agent-shim 8.7.0 → 8.9.0

package/dist/types/index.d.ts

@@ -1,7 +1,11 @@
+import * as zod from 'zod';
 import { z } from 'zod';
 import { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
 import * as net from 'node:net';
 import { Duplex } from 'node:stream';
+import * as zod_v4_core from 'zod/v4/core';
+import * as _orpc_server from '@orpc/server';
+import { RouterClient } from '@orpc/server';
 
 /**
  * Every category a `~/.claude` entry can be classified into. `secret` is deliberately part of this list — it is a real classification the resolver acts on — but it is NOT part of `CategoryMapSchema`'s shape, because no configuration layer may ever toggle it. See OVERRIDABLE_CATEGORIES.
@@ -1602,6 +1606,44 @@ declare function realConnectCertStore(paths: {
     readonly frontdoorCaKeyFile: string;
 }): ConnectCertStore;
 
+/**
+ * The Zod schemas of the Remote Control surfaces: one definition each for the summaries, statuses and pending lists the tracker produces, the stream events the door's client attachment fans out, and every input and output the typed API accepts. The tracker's own TypeScript interfaces in `rcSessions.ts` stay the implementations' types; these schemas are what the oRPC contract validates through, and because the procedures wrap the very operations that produce those interfaces' values, a drift between a schema and its interface fails the API's own output validation (exercised by its tests) rather than shipping silently. This module deliberately imports nothing from oRPC: it is a plain Zod leaf, so the tracker and the stream half can share it without either depending on the API layer.
+ */
+/** The permission modes the SDK's own `set_permission_mode` control request accepts, as the input schema of the set-permission-mode operation and the subscribe-free vocabulary every surface narrows untrusted strings through. */
+declare const RcPermissionModeSchema: z.ZodEnum<{
+    default: "default";
+    acceptEdits: "acceptEdits";
+    bypassPermissions: "bypassPermissions";
+    plan: "plan";
+    dontAsk: "dontAsk";
+    auto: "auto";
+}>;
+/** One event off the client read stream, exactly as the door forwards it to subscribers: the envelope the API host sent, with the fields the door itself relies on typed and the rest (the payload above all) carried verbatim for the consumer to narrow. */
+declare const RcStreamEnvelopeSchema: z.ZodObject<{
+    event_id: z.ZodOptional<z.ZodString>;
+    event_type: z.ZodString;
+    sequence_num: z.ZodInt;
+    source: z.ZodString;
+    payload: z.ZodOptional<z.ZodUnknown>;
+    created_at: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$loose>;
+/** One fan-out event: the session the stream it rode belongs to, beside the envelope itself. */
+declare const RcStreamEventSchema: z.ZodObject<{
+    session: z.ZodString;
+    envelope: z.ZodObject<{
+        event_id: z.ZodOptional<z.ZodString>;
+        event_type: z.ZodString;
+        sequence_num: z.ZodInt;
+        source: z.ZodString;
+        payload: z.ZodOptional<z.ZodUnknown>;
+        created_at: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$loose>;
+}, z.core.$strict>;
+/** One event off the client read stream, as the TypeScript every in-process consumer of the fan-out handles it (the schema's own inferred type, so the two cannot drift). */
+type RcStreamEnvelope = z.output<typeof RcStreamEnvelopeSchema>;
+/** One fan-out event, as the TypeScript every in-process consumer handles it. */
+type RcStreamEvent = z.output<typeof RcStreamEventSchema>;
+
 /** What the identity step learned about one request from the launcher-injected headers. */
 interface SessionIdentity {
     /** The identity name the launch resolved, when it resolved one. */
@@ -1750,6 +1792,14 @@ interface RcSessionTracker {
     readonly pendingOf: (sessionId?: string) => readonly RcPendingRequestSummary[];
     /** The observed credential and protocol headers for one session, the client-half writes' accessor: present only while the session is tracked, and never surfaced anywhere a summary, log or capture goes. */
     readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** Advances the session's sequence cursor to the highest number named, which every confirmed client-half write calls with the numbers the real service assigned its events. */
+    readonly noteSequenceNums: (sessionId: string, sequenceNums: readonly number[]) => void;
+    /** The session's sequence cursor: the highest number the door has seen, from the client read stream's envelopes or from its own confirmed writes; undefined while neither has been seen. */
+    readonly sequenceNumOf: (sessionId: string) => number | undefined;
+    /**
+     * Files one client read stream envelope: advances the session's sequence cursor, and treats the payload exactly as an observed event-batch body's would be treated, which is how an approval reaches the pending list from the stream (the live finding behind the client attachment: the CLI routes `control_request`s only toward attached clients, so the stream, not the worker's own writes, is where a `can_use_tool` the door must answer becomes visible). A `control_request` whose envelope names the worker as its source births a pending entry; a `control_response` retires the request it answers, whoever answered it.
+     */
+    readonly fileStreamEvent: (sessionId: string, event: RcStreamEnvelope) => void;
     /** Retires one pending control request as answered: what a successful answer write calls, so the request stops being listed the moment it is answered. */
     readonly completePending: (sessionId: string, requestId: string) => void;
     /** Stops the idle sweep timer. The entries themselves are unreachable the moment the door drops them. */
@@ -1759,8 +1809,12 @@ interface RcSessionTracker {
 declare function createRcSessionTracker(deps: RcSessionTrackerDeps): RcSessionTracker;
 /**
  * Wraps one route so the tracker sees every exchange the route serves: the request's facts are handed over first, and when they are Remote Control facts the request's body chunks and the response the route writes are teed to the tracker's observer while flowing on unchanged. Used on the door's route resolution, so the bare `/v1/` pass-through an OAuth session's Remote Control calls ride is where observation happens.
+ *
+ * `onExchangeSettled`, when given, is called once the exchange's response has ended and the observer has filed whatever it filed: it is where the door re-pokes the client stream attachment, so a session becomes attached the moment its create's own response completes rather than at whatever exchange happens to follow.
  */
-declare function observingRoutedRoute(route: FrontDoorRoute, tracker: RcSessionTracker): FrontDoorRoute;
+declare function observingRoutedRoute(route: FrontDoorRoute, tracker: RcSessionTracker, hooks?: {
+    readonly onExchangeSettled?: () => void;
+}): FrontDoorRoute;
 /** Adapts the tracker's exchange observer to the passthrough forwarding's observer shape, so the connect test world (which forwards rather than routes) observes through the same tracker. */
 declare function rcObserverAsPassthrough(observer: RcExchangeObserver): PassthroughObserver;
 /**
@@ -1800,6 +1854,8 @@ type RcObservedCredential = RcWriteHeaders;
 interface RcInjectDeps {
     /** Reads the observed credential for a session: the tracker's accessor, in production. */
     readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** Advances the session's sequence cursor: the tracker's accessor, in production, so a delivered write's numbers are what a stream resume continues after. */
+    readonly noteSequenceNums: (sessionId: string, sequenceNums: readonly number[]) => void;
     /** The dial to the real API host. */
     readonly dial: RcEventDial;
     /** Mints the payload event's uuid: a v4 UUID or better in production. */
@@ -1847,6 +1903,8 @@ interface RcAnswerDeps {
     readonly pendingOf: (sessionId: string) => readonly RcPendingRequestSummary[];
     /** Retires a pending request as answered: the tracker's accessor, in production, called only once the write is confirmed delivered. */
     readonly completePending: (sessionId: string, requestId: string) => void;
+    /** Advances the session's sequence cursor: the tracker's accessor, in production, so a delivered write's numbers are what a stream resume continues after. */
+    readonly noteSequenceNums: (sessionId: string, sequenceNums: readonly number[]) => void;
     /** The dial to the real API host. */
     readonly dial: RcEventDial;
 }
@@ -1858,6 +1916,8 @@ declare function answerRcControlRequest(deps: RcAnswerDeps, sessionId: string, r
 interface RcControlRequestDeps {
     /** Reads the observed credential for a session: the tracker's accessor, in production. */
     readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** Advances the session's sequence cursor: the tracker's accessor, in production, so a delivered write's numbers are what a stream resume continues after. */
+    readonly noteSequenceNums: (sessionId: string, sequenceNums: readonly number[]) => void;
     /** The dial to the real API host. */
     readonly dial: RcEventDial;
     /** Mints the request's id: a v4 UUID or better in production, the id the worker's `control_response` echoes. */
@@ -1876,6 +1936,88 @@ declare function setRcSessionModel(deps: RcControlRequestDeps, sessionId: string
  */
 declare function setRcSessionPermissionMode(deps: RcControlRequestDeps, sessionId: string, mode: RcPermissionMode): Promise<RcEventWriteResult>;
 
+/**
+ * How long a failed attachment backs off before retrying. Not a fresh number: it is the session's own liveness bound (`RC_IDLE_EXPIRY_MS`, the 45 s stream timeout the tracker's idle expiry already derives from), so an attachment that cannot be re-established retries at exactly the cadence the protocol itself gives up on a quiet session at. Production passes that constant; tests pass small values so a backoff is reached in milliseconds.
+ */
+declare const RC_STREAM_BACKOFF_MS = 45000;
+/** One event the SSE parser completed: the fields the wire's own framing carried, before any protocol interpretation. */
+interface SseParsedEvent {
+    /** The `event:` field's value, when the block carried one; the protocol's own events always do. */
+    readonly event: string | undefined;
+    /** The `id:` field's value in force at dispatch (the most recent one the connection saw, per the SSE framing rules); on this stream it carries the event's sequence number. */
+    readonly id: string | undefined;
+    /** The `data:` lines joined with newlines, exactly as the SSE framing defines. */
+    readonly data: string;
+}
+/**
+ * An incremental Server-Sent Events parser: feed it the stream's text chunks as they arrive and it returns the events each write completed. Chunks may split lines, fields and even a CRLF pair anywhere; the parser buffers until a line ending is certain, so a `\r` at a chunk's end waits for the byte that decides whether it is `\r\n`. Comments (`:`-prefixed lines, the protocol's 15 s keepalives) complete nothing, an event with no `data:` line dispatches nothing (the framing's own rule), and the `id:` value persists to the next dispatched event the same way, which is what carries the sequence number of an id-only block forward.
+ */
+declare function createSseParser(): {
+    readonly write: (text: string) => readonly SseParsedEvent[];
+};
+/**
+ * One parsed SSE event as the protocol's envelope, or undefined when the event is not a client event this half reads: a block under any other event name, or data that is not one JSON object carrying the fields the door relies on (`event_type`, `sequence_num`, `source`). An envelope the door cannot read is one it knows nothing about, never a failure: the stream stays up and the next event is read on its own merits.
+ */
+declare function parseRcStreamEnvelope(parsed: SseParsedEvent): RcStreamEnvelope | undefined;
+/** One answer from the API host the presence call dials: the status and the whole body. Presence answers one small JSON object, never a stream, so the body needs no cap of its own. */
+interface RcPresenceAnswer {
+    readonly status: number;
+    readonly body: string;
+}
+/** One answer from the API host the stream dial opens: the status and the body's chunks as they arrive. On a success the chunks are the live stream (consumed incrementally, never buffered); the production dial returns an already-drained empty iterable for any non-2xx answer, whose body is one small error document. */
+interface RcStreamAnswer {
+    readonly status: number;
+    readonly chunks: AsyncIterable<Uint8Array>;
+}
+/**
+ * The one network effect the client read stream performs, injected so the attachment logic runs against fakes: announce a client's presence, and open the read stream. Production dials the real API host over the door's interception-proof agent; tests redirect to a local stand-in. `resume` names the documented resume pair's value: present only when the door has seen events for the session already, it sends `from_sequence_num` as a query parameter and `Last-Event-ID` as a header together.
+ */
+interface RcStreamDial {
+    readonly announcePresence: (sessionId: string, headers: Readonly<Record<string, string>>, clientId: string) => Promise<RcPresenceAnswer>;
+    readonly openStream: (sessionId: string, headers: Readonly<Record<string, string>>, resume: {
+        readonly fromSequenceNum: number;
+    } | undefined, signal: AbortSignal) => Promise<RcStreamAnswer>;
+}
+/** The fan-out every stream event is handed to: the tracker files what it recognises, and each subscriber receives the event beside it. */
+interface RcEventFanout {
+    /** Delivers one event to every subscriber listening for its session (or for every session), synchronously, in publication order. */
+    readonly publish: (event: RcStreamEvent) => void;
+    /** Adds one listener, told every event whose session it matches; `undefined` listens to every session. Returns the detach function. */
+    readonly subscribe: (session: string | undefined, listener: (event: RcStreamEvent) => void) => () => void;
+}
+/** Creates the fan-out: plain synchronous listener sets, one per session plus one for every-session listeners. Delivery is synchronous so the tracker's filing (which rides the same publish) and every subscriber observe the same order; a subscriber that cannot keep up is bounded where it is bridged to a pull (the typed API's subscription), not here. */
+declare function createRcEventFanout(): RcEventFanout;
+/** Everything the attachment hub needs, injected so its decisions run against fakes in unit tests. */
+interface RcStreamHubDeps {
+    readonly now: () => number;
+    /** The tracker's credential accessor: the OAuth-kind bearer and protocol headers the attachment replays, exactly as the write path does. */
+    readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** The tracker's swept session list: an attachment whose session has expired is dropped, exactly when the tracker itself gives up on it. */
+    readonly trackedSessions: () => readonly string[];
+    /** Files one envelope with the tracker: advances the session's sequence cursor and births or retires pending control requests, exactly as an observed event-batch body does. */
+    readonly fileStreamEvent: (sessionId: string, event: RcStreamEnvelope) => void;
+    /** Reads the session's sequence cursor: the highest number the door has seen, from the stream or from its own confirmed writes. */
+    readonly sequenceNumOf: (sessionId: string) => number | undefined;
+    readonly dial: RcStreamDial;
+    readonly fanout: RcEventFanout;
+    /** Mints the stable client id one session's attachment announces: a v4 UUID or better in production. Stable means it survives reconnects, so the host sees one client, not a new one per drop. */
+    readonly newClientId: () => string;
+    /** How long a failed attachment backs off; production passes `RC_STREAM_BACKOFF_MS`, tests pass small values so a backoff is reached in milliseconds. */
+    readonly backoffMs: number;
+    readonly sleep: (ms: number) => Promise<void>;
+    /** The door's log, for attachment lifecycle lines only: never an event payload, never a credential. */
+    readonly log?: (line: string) => void;
+}
+/** The door's client read stream attachment: one stream per tracked session, fanned out to every subscriber. */
+interface RcStreamHub {
+    /** Reconciles the attachments against the tracker: attaches a stream to every tracked session whose OAuth credential is known, and drops an attachment whose session has expired or lost its credential. Idempotent, synchronous and total (never throws): the door calls it after every observed Remote Control exchange, so an attachment follows the session it belongs to without any polling of its own. */
+    readonly reconcile: () => void;
+    /** Stops every attachment and frees their dials. */
+    readonly close: () => void;
+}
+/** Creates the attachment hub. One per door process; everything it holds dies with it. */
+declare function createRcStreamHub(deps: RcStreamHubDeps): RcStreamHub;
+
 /** Where the Remote Control inject path dials: the API host's own address by default, over TLS with the door's interception-proof agent (real-name DNS resolution and the pf-exempt source-port range), so an injected event cannot be looped back into the door's own transparent surface. A test redirects the dial at a local stand-in presenting the host's name, exactly as the forwarding targets are redirected. */
 interface RcDialTarget {
     readonly host: string;
@@ -1891,6 +2033,7 @@ interface RcDialTarget {
  * The real `RcEventDial`: one keep-alive TLS agent of the door's own exempt kind, so every injected event rides the same interception-proof dials the door's forwarded traffic does. The dial only ever reads small JSON answers (an event write's result, or an error), never a stream.
  */
 declare function realRcEventDial(target?: RcDialTarget): RcEventDial;
+declare function realRcStreamDial(target?: RcDialTarget): RcStreamDial;
 declare function realConnectEffects(): ConnectEffects;
 
 /**
@@ -1966,6 +2109,225 @@ declare function frontDoorRcControl(transport: RcControlTransport, token: string
 /** The filesystem operations headroom coordination needs: the same shape as `FarmFs`, injected so every decision over state, sessions, and the start lock runs against an in-memory fake in tests. */
 type HeadroomFs = Pick<FarmFs, "mkdirp" | "mkdirPrivate" | "readFileUtf8" | "writeFileUtf8" | "writeFilePrivate" | "writeFileExclusive" | "readdir" | "removeRecursive">;
 
+/** What an `lstat` (which never follows symlinks) reports about one path, narrowed to what authenticating the socket needs. */
+interface SocketPathStat {
+    readonly kind: "dir" | "socket" | "symlink" | "other";
+    /** The owning user id. */
+    readonly uid: number;
+    /** The permission bits, without the file type bits. */
+    readonly mode: number;
+}
+/** The platform facts and the one filesystem call the socket checks need, injected so every refusal is unit-testable without a real socket, directory or second user. */
+interface HeadroomSocketTrustPorts {
+    /** `process.platform` in the real implementation. */
+    readonly platform: string;
+    /** This process's user id. Only called on a platform with unix sockets, which all have POSIX user ids. */
+    readonly currentUid: () => number;
+    /** Stats one path without following symlinks, or returns undefined when nothing is there. */
+    readonly lstat: (target: string) => SocketPathStat | undefined;
+}
+
+/**
+ * A secondary pre-pipeline surface the listener answers under one path prefix: the typed Remote Control API. The listener owns only the dispatch (the prefix and the not-matched 404); the handle itself is whatever the door built, so this file stays independent of the API framework behind it.
+ */
+interface PrePipelineApi {
+    /** The path prefix every request of this surface arrives under, outside the routed URL space. */
+    readonly pathPrefix: string;
+    /** Serves one request, resolving with whether a procedure under the prefix matched; the listener answers the 404 itself when one did not. */
+    readonly handle: (request: IncomingMessage, response: ServerResponse) => Promise<{
+        readonly matched: boolean;
+    }>;
+}
+
+/**
+ * The Remote Control operations as a typed oRPC API, so programmatic consumers (automation, a mobile or web client, another of this user's tools) get a generated type-safe client instead of hand-rolled HTTP. One procedure per existing operation, each wrapping the same operation the bespoke token-gated routes wrap (the routes stay: the CLI uses them), with inputs and outputs validating through the Zod schemas of `rcSchemas.ts`, which the operations' own values must satisfy, so contract and behaviour share one schema source and cannot drift apart silently.
+ *
+ * Mounted on the provider listener beside the bespoke namespace, authenticated by the same per-generation owner-only control token as a Bearer credential: a fresh random value per door start, written owner-only under the front door's state directory, and checked in constant time like every other capability the door accepts. `rc.subscribe` streams the client attachment's fan-out: every event the door's held stream produced, SSE-framed by oRPC's event iterator, each carrying its sequence number as the SSE event id so a consumer's own reconnect can resume exactly as the door's does.
+ */
+/** The one path prefix the typed API is mounted under, answered before the routed pipeline like the bespoke control routes are. */
+declare const RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
+/** Everything the typed API needs: the same operations the bespoke control routes take, the fan-out its subscription reads, and the token both surfaces demand. */
+interface RcApiDeps {
+    /** This generation's control token: the value the door wrote owner-only for its callers to present. */
+    readonly expectedToken: string;
+    /** The observed sessions as the tracker lists them. */
+    readonly list: () => readonly RcSessionSummary[];
+    /** The observed sessions as the tracker reports their status, filtered to one when named. */
+    readonly statusOf: (sessionId?: string) => readonly RcSessionStatus[];
+    /** The control requests awaiting an answer, filtered to one session when named. */
+    readonly pendingOf: (sessionId?: string) => readonly RcPendingRequestSummary[];
+    /** The inject operation, already wired to the tracker and the door's API-host dial. */
+    readonly inject: (sessionId: string, text: string) => Promise<RcEventWriteResult>;
+    /** The answer operation, already wired to the tracker and the door's API-host dial. */
+    readonly answer: (sessionId: string, requestId: string, decision: RcAnswerDecision) => Promise<RcEventWriteResult>;
+    /** The interrupt operation, already wired to the tracker and the door's API-host dial. */
+    readonly interrupt: (sessionId: string) => Promise<RcEventWriteResult>;
+    /** The set-model operation, already wired to the tracker and the door's API-host dial. */
+    readonly setModel: (sessionId: string, model: string) => Promise<RcEventWriteResult>;
+    /** The set-permission-mode operation, already wired to the tracker and the door's API-host dial. */
+    readonly setPermissionMode: (sessionId: string, mode: RcPermissionMode) => Promise<RcEventWriteResult>;
+    /** The client attachment's fan-out, whose events the subscription yields. */
+    readonly fanout: RcEventFanout;
+}
+/** Builds the typed API's router: one procedure per operation, every one behind the control-token middleware. */
+declare function createRcApiRouter(deps: RcApiDeps): {
+    rc: {
+        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
+            readonly headers: IncomingHttpHeaders;
+        } & Record<never, never>, {
+            readonly headers: IncomingHttpHeaders;
+        }, {
+            readonly headers: IncomingHttpHeaders;
+        }>, any, Schema<unknown, unknown>, zod.ZodObject<{
+            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                id: zod.ZodString;
+                createdAt: zod.ZodNumber;
+                lastSeenAt: zod.ZodNumber;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
+            readonly headers: IncomingHttpHeaders;
+        } & Record<never, never>, {
+            readonly headers: IncomingHttpHeaders;
+        }, {
+            readonly headers: IncomingHttpHeaders;
+        }>, any, zod.ZodObject<{
+            session: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            statuses: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                workerState: zod.ZodOptional<zod.ZodObject<{
+                    value: zod.ZodString;
+                    observedAt: zod.ZodNumber;
+                }, zod_v4_core.$strict>>;
+                workerIdleSeconds: zod.ZodOptional<zod.ZodObject<{
+                    value: zod.ZodNumber;
+                    observedAt: zod.ZodNumber;
+                }, zod_v4_core.$strict>>;
+                pending: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                    sessionId: zod.ZodString;
+                    requestId: zod.ZodString;
+                    type: zod.ZodString;
+                    summary: zod.ZodString;
+                    observedAt: zod.ZodNumber;
+                }, zod_v4_core.$strict>>>;
+                id: zod.ZodString;
+                createdAt: zod.ZodNumber;
+                lastSeenAt: zod.ZodNumber;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        pending: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
+            readonly headers: IncomingHttpHeaders;
+        } & Record<never, never>, {
+            readonly headers: IncomingHttpHeaders;
+        }, {
+            readonly headers: IncomingHttpHeaders;
+        }>, any, zod.ZodObject<{
+            session: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            pending: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                sessionId: zod.ZodString;
+                requestId: zod.ZodString;
+                type: zod.ZodString;
+                summary: zod.ZodString;
+                observedAt: zod.ZodNumber;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        send: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
+            readonly headers: IncomingHttpHeaders;
+        } & Record<never, never>, {
+            readonly headers: IncomingHttpHeaders;
+        }, {
+            readonly headers: IncomingHttpHeaders;
+        }>, any, zod.ZodObject<{
+            session: zod.ZodString;
+            text: zod.ZodString;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        answer: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
+            readonly headers: IncomingHttpHeaders;
+        } & Record<never, never>, {
+            readonly headers: IncomingHttpHeaders;
+        }, {
+            readonly headers: IncomingHttpHeaders;
+        }>, any, zod.ZodObject<{
+            session: zod.ZodString;
+            request: zod.ZodString;
+            approve: zod.ZodBoolean;
+            text: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            request: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        interrupt: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
+            readonly headers: IncomingHttpHeaders;
+        } & Record<never, never>, {
+            readonly headers: IncomingHttpHeaders;
+        }, {
+            readonly headers: IncomingHttpHeaders;
+        }>, any, zod.ZodObject<{
+            session: zod.ZodString;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        setModel: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
+            readonly headers: IncomingHttpHeaders;
+        } & Record<never, never>, {
+            readonly headers: IncomingHttpHeaders;
+        }, {
+            readonly headers: IncomingHttpHeaders;
+        }>, any, zod.ZodObject<{
+            session: zod.ZodString;
+            model: zod.ZodString;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        setPermissionMode: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
+            readonly headers: IncomingHttpHeaders;
+        } & Record<never, never>, {
+            readonly headers: IncomingHttpHeaders;
+        }, {
+            readonly headers: IncomingHttpHeaders;
+        }>, any, zod.ZodObject<{
+            session: zod.ZodString;
+            mode: zod.ZodEnum<{
+                default: "default";
+                acceptEdits: "acceptEdits";
+                bypassPermissions: "bypassPermissions";
+                plan: "plan";
+                dontAsk: "dontAsk";
+                auto: "auto";
+            }>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            session: zod.ZodString;
+            sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
+        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        subscribe: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<{
+            readonly headers: IncomingHttpHeaders;
+        } & Record<never, never>, {
+            readonly headers: IncomingHttpHeaders;
+        }, {
+            readonly headers: IncomingHttpHeaders;
+        }>, any, zod.ZodObject<{
+            session: zod.ZodOptional<zod.ZodString>;
+        }, zod_v4_core.$strict>, any, Record<never, never>, Record<never, never>>;
+    };
+};
+/** The typed API's router, as the CLI-side client's own type is derived from it. */
+type RcApiRouter = ReturnType<typeof createRcApiRouter>;
+/**
+ * Builds the typed API's node handler, already bound to its mount prefix and context: the pre-pipeline surface the provider listener hands every request under `RC_ORPC_PATH_PREFIX`, answering with `matched: false` for a path under the prefix that names no procedure (which the listener itself answers as a 404). Request bodies are bounded by the same protocol cap the bespoke routes apply.
+ */
+declare function createRcApiNodeHandler(deps: RcApiDeps): PrePipelineApi;
+/** The typed API's client as the `frontdoor rc` verbs use it: every call presents the control token, over TLS trusting only the CA file the door's own state names. */
+type RcApiClient = RouterClient<RcApiRouter>;
+/** Builds the typed API's client for the door's provider listener: the same address, CA and per-generation control token the bespoke control client uses. */
+declare function frontDoorRcApiClient(port: number, ca: string, token: string): RcApiClient;
+
 /** The outcome of authenticating the listener a front-door state file names. */
 type ListenerVerdict = {
     readonly ok: true;
@@ -2049,6 +2411,73 @@ interface RunFrontDoorSupervisorOptions {
  */
 declare function runFrontDoorSupervisor(idleShutdownMinutes: number, ports: FrontDoorSupervisorPorts, options?: RunFrontDoorSupervisorOptions): Promise<number>;
 
+/** One routed request, appended to the usage log when its response has finished. */
+declare const UsageRecordSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    at: z.ZodISODateTime;
+    identity: z.ZodOptional<z.ZodString>;
+    provider: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    project: z.ZodOptional<z.ZodString>;
+    route: z.ZodString;
+    method: z.ZodString;
+    endpoint: z.ZodString;
+    model: z.ZodOptional<z.ZodString>;
+    status: z.ZodNumber;
+    latencyMs: z.ZodNumber;
+    durationMs: z.ZodNumber;
+    outcome: z.ZodEnum<{
+        completed: "completed";
+        aborted: "aborted";
+    }>;
+    usage: z.ZodOptional<z.ZodObject<{
+        inputTokens: z.ZodOptional<z.ZodNumber>;
+        outputTokens: z.ZodOptional<z.ZodNumber>;
+        cacheCreationInputTokens: z.ZodOptional<z.ZodNumber>;
+        cacheReadInputTokens: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    rateLimitHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    limit: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "rate-limited": "rate-limited";
+            "quota-exhausted": "quota-exhausted";
+        }>;
+        retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+        resetAt: z.ZodOptional<z.ZodISODateTime>;
+        window: z.ZodOptional<z.ZodString>;
+        evidence: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    requestId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type UsageRecord = z.infer<typeof UsageRecordSchema>;
+/** One quota window from Anthropic's unified rate-limit headers. */
+declare const QuotaWindowSchema: z.ZodObject<{
+    utilization: z.ZodOptional<z.ZodNumber>;
+    resetsAt: z.ZodOptional<z.ZodISODateTime>;
+    status: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type QuotaWindow = z.infer<typeof QuotaWindowSchema>;
+/**
+ * The account fields copied from an identity's stored Claude login (`oauthAccount` in the identity's `.claude.json`): who the account is and which plan and tier it is on. Never the token, which Claude Code keeps elsewhere. Each field is present only when the stored login has it; a setup-token identity has no profile scope and so none of them (see issue #44).
+ */
+declare const AccountMetadataSchema: z.ZodObject<{
+    accountUuid: z.ZodOptional<z.ZodString>;
+    emailAddress: z.ZodOptional<z.ZodString>;
+    displayName: z.ZodOptional<z.ZodString>;
+    organizationUuid: z.ZodOptional<z.ZodString>;
+    organizationName: z.ZodOptional<z.ZodString>;
+    organizationType: z.ZodOptional<z.ZodString>;
+    organizationRole: z.ZodOptional<z.ZodString>;
+    workspaceRole: z.ZodOptional<z.ZodString>;
+    billingType: z.ZodOptional<z.ZodString>;
+    seatTier: z.ZodOptional<z.ZodString>;
+    organizationRateLimitTier: z.ZodOptional<z.ZodString>;
+    userRateLimitTier: z.ZodOptional<z.ZodString>;
+    hasExtraUsageEnabled: z.ZodOptional<z.ZodBoolean>;
+    subscriptionCreatedAt: z.ZodOptional<z.ZodString>;
+    accountCreatedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type AccountMetadata = z.infer<typeof AccountMetadataSchema>;
 /**
  * The latest state for one identity, rewritten atomically after each recorded response: the snapshot file other tools read (`~/.agent-shim/usage/snapshots/<identity>.json`) without shelling out to `agent-shim`.
  */
@@ -2145,6 +2574,175 @@ declare function readUsageSnapshot(fs: Pick<FarmFs, "readFileUtf8">, snapshotsDi
 /** Reads every identity's snapshot, by identity name. */
 declare function listUsageSnapshots(fs: UsageReadFs, snapshotsDir: string): readonly UsageSnapshot[];
 
+/** A quota window as it stands at a given instant. */
+interface EffectiveWindow {
+    /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
+    readonly reset: boolean;
+    /** The fraction used: 0 for a reset window, otherwise what was last observed (a lower bound, since utilisation only rises within a window), or undefined when none was reported. */
+    readonly utilization?: number;
+    /** The reset instant, for a window that has not reset yet and reported one. */
+    readonly resetsAtMs?: number;
+    /** The window's own status, for a window that has not reset yet. */
+    readonly status?: string;
+}
+/** Reads a recorded window at `nowMs`: a window whose reset has passed is empty and carries no status, so every consumer agrees on what an old observation still means. */
+declare function effectiveWindow(window: Readonly<QuotaWindow>, nowMs: number): EffectiveWindow;
+
+/**
+ * What an account's plan means for picking it: a subscription with a capacity relative to the smallest paid tier, or an account billed by use.
+ */
+declare const PlanClassSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"subscription">;
+    capacity: z.ZodNumber;
+    recognised: z.ZodBoolean;
+    tier: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"pay-per-use">;
+    tier: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+type PlanClass = z.infer<typeof PlanClassSchema>;
+/**
+ * Classifies an account from the rate-limit tier of its stored login (`organizationRateLimitTier`, which decides the organisation's limits, then `userRateLimitTier`). The tier strings are free text on Anthropic's side, so only the shapes seen are read: a trailing `<n>x` is that multiple, a bare `pro` is 1, a `zero` tier is pay-per-use. Anything else is a subscription of unrecognised size, counted as 1 and marked so the ranking can say it guessed.
+ */
+declare function planOf(account: AccountMetadata | undefined): PlanClass;
+
+/** Anthropic's longest prompt-cache lifetime (the one-hour tier): a conversation resumed within it still has a warm cache on the account that served it, and the cache is per organisation, so it is lost by switching. */
+declare const PROMPT_CACHE_TTL_MS: number;
+/** The state a member's ranking was built from. */
+interface PoolMember {
+    readonly identity: string;
+    /** The identity's usage snapshot, when it has one. */
+    readonly snapshot?: UsageSnapshot;
+    /** Why the member's recorded state could not be read (a corrupt or newer-schema snapshot, an unreadable login file), when that is the case. */
+    readonly readError?: string;
+    readonly account?: AccountMetadata;
+    /** The member's usage-log records from the current five-hour window on. */
+    readonly records: readonly UsageRecord[];
+}
+/** The member last picked for this directory, kept so a conversation stays on the account whose prompt cache is warm. */
+interface StickyPick {
+    readonly identity: string;
+    readonly at: string;
+}
+interface RankPoolInput {
+    readonly members: readonly PoolMember[];
+    readonly nowMs: number;
+    readonly sticky?: StickyPick;
+    /** True when the launch continues or resumes a conversation, which belongs on the account it started on whatever the cache lifetime. */
+    readonly resuming: boolean;
+}
+/** In pick order. `scored` has usable quota data; `unknown` has none (never recorded, or unreadable); `pay-per-use` bills by use instead of drawing on a plan; `ineligible` is refused right now. */
+type CandidateClass = "scored" | "unknown" | "pay-per-use" | "ineligible";
+interface Candidate {
+    readonly identity: string;
+    readonly class: CandidateClass;
+    /** Plan-size-weighted remaining quota per hour until its reset: higher is more wasted if left unused. Present for `scored` only. */
+    readonly score?: number;
+    /** False when the five-hour window would run dry, at the observed pace, before it resets. A `scored` candidate that is not feasible ranks below every feasible one. */
+    readonly feasible: boolean;
+    /** When an `ineligible` candidate can be used again. */
+    readonly blockedUntilMs?: number;
+    readonly plan: PlanClass;
+    /** Human-readable facts behind the class and score, in the order they matter. */
+    readonly reasons: readonly string[];
+}
+interface PoolRanking {
+    /** Every member, best first. */
+    readonly candidates: readonly Candidate[];
+    /** The member to launch on: the best one that is not refused. Undefined when every member is refused. */
+    readonly pick?: Candidate;
+    /** When nothing can be picked, the soonest any member comes back. */
+    readonly earliestReturn?: {
+        readonly identity: string;
+        readonly atMs: number;
+    };
+}
+/**
+ * Ranks `members` for a launch.
+ *
+ * A member is `ineligible` while a window of its plan, or a refusal it last hit, still binds; it is `unknown` without recorded quota, `pay-per-use` when its usage bills by use, and otherwise `scored`. Scored members order by how much plan-size-weighted quota would expire unused per hour of runway, with any whose five-hour window would run dry at the observed pace (their own, or the person's pace on another member rescaled by plan size) placed behind those that would not. The member last picked for this directory then moves to the front if it is still usable and either the launch resumes a conversation or its prompt cache is still warm.
+ */
+declare function rankPool(input: RankPoolInput): PoolRanking;
+
+/** What `pool pick` reports: the ranking a launch from `directory` would act on right now. */
+declare const PoolPickReportSchema: z.ZodObject<{
+    pool: z.ZodString;
+    directory: z.ZodString;
+    pick: z.ZodOptional<z.ZodString>;
+    candidates: z.ZodArray<z.ZodObject<{
+        identity: z.ZodString;
+        class: z.ZodEnum<{
+            unknown: "unknown";
+            "pay-per-use": "pay-per-use";
+            scored: "scored";
+            ineligible: "ineligible";
+        }>;
+        score: z.ZodOptional<z.ZodNumber>;
+        feasible: z.ZodBoolean;
+        blockedUntil: z.ZodOptional<z.ZodISODateTime>;
+        plan: z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"subscription">;
+            capacity: z.ZodNumber;
+            recognised: z.ZodBoolean;
+            tier: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"pay-per-use">;
+            tier: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>;
+        reasons: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    missing: z.ZodArray<z.ZodString>;
+    earliestReturn: z.ZodOptional<z.ZodObject<{
+        identity: z.ZodString;
+        at: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    stickyProblem: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type PoolPickReport = z.infer<typeof PoolPickReportSchema>;
+
+/**
+ * Ranks a pool exactly as a launch from `directory` would right now, without recording a pick. Shares `rankPoolFromStore` with the launcher, so what this prints is what a launch does.
+ */
+declare function collectPoolPick(params: Readonly<{
+    paths: LayoutPaths;
+    fs: FsPort;
+    usageFs: FarmFs;
+    poolName: string;
+    pool: Pool;
+    directory: string;
+    nowMs: number;
+}>): PoolPickReport;
+
+/** Everything a `when` condition can be evaluated against, injected rather than read. */
+interface ConditionContext {
+    readonly nowMs: number;
+    /** Facts about the specific entry being decided. Absent when evaluating a rule-level condition that has no single entry (a directory rule's own `when`). */
+    readonly fact?: EntryFact;
+    /** The branch checked out at `cwd`, or undefined when `cwd` is not in a repository. */
+    readonly branch?: string;
+    /** True when the repository is in detached-HEAD state, in which case no `branch` condition can match. */
+    readonly branchDetached?: boolean;
+    readonly env: Readonly<Record<string, string | undefined>>;
+}
+/** The result of evaluating one `when` object. */
+interface WhenEvaluation {
+    readonly passed: boolean;
+    /** Which condition fields were present and evaluated. */
+    readonly checked: readonly string[];
+    /** Which of those fields did not hold. Empty when `passed` is true. */
+    readonly failed: readonly string[];
+}
+/** True when `branch` matches `pattern`. The pattern is glob-capable (`client/*`); a detached HEAD or a non-repository directory never matches. */
+declare function matchBranch(pattern: string, branch: string | undefined, detached?: boolean): boolean;
+/**
+ * Evaluates a `when` object. Every present field must hold — conditions AND together within one object.
+ *
+ * An absent condition is vacuously true, so `when: {}` passes; `agent-shim check` warns about that rather than erroring, since an empty object is more likely a half-finished edit than an intentional statement.
+ *
+ * `newerThan`, `olderThan`, and `maxSizeBytes` read the subtree-aggregated facts (`latestMtimeMs`, `totalSizeBytes`), never the entry's own inode stat: a directory's own mtime does not change when a file three levels beneath it is rewritten, and its own size is a ~4KB inode figure that says nothing about what it contains.
+ */
+declare function evaluateWhen(when: WhenCondition | undefined, context: ConditionContext): WhenEvaluation;
+
 /** Raised when the daemon cannot be brought up in time, or reports a fatal `lastError`: a launch that asked for headroom must never silently fall back to a direct connection. */
 declare class HeadroomStartError extends CliError {
     constructor(message: string);
@@ -2181,24 +2779,6 @@ declare function ensureHeadroom(params: {
 /** The token-saving settings of the `headroom` config block, without its install and lifecycle fields (`source`, `idleShutdownMinutes`). */
 type HeadroomSettings = Pick<HeadroomGlobalConfig, "mode" | "targetRatio" | "ccr" | "rolloutChannel" | "interceptToolResults" | "readMaturation">;
 
-/** What an `lstat` (which never follows symlinks) reports about one path, narrowed to what authenticating the socket needs. */
-interface SocketPathStat {
-    readonly kind: "dir" | "socket" | "symlink" | "other";
-    /** The owning user id. */
-    readonly uid: number;
-    /** The permission bits, without the file type bits. */
-    readonly mode: number;
-}
-/** The platform facts and the one filesystem call the socket checks need, injected so every refusal is unit-testable without a real socket, directory or second user. */
-interface HeadroomSocketTrustPorts {
-    /** `process.platform` in the real implementation. */
-    readonly platform: string;
-    /** This process's user id. Only called on a platform with unix sockets, which all have POSIX user ids. */
-    readonly currentUid: () => number;
-    /** Stats one path without following symlinks, or returns undefined when nothing is there. */
-    readonly lstat: (target: string) => SocketPathStat | undefined;
-}
-
 /** Everything the supervisor needs to run the daemon, resolved from the global config and the filesystem before it starts. */
 interface HeadroomSupervisorConfig {
     /** The install spec as configured (`headroom.source`), already defaulted. */
@@ -2755,64 +3335,6 @@ type ConfigProfileDecisionSource =
 /** Nothing resolved a configuration profile at all. */
  | "none";
 
-/** What an account's plan means for picking it: a subscription with a capacity relative to the smallest paid tier, or an account billed by use. */
-type PlanClass = {
-    readonly kind: "subscription";
-    /** The plan's size as a multiple of the smallest subscription tier (Max 5x is 5, Max 20x is 20). */
-    readonly capacity: number;
-    /** False when the tier string named no multiplier and no tier this project knows, so `capacity` is the neutral 1 rather than a reading. */
-    readonly recognised: boolean;
-    /** The tier string the classification rests on, when the account had one. */
-    readonly tier?: string;
-} | {
-    readonly kind: "pay-per-use";
-    readonly tier?: string;
-};
-
-/** In pick order. `scored` has usable quota data; `unknown` has none (never recorded, or unreadable); `pay-per-use` bills by use instead of drawing on a plan; `ineligible` is refused right now. */
-type CandidateClass = "scored" | "unknown" | "pay-per-use" | "ineligible";
-interface Candidate {
-    readonly identity: string;
-    readonly class: CandidateClass;
-    /** Plan-size-weighted remaining quota per hour until its reset: higher is more wasted if left unused. Present for `scored` only. */
-    readonly score?: number;
-    /** False when the five-hour window would run dry, at the observed pace, before it resets. A `scored` candidate that is not feasible ranks below every feasible one. */
-    readonly feasible: boolean;
-    /** When an `ineligible` candidate can be used again. */
-    readonly blockedUntilMs?: number;
-    readonly plan: PlanClass;
-    /** Human-readable facts behind the class and score, in the order they matter. */
-    readonly reasons: readonly string[];
-}
-
-/** What `pool pick` reports: the ranking a launch from `directory` would act on right now. */
-interface PoolPickReport {
-    readonly pool: string;
-    readonly directory: string;
-    /** The member a launch would run as, absent when every member is refused. */
-    readonly pick?: string;
-    readonly candidates: readonly PoolPickCandidateView[];
-    /** Members that name an identity that does not exist; a launch skips them. */
-    readonly missing: readonly string[];
-    /** When nothing can be picked, the soonest any member returns. */
-    readonly earliestReturn?: {
-        readonly identity: string;
-        readonly at: string;
-    };
-    /** Why the last-pick record could not be read, when that is the case. */
-    readonly stickyProblem?: string;
-}
-/** One ranked member as `pool pick --json` prints it. */
-interface PoolPickCandidateView {
-    readonly identity: string;
-    readonly class: Candidate["class"];
-    readonly score?: number;
-    readonly feasible: boolean;
-    readonly blockedUntil?: string;
-    readonly plan: Candidate["plan"];
-    readonly reasons: readonly string[];
-}
-
 /**
  * Forward-only encoding of a real working directory into the single directory name Claude Code gives it under `~/.claude/projects/`.
  *
@@ -3209,5 +3731,5 @@ interface PrepareClaudeLaunchOptions {
  */
 declare function prepareClaudeLaunch(options: PrepareClaudeLaunchOptions): LaunchPlan;
 
-export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PoolNameSchema, PoolNotFoundError, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_REQUEST_PARSE_CAP_BYTES, RC_SESSIONS_PATH_PREFIX, ROUTED_PATH_PREFIX, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcInterruptPayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, createLeafCache, createProfile, createRcControlHandler, createRcSessionTracker, describeProviderEndpoint, detectAmbientCredential, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isRcPermissionMode, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, mintLeaf, observingRoutedRoute, parseConnectTarget, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
-export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, Pool, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RcAnswerDecision, RcAnswerDeps, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcDialAnswer, RcDialTarget, RcEventDial, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition };
+export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_REQUEST_PARSE_CAP_BYTES, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, ROUTED_PATH_PREFIX, RcPermissionModeSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcInterruptPayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectPoolPick, createLeafCache, createProfile, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcEventFanout, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, effectiveWindow, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcApiClient, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isRcPermissionMode, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, matchBranch, mintLeaf, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
+export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SseParsedEvent, StickyPick, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation };