcPermissionModeSchema, RcRateLimitInfoSchema, RcRateLimitWindowSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, UsageError, UsageListOutputSchema, UsageLiveOutputSchema, UsageSnapshotError, UsageSnapshotSchema, UsageWindowsInputSchema, UsageWindowsOutputSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, authenticateRcSessionMcpServer, buildEntryFacts, buildLayoutPaths, buildRcControlRequestPayload, buildRcControlResponsePayload, buildRcEndSessionPayload, buildRcEventWriteBody, buildRcFileSuggestionsPayload, buildRcGetContextUsagePayload, buildRcGetUsagePayload, buildRcInterruptPayload, buildRcKeepAlivePayload, buildRcMarkReadBody, buildRcMcpAuthenticatePayload, buildRcMcpOAuthCallbackUrlPayload, buildRcMcpReconnectPayload, buildRcMcpStatusPayload, buildRcReadFilePayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectFrontDoorStatus, collectPoolPick, createControlApiRouter, createDoorApiNodeHandler, createDoorApiRouter, createDoorEventHub, createEventsApiRouter, createLaunchEventPublisher, createLeafCache, createProfile, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcLiveUsage, createRcSelfHostSurface, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, doorApiAuth, doorApiNodeHandlerOf, effectiveWindow, endRcSession, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, fetchThroughWebProxy, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, formatFrontDoorStatus, forwardableHeaders, frontDoorApiClient, frontDoorApiLink, frontDoorRcApiClient, frontDoorRcControl, generateCa, getRcSessionContextUsage, getRcSessionMcpStatus, getRcSessionUsage, headroomSocketTarget, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isPrivateAddress, isRcContextUsageDetail, isRcPermissionMode, isRcReadFileEncoding, lateRcEventDial, lateRcStreamDial, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, matchBranch, mintLeaf, mintRcSelfHostCredential, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcFanoutOnDoorHub, rcObserverAsPassthrough, rcRateLimitInfoOf, rcSelfHostFromEnv, rcWebFetchAllowsPrivateFromEnv, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readRcSelfHostRecord, readRcSessionFile, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, realRcWebFetch, reconnectRcSessionMcpServer, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runLauncher, runSupervisor, sendRcKeepAlive, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, spawnClaude, startConnectServer, submitRcSessionMcpOAuthCallbackUrl, suggestRcSessionFiles, teleportRcSession, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
-export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CheckReportJson, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectLocalSurface, ConnectServerConfig, ConnectServerHandle, ConnectTarget, ControlApiClient, ControlApiDeps, ControlApiRouter, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, DoorApiClient, DoorApiContext, DoorApiDeps, DoorApiRouter, DoorEvent, DoorEventHub, DoorEventPublisher, DoorEventStream, DoorEventsApiDeps, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSessionStatus, FrontDoorStatus, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchEventPublisher, LaunchLifecycleEvent, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, NestedContribution, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcContextUsageDetail, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcCredentialStore, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcLiveRateLimit, RcLiveUsage, RcLiveUsageDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcRateLimitInfo, RcRateLimitWindow, RcReadFileEncoding, RcReadFileOptions, RcSelfHostCredentialRecord, RcSelfHostDeps, RcSelfHostMintResult, RcSelfHostSurface, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWebFetchDeps, RcWebFetchHop, RcWebFetchOutcome, RcWebFetcher, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunLauncherParams, RunSupervisorOptions, SpawnClaudeParams, SseParsedEvent, StickyPick, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation };
+export { AMBIENT_CREDENTIAL_VARS, CHECK_CREDENTIAL_APPLIES, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CheckReportJsonSchema, CheckRunInputSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DOOR_EVENT_BUFFER_EVENTS, DOOR_EVENT_SOURCE_RC, DOOR_HEALTH_EVENT_SOURCE, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, DoctorFindingSchema, DoctorRunOutputSchema, DoorEventSchema, DoorEventSourceQuerySchema, DoorHealthEventSchema, EXIT_FAILURE, EXIT_USAGE, EffectiveWindowSchema, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorSessionStatusSchema, FrontDoorSessionsOutputSchema, FrontDoorStartError, FrontDoorStateSchema, FrontDoorStatusOutputSchema, GlobalConfigSchema, HeadroomSocketTargetSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LAUNCH_EVENT_SOURCE, LaunchLifecycleEventSchema, LaunchRefusedError, LegacyProviderFileError, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, QUOTA_EXPIRING_EVENT_SOURCE, QuotaExpiringEventSchema, RC_CONTEXT_USAGE_DETAILS, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_READ_FILE_ENCODINGS, RC_REQUEST_PARSE_CAP_BYTES, RC_SELF_HOST_ENV, RC_SELF_HOST_KEEPALIVE_MS, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE, RC_SELF_HOST_RETENTION_MS, RC_SELF_HOST_SCOPE_LIST, RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, RC_WEB_FETCH_ALLOW_PRIVATE_ENV, RC_WEB_FETCH_DEADLINE_MS, RC_WEB_FETCH_MAX_BYTES, RC_WEB_FETCH_MAX_REDIRECTS, ROUTED_PATH_PREFIX, RcLiveRateLimitSchema, RcPermissionModeSchema, RcRateLimitInfoSchema, RcRateLimitWindowSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, USAGE_EVENT_SOURCE, UsageError, UsageListOutputSchema, UsageLiveOutputSchema, UsageSnapshotError, UsageSnapshotSchema, UsageWindowsInputSchema, UsageWindowsOutputSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, authenticateRcSessionMcpServer, buildEntryFacts, buildLayoutPaths, buildRcControlRequestPayload, buildRcControlResponsePayload, buildRcEndSessionPayload, buildRcEventWriteBody, buildRcFileSuggestionsPayload, buildRcGetContextUsagePayload, buildRcGetUsagePayload, buildRcInterruptPayload, buildRcKeepAlivePayload, buildRcMarkReadBody, buildRcMcpAuthenticatePayload, buildRcMcpOAuthCallbackUrlPayload, buildRcMcpReconnectPayload, buildRcMcpStatusPayload, buildRcReadFilePayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectFrontDoorStatus, collectPoolPick, createControlApiRouter, createDoorApiNodeHandler, createDoorApiRouter, createDoorEventHub, createDoorHealthPublisher, createEventsApiRouter, createLaunchEventPublisher, createLeafCache, createProfile, createQuotaExpiringPublisher, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcLiveUsage, createRcSelfHostSurface, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, doorApiAuth, doorApiNodeHandlerOf, effectiveWindow, endRcSession, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, fetchThroughWebProxy, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, formatFrontDoorStatus, forwardableHeaders, frontDoorApiClient, frontDoorApiLink, frontDoorRcApiClient, frontDoorRcControl, generateCa, getRcSessionContextUsage, getRcSessionMcpStatus, getRcSessionUsage, headroomSocketTarget, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isPrivateAddress, isRcContextUsageDetail, isRcPermissionMode, isRcReadFileEncoding, lateRcEventDial, lateRcStreamDial, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, matchBranch, mintLeaf, mintRcSelfHostCredential, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcFanoutOnDoorHub, rcObserverAsPassthrough, rcRateLimitInfoOf, rcSelfHostFromEnv, rcWebFetchAllowsPrivateFromEnv, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readRcSelfHostRecord, readRcSessionFile, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, realRcWebFetch, reconnectRcSessionMcpServer, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runLauncher, runSupervisor, sendRcKeepAlive, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, spawnClaude, startConnectServer, submitRcSessionMcpOAuthCallbackUrl, suggestRcSessionFiles, teleportRcSession, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
+export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CheckReportJson, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectLocalSurface, ConnectServerConfig, ConnectServerHandle, ConnectTarget, ControlApiClient, ControlApiDeps, ControlApiRouter, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, DoorApiClient, DoorApiContext, DoorApiDeps, DoorApiRouter, DoorEvent, DoorEventHub, DoorEventPublisher, DoorEventStream, DoorEventsApiDeps, DoorHealthEvent, DoorHealthPublisher, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSessionStatus, FrontDoorStatus, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchEventPublisher, LaunchLifecycleEvent, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, NestedContribution, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, QuotaExpiringEvent, QuotaExpiringPublisher, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcContextUsageDetail, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcCredentialStore, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcLiveRateLimit, RcLiveUsage, RcLiveUsageDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcRateLimitInfo, RcRateLimitWindow, RcReadFileEncoding, RcReadFileOptions, RcSelfHostCredentialRecord, RcSelfHostDeps, RcSelfHostMintResult, RcSelfHostSurface, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWebFetchDeps, RcWebFetchHop, RcWebFetchOutcome, RcWebFetcher, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunLauncherParams, RunSupervisorOptions, SpawnClaudeParams, SseParsedEvent, StickyPick, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageChangeEvent, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.30.0",
+  "version": "8.32.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",