claude-use 9.5.0 → 9.6.0

package/dist/types/index.d.ts

@@ -3499,20 +3499,22 @@ interface RcApiDeps {
 /** The context every procedure on the door's typed API runs in: the request's own headers, which the control-token middleware reads the Bearer credential from. */
 interface DoorApiContext {
     readonly headers: IncomingHttpHeaders;
+    /** Registers an action that runs once the response has been fully written, so a procedure whose effect ends the process serving the call (a door restart) never cuts its own answer off. */
+    readonly afterResponse: (action: () => void) => void;
 }
 /** Builds the middleware every procedure on the door's typed API sits behind, whichever router it belongs to: the per-generation owner-only control token, presented as a Bearer credential and checked in constant time like every other capability the door accepts. */
-declare function doorApiAuth(expectedToken: string): _orpc_server.BuilderWithMiddlewares<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, Schema<unknown, unknown>, Record<never, never>, Record<never, never>>;
+declare function doorApiAuth(expectedToken: string): _orpc_server.BuilderWithMiddlewares<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, MergedErrorMap<$ErrorMap, TErrorMap>>;
 /** Builds the typed API's router: one procedure per operation, every one behind the control-token middleware. */
 declare function createRcApiRouter(deps: RcApiDeps): {
     rc: {
-        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+        list: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
             sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
                 id: zod.ZodString;
                 createdAt: zod.ZodNumber;
                 lastSeenAt: zod.ZodNumber;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        status: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             statuses: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
@@ -3535,8 +3537,8 @@ declare function createRcApiRouter(deps: RcApiDeps): {
                 createdAt: zod.ZodNumber;
                 lastSeenAt: zod.ZodNumber;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        pending: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        pending: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             pending: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
@@ -3546,15 +3548,15 @@ declare function createRcApiRouter(deps: RcApiDeps): {
                 summary: zod.ZodString;
                 observedAt: zod.ZodNumber;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        send: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        send: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             text: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        answer: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        answer: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             approve: zod.ZodBoolean;
@@ -3563,23 +3565,23 @@ declare function createRcApiRouter(deps: RcApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        interrupt: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        interrupt: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        setModel: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        setModel: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             model: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        setPermissionMode: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        setPermissionMode: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             mode: zod.ZodEnum<{
                 default: "default";
@@ -3593,24 +3595,24 @@ declare function createRcApiRouter(deps: RcApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        endSession: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        endSession: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             reason: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        getUsage: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        getUsage: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             skipBehaviors: zod.ZodOptional<zod.ZodBoolean>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        getContextUsage: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        getContextUsage: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             detail: zod.ZodOptional<zod.ZodEnum<{
                 summary: "summary";
@@ -3620,8 +3622,8 @@ declare function createRcApiRouter(deps: RcApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        readFile: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        readFile: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             path: zod.ZodString;
             maxBytes: zod.ZodOptional<zod.ZodNumber>;
@@ -3633,37 +3635,37 @@ declare function createRcApiRouter(deps: RcApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        fileSuggestions: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        fileSuggestions: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             query: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        keepAlive: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        keepAlive: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        mcpStatus: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        mcpStatus: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        mcpReconnect: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        mcpReconnect: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             serverName: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        mcpAuthenticate: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        mcpAuthenticate: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             serverName: zod.ZodString;
             redirectUri: zod.ZodString;
@@ -3671,8 +3673,8 @@ declare function createRcApiRouter(deps: RcApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        mcpOAuthCallbackUrl: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        mcpOAuthCallbackUrl: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             serverName: zod.ZodString;
             callbackUrl: zod.ZodString;
@@ -3680,17 +3682,17 @@ declare function createRcApiRouter(deps: RcApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        teleport: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        teleport: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             marker: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        subscribe: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        subscribe: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
-        }, zod_v4_core.$strict>, any, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, any, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
 };
 /** The typed API's router, as the CLI-side client's own type is derived from it. */
@@ -3720,12 +3722,12 @@ declare const CheckReportJsonSchema: z.ZodObject<{
     identity: z.ZodObject<{
         name: z.ZodNullable<z.ZodString>;
         source: z.ZodEnum<{
+            none: "none";
             "config-dir-escape-hatch": "config-dir-escape-hatch";
             argv: "argv";
             env: "env";
             "directory-pin": "directory-pin";
             "active-identity-file": "active-identity-file";
-            none: "none";
         }>;
     }, z.core.$strict>;
     pool: z.ZodOptional<z.ZodObject<{
@@ -3773,8 +3775,8 @@ declare const CheckReportJsonSchema: z.ZodObject<{
         name: z.ZodNullable<z.ZodString>;
         source: z.ZodEnum<{
             "directory-rule": "directory-rule";
-            env: "env";
             none: "none";
+            env: "env";
             "cli-flag": "cli-flag";
             "identity-default": "identity-default";
             "global-default": "global-default";
@@ -4747,6 +4749,113 @@ declare const UsageSnapshotSchema: z.ZodObject<{
 }, z.core.$strict>;
 type UsageSnapshot = z.infer<typeof UsageSnapshotSchema>;
 
+/** The record held in one front-door session-registry file: the launcher's pid plus the per-launch capability token its child presents on every request. */
+declare const FrontDoorSessionSchema: z.ZodObject<{
+    pid: z.ZodNumber;
+    startedAt: z.ZodNumber;
+    token: z.ZodString;
+}, z.core.$strict>;
+type FrontDoorSession = z.infer<typeof FrontDoorSessionSchema>;
+/**
+ * The front-door supervisor's state.json under `<home>/frontdoor/`. Every field is optional because the file exists in stages, exactly like headroom's and the old codex daemon's: a fresh supervisor writes its own pid before the listener is up, and a shut-down front door leaves only the sticky `lastPort` and any `lastError` worth surfacing.
+ */
+declare const FrontDoorStateSchema: z.ZodObject<{
+    protocol: z.ZodOptional<z.ZodNumber>;
+    supervisorPid: z.ZodOptional<z.ZodNumber>;
+    port: z.ZodOptional<z.ZodNumber>;
+    lastPort: z.ZodOptional<z.ZodNumber>;
+    connectPort: z.ZodOptional<z.ZodNumber>;
+    lastConnectPort: z.ZodOptional<z.ZodNumber>;
+    directPort: z.ZodOptional<z.ZodNumber>;
+    lastDirectPort: z.ZodOptional<z.ZodNumber>;
+    lastError: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type FrontDoorState = z.infer<typeof FrontDoorStateSchema>;
+/** A registered launch as status and the idle decision see it: the pid and start time, never the token, so nothing that prints or serialises a session can leak the capability. */
+type FrontDoorSessionSummary = Pick<FrontDoorSession, "pid" | "startedAt">;
+
+/** How a sign-out went: whether OpenAI was told, so the person knows the grant is dead on its side too. */
+interface SiwcLogoutResult {
+    readonly hadGrant: boolean;
+    /** True when the refresh token was revoked at the issuer; false when the revocation call failed (the local grant is removed either way). */
+    readonly revoked: boolean;
+}
+
+/** One session-registry entry plus whether its launcher is still running. */
+interface CodexSessionStatus extends FrontDoorSessionSummary {
+    readonly alive: boolean;
+}
+/** The Sign in with ChatGPT login's state: no sign-in yet, signed in (with who and when the access token lapses), or a file that cannot be read. */
+type SignInStatus = {
+    readonly state: "none";
+} | {
+    readonly state: "signed-in";
+    readonly email: string | undefined;
+    readonly planScope: boolean;
+    readonly accessTokenExpiresAt: number;
+} | {
+    readonly state: "unreadable";
+    readonly message: string;
+};
+/** Everything `agent-shim codex status` reports, collected read-only. */
+interface CodexStatus {
+    /** The front door's state: the codex translation is one route inside the front-door daemon, so its availability is the front door's. */
+    readonly frontDoor: FrontDoorState;
+    readonly supervisorAlive: boolean;
+    readonly sessions: readonly CodexSessionStatus[];
+    /** The codex provider files this AGENT_SHIM_HOME defines. */
+    readonly codexProviders: readonly string[];
+    /** Where the statusline usage snapshot lives. */
+    /** The Sign in with ChatGPT login a provider with `codex.login: "chatgpt-sign-in"` spends. */
+    readonly signIn: SignInStatus;
+    readonly usageSnapshotPath: string;
+    readonly usageSnapshotExists: boolean;
+    readonly logPath: string;
+    readonly logExists: boolean;
+}
+
+/**
+ * The door's Codex sign-in as a typed oRPC API, behind the same per-generation control token as every other procedure on the mount: `codex.status` reports what `agent-shim codex status` reports about the sign-in and the codex providers, and `codex.logout` revokes the Sign in with ChatGPT login and removes it from this machine.
+ *
+ * `codex login` is deliberately not a procedure: the sign-in redirects to a fixed loopback port on the door's host, so a browser on another machine cannot complete it, and a same-host caller has the CLI.
+ */
+/** Everything the Codex procedures need, injected so they serve against fakes in tests exactly as the door's real wiring serves against this machine. */
+interface CodexApiDeps {
+    /** This generation's control token: the same value every other router on the mount checks. */
+    readonly expectedToken: string;
+    /** The codex translation's read-only status, as `collectCodexStatus` collects it. */
+    readonly codexStatus: () => CodexStatus;
+    /** Signs out as `agent-shim codex logout` does: revokes the refresh token at the issuer and removes the grant. */
+    readonly codexLogout: () => Promise<SiwcLogoutResult>;
+}
+/** Builds the Codex router: `codex.status` and `codex.logout`, every one behind the control-token middleware. */
+declare function createCodexApiRouter(deps: CodexApiDeps): {
+    codex: {
+        status: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            signIn: zod.ZodDiscriminatedUnion<[zod.ZodObject<{
+                state: zod.ZodLiteral<"none">;
+            }, zod_v4_core.$strict>, zod.ZodObject<{
+                state: zod.ZodLiteral<"signed-in">;
+                email: zod.ZodOptional<zod.ZodString>;
+                planScope: zod.ZodBoolean;
+                accessTokenExpiresAt: zod.ZodNumber;
+            }, zod_v4_core.$strict>, zod.ZodObject<{
+                state: zod.ZodLiteral<"unreadable">;
+                message: zod.ZodString;
+            }, zod_v4_core.$strict>], "state">;
+            codexProviders: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        logout: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            hadGrant: zod.ZodBoolean;
+            revoked: zod.ZodBoolean;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+    };
+};
+/** The Codex router, as the merged mount's and the client's own types are derived from it. */
+type CodexApiRouter = ReturnType<typeof createCodexApiRouter>;
+/** The Codex procedures alone as a client sees them. */
+type CodexApiClient = RouterClient<CodexApiRouter>;
+
 /**
  * The Zod schemas of the door's event backbone: the envelope every source-tagged event carries, the source filter the subscription takes, and the launch lifecycle's own payload family. The backbone's TypeScript shapes in `eventHub.ts` and `launchEvents.ts` stay the implementations' types; these schemas are what the typed API's contract validates through, and because the backbone's publishers produce those interfaces' values, a drift between a schema and its interface fails the API's own output validation (exercised by its tests) rather than shipping silently. This module deliberately imports nothing from oRPC: it is a plain Zod leaf, so the backbone and its publishers can share it without depending on the API layer.
  */
@@ -4904,36 +5013,393 @@ interface DoorEventsApiDeps {
 /** Builds the events router: one streaming procedure behind the control-token middleware. */
 declare function createEventsApiRouter(deps: DoorEventsApiDeps): {
     events: {
-        subscribe: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        subscribe: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             sources: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
-        }, zod_v4_core.$strict>, any, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, any, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
 };
 
-/** The record held in one front-door session-registry file: the launcher's pid plus the per-launch capability token its child presents on every request. */
-declare const FrontDoorSessionSchema: z.ZodObject<{
-    pid: z.ZodNumber;
-    startedAt: z.ZodNumber;
-    token: z.ZodString;
-}, z.core.$strict>;
-type FrontDoorSession = z.infer<typeof FrontDoorSessionSchema>;
+/** What `agent-shim update` reports: the versions compared and what it did about them. */
+interface UpdateReport {
+    readonly current: string;
+    readonly latest: string;
+    /** `current` when nothing was needed, `available` when `--check` found a newer release and changed nothing, `updated` when the new binary was installed. */
+    readonly action: "current" | "available" | "updated";
+}
+
 /**
- * The front-door supervisor's state.json under `<home>/frontdoor/`. Every field is optional because the file exists in stages, exactly like headroom's and the old codex daemon's: a fresh supervisor writes its own pid before the listener is up, and a shut-down front door leaves only the sticky `lastPort` and any `lastError` worth surfacing.
+ * The door's lifecycle operations as a typed oRPC API, behind the same per-generation control token as every other procedure on the mount: `frontdoor.restart` replaces the serving door in place, and `update.check` reports whether a newer release exists, the report `agent-shim update --check` prints.
+ *
+ * Applying an update is deliberately not a procedure: `update --mode auto` already installs releases on launch and restarts the door on every automatic update, so a network trigger would add the most dangerous call in the API (replacing the running program) for a case the mode covers.
  */
-declare const FrontDoorStateSchema: z.ZodObject<{
-    protocol: z.ZodOptional<z.ZodNumber>;
-    supervisorPid: z.ZodOptional<z.ZodNumber>;
-    port: z.ZodOptional<z.ZodNumber>;
-    lastPort: z.ZodOptional<z.ZodNumber>;
-    connectPort: z.ZodOptional<z.ZodNumber>;
-    lastConnectPort: z.ZodOptional<z.ZodNumber>;
-    directPort: z.ZodOptional<z.ZodNumber>;
-    lastDirectPort: z.ZodOptional<z.ZodNumber>;
-    lastError: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-type FrontDoorState = z.infer<typeof FrontDoorStateSchema>;
-/** A registered launch as status and the idle decision see it: the pid and start time, never the token, so nothing that prints or serialises a session can leak the capability. */
-type FrontDoorSessionSummary = Pick<FrontDoorSession, "pid" | "startedAt">;
+/** Everything the lifecycle procedures need, injected so they serve against fakes in tests exactly as the door's real wiring serves against this machine. */
+interface LifecycleApiDeps {
+    /** This generation's control token: the same value every other router on the mount checks. */
+    readonly expectedToken: string;
+    /** The pid of the door process serving the call, which is the generation a restart replaces. */
+    readonly doorPid: number;
+    /** Replaces the serving door in place. The replacement ends the process answering the call, so the procedure runs this only once its own answer has been written. */
+    readonly restartDoor: () => void;
+    /** The update check as `agent-shim update --check` makes it: nothing is downloaded or changed. */
+    readonly checkForUpdate: () => Promise<UpdateReport>;
+}
+/** Builds the lifecycle routers: `frontdoor.restart` and `update.check`, every one behind the control-token middleware. */
+declare function createLifecycleApiRouter(deps: LifecycleApiDeps): {
+    frontdoor: {
+        restart: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            action: zod.ZodLiteral<"restarting">;
+            previousPid: zod.ZodInt;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+    };
+    update: {
+        check: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            current: zod.ZodString;
+            latest: zod.ZodString;
+            action: zod.ZodEnum<{
+                current: "current";
+                available: "available";
+                updated: "updated";
+            }>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+    };
+};
+/** The lifecycle routers, as the merged mount's and the client's own types are derived from them. */
+type LifecycleApiRouter = ReturnType<typeof createLifecycleApiRouter>;
+/** The lifecycle procedures alone as a client sees them. */
+type LifecycleApiClient = RouterClient<LifecycleApiRouter>;
+
+/** What a launch's one-off command-line/environment overrides resolve to: the `cliOverride` layer `src/resolve/walk.ts`'s `assembleCascade` composes last, so it beats every other layer. */
+interface CliOverride {
+    readonly categories?: CategoryMap;
+    readonly entries?: Entries;
+    readonly launch?: {
+        readonly provider?: string;
+    };
+}
+
+/** The fully resolved launch flags for one launch. */
+interface ResolvedLaunchFlags {
+    readonly skipPermissions: boolean;
+    readonly remoteControl: boolean;
+    readonly headroom: boolean;
+    /** Whether the launch routes through the front door so its requests are recorded, even with no provider and no headroom. */
+    readonly trackUsage: boolean;
+}
+
+/**
+ * Everything the launch-time update check needs from its host, injected so tests run it against scripted answers and no launch ever reaches GitHub by accident. Deliberately narrower than `UpdatePorts`: the launch path never downloads anything (the detached `agent-shim update` does), so only the release check, the cooldown stamp, the clock, the background spawn and the terminal are wired.
+ */
+interface UpdateLaunchPort {
+    /** Resolves the URL the `releases/latest` redirect lands on, exactly as `agent-shim update` resolves the newest version. */
+    readonly effectiveUrl: (url: string) => Promise<string>;
+    /** Reads the cooldown stamp, or undefined when it does not exist. */
+    readonly readStamp: (filePath: string) => string | undefined;
+    /** Writes the cooldown stamp atomically: a reader either sees the previous whole stamp or the new one, never a partial write. */
+    readonly writeStamp: (filePath: string, contents: string) => void;
+    /** The clock the cooldown reads, in epoch milliseconds. */
+    readonly now: () => number;
+    /** Re-invokes this very binary with `args` as a detached child whose stdio is ignored and which is unref'd, so it outlives the launch and never holds the terminal. */
+    readonly spawnDetached: (args: readonly string[]) => void;
+    /** Writes one line to the launching terminal's stderr. */
+    readonly writeErr: (line: string) => void;
+}
+
+/**
+ * Everything the farm resync needs that the launcher itself has no way to produce: a real filesystem, a real clock, the working directory, and a way to load the cascade for it.
+ *
+ * Supplied by `src/cli.ts` in normal operation. A caller that omits it launches with no farm at all, which is the right behaviour in exactly the cases where there is no agent-shim-managed farm to resync — and is what the launcher's own pre-farm tests exercise.
+ */
+interface FarmRuntime {
+    readonly fs: FarmFs;
+    /** The canonical `~/.claude` every farm symlink points back into. */
+    readonly claudeHome: string;
+    readonly home: string;
+    readonly cwd: string;
+    /** The git branch at `cwd`, for `when: { branch }` conditions. Undefined when `cwd` is not in a repository. */
+    readonly branch?: string;
+    readonly branchDetached?: boolean;
+    readonly classification: {
+        readonly defaults: CategoryClassification;
+        readonly overlay?: CategoryClassificationOverlay;
+    };
+    /** Loads and assembles the cascade for `cwd` under the given configuration profile and one-off command-line/environment overrides. Injected so the launcher never reads a config file itself. */
+    readonly loadCascade: (baseConfigProfile: string | undefined, cliOverride: CliOverride | undefined) => CascadeInput;
+    readonly now: () => number;
+    /** Distinguishes this process's scratch and superseded farm directories from any other's. */
+    readonly uniqueSuffix: string;
+    readonly lock: {
+        readonly pid: number;
+        readonly isRunning: (pid: number) => boolean;
+        readonly sleep: (ms: number) => void;
+        readonly staleAfterMs?: number;
+        readonly retryDelayMs?: number;
+        readonly maxAttempts?: number;
+    };
+}
+/** Inputs to `prepareLaunch`: everything a launch needs except the means of spawning the child. */
+interface PrepareLaunchParams {
+    readonly paths: LayoutPaths;
+    readonly fs: FsPort;
+    readonly proc: ProcPort;
+    readonly log: LogPort;
+    /** Discovers the real `claude` binary to spawn. Injected so `runLauncher` never depends on `src/versionDiscovery.ts`'s own filesystem/PATH inputs directly — the caller (`src/cli.ts`) wires the real discovery, tests wire a fake that returns a fixed path. */
+    readonly resolveClaudeBinary: ClaudeBinaryResolver;
+    /** An identity pinned to `$PWD` by a directory rule. Accepted as an already-resolved value — the rules-loading code that produces it lands in Phase 4/5. */
+    readonly directoryPinnedIdentity?: string;
+    /** A directory rule's `configProfile` selection for `$PWD`. Accepted as an already-resolved value for the same reason. */
+    readonly directoryRuleConfigProfile?: string;
+    /** An explicit `--config-profile` value, when the caller wants to force one regardless of argv — normal operation instead relies on `parseLauncherArgv` finding `--config-profile` in `proc.argv` itself, so this is only needed to override that. */
+    readonly cliFlagConfigProfile?: string;
+    /** The user-global `~/.agent-shim/config.json` default configuration profile, when one is configured. */
+    readonly globalDefaultConfigProfile?: string;
+    /** The user-global `pools`, which a `pool:<name>` selector picks a member of. */
+    readonly pools?: Readonly<Record<string, Pool>>;
+    /** Wires the farm resync. Omitted only by a caller that has no farm to manage. */
+    readonly farm?: FarmRuntime;
+    /** Wires headroom routing. Omitted by a caller that cannot route through the daemon; a launch that resolves `headroom` on with no port wired is refused loudly rather than silently bypassing it. */
+    readonly headroom?: HeadroomPort;
+    /** Wires the front-door daemon. Omitted by a caller that cannot run it; a launch that routes anything (a provider, or headroom) with no port wired is refused rather than started against an address nothing serves. */
+    readonly frontdoor?: FrontDoorPort;
+    /** Resolves credential blocks (a provider's, or the launching identity's own). Omitted by a caller that cannot read secret files or run commands; a launch that needs a credential is then refused rather than started without it. */
+    readonly credentials?: CredentialPort;
+    /** True when the user was asked on a terminal whether to create the selected configuration profile and chose to launch without it. Without that explicit choice, a selected profile with no file is refused rather than silently skipped. */
+    readonly allowMissingConfigProfile?: boolean;
+    /** The user-global `update.mode`, resolved from the same global config the launcher already loads. Absent means `off`, and `off` runs no launch-time update check at all. */
+    readonly updateMode?: UpdateMode;
+    /** Wires the launch-time update check behind `update.mode`. Omitted by a caller that cannot resolve releases, re-invoke this binary, or write to the terminal; a mode of `notify` or `auto` with no port wired simply checks nothing. */
+    readonly update?: UpdateLaunchPort;
+}
+/** Inputs to `runLauncher`: a launch's inputs plus the port that spawns the child. */
+interface RunLauncherParams extends PrepareLaunchParams {
+    readonly spawn: SpawnPort;
+}
+/** The pick a pool made for a launch: the pool, why the ranking chose the member it did, and, for a resumed conversation, the member it left. */
+interface LaunchPoolDecision {
+    /** The pool the launch selected with `pool:<name>`. */
+    readonly name: string;
+    /** Every reason the ranking gave for the chosen member, in the ranking's order. */
+    readonly reasons: readonly string[];
+    /** The member a resumed conversation left, and why the ranking could not keep it. */
+    readonly movedOff?: {
+        readonly identity: string;
+        readonly reason: string;
+    };
+}
+/**
+ * What a launch resolved to, and where each decision came from. Everything here is a name or a path, never a credential.
+ */
+interface LaunchDecision {
+    /** The identity the launch runs as. Absent when the escape hatch applied or nothing resolved one. */
+    readonly identity?: string;
+    /** Which precedence rule selected the identity (or the pool the identity was picked from). */
+    readonly identitySource: IdentityDecisionSource;
+    /** The pool pick behind `identity`, when the launch selected a pool. */
+    readonly pool?: LaunchPoolDecision;
+    /** True when `CLAUDE_CONFIG_DIR` was already set, so no identity was resolved and no farm was managed. */
+    readonly configDirEscapeHatch: boolean;
+    /** The configuration directory the child runs with: the identity's own, or the one the caller named. Absent when none is set. */
+    readonly configDir?: string;
+    /** The configuration profile that applied, when one did. */
+    readonly configProfile?: string;
+    /** Which precedence rule selected the configuration profile. */
+    readonly configProfileSource: ConfigProfileDecisionSource;
+    /** The provider the launch routes through, when it selected one. */
+    readonly provider?: string;
+}
+/**
+ * What one launch resolved to, once every effect its child depends on is in place (the identity's farm resynced, the front door and headroom up and this launch registered with them): the real binary, its arguments and its environment.
+ */
+interface LaunchPlan {
+    readonly bin: string;
+    readonly args: readonly string[];
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /** Releases the daemon session registrations this launch holds. Call it when the child has exited; it is safe to call more than once. */
+    readonly release: () => void;
+    /** What the launch resolved to, as data: the facts the launcher's decision line reports. */
+    readonly decision: LaunchDecision;
+    /** Marks the moment this plan's child is spawned: the launch-time update check suppresses its notify line from then on, since a line printed after the child took over the terminal would land mid-session. Call it immediately before spawning; it is safe to call more than once. */
+    readonly markChildStarted: () => void;
+}
+/**
+ * Prepares one `claude` launch, in order:
+ *
+ * `CLAUDE_CONFIG_DIR` escape-hatch check, then the identity/config-profile decision, the provider decision, the identity's own credential, the ambient-credential guard, the config-gated launch-time update check (fired after the decision line and never awaited; see `runLaunchUpdateCheck`), farm resync, version discovery, flag resolution (and, when headroom resolved on, daemon bring-up), the extra-flags split, and the final argument list and environment, returned as a `LaunchPlan` for the caller to spawn. It refuses through `params.proc.exit`, so a caller that is not a command line process passes a `proc` whose `exit` throws.
+ *
+ * A launch that resolves an identity with no `identity.json`, or a configuration profile with no file, is refused with exit 1 naming the missing name and how it was selected: silently proceeding would create a brand-new login for a mistyped `@name`, or launch with a whole cascade layer missing. On a terminal, `src/runClaude.ts` offers to create either before this runs.
+ *
+ * The farm resync is skipped when `CLAUDE_CONFIG_DIR` was already set (the escape hatch means the user has named a configuration directory explicitly, and agent-shim manages neither its contents nor its lifetime) and when no identity resolved at all (a bare launch against plain `~/.claude`, matching the legacy tool's own behaviour). In both cases there is no agent-shim-managed farm for a resync to act on.
+ */
+declare function prepareLaunch(params: PrepareLaunchParams): LaunchPlan;
+/**
+ * What one launch would resolve to, reported without performing it: the decision, the resolved launch flags, the binary and argument list, the credential that would apply (by its block, never a token) and the names of the environment variables the launch would set.
+ */
+interface LaunchResolution {
+    /** What the launch resolved to, as data: the same decision a real launch reports. */
+    readonly decision: LaunchDecision;
+    /** The launch flags after the command line, the environment and the cascade have each had their say. */
+    readonly flags: ResolvedLaunchFlags;
+    /** The Claude Code version the launch pins, and what pinned it, when it pins one. */
+    readonly claudeVersion?: PinnedClaudeVersion;
+    /** The real `claude` binary the launch would spawn. */
+    readonly bin: string;
+    /** The arguments the launch would pass it. */
+    readonly args: readonly string[];
+    /** The credential the launch would authenticate with, summarised by target and source kinds. Absent when none applies. */
+    readonly credential?: {
+        readonly subject: "provider" | "identity";
+        readonly name: string;
+        readonly summary: CredentialSummary;
+    };
+    /** Which daemons the launch would route through. */
+    readonly routing: {
+        readonly frontDoor: boolean;
+        readonly headroom: boolean;
+    };
+    /** The names of the environment variables the launch would set or unset, sorted. Values are never reported: the launcher's environment carries tokens and per-launch capabilities that mean nothing outside it. */
+    readonly environment: readonly string[];
+}
+/**
+ * Resolves one launch exactly as `prepareLaunch` decides it and reports the result, changing nothing: no farm recovery or resync, no daemon started or session registered, no pool pick recorded or waited for, no credential command run or token read.
+ *
+ * Refusals surface as `prepareLaunch` surfaces them: logged through `params.log` and ended in `params.proc.exit`.
+ */
+declare function resolveLaunch(params: PrepareLaunchParams): LaunchResolution;
+/**
+ * Runs the child a `plan` describes under `spawn` and returns its exit code, in the order every launch observes: the update check's notice is suppressed from the moment the child takes the terminal, the child runs to completion, and the plan's session registrations are released whether it exited, was signalled or could not be spawned. A spawn failure is thrown after the release rather than turned into an exit code.
+ */
+declare function runLaunchPlan(plan: LaunchPlan, spawn: SpawnPort): number;
+/**
+ * Runs one `claude` launch: `prepareLaunch`, then the child under `params.spawn`, whose exit code becomes this process's.
+ *
+ * The session registrations are released by `runLaunchPlan` before `proc.exit` runs, because the real `process.exit` never unwinds a `finally` block.
+ */
+declare function runLauncher(params: RunLauncherParams): void;
+
+/**
+ * The door's launch resolution as a typed oRPC API: what a launch from one directory would resolve to, as data, so a consumer that picks identities and spawns sessions elsewhere can ask the door for the decision without running the launcher.
+ *
+ * `launch.resolve` is the launcher's own decision (identity, pool pick, configuration profile, provider, launch flags, pinned version, binary and arguments) with its effects left out: nothing is spawned, the farm is not touched, no daemon is started or session registered, no pool pick is recorded, and no credential is resolved, so the answer names a credential by its block and never carries a token. It spawns nothing by design: a procedure that starts a process on the door's host with caller-chosen arguments is remote command execution, so the consumer spawns from the answer on its own host.
+ */
+/** Everything the launch procedures need, injected so they serve against fakes in tests exactly as the door's real wiring serves against this machine. */
+interface LaunchApiDeps {
+    /** This generation's control token: the same value every router on the mount checks. */
+    readonly expectedToken: string;
+    /** Resolves one launch from a directory without performing it, returning the resolution and the warnings it raised. A refusal is thrown as the launcher raises it (a `CliError`). */
+    readonly resolveLaunch: (request: {
+        readonly path: string;
+        readonly argv: readonly string[];
+        readonly env: Readonly<Record<string, string>>;
+    }) => {
+        readonly resolution: LaunchResolution;
+        readonly warnings: readonly string[];
+    };
+}
+/** Builds the launch router: one read, behind the control-token middleware. */
+declare function createLaunchApiRouter(deps: LaunchApiDeps): {
+    launch: {
+        resolve: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
+            path: zod.ZodString;
+            argv: zod.ZodOptional<zod.ZodReadonly<zod.ZodArray<zod.ZodString>>>;
+            env: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodString>>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            decision: zod.ZodObject<{
+                identity: zod.ZodOptional<zod.ZodString>;
+                identitySource: zod.ZodEnum<{
+                    none: "none";
+                    "config-dir-escape-hatch": "config-dir-escape-hatch";
+                    argv: "argv";
+                    env: "env";
+                    "directory-pin": "directory-pin";
+                    "active-identity-file": "active-identity-file";
+                }>;
+                pool: zod.ZodOptional<zod.ZodObject<{
+                    name: zod.ZodString;
+                    reasons: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+                    movedOff: zod.ZodOptional<zod.ZodObject<{
+                        identity: zod.ZodString;
+                        reason: zod.ZodString;
+                    }, zod_v4_core.$strict>>;
+                }, zod_v4_core.$strict>>;
+                configDirEscapeHatch: zod.ZodBoolean;
+                configDir: zod.ZodOptional<zod.ZodString>;
+                configProfile: zod.ZodOptional<zod.ZodString>;
+                configProfileSource: zod.ZodEnum<{
+                    "directory-rule": "directory-rule";
+                    none: "none";
+                    env: "env";
+                    "cli-flag": "cli-flag";
+                    "identity-default": "identity-default";
+                    "global-default": "global-default";
+                }>;
+                provider: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>;
+            flags: zod.ZodObject<{
+                skipPermissions: zod.ZodBoolean;
+                remoteControl: zod.ZodBoolean;
+                headroom: zod.ZodBoolean;
+                trackUsage: zod.ZodBoolean;
+            }, zod_v4_core.$strict>;
+            claudeVersion: zod.ZodOptional<zod.ZodObject<{
+                version: zod.ZodString;
+                source: zod.ZodEnum<{
+                    flag: "flag";
+                    environment: "environment";
+                    cascade: "cascade";
+                }>;
+            }, zod_v4_core.$strict>>;
+            bin: zod.ZodString;
+            args: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+            credential: zod.ZodOptional<zod.ZodObject<{
+                subject: zod.ZodEnum<{
+                    identity: "identity";
+                    provider: "provider";
+                }>;
+                name: zod.ZodString;
+                summary: zod.ZodObject<{
+                    target: zod.ZodEnum<{
+                        bearer: "bearer";
+                        apiKey: "apiKey";
+                        oauthToken: "oauthToken";
+                    }>;
+                    sources: zod.ZodReadonly<zod.ZodArray<zod.ZodUnion<readonly [zod.ZodObject<{
+                        kind: zod.ZodLiteral<"env">;
+                        variable: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"file">;
+                        path: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"command">;
+                        program: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"op">;
+                        reference: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"keychain">;
+                        service: zod.ZodString;
+                        account: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"literal">;
+                    }, zod_v4_core.$strict>]>>>;
+                    cache: zod.ZodOptional<zod.ZodObject<{
+                        ttl: zod.ZodOptional<zod.ZodString>;
+                        store: zod.ZodOptional<zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>>;
+                    }, zod_v4_core.$strict>>;
+                }, zod_v4_core.$strict>;
+            }, zod_v4_core.$strict>>;
+            routing: zod.ZodObject<{
+                frontDoor: zod.ZodBoolean;
+                headroom: zod.ZodBoolean;
+            }, zod_v4_core.$strict>;
+            environment: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+            warnings: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+    };
+};
+/** The launch router, as the merged mount's and the client's own types are derived from it. */
+type LaunchApiRouter = ReturnType<typeof createLaunchApiRouter>;
 
 /**
  * The front door's read-only status: the data `agent-shim frontdoor status` prints and the door's own typed `frontdoor.status` procedure returns, collected without starting or stopping anything. Kept here, beside the state file and session registry it reads, so both the command layer and the typed API's schema layer share one shape and one collector with no dependency on the CLI's command wiring.
@@ -4969,7 +5435,7 @@ declare function formatFrontDoorStatus(status: FrontDoorStatus, caCertPath: stri
  * - `check.run` and `doctor.run` return the reports `agent-shim check` and `agent-shim doctor` print, as data, `check.run` parameterised by an absolute directory path.
  * - `pool.pick` returns what `agent-shim pool pick` prints, the ranked pick for one pool exactly as a launch from the named absolute directory would make it right now, so a programmatic consumer can ask which identity to use without reading the door host's files.
  *
- * Read-only by design: identity, configuration-profile, provider, pool and directory-rule management stay CLI-side, and adding writes over this mount is a decision of its own rather than a gap here. `createDoorApiNodeHandler` mounts these routers and the door-wide `events.subscribe` router beside the Remote Control router on the one prefix the provider listener already serves, so a consumer dials one address with one token for the whole door.
+ * This router is reads only; the door's writes live in routers of their own so each is a decision of its own (`lifecycleApi.ts` for the restart and the update check, `codexApi.ts` for the Codex sign-in), and identity, configuration-profile, provider, pool and directory-rule management stay CLI-side. `createDoorApiNodeHandler` mounts these routers and the door-wide `events.subscribe` router beside the Remote Control router on the one prefix the provider listener already serves, so a consumer dials one address with one token for the whole door.
  */
 /** Everything the control-plane procedures need, injected so they serve against fakes in tests exactly as the door's real wiring serves against this machine. */
 interface ControlApiDeps {
@@ -5001,7 +5467,7 @@ interface ControlApiDeps {
 /** Builds the control-plane routers: one procedure per read, every one behind the control-token middleware. */
 declare function createControlApiRouter(deps: ControlApiDeps): {
     usage: {
-        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+        list: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
             snapshots: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
                 schemaVersion: zod.ZodLiteral<1>;
                 identity: zod.ZodString;
@@ -5095,8 +5561,8 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     }, zod_v4_core.$strict>>;
                 }, zod_v4_core.$strict>>;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        effectiveWindow: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        effectiveWindow: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             identity: zod.ZodString;
             provider: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
@@ -5115,8 +5581,8 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                 resetsAtMs: zod.ZodOptional<zod.ZodNumber>;
                 status: zod.ZodOptional<zod.ZodString>;
             }, zod_v4_core.$strict>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        live: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        live: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             latest: zod.ZodOptional<zod.ZodObject<{
@@ -5173,10 +5639,10 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     }, zod_v4_core.$loose>>;
                 }, zod_v4_core.$loose>;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
     frontdoor: {
-        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+        status: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
             state: zod.ZodObject<{
                 protocol: zod.ZodOptional<zod.ZodNumber>;
                 supervisorPid: zod.ZodOptional<zod.ZodNumber>;
@@ -5201,29 +5667,29 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
             }, zod_v4_core.$strict>]>>;
             logPath: zod.ZodString;
             logExists: zod.ZodBoolean;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        sessions: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        sessions: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
             sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
                 pid: zod.ZodInt;
                 startedAt: zod.ZodNumber;
                 alive: zod.ZodBoolean;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
     check: {
-        run: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        run: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             path: zod.ZodString;
             identity: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             identity: zod.ZodObject<{
                 name: zod.ZodNullable<zod.ZodString>;
                 source: zod.ZodEnum<{
+                    none: "none";
                     "config-dir-escape-hatch": "config-dir-escape-hatch";
                     argv: "argv";
                     env: "env";
                     "directory-pin": "directory-pin";
                     "active-identity-file": "active-identity-file";
-                    none: "none";
                 }>;
             }, zod_v4_core.$strict>;
             pool: zod.ZodOptional<zod.ZodObject<{
@@ -5271,8 +5737,8 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                 name: zod.ZodNullable<zod.ZodString>;
                 source: zod.ZodEnum<{
                     "directory-rule": "directory-rule";
-                    env: "env";
                     none: "none";
+                    env: "env";
                     "cli-flag": "cli-flag";
                     "identity-default": "identity-default";
                     "global-default": "global-default";
@@ -5514,10 +5980,10 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                 highestInstalled: zod.ZodOptional<zod.ZodString>;
                 installed: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
             }, zod_v4_core.$strict>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
     doctor: {
-        run: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+        run: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
             ok: zod.ZodBoolean;
             findings: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
                 section: zod.ZodEnum<{
@@ -5526,12 +5992,12 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     identity: "identity";
                     provider: "provider";
                     pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
+                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -5545,10 +6011,10 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                 }>;
                 message: zod.ZodString;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
     pool: {
-        pick: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        pick: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             pool: zod.ZodString;
             path: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
@@ -5591,7 +6057,7 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                 reason: zod.ZodString;
             }, zod_v4_core.$strict>>;
             stickyProblem: zod.ZodOptional<zod.ZodString>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
 };
 /** The control-plane routers, as the merged mount's and the client's own types are derived from them. */
@@ -5599,17 +6065,188 @@ type ControlApiRouter = ReturnType<typeof createControlApiRouter>;
 /** The control plane alone as a client sees it: every call presents the control token, over TLS trusting only the CA file the door's own state names. */
 type ControlApiClient = RouterClient<ControlApiRouter>;
 /** Everything the door's whole typed API needs: the Remote Control operations, the control-plane reads and the door-wide event stream, one deps object because one mount serves them under one token. */
-interface DoorApiDeps extends RcApiDeps, ControlApiDeps, DoorEventsApiDeps {
+interface DoorApiDeps extends RcApiDeps, ControlApiDeps, DoorEventsApiDeps, LifecycleApiDeps, CodexApiDeps, LaunchApiDeps {
 }
 /** Builds the door's whole typed API: the Remote Control router, the control-plane routers and the events router beside them, one object for the one handler the provider listener mounts. */
 declare function createDoorApiRouter(deps: DoorApiDeps): {
+    frontdoor: {
+        restart: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            action: zod.ZodLiteral<"restarting">;
+            previousPid: zod.ZodInt;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        status: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            state: zod.ZodObject<{
+                protocol: zod.ZodOptional<zod.ZodNumber>;
+                supervisorPid: zod.ZodOptional<zod.ZodNumber>;
+                port: zod.ZodOptional<zod.ZodNumber>;
+                lastPort: zod.ZodOptional<zod.ZodNumber>;
+                connectPort: zod.ZodOptional<zod.ZodNumber>;
+                lastConnectPort: zod.ZodOptional<zod.ZodNumber>;
+                directPort: zod.ZodOptional<zod.ZodNumber>;
+                lastDirectPort: zod.ZodOptional<zod.ZodNumber>;
+                lastError: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>;
+            supervisorAlive: zod.ZodBoolean;
+            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                pid: zod.ZodInt;
+                startedAt: zod.ZodNumber;
+                alive: zod.ZodBoolean;
+            }, zod_v4_core.$strict>>>;
+            headroomSocket: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                socketPath: zod.ZodString;
+            }, zod_v4_core.$strict>, zod.ZodObject<{
+                refused: zod.ZodString;
+            }, zod_v4_core.$strict>]>>;
+            logPath: zod.ZodString;
+            logExists: zod.ZodBoolean;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        sessions: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
+                pid: zod.ZodInt;
+                startedAt: zod.ZodNumber;
+                alive: zod.ZodBoolean;
+            }, zod_v4_core.$strict>>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+    };
     events: {
-        subscribe: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        subscribe: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             sources: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
-        }, zod_v4_core.$strict>, any, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, any, MergedErrorMap<$ErrorMap, TErrorMap>>;
+    };
+    launch: {
+        resolve: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
+            path: zod.ZodString;
+            argv: zod.ZodOptional<zod.ZodReadonly<zod.ZodArray<zod.ZodString>>>;
+            env: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodString>>;
+        }, zod_v4_core.$strict>, zod.ZodObject<{
+            decision: zod.ZodObject<{
+                identity: zod.ZodOptional<zod.ZodString>;
+                identitySource: zod.ZodEnum<{
+                    none: "none";
+                    "config-dir-escape-hatch": "config-dir-escape-hatch";
+                    argv: "argv";
+                    env: "env";
+                    "directory-pin": "directory-pin";
+                    "active-identity-file": "active-identity-file";
+                }>;
+                pool: zod.ZodOptional<zod.ZodObject<{
+                    name: zod.ZodString;
+                    reasons: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+                    movedOff: zod.ZodOptional<zod.ZodObject<{
+                        identity: zod.ZodString;
+                        reason: zod.ZodString;
+                    }, zod_v4_core.$strict>>;
+                }, zod_v4_core.$strict>>;
+                configDirEscapeHatch: zod.ZodBoolean;
+                configDir: zod.ZodOptional<zod.ZodString>;
+                configProfile: zod.ZodOptional<zod.ZodString>;
+                configProfileSource: zod.ZodEnum<{
+                    "directory-rule": "directory-rule";
+                    none: "none";
+                    env: "env";
+                    "cli-flag": "cli-flag";
+                    "identity-default": "identity-default";
+                    "global-default": "global-default";
+                }>;
+                provider: zod.ZodOptional<zod.ZodString>;
+            }, zod_v4_core.$strict>;
+            flags: zod.ZodObject<{
+                skipPermissions: zod.ZodBoolean;
+                remoteControl: zod.ZodBoolean;
+                headroom: zod.ZodBoolean;
+                trackUsage: zod.ZodBoolean;
+            }, zod_v4_core.$strict>;
+            claudeVersion: zod.ZodOptional<zod.ZodObject<{
+                version: zod.ZodString;
+                source: zod.ZodEnum<{
+                    flag: "flag";
+                    environment: "environment";
+                    cascade: "cascade";
+                }>;
+            }, zod_v4_core.$strict>>;
+            bin: zod.ZodString;
+            args: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+            credential: zod.ZodOptional<zod.ZodObject<{
+                subject: zod.ZodEnum<{
+                    identity: "identity";
+                    provider: "provider";
+                }>;
+                name: zod.ZodString;
+                summary: zod.ZodObject<{
+                    target: zod.ZodEnum<{
+                        bearer: "bearer";
+                        apiKey: "apiKey";
+                        oauthToken: "oauthToken";
+                    }>;
+                    sources: zod.ZodReadonly<zod.ZodArray<zod.ZodUnion<readonly [zod.ZodObject<{
+                        kind: zod.ZodLiteral<"env">;
+                        variable: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"file">;
+                        path: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"command">;
+                        program: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"op">;
+                        reference: zod.ZodString;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"keychain">;
+                        service: zod.ZodString;
+                        account: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>, zod.ZodObject<{
+                        kind: zod.ZodLiteral<"literal">;
+                    }, zod_v4_core.$strict>]>>>;
+                    cache: zod.ZodOptional<zod.ZodObject<{
+                        ttl: zod.ZodOptional<zod.ZodString>;
+                        store: zod.ZodOptional<zod.ZodEnum<{
+                            file: "file";
+                            keychain: "keychain";
+                        }>>;
+                    }, zod_v4_core.$strict>>;
+                }, zod_v4_core.$strict>;
+            }, zod_v4_core.$strict>>;
+            routing: zod.ZodObject<{
+                frontDoor: zod.ZodBoolean;
+                headroom: zod.ZodBoolean;
+            }, zod_v4_core.$strict>;
+            environment: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+            warnings: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+    };
+    codex: {
+        status: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            signIn: zod.ZodDiscriminatedUnion<[zod.ZodObject<{
+                state: zod.ZodLiteral<"none">;
+            }, zod_v4_core.$strict>, zod.ZodObject<{
+                state: zod.ZodLiteral<"signed-in">;
+                email: zod.ZodOptional<zod.ZodString>;
+                planScope: zod.ZodBoolean;
+                accessTokenExpiresAt: zod.ZodNumber;
+            }, zod_v4_core.$strict>, zod.ZodObject<{
+                state: zod.ZodLiteral<"unreadable">;
+                message: zod.ZodString;
+            }, zod_v4_core.$strict>], "state">;
+            codexProviders: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        logout: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            hadGrant: zod.ZodBoolean;
+            revoked: zod.ZodBoolean;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+    };
+    update: {
+        check: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
+            current: zod.ZodString;
+            latest: zod.ZodString;
+            action: zod.ZodEnum<{
+                current: "current";
+                available: "available";
+                updated: "updated";
+            }>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
     usage: {
-        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+        list: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
             snapshots: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
                 schemaVersion: zod.ZodLiteral<1>;
                 identity: zod.ZodString;
@@ -5703,8 +6340,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     }, zod_v4_core.$strict>>;
                 }, zod_v4_core.$strict>>;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        effectiveWindow: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        effectiveWindow: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             identity: zod.ZodString;
             provider: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
@@ -5723,8 +6360,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 resetsAtMs: zod.ZodOptional<zod.ZodNumber>;
                 status: zod.ZodOptional<zod.ZodString>;
             }, zod_v4_core.$strict>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        live: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        live: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             latest: zod.ZodOptional<zod.ZodObject<{
@@ -5781,57 +6418,22 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     }, zod_v4_core.$loose>>;
                 }, zod_v4_core.$loose>;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-    };
-    frontdoor: {
-        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
-            state: zod.ZodObject<{
-                protocol: zod.ZodOptional<zod.ZodNumber>;
-                supervisorPid: zod.ZodOptional<zod.ZodNumber>;
-                port: zod.ZodOptional<zod.ZodNumber>;
-                lastPort: zod.ZodOptional<zod.ZodNumber>;
-                connectPort: zod.ZodOptional<zod.ZodNumber>;
-                lastConnectPort: zod.ZodOptional<zod.ZodNumber>;
-                directPort: zod.ZodOptional<zod.ZodNumber>;
-                lastDirectPort: zod.ZodOptional<zod.ZodNumber>;
-                lastError: zod.ZodOptional<zod.ZodString>;
-            }, zod_v4_core.$strict>;
-            supervisorAlive: zod.ZodBoolean;
-            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
-                pid: zod.ZodInt;
-                startedAt: zod.ZodNumber;
-                alive: zod.ZodBoolean;
-            }, zod_v4_core.$strict>>>;
-            headroomSocket: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
-                socketPath: zod.ZodString;
-            }, zod_v4_core.$strict>, zod.ZodObject<{
-                refused: zod.ZodString;
-            }, zod_v4_core.$strict>]>>;
-            logPath: zod.ZodString;
-            logExists: zod.ZodBoolean;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        sessions: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
-            sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
-                pid: zod.ZodInt;
-                startedAt: zod.ZodNumber;
-                alive: zod.ZodBoolean;
-            }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
     check: {
-        run: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        run: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             path: zod.ZodString;
             identity: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             identity: zod.ZodObject<{
                 name: zod.ZodNullable<zod.ZodString>;
                 source: zod.ZodEnum<{
+                    none: "none";
                     "config-dir-escape-hatch": "config-dir-escape-hatch";
                     argv: "argv";
                     env: "env";
                     "directory-pin": "directory-pin";
                     "active-identity-file": "active-identity-file";
-                    none: "none";
                 }>;
             }, zod_v4_core.$strict>;
             pool: zod.ZodOptional<zod.ZodObject<{
@@ -5879,8 +6481,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 name: zod.ZodNullable<zod.ZodString>;
                 source: zod.ZodEnum<{
                     "directory-rule": "directory-rule";
-                    env: "env";
                     none: "none";
+                    env: "env";
                     "cli-flag": "cli-flag";
                     "identity-default": "identity-default";
                     "global-default": "global-default";
@@ -6122,10 +6724,10 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 highestInstalled: zod.ZodOptional<zod.ZodString>;
                 installed: zod.ZodReadonly<zod.ZodArray<zod.ZodString>>;
             }, zod_v4_core.$strict>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
     doctor: {
-        run: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+        run: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
             ok: zod.ZodBoolean;
             findings: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
                 section: zod.ZodEnum<{
@@ -6134,12 +6736,12 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     identity: "identity";
                     provider: "provider";
                     pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
+                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -6153,10 +6755,10 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 }>;
                 message: zod.ZodString;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
     pool: {
-        pick: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        pick: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             pool: zod.ZodString;
             path: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
@@ -6199,17 +6801,17 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 reason: zod.ZodString;
             }, zod_v4_core.$strict>>;
             stickyProblem: zod.ZodOptional<zod.ZodString>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
     rc: {
-        list: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, Schema<unknown, unknown>, zod.ZodObject<{
+        list: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, InitialInputSchema, zod.ZodObject<{
             sessions: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
                 id: zod.ZodString;
                 createdAt: zod.ZodNumber;
                 lastSeenAt: zod.ZodNumber;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        status: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        status: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             statuses: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
@@ -6232,8 +6834,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 createdAt: zod.ZodNumber;
                 lastSeenAt: zod.ZodNumber;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        pending: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        pending: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             pending: zod.ZodReadonly<zod.ZodArray<zod.ZodObject<{
@@ -6243,15 +6845,15 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 summary: zod.ZodString;
                 observedAt: zod.ZodNumber;
             }, zod_v4_core.$strict>>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        send: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        send: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             text: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        answer: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        answer: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             approve: zod.ZodBoolean;
@@ -6260,23 +6862,23 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        interrupt: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        interrupt: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        setModel: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        setModel: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             model: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        setPermissionMode: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        setPermissionMode: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             mode: zod.ZodEnum<{
                 default: "default";
@@ -6290,24 +6892,24 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        endSession: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        endSession: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             reason: zod.ZodOptional<zod.ZodString>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        getUsage: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        getUsage: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             skipBehaviors: zod.ZodOptional<zod.ZodBoolean>;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        getContextUsage: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        getContextUsage: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             detail: zod.ZodOptional<zod.ZodEnum<{
                 summary: "summary";
@@ -6317,8 +6919,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        readFile: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        readFile: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             path: zod.ZodString;
             maxBytes: zod.ZodOptional<zod.ZodNumber>;
@@ -6330,37 +6932,37 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        fileSuggestions: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        fileSuggestions: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             query: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        keepAlive: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        keepAlive: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        mcpStatus: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        mcpStatus: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        mcpReconnect: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        mcpReconnect: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             serverName: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        mcpAuthenticate: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        mcpAuthenticate: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             serverName: zod.ZodString;
             redirectUri: zod.ZodString;
@@ -6368,8 +6970,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        mcpOAuthCallbackUrl: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        mcpOAuthCallbackUrl: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             serverName: zod.ZodString;
             callbackUrl: zod.ZodString;
@@ -6377,17 +6979,17 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             session: zod.ZodString;
             request: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        teleport: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        teleport: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodString;
             marker: zod.ZodString;
         }, zod_v4_core.$strict>, zod.ZodObject<{
             session: zod.ZodString;
             sequenceNums: zod.ZodReadonly<zod.ZodArray<zod.ZodNumber>>;
-        }, zod_v4_core.$strict>, Record<never, never>, Record<never, never>>;
-        subscribe: _orpc_server.DecoratedProcedure<_orpc_server.MergedInitialContext<DoorApiContext & Record<never, never>, DoorApiContext, DoorApiContext>, any, zod.ZodObject<{
+        }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
+        subscribe: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
             session: zod.ZodOptional<zod.ZodString>;
-        }, zod_v4_core.$strict>, any, Record<never, never>, Record<never, never>>;
+        }, zod_v4_core.$strict>, any, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
 };
 /** The door's whole typed API, as the client the door's own verbs and library consumers use is derived from it. */
@@ -6674,12 +7276,12 @@ declare const DoctorFindingSchema: z.ZodObject<{
         identity: "identity";
         provider: "provider";
         pool: "pool";
-        keychain: "keychain";
         "ambient-credential": "ambient-credential";
         "binary-discovery": "binary-discovery";
         "claude-shim": "claude-shim";
         "path-resolution": "path-resolution";
         "legacy-name": "legacy-name";
+        keychain: "keychain";
         "directory-rules": "directory-rules";
         "categories-local": "categories-local";
         "active-identity": "active-identity";
@@ -6703,12 +7305,12 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
             identity: "identity";
             provider: "provider";
             pool: "pool";
-            keychain: "keychain";
             "ambient-credential": "ambient-credential";
             "binary-discovery": "binary-discovery";
             "claude-shim": "claude-shim";
             "path-resolution": "path-resolution";
             "legacy-name": "legacy-name";
+            keychain: "keychain";
             "directory-rules": "directory-rules";
             "categories-local": "categories-local";
             "active-identity": "active-identity";
@@ -6723,6 +7325,159 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
         message: z.ZodString;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
+/** The restart's answer: the pid of the door being replaced, which is the only part of the new generation the caller cannot yet know. The caller reopens its client from the state root once the door's supervisor pid differs from this one, because the replacement mints its own control token. */
+declare const FrontDoorRestartOutputSchema: z.ZodObject<{
+    action: z.ZodLiteral<"restarting">;
+    previousPid: z.ZodInt;
+}, z.core.$strict>;
+/** `update --check`'s report: the running version, the latest release, and whether they differ (`available`) or match (`current`). A check never installs, so `updated` is not an answer here. */
+declare const UpdateCheckOutputSchema: z.ZodObject<{
+    current: z.ZodString;
+    latest: z.ZodString;
+    action: z.ZodEnum<{
+        current: "current";
+        available: "available";
+        updated: "updated";
+    }>;
+}, z.core.$strict>;
+/** The Sign in with ChatGPT login's state as `codex status` reports it: no sign-in yet, signed in (with who, whether the plan scope was granted, and when the access token lapses), or a file that cannot be read. */
+declare const CodexSignInSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"none">;
+}, z.core.$strict>, z.ZodObject<{
+    state: z.ZodLiteral<"signed-in">;
+    email: z.ZodOptional<z.ZodString>;
+    planScope: z.ZodBoolean;
+    accessTokenExpiresAt: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    state: z.ZodLiteral<"unreadable">;
+    message: z.ZodString;
+}, z.core.$strict>], "state">;
+/** What `codex status` reports about the translation's sign-in and the codex providers the machine defines; the door's own status and sessions are `frontdoor.status` and `frontdoor.sessions`. */
+declare const CodexStatusOutputSchema: z.ZodObject<{
+    signIn: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        state: z.ZodLiteral<"none">;
+    }, z.core.$strict>, z.ZodObject<{
+        state: z.ZodLiteral<"signed-in">;
+        email: z.ZodOptional<z.ZodString>;
+        planScope: z.ZodBoolean;
+        accessTokenExpiresAt: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        state: z.ZodLiteral<"unreadable">;
+        message: z.ZodString;
+    }, z.core.$strict>], "state">;
+    codexProviders: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** `codex logout`'s result: whether there was a login to remove, and whether the issuer was told to revoke it (a failed revocation still removes the login here). */
+declare const CodexLogoutOutputSchema: z.ZodObject<{
+    hadGrant: z.ZodBoolean;
+    revoked: z.ZodBoolean;
+}, z.core.$strict>;
+
+/**
+ * The Zod schemas of the door's launch resolution: what a launch from one directory would resolve to, as data. The output is a closed shape of names, flags, paths and credential summaries (a target and each source's kind and non-secret identifier), so a token has nowhere to appear in it: a value outside the shape fails the door's own output validation instead of reaching the caller.
+ */
+/** The launch to resolve: the directory it is for (absolute, since the door has no working directory of the caller's to resolve a relative path against), the arguments after `agent-shim run` exactly as the command line takes them, and the environment the launch would inherit. */
+declare const LaunchResolveInputSchema: z.ZodObject<{
+    path: z.ZodString;
+    argv: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strict>;
+/** One launch resolved, with the warnings the resolution raised. Nothing was started, written or recorded to produce it. */
+declare const LaunchResolveOutputSchema: z.ZodObject<{
+    decision: z.ZodObject<{
+        identity: z.ZodOptional<z.ZodString>;
+        identitySource: z.ZodEnum<{
+            none: "none";
+            "config-dir-escape-hatch": "config-dir-escape-hatch";
+            argv: "argv";
+            env: "env";
+            "directory-pin": "directory-pin";
+            "active-identity-file": "active-identity-file";
+        }>;
+        pool: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            reasons: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+            movedOff: z.ZodOptional<z.ZodObject<{
+                identity: z.ZodString;
+                reason: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        configDirEscapeHatch: z.ZodBoolean;
+        configDir: z.ZodOptional<z.ZodString>;
+        configProfile: z.ZodOptional<z.ZodString>;
+        configProfileSource: z.ZodEnum<{
+            "directory-rule": "directory-rule";
+            none: "none";
+            env: "env";
+            "cli-flag": "cli-flag";
+            "identity-default": "identity-default";
+            "global-default": "global-default";
+        }>;
+        provider: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    flags: z.ZodObject<{
+        skipPermissions: z.ZodBoolean;
+        remoteControl: z.ZodBoolean;
+        headroom: z.ZodBoolean;
+        trackUsage: z.ZodBoolean;
+    }, z.core.$strict>;
+    claudeVersion: z.ZodOptional<z.ZodObject<{
+        version: z.ZodString;
+        source: z.ZodEnum<{
+            flag: "flag";
+            environment: "environment";
+            cascade: "cascade";
+        }>;
+    }, z.core.$strict>>;
+    bin: z.ZodString;
+    args: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    credential: z.ZodOptional<z.ZodObject<{
+        subject: z.ZodEnum<{
+            identity: "identity";
+            provider: "provider";
+        }>;
+        name: z.ZodString;
+        summary: z.ZodObject<{
+            target: z.ZodEnum<{
+                bearer: "bearer";
+                apiKey: "apiKey";
+                oauthToken: "oauthToken";
+            }>;
+            sources: z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                kind: z.ZodLiteral<"env">;
+                variable: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"file">;
+                path: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"command">;
+                program: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"op">;
+                reference: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"keychain">;
+                service: z.ZodString;
+                account: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"literal">;
+            }, z.core.$strict>]>>>;
+            cache: z.ZodOptional<z.ZodObject<{
+                ttl: z.ZodOptional<z.ZodString>;
+                store: z.ZodOptional<z.ZodEnum<{
+                    file: "file";
+                    keychain: "keychain";
+                }>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    routing: z.ZodObject<{
+        frontDoor: z.ZodBoolean;
+        headroom: z.ZodBoolean;
+    }, z.core.$strict>;
+    environment: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    warnings: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
 
 /**
  * The launch lifecycle publisher: the door's first event source of its own, turning the session registry the supervisor already reads each tick into source-tagged backbone events. A launch registering, a capability pruned because its launcher died, and a session ending by its launcher's own exit hook are all registry facts before they are events, which is why the publisher emits nothing of its own: it is fed the tick's listing and the pids the prune removed, and publishes the diff against the previous tick.
@@ -7760,170 +8515,6 @@ interface LaunchSelection {
  */
 declare function resolveLaunchSelection(params: ResolveLaunchSelectionParams): LaunchSelection;
 
-/** What a launch's one-off command-line/environment overrides resolve to: the `cliOverride` layer `src/resolve/walk.ts`'s `assembleCascade` composes last, so it beats every other layer. */
-interface CliOverride {
-    readonly categories?: CategoryMap;
-    readonly entries?: Entries;
-    readonly launch?: {
-        readonly provider?: string;
-    };
-}
-
-/**
- * Everything the launch-time update check needs from its host, injected so tests run it against scripted answers and no launch ever reaches GitHub by accident. Deliberately narrower than `UpdatePorts`: the launch path never downloads anything (the detached `agent-shim update` does), so only the release check, the cooldown stamp, the clock, the background spawn and the terminal are wired.
- */
-interface UpdateLaunchPort {
-    /** Resolves the URL the `releases/latest` redirect lands on, exactly as `agent-shim update` resolves the newest version. */
-    readonly effectiveUrl: (url: string) => Promise<string>;
-    /** Reads the cooldown stamp, or undefined when it does not exist. */
-    readonly readStamp: (filePath: string) => string | undefined;
-    /** Writes the cooldown stamp atomically: a reader either sees the previous whole stamp or the new one, never a partial write. */
-    readonly writeStamp: (filePath: string, contents: string) => void;
-    /** The clock the cooldown reads, in epoch milliseconds. */
-    readonly now: () => number;
-    /** Re-invokes this very binary with `args` as a detached child whose stdio is ignored and which is unref'd, so it outlives the launch and never holds the terminal. */
-    readonly spawnDetached: (args: readonly string[]) => void;
-    /** Writes one line to the launching terminal's stderr. */
-    readonly writeErr: (line: string) => void;
-}
-
-/**
- * Everything the farm resync needs that the launcher itself has no way to produce: a real filesystem, a real clock, the working directory, and a way to load the cascade for it.
- *
- * Supplied by `src/cli.ts` in normal operation. A caller that omits it launches with no farm at all, which is the right behaviour in exactly the cases where there is no agent-shim-managed farm to resync — and is what the launcher's own pre-farm tests exercise.
- */
-interface FarmRuntime {
-    readonly fs: FarmFs;
-    /** The canonical `~/.claude` every farm symlink points back into. */
-    readonly claudeHome: string;
-    readonly home: string;
-    readonly cwd: string;
-    /** The git branch at `cwd`, for `when: { branch }` conditions. Undefined when `cwd` is not in a repository. */
-    readonly branch?: string;
-    readonly branchDetached?: boolean;
-    readonly classification: {
-        readonly defaults: CategoryClassification;
-        readonly overlay?: CategoryClassificationOverlay;
-    };
-    /** Loads and assembles the cascade for `cwd` under the given configuration profile and one-off command-line/environment overrides. Injected so the launcher never reads a config file itself. */
-    readonly loadCascade: (baseConfigProfile: string | undefined, cliOverride: CliOverride | undefined) => CascadeInput;
-    readonly now: () => number;
-    /** Distinguishes this process's scratch and superseded farm directories from any other's. */
-    readonly uniqueSuffix: string;
-    readonly lock: {
-        readonly pid: number;
-        readonly isRunning: (pid: number) => boolean;
-        readonly sleep: (ms: number) => void;
-        readonly staleAfterMs?: number;
-        readonly retryDelayMs?: number;
-        readonly maxAttempts?: number;
-    };
-}
-/** Inputs to `prepareLaunch`: everything a launch needs except the means of spawning the child. */
-interface PrepareLaunchParams {
-    readonly paths: LayoutPaths;
-    readonly fs: FsPort;
-    readonly proc: ProcPort;
-    readonly log: LogPort;
-    /** Discovers the real `claude` binary to spawn. Injected so `runLauncher` never depends on `src/versionDiscovery.ts`'s own filesystem/PATH inputs directly — the caller (`src/cli.ts`) wires the real discovery, tests wire a fake that returns a fixed path. */
-    readonly resolveClaudeBinary: ClaudeBinaryResolver;
-    /** An identity pinned to `$PWD` by a directory rule. Accepted as an already-resolved value — the rules-loading code that produces it lands in Phase 4/5. */
-    readonly directoryPinnedIdentity?: string;
-    /** A directory rule's `configProfile` selection for `$PWD`. Accepted as an already-resolved value for the same reason. */
-    readonly directoryRuleConfigProfile?: string;
-    /** An explicit `--config-profile` value, when the caller wants to force one regardless of argv — normal operation instead relies on `parseLauncherArgv` finding `--config-profile` in `proc.argv` itself, so this is only needed to override that. */
-    readonly cliFlagConfigProfile?: string;
-    /** The user-global `~/.agent-shim/config.json` default configuration profile, when one is configured. */
-    readonly globalDefaultConfigProfile?: string;
-    /** The user-global `pools`, which a `pool:<name>` selector picks a member of. */
-    readonly pools?: Readonly<Record<string, Pool>>;
-    /** Wires the farm resync. Omitted only by a caller that has no farm to manage. */
-    readonly farm?: FarmRuntime;
-    /** Wires headroom routing. Omitted by a caller that cannot route through the daemon; a launch that resolves `headroom` on with no port wired is refused loudly rather than silently bypassing it. */
-    readonly headroom?: HeadroomPort;
-    /** Wires the front-door daemon. Omitted by a caller that cannot run it; a launch that routes anything (a provider, or headroom) with no port wired is refused rather than started against an address nothing serves. */
-    readonly frontdoor?: FrontDoorPort;
-    /** Resolves credential blocks (a provider's, or the launching identity's own). Omitted by a caller that cannot read secret files or run commands; a launch that needs a credential is then refused rather than started without it. */
-    readonly credentials?: CredentialPort;
-    /** True when the user was asked on a terminal whether to create the selected configuration profile and chose to launch without it. Without that explicit choice, a selected profile with no file is refused rather than silently skipped. */
-    readonly allowMissingConfigProfile?: boolean;
-    /** The user-global `update.mode`, resolved from the same global config the launcher already loads. Absent means `off`, and `off` runs no launch-time update check at all. */
-    readonly updateMode?: UpdateMode;
-    /** Wires the launch-time update check behind `update.mode`. Omitted by a caller that cannot resolve releases, re-invoke this binary, or write to the terminal; a mode of `notify` or `auto` with no port wired simply checks nothing. */
-    readonly update?: UpdateLaunchPort;
-}
-/** Inputs to `runLauncher`: a launch's inputs plus the port that spawns the child. */
-interface RunLauncherParams extends PrepareLaunchParams {
-    readonly spawn: SpawnPort;
-}
-/** The pick a pool made for a launch: the pool, why the ranking chose the member it did, and, for a resumed conversation, the member it left. */
-interface LaunchPoolDecision {
-    /** The pool the launch selected with `pool:<name>`. */
-    readonly name: string;
-    /** Every reason the ranking gave for the chosen member, in the ranking's order. */
-    readonly reasons: readonly string[];
-    /** The member a resumed conversation left, and why the ranking could not keep it. */
-    readonly movedOff?: {
-        readonly identity: string;
-        readonly reason: string;
-    };
-}
-/**
- * What a launch resolved to, and where each decision came from. Everything here is a name or a path, never a credential.
- */
-interface LaunchDecision {
-    /** The identity the launch runs as. Absent when the escape hatch applied or nothing resolved one. */
-    readonly identity?: string;
-    /** Which precedence rule selected the identity (or the pool the identity was picked from). */
-    readonly identitySource: IdentityDecisionSource;
-    /** The pool pick behind `identity`, when the launch selected a pool. */
-    readonly pool?: LaunchPoolDecision;
-    /** True when `CLAUDE_CONFIG_DIR` was already set, so no identity was resolved and no farm was managed. */
-    readonly configDirEscapeHatch: boolean;
-    /** The configuration directory the child runs with: the identity's own, or the one the caller named. Absent when none is set. */
-    readonly configDir?: string;
-    /** The configuration profile that applied, when one did. */
-    readonly configProfile?: string;
-    /** Which precedence rule selected the configuration profile. */
-    readonly configProfileSource: ConfigProfileDecisionSource;
-    /** The provider the launch routes through, when it selected one. */
-    readonly provider?: string;
-}
-/**
- * What one launch resolved to, once every effect its child depends on is in place (the identity's farm resynced, the front door and headroom up and this launch registered with them): the real binary, its arguments and its environment.
- */
-interface LaunchPlan {
-    readonly bin: string;
-    readonly args: readonly string[];
-    readonly env: Readonly<Record<string, string | undefined>>;
-    /** Releases the daemon session registrations this launch holds. Call it when the child has exited; it is safe to call more than once. */
-    readonly release: () => void;
-    /** What the launch resolved to, as data: the facts the launcher's decision line reports. */
-    readonly decision: LaunchDecision;
-    /** Marks the moment this plan's child is spawned: the launch-time update check suppresses its notify line from then on, since a line printed after the child took over the terminal would land mid-session. Call it immediately before spawning; it is safe to call more than once. */
-    readonly markChildStarted: () => void;
-}
-/**
- * Prepares one `claude` launch, in order:
- *
- * `CLAUDE_CONFIG_DIR` escape-hatch check, then the identity/config-profile decision, the provider decision, the identity's own credential, the ambient-credential guard, the config-gated launch-time update check (fired after the decision line and never awaited; see `runLaunchUpdateCheck`), farm resync, version discovery, flag resolution (and, when headroom resolved on, daemon bring-up), the extra-flags split, and the final argument list and environment, returned as a `LaunchPlan` for the caller to spawn. It refuses through `params.proc.exit`, so a caller that is not a command line process passes a `proc` whose `exit` throws.
- *
- * A launch that resolves an identity with no `identity.json`, or a configuration profile with no file, is refused with exit 1 naming the missing name and how it was selected: silently proceeding would create a brand-new login for a mistyped `@name`, or launch with a whole cascade layer missing. On a terminal, `src/runClaude.ts` offers to create either before this runs.
- *
- * The farm resync is skipped when `CLAUDE_CONFIG_DIR` was already set (the escape hatch means the user has named a configuration directory explicitly, and agent-shim manages neither its contents nor its lifetime) and when no identity resolved at all (a bare launch against plain `~/.claude`, matching the legacy tool's own behaviour). In both cases there is no agent-shim-managed farm for a resync to act on.
- */
-declare function prepareLaunch(params: PrepareLaunchParams): LaunchPlan;
-/**
- * Runs the child a `plan` describes under `spawn` and returns its exit code, in the order every launch observes: the update check's notice is suppressed from the moment the child takes the terminal, the child runs to completion, and the plan's session registrations are released whether it exited, was signalled or could not be spawned. A spawn failure is thrown after the release rather than turned into an exit code.
- */
-declare function runLaunchPlan(plan: LaunchPlan, spawn: SpawnPort): number;
-/**
- * Runs one `claude` launch: `prepareLaunch`, then the child under `params.spawn`, whose exit code becomes this process's.
- *
- * The session registrations are released by `runLaunchPlan` before `proc.exit` runs, because the real `process.exit` never unwinds a `finally` block.
- */
-declare function runLauncher(params: RunLauncherParams): void;
-
 /** Inputs to `spawnClaude`. */
 interface SpawnClaudeParams {
     /** Full path to the real `claude` binary to run, as discovered by `src/versionDiscovery.ts`. */
@@ -7968,6 +8559,19 @@ interface PrepareClaudeLaunchOptions {
  * A refused launch throws `LaunchRefusedError` carrying the launcher's own message. Interactive offers (creating a missing identity or profile on a terminal) belong to the command line and are not made here.
  */
 declare function prepareClaudeLaunch(options: PrepareClaudeLaunchOptions): LaunchPlan;
+/** What `resolveClaudeLaunch` needs from its caller: the launch `prepareClaudeLaunch` takes, less the daemon executable, since a resolution starts no daemon. */
+type ResolveClaudeLaunchOptions = Omit<PrepareClaudeLaunchOptions, "agentShim">;
+/** A launch's resolution and the warnings resolving it raised (a quota the front door last saw, a pool member whose identity is gone). */
+interface ClaudeLaunchResolution {
+    readonly resolution: LaunchResolution;
+    readonly warnings: readonly string[];
+}
+/**
+ * Reports what a launch for `options.cwd` would resolve to on this machine, changing nothing: the identity (and the pool pick behind it), configuration profile, provider, launch flags, pinned version, binary, arguments, the credential by its block and the names of the environment variables it would set. It recovers and resyncs no farm, starts no daemon, registers no session, records no pool pick and runs no credential command, so it is safe to call from a read.
+ *
+ * A launch that would be refused throws `LaunchRefusedError` carrying the launcher's own message, exactly as `prepareClaudeLaunch` does.
+ */
+declare function resolveClaudeLaunch(options: ResolveClaudeLaunchOptions): ClaudeLaunchResolution;
 
 /** How one refresh ended. */
 type AnthropicRefreshOutcome = {
@@ -8057,5 +8661,5 @@ declare const OWN_CLI_FILE_NAME = "cli.cjs";
  */
 declare function agentShimCliPath(distDir?: string | undefined): string;
 
-export { AMBIENT_CREDENTIAL_VARS, CHECK_CREDENTIAL_APPLIES, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CheckReportJsonSchema, CheckRunInputSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DOOR_EVENT_BUFFER_EVENTS, DOOR_EVENT_SOURCE_RC, DOOR_HEALTH_EVENT_SOURCE, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, DoctorFindingSchema, DoctorRunOutputSchema, DoorEventSchema, DoorEventSourceQuerySchema, DoorHealthEventSchema, EXIT_FAILURE, EXIT_USAGE, EffectiveWindowSchema, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorControlMaterialError, FrontDoorNotServingError, FrontDoorSessionStatusSchema, FrontDoorSessionsOutputSchema, FrontDoorStartError, FrontDoorStateSchema, FrontDoorStatusOutputSchema, GlobalConfigSchema, HeadroomSocketTargetSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LAUNCH_EVENT_SOURCE, LaunchLifecycleEventSchema, LaunchRefusedError, LegacyProviderFileError, OWN_CLI_FILE_NAME, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolGraphError, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, QUOTA_EXPIRING_EVENT_SOURCE, QuotaExpiringEventSchema, RC_CONTEXT_USAGE_DETAILS, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_READ_FILE_ENCODINGS, RC_REQUEST_PARSE_CAP_BYTES, RC_SELF_HOST_ENV, RC_SELF_HOST_KEEPALIVE_MS, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE, RC_SELF_HOST_RETENTION_MS, RC_SELF_HOST_SCOPE_LIST, RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, RC_WEB_FETCH_ALLOW_PRIVATE_ENV, RC_WEB_FETCH_DEADLINE_MS, RC_WEB_FETCH_MAX_BYTES, RC_WEB_FETCH_MAX_REDIRECTS, ROUTED_PATH_PREFIX, RcLiveRateLimitSchema, RcPermissionModeSchema, RcRateLimitInfoSchema, RcRateLimitWindowSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, USAGE_EVENT_SOURCE, UsageError, UsageListOutputSchema, UsageLiveOutputSchema, UsageSnapshotError, UsageSnapshotSchema, UsageWindowsInputSchema, UsageWindowsOutputSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, agentShimCliPath, answerRcControlRequest, authenticateRcSessionMcpServer, buildEntryFacts, buildLayoutPaths, buildRcControlRequestPayload, buildRcControlResponsePayload, buildRcEndSessionPayload, buildRcEventWriteBody, buildRcFileSuggestionsPayload, buildRcGetContextUsagePayload, buildRcGetUsagePayload, buildRcInterruptPayload, buildRcKeepAlivePayload, buildRcMarkReadBody, buildRcMcpAuthenticatePayload, buildRcMcpOAuthCallbackUrlPayload, buildRcMcpReconnectPayload, buildRcMcpStatusPayload, buildRcReadFilePayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectFrontDoorStatus, collectPoolPick, createControlApiRouter, createDoorApiNodeHandler, createDoorApiRouter, createDoorEventHub, createDoorHealthPublisher, createEventsApiRouter, createLaunchEventPublisher, createLeafCache, createProfile, createQuotaExpiringPublisher, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcLiveUsage, createRcSelfHostSurface, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, doorApiAuth, doorApiNodeHandlerOf, effectiveWindow, endRcSession, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, fetchThroughWebProxy, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, formatFrontDoorStatus, forwardableHeaders, frontDoorApiClient, frontDoorApiFromState, frontDoorApiLink, frontDoorRcApiClient, frontDoorRcControl, generateCa, getRcSessionContextUsage, getRcSessionMcpStatus, getRcSessionUsage, headroomSocketTarget, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isPrivateAddress, isRcContextUsageDetail, isRcPermissionMode, isRcReadFileEncoding, lateRcEventDial, lateRcStreamDial, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, matchBranch, mintLeaf, mintRcSelfHostCredential, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, poolIdentities, poolSelectedByLaunch, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcFanoutOnDoorHub, rcObserverAsPassthrough, rcRateLimitInfoOf, rcSelfHostFromEnv, rcWebFetchAllowsPrivateFromEnv, readActiveIdentity, readDirectoryRules, readFarmManifest, readFrontDoorControlMaterial, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readRcSelfHostRecord, readRcSessionFile, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, realRcWebFetch, reconnectRcSessionMcpServer, recoverFarm, recoveryDiagnostics, refreshLaunchPoolUsage, refreshPoolUsage, refreshStalePoolMembers, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLaunchSelection, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runClaudeLaunch, runDoctor, runFrontDoorSupervisor, runLaunchPlan, runLauncher, runSupervisor, sendRcKeepAlive, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, spawnClaude, startConnectServer, submitRcSessionMcpOAuthCallbackUrl, suggestRcSessionFiles, teleportRcSession, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, watchedInstallEntry, writeDirectoryRules };
-export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, AnthropicUsageRefresher, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CheckReportJson, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectLocalSurface, ConnectServerConfig, ConnectServerHandle, ConnectTarget, ControlApiClient, ControlApiDeps, ControlApiRouter, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, DoorApiClient, DoorApiContext, DoorApiDeps, DoorApiRouter, DoorEvent, DoorEventHub, DoorEventPublisher, DoorEventStream, DoorEventsApiDeps, DoorHealthEvent, DoorHealthPublisher, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorControlMaterial, FrontDoorRcControl, FrontDoorSessionStatus, FrontDoorStatus, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchDecision, LaunchEventPublisher, LaunchLifecycleEvent, LaunchPlan, LaunchPoolDecision, LaunchSelection, Layer, LayerId, LayoutPaths, LeafCert, NestedContribution, OwnExecutableStat, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, QuotaExpiringEvent, QuotaExpiringPublisher, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcContextUsageDetail, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcCredentialStore, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcLiveRateLimit, RcLiveUsage, RcLiveUsageDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcRateLimitInfo, RcRateLimitWindow, RcReadFileEncoding, RcReadFileOptions, RcSelfHostCredentialRecord, RcSelfHostDeps, RcSelfHostMintResult, RcSelfHostSurface, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWebFetchDeps, RcWebFetchHop, RcWebFetchOutcome, RcWebFetcher, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, RefreshLaunchPoolUsageOptions, RefreshPoolUsageParams, RefreshStalePoolMembersParams, ResolveDecisionsInput, ResolveLaunchSelectionParams, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunClaudeLaunchOptions, RunDoctorParams, RunFrontDoorSupervisorOptions, RunLauncherParams, RunSupervisorOptions, SpawnClaudeParams, SseParsedEvent, StickyPick, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageChangeEvent, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation };
+export { AMBIENT_CREDENTIAL_VARS, CHECK_CREDENTIAL_APPLIES, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CheckReportJsonSchema, CheckRunInputSchema, CliError, CodexLogoutOutputSchema, CodexSignInSchema, CodexStatusOutputSchema, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DOOR_EVENT_BUFFER_EVENTS, DOOR_EVENT_SOURCE_RC, DOOR_HEALTH_EVENT_SOURCE, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, DoctorFindingSchema, DoctorRunOutputSchema, DoorEventSchema, DoorEventSourceQuerySchema, DoorHealthEventSchema, EXIT_FAILURE, EXIT_USAGE, EffectiveWindowSchema, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorControlMaterialError, FrontDoorNotServingError, FrontDoorRestartOutputSchema, FrontDoorSessionStatusSchema, FrontDoorSessionsOutputSchema, FrontDoorStartError, FrontDoorStateSchema, FrontDoorStatusOutputSchema, GlobalConfigSchema, HeadroomSocketTargetSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LAUNCH_EVENT_SOURCE, LaunchLifecycleEventSchema, LaunchRefusedError, LaunchResolveInputSchema, LaunchResolveOutputSchema, LegacyProviderFileError, OWN_CLI_FILE_NAME, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolGraphError, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, QUOTA_EXPIRING_EVENT_SOURCE, QuotaExpiringEventSchema, RC_CONTEXT_USAGE_DETAILS, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_READ_FILE_ENCODINGS, RC_REQUEST_PARSE_CAP_BYTES, RC_SELF_HOST_ENV, RC_SELF_HOST_KEEPALIVE_MS, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE, RC_SELF_HOST_RETENTION_MS, RC_SELF_HOST_SCOPE_LIST, RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, RC_WEB_FETCH_ALLOW_PRIVATE_ENV, RC_WEB_FETCH_DEADLINE_MS, RC_WEB_FETCH_MAX_BYTES, RC_WEB_FETCH_MAX_REDIRECTS, ROUTED_PATH_PREFIX, RcLiveRateLimitSchema, RcPermissionModeSchema, RcRateLimitInfoSchema, RcRateLimitWindowSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, USAGE_EVENT_SOURCE, UpdateCheckOutputSchema, UsageError, UsageListOutputSchema, UsageLiveOutputSchema, UsageSnapshotError, UsageSnapshotSchema, UsageWindowsInputSchema, UsageWindowsOutputSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, agentShimCliPath, answerRcControlRequest, authenticateRcSessionMcpServer, buildEntryFacts, buildLayoutPaths, buildRcControlRequestPayload, buildRcControlResponsePayload, buildRcEndSessionPayload, buildRcEventWriteBody, buildRcFileSuggestionsPayload, buildRcGetContextUsagePayload, buildRcGetUsagePayload, buildRcInterruptPayload, buildRcKeepAlivePayload, buildRcMarkReadBody, buildRcMcpAuthenticatePayload, buildRcMcpOAuthCallbackUrlPayload, buildRcMcpReconnectPayload, buildRcMcpStatusPayload, buildRcReadFilePayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectFrontDoorStatus, collectPoolPick, createCodexApiRouter, createControlApiRouter, createDoorApiNodeHandler, createDoorApiRouter, createDoorEventHub, createDoorHealthPublisher, createEventsApiRouter, createLaunchApiRouter, createLaunchEventPublisher, createLeafCache, createLifecycleApiRouter, createProfile, createQuotaExpiringPublisher, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcLiveUsage, createRcSelfHostSurface, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, doorApiAuth, doorApiNodeHandlerOf, effectiveWindow, endRcSession, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, fetchThroughWebProxy, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, formatFrontDoorStatus, forwardableHeaders, frontDoorApiClient, frontDoorApiFromState, frontDoorApiLink, frontDoorRcApiClient, frontDoorRcControl, generateCa, getRcSessionContextUsage, getRcSessionMcpStatus, getRcSessionUsage, headroomSocketTarget, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isPrivateAddress, isRcContextUsageDetail, isRcPermissionMode, isRcReadFileEncoding, lateRcEventDial, lateRcStreamDial, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, matchBranch, mintLeaf, mintRcSelfHostCredential, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, poolIdentities, poolSelectedByLaunch, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcFanoutOnDoorHub, rcObserverAsPassthrough, rcRateLimitInfoOf, rcSelfHostFromEnv, rcWebFetchAllowsPrivateFromEnv, readActiveIdentity, readDirectoryRules, readFarmManifest, readFrontDoorControlMaterial, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readRcSelfHostRecord, readRcSessionFile, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, realRcWebFetch, reconnectRcSessionMcpServer, recoverFarm, recoveryDiagnostics, refreshLaunchPoolUsage, refreshPoolUsage, refreshStalePoolMembers, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveClaudeLaunch, resolveDecisions, resolveLaunch, resolveLaunchSelection, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runClaudeLaunch, runDoctor, runFrontDoorSupervisor, runLaunchPlan, runLauncher, runSupervisor, sendRcKeepAlive, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, spawnClaude, startConnectServer, submitRcSessionMcpOAuthCallbackUrl, suggestRcSessionFiles, teleportRcSession, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, watchedInstallEntry, writeDirectoryRules };
+export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, AnthropicUsageRefresher, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CheckReportJson, ClaudeLaunchResolution, CodexApiClient, CodexApiDeps, CodexApiRouter, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectLocalSurface, ConnectServerConfig, ConnectServerHandle, ConnectTarget, ControlApiClient, ControlApiDeps, ControlApiRouter, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, DoorApiClient, DoorApiContext, DoorApiDeps, DoorApiRouter, DoorEvent, DoorEventHub, DoorEventPublisher, DoorEventStream, DoorEventsApiDeps, DoorHealthEvent, DoorHealthPublisher, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorControlMaterial, FrontDoorRcControl, FrontDoorSessionStatus, FrontDoorStatus, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchApiDeps, LaunchApiRouter, LaunchDecision, LaunchEventPublisher, LaunchLifecycleEvent, LaunchPlan, LaunchPoolDecision, LaunchResolution, LaunchSelection, Layer, LayerId, LayoutPaths, LeafCert, LifecycleApiClient, LifecycleApiDeps, LifecycleApiRouter, NestedContribution, OwnExecutableStat, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, QuotaExpiringEvent, QuotaExpiringPublisher, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcContextUsageDetail, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcCredentialStore, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcLiveRateLimit, RcLiveUsage, RcLiveUsageDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcRateLimitInfo, RcRateLimitWindow, RcReadFileEncoding, RcReadFileOptions, RcSelfHostCredentialRecord, RcSelfHostDeps, RcSelfHostMintResult, RcSelfHostSurface, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWebFetchDeps, RcWebFetchHop, RcWebFetchOutcome, RcWebFetcher, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, RefreshLaunchPoolUsageOptions, RefreshPoolUsageParams, RefreshStalePoolMembersParams, ResolveClaudeLaunchOptions, ResolveDecisionsInput, ResolveLaunchSelectionParams, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunClaudeLaunchOptions, RunDoctorParams, RunFrontDoorSupervisorOptions, RunLauncherParams, RunSupervisorOptions, SpawnClaudeParams, SseParsedEvent, StickyPick, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageChangeEvent, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation };