@tokensrc/codex 1.13.4 → 1.14.0

package/dist/protocol.d.ts

@@ -5,6 +5,24 @@ export declare const CODEX_ACCOUNTS_LIST_PATH = "/v1/codex/accounts";
 export declare const CODEX_ACCOUNTS_IMPORT_PATH = "/v1/admin/codex/accounts/import";
 export declare const CODEX_ADMIN_ACCOUNTS_PATH = "/v1/admin/codex/accounts";
 export declare const CODEX_ADMIN_ASSIGNMENTS_PATH = "/v1/admin/codex/assignments";
+export declare const CODEX_ENROLLMENT_SCHEMA_VERSION: 2;
+export declare const CODEX_ADMIN_ENROLLMENT_INTENTS_PATH = "/v2/admin/codex/enrollment-intents";
+export declare const CODEX_CREDENTIAL_ASSIGNMENTS_PATH = "/v2/codex/credential-assignments";
+export declare const CODEX_SHORT_LIVED_DELIVERIES_PATH = "/v2/codex/short-lived-credential-deliveries";
+export declare const CODEX_ASSIGNMENT_RETIREMENTS_PATH = "/v2/codex/assignment-retirements";
+export declare const CODEX_ADMIN_MIGRATION_PLANS_PATH = "/v2/admin/codex/migration-plans";
+export declare const CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION: 3;
+export declare const CODEX_MANAGED_CREDENTIALS_V3_PATH = "/v3/codex";
+export declare const CODEX_V3_ENROLLMENT_CONFIGURATION_PATH = "/v3/codex/enrollment-configuration";
+export declare const CODEX_V3_ENROLLMENTS_PATH = "/v3/codex/enrollments";
+export declare const CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH = "/v3/codex/credential-assignments";
+export declare const CODEX_V3_FULL_CREDENTIAL_DELIVERIES_PATH = "/v3/codex/full-credential-deliveries";
+export declare const CODEX_V3_CREDENTIAL_LINEAGES_PATH = "/v3/codex/credential-lineages";
+export declare const CODEX_MIGRATION_CAPACITY: {
+    readonly verifiedMinimum: 2;
+    readonly verifiedLimit: null;
+    readonly sequentialRequired: true;
+};
 export interface CodexQuotaWindowLike {
     usedPercent?: number | null;
     windowMinutes?: number | null;
@@ -68,6 +86,19 @@ export declare const CodexAccountSummarySchema: z.ZodObject<{
         NEEDS_REAUTH: "NEEDS_REAUTH";
         TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
     }>>;
+    lineageStatus: z.ZodOptional<z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        COMPROMISED: "COMPROMISED";
+        DELIVERY_UNKNOWN: "DELIVERY_UNKNOWN";
+        DIVERGED: "DIVERGED";
+        ENROLLING: "ENROLLING";
+        LOST: "LOST";
+        NEEDS_REAUTH: "NEEDS_REAUTH";
+        READY: "READY";
+        RETIRED: "RETIRED";
+        RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        SYNC_LAGGING: "SYNC_LAGGING";
+    }>>;
     quota: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         updatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>>;
         status: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
@@ -115,6 +146,19 @@ export declare const CodexAccountListResponseSchema: z.ZodObject<{
             NEEDS_REAUTH: "NEEDS_REAUTH";
             TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
         }>>;
+        lineageStatus: z.ZodOptional<z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            COMPROMISED: "COMPROMISED";
+            DELIVERY_UNKNOWN: "DELIVERY_UNKNOWN";
+            DIVERGED: "DIVERGED";
+            ENROLLING: "ENROLLING";
+            LOST: "LOST";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            READY: "READY";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+            SYNC_LAGGING: "SYNC_LAGGING";
+        }>>;
         quota: z.ZodOptional<z.ZodNullable<z.ZodObject<{
             updatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>>;
             status: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
@@ -164,6 +208,19 @@ export declare const CodexLoginCredentialsResponseSchema: z.ZodObject<{
             NEEDS_REAUTH: "NEEDS_REAUTH";
             TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
         }>>;
+        lineageStatus: z.ZodOptional<z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            COMPROMISED: "COMPROMISED";
+            DELIVERY_UNKNOWN: "DELIVERY_UNKNOWN";
+            DIVERGED: "DIVERGED";
+            ENROLLING: "ENROLLING";
+            LOST: "LOST";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            READY: "READY";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+            SYNC_LAGGING: "SYNC_LAGGING";
+        }>>;
         quota: z.ZodOptional<z.ZodNullable<z.ZodObject<{
             updatedAt: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>>;
             status: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
@@ -730,6 +787,963 @@ export declare const CodexAdminAssignmentDeleteResponseSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     assignmentId: z.ZodString;
 }, z.core.$strict>;
+export declare const CodexEnrollmentIntentReasonSchema: z.ZodEnum<{
+    NEW: "NEW";
+    REPLACE_ADMIN: "REPLACE_ADMIN";
+    REPLACE_DIVERGED: "REPLACE_DIVERGED";
+    REPLACE_LOST: "REPLACE_LOST";
+    REPLACE_REJECTED: "REPLACE_REJECTED";
+}>;
+export declare const CodexEnrollmentIntentStatusSchema: z.ZodEnum<{
+    ACCOUNT_MISMATCH: "ACCOUNT_MISMATCH";
+    AWAITING_CLI: "AWAITING_CLI";
+    CANCELLED: "CANCELLED";
+    CLAIMED: "CLAIMED";
+    EXPIRED: "EXPIRED";
+    IDENTITY_UNVERIFIABLE: "IDENTITY_UNVERIFIABLE";
+    LOGIN_IN_PROGRESS: "LOGIN_IN_PROGRESS";
+    OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+    READY: "READY";
+    TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+    UPLOADING: "UPLOADING";
+    VALIDATING: "VALIDATING";
+}>;
+export declare const CodexEnrollmentIntentSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodEnum<{
+        ACCOUNT_DISCOVERY: "ACCOUNT_DISCOVERY";
+        ASSIGNMENT_ENROLLMENT: "ASSIGNMENT_ENROLLMENT";
+    }>;
+    status: z.ZodEnum<{
+        ACCOUNT_MISMATCH: "ACCOUNT_MISMATCH";
+        AWAITING_CLI: "AWAITING_CLI";
+        CANCELLED: "CANCELLED";
+        CLAIMED: "CLAIMED";
+        EXPIRED: "EXPIRED";
+        IDENTITY_UNVERIFIABLE: "IDENTITY_UNVERIFIABLE";
+        LOGIN_IN_PROGRESS: "LOGIN_IN_PROGRESS";
+        OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+        READY: "READY";
+        TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+        UPLOADING: "UPLOADING";
+        VALIDATING: "VALIDATING";
+    }>;
+    revision: z.ZodNumber;
+    reason: z.ZodEnum<{
+        NEW: "NEW";
+        REPLACE_ADMIN: "REPLACE_ADMIN";
+        REPLACE_DIVERGED: "REPLACE_DIVERGED";
+        REPLACE_LOST: "REPLACE_LOST";
+        REPLACE_REJECTED: "REPLACE_REJECTED";
+    }>;
+    assignmentId: z.ZodNullable<z.ZodString>;
+    managedAccountId: z.ZodNullable<z.ZodString>;
+    userSubject: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    claimedAt: z.ZodNullable<z.ZodString>;
+    lastHeartbeatAt: z.ZodNullable<z.ZodString>;
+    cancelledAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodString;
+    safeErrorCode: z.ZodNullable<z.ZodString>;
+    resultManagedAccountId: z.ZodNullable<z.ZodString>;
+    resultLineageId: z.ZodNullable<z.ZodString>;
+    currentGenerationVersion: z.ZodNullable<z.ZodNumber>;
+    allowedActions: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const CodexEnrollmentCandidateIngressSchema: z.ZodObject<{
+    envelopeVersion: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+    keyId: z.ZodString;
+    publicKey: z.ZodString;
+    maxRequestBytes: z.ZodNumber;
+    maxCiphertextBytes: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexEnrollmentCapabilitiesSchema: z.ZodObject<{
+    enrollmentIntents: z.ZodBoolean;
+    candidateUpload: z.ZodBoolean;
+    delivery: z.ZodBoolean;
+    rotationSync: z.ZodBoolean;
+    candidateIngress: z.ZodOptional<z.ZodObject<{
+        envelopeVersion: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        publicKey: z.ZodString;
+        maxRequestBytes: z.ZodNumber;
+        maxCiphertextBytes: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const CodexEnrollmentIntentResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    intent: z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<{
+            ACCOUNT_DISCOVERY: "ACCOUNT_DISCOVERY";
+            ASSIGNMENT_ENROLLMENT: "ASSIGNMENT_ENROLLMENT";
+        }>;
+        status: z.ZodEnum<{
+            ACCOUNT_MISMATCH: "ACCOUNT_MISMATCH";
+            AWAITING_CLI: "AWAITING_CLI";
+            CANCELLED: "CANCELLED";
+            CLAIMED: "CLAIMED";
+            EXPIRED: "EXPIRED";
+            IDENTITY_UNVERIFIABLE: "IDENTITY_UNVERIFIABLE";
+            LOGIN_IN_PROGRESS: "LOGIN_IN_PROGRESS";
+            OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+            READY: "READY";
+            TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+            UPLOADING: "UPLOADING";
+            VALIDATING: "VALIDATING";
+        }>;
+        revision: z.ZodNumber;
+        reason: z.ZodEnum<{
+            NEW: "NEW";
+            REPLACE_ADMIN: "REPLACE_ADMIN";
+            REPLACE_DIVERGED: "REPLACE_DIVERGED";
+            REPLACE_LOST: "REPLACE_LOST";
+            REPLACE_REJECTED: "REPLACE_REJECTED";
+        }>;
+        assignmentId: z.ZodNullable<z.ZodString>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        userSubject: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        claimedAt: z.ZodNullable<z.ZodString>;
+        lastHeartbeatAt: z.ZodNullable<z.ZodString>;
+        cancelledAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+        resultManagedAccountId: z.ZodNullable<z.ZodString>;
+        resultLineageId: z.ZodNullable<z.ZodString>;
+        currentGenerationVersion: z.ZodNullable<z.ZodNumber>;
+        allowedActions: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    capabilities: z.ZodObject<{
+        enrollmentIntents: z.ZodBoolean;
+        candidateUpload: z.ZodBoolean;
+        delivery: z.ZodBoolean;
+        rotationSync: z.ZodBoolean;
+        candidateIngress: z.ZodOptional<z.ZodObject<{
+            envelopeVersion: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+            keyId: z.ZodString;
+            publicKey: z.ZodString;
+            maxRequestBytes: z.ZodNumber;
+            maxCiphertextBytes: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexEnrollmentMutationInputSchema: z.ZodObject<{
+    idempotencyKey: z.ZodString;
+    revision: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexEnrollmentHeartbeatInputSchema: z.ZodObject<{
+    idempotencyKey: z.ZodString;
+    revision: z.ZodNumber;
+    phase: z.ZodEnum<{
+        LOGIN_IN_PROGRESS: "LOGIN_IN_PROGRESS";
+        UPLOADING: "UPLOADING";
+    }>;
+}, z.core.$strict>;
+export declare const CodexEnrollmentCandidateEnvelopeSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+    keyId: z.ZodString;
+    ephemeralPublicKey: z.ZodString;
+    salt: z.ZodString;
+    nonce: z.ZodString;
+    ciphertext: z.ZodString;
+    authenticationTag: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexEnrollmentCandidateInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    revision: z.ZodNumber;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexEnrollmentCandidateResultSchema: z.ZodObject<{
+    outcome: z.ZodEnum<{
+        ACCOUNT_MISMATCH: "ACCOUNT_MISMATCH";
+        IDENTITY_UNVERIFIABLE: "IDENTITY_UNVERIFIABLE";
+        OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+        READY: "READY";
+        TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+    }>;
+    managedAccountId: z.ZodNullable<z.ZodString>;
+    lineageId: z.ZodNullable<z.ZodString>;
+    generationVersion: z.ZodNullable<z.ZodNumber>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexEnrollmentCandidateResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    intent: z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<{
+            ACCOUNT_DISCOVERY: "ACCOUNT_DISCOVERY";
+            ASSIGNMENT_ENROLLMENT: "ASSIGNMENT_ENROLLMENT";
+        }>;
+        status: z.ZodEnum<{
+            ACCOUNT_MISMATCH: "ACCOUNT_MISMATCH";
+            AWAITING_CLI: "AWAITING_CLI";
+            CANCELLED: "CANCELLED";
+            CLAIMED: "CLAIMED";
+            EXPIRED: "EXPIRED";
+            IDENTITY_UNVERIFIABLE: "IDENTITY_UNVERIFIABLE";
+            LOGIN_IN_PROGRESS: "LOGIN_IN_PROGRESS";
+            OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+            READY: "READY";
+            TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+            UPLOADING: "UPLOADING";
+            VALIDATING: "VALIDATING";
+        }>;
+        revision: z.ZodNumber;
+        reason: z.ZodEnum<{
+            NEW: "NEW";
+            REPLACE_ADMIN: "REPLACE_ADMIN";
+            REPLACE_DIVERGED: "REPLACE_DIVERGED";
+            REPLACE_LOST: "REPLACE_LOST";
+            REPLACE_REJECTED: "REPLACE_REJECTED";
+        }>;
+        assignmentId: z.ZodNullable<z.ZodString>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        userSubject: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        claimedAt: z.ZodNullable<z.ZodString>;
+        lastHeartbeatAt: z.ZodNullable<z.ZodString>;
+        cancelledAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+        resultManagedAccountId: z.ZodNullable<z.ZodString>;
+        resultLineageId: z.ZodNullable<z.ZodString>;
+        currentGenerationVersion: z.ZodNullable<z.ZodNumber>;
+        allowedActions: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    capabilities: z.ZodObject<{
+        enrollmentIntents: z.ZodBoolean;
+        candidateUpload: z.ZodBoolean;
+        delivery: z.ZodBoolean;
+        rotationSync: z.ZodBoolean;
+        candidateIngress: z.ZodOptional<z.ZodObject<{
+            envelopeVersion: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+            keyId: z.ZodString;
+            publicKey: z.ZodString;
+            maxRequestBytes: z.ZodNumber;
+            maxCiphertextBytes: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    result: z.ZodObject<{
+        outcome: z.ZodEnum<{
+            ACCOUNT_MISMATCH: "ACCOUNT_MISMATCH";
+            IDENTITY_UNVERIFIABLE: "IDENTITY_UNVERIFIABLE";
+            OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+            READY: "READY";
+            TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+        }>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        lineageId: z.ZodNullable<z.ZodString>;
+        generationVersion: z.ZodNullable<z.ZodNumber>;
+        replayed: z.ZodBoolean;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexMigrationPlanStatusSchema: z.ZodEnum<{
+    ACTIVE: "ACTIVE";
+    CANCELLED: "CANCELLED";
+    COMPLETED: "COMPLETED";
+    PAUSED: "PAUSED";
+}>;
+export declare const CodexMigrationTargetSchema: z.ZodObject<{
+    id: z.ZodString;
+    assignmentId: z.ZodString;
+    userSubject: z.ZodString;
+    distributionMode: z.ZodEnum<{
+        LEGACY: "LEGACY";
+        MIGRATING: "MIGRATING";
+        USER_BOUND: "USER_BOUND";
+    }>;
+    projectedStatus: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        AWAITING_CLI: "AWAITING_CLI";
+        COMPROMISED: "COMPROMISED";
+        DELIVERY_UNKNOWN: "DELIVERY_UNKNOWN";
+        DIVERGED: "DIVERGED";
+        ENROLLING: "ENROLLING";
+        LEGACY_V1: "LEGACY_V1";
+        LOST: "LOST";
+        NEEDS_REAUTH: "NEEDS_REAUTH";
+        READY: "READY";
+        RETIRED: "RETIRED";
+        RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        SYNC_LAGGING: "SYNC_LAGGING";
+        UNENROLLED: "UNENROLLED";
+        VALIDATING: "VALIDATING";
+    }>;
+    enrollmentAttachment: z.ZodEnum<{
+        CREATED: "CREATED";
+        NONE: "NONE";
+        REUSED: "REUSED";
+    }>;
+    enrollmentIntent: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        status: z.ZodEnum<{
+            ACCOUNT_MISMATCH: "ACCOUNT_MISMATCH";
+            AWAITING_CLI: "AWAITING_CLI";
+            CANCELLED: "CANCELLED";
+            CLAIMED: "CLAIMED";
+            EXPIRED: "EXPIRED";
+            IDENTITY_UNVERIFIABLE: "IDENTITY_UNVERIFIABLE";
+            LOGIN_IN_PROGRESS: "LOGIN_IN_PROGRESS";
+            OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+            READY: "READY";
+            TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+            UPLOADING: "UPLOADING";
+            VALIDATING: "VALIDATING";
+        }>;
+        revision: z.ZodNumber;
+        expiresAt: z.ZodString;
+        updatedAt: z.ZodString;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    allowedAction: z.ZodEnum<{
+        LOGIN: "LOGIN";
+        NONE: "NONE";
+        VIEW_ENROLLMENT: "VIEW_ENROLLMENT";
+    }>;
+}, z.core.$strict>;
+export declare const CodexMigrationLoginQueueResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    plan: z.ZodObject<{
+        id: z.ZodString;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            CANCELLED: "CANCELLED";
+            COMPLETED: "COMPLETED";
+            PAUSED: "PAUSED";
+        }>;
+        revision: z.ZodNumber;
+        accountId: z.ZodString;
+        sequentialRequired: z.ZodLiteral<true>;
+    }, z.core.$strict>;
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        assignmentId: z.ZodString;
+        userSubject: z.ZodString;
+        distributionMode: z.ZodEnum<{
+            LEGACY: "LEGACY";
+            MIGRATING: "MIGRATING";
+            USER_BOUND: "USER_BOUND";
+        }>;
+        projectedStatus: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            AWAITING_CLI: "AWAITING_CLI";
+            COMPROMISED: "COMPROMISED";
+            DELIVERY_UNKNOWN: "DELIVERY_UNKNOWN";
+            DIVERGED: "DIVERGED";
+            ENROLLING: "ENROLLING";
+            LEGACY_V1: "LEGACY_V1";
+            LOST: "LOST";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            READY: "READY";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+            SYNC_LAGGING: "SYNC_LAGGING";
+            UNENROLLED: "UNENROLLED";
+            VALIDATING: "VALIDATING";
+        }>;
+        enrollmentAttachment: z.ZodEnum<{
+            CREATED: "CREATED";
+            NONE: "NONE";
+            REUSED: "REUSED";
+        }>;
+        enrollmentIntent: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            status: z.ZodEnum<{
+                ACCOUNT_MISMATCH: "ACCOUNT_MISMATCH";
+                AWAITING_CLI: "AWAITING_CLI";
+                CANCELLED: "CANCELLED";
+                CLAIMED: "CLAIMED";
+                EXPIRED: "EXPIRED";
+                IDENTITY_UNVERIFIABLE: "IDENTITY_UNVERIFIABLE";
+                LOGIN_IN_PROGRESS: "LOGIN_IN_PROGRESS";
+                OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+                READY: "READY";
+                TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+                UPLOADING: "UPLOADING";
+                VALIDATING: "VALIDATING";
+            }>;
+            revision: z.ZodNumber;
+            expiresAt: z.ZodString;
+            updatedAt: z.ZodString;
+            safeErrorCode: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        allowedAction: z.ZodEnum<{
+            LOGIN: "LOGIN";
+            NONE: "NONE";
+            VIEW_ENROLLMENT: "VIEW_ENROLLMENT";
+        }>;
+    }, z.core.$strict>>;
+    total: z.ZodNumber;
+    page: z.ZodNumber;
+    pageSize: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexUserCredentialAssignmentSchema: z.ZodObject<{
+    assignmentId: z.ZodString;
+    managedAccountId: z.ZodString;
+    label: z.ZodString;
+    distributionMode: z.ZodLiteral<"SERVER_MANAGED_SHORT_LIVED">;
+    lineageStatus: z.ZodNullable<z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        COMPROMISED: "COMPROMISED";
+        DELIVERY_UNKNOWN: "DELIVERY_UNKNOWN";
+        DIVERGED: "DIVERGED";
+        ENROLLING: "ENROLLING";
+        LOST: "LOST";
+        NEEDS_REAUTH: "NEEDS_REAUTH";
+        READY: "READY";
+        RETIRED: "RETIRED";
+        RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        SYNC_LAGGING: "SYNC_LAGGING";
+    }>>;
+    generationVersion: z.ZodNullable<z.ZodNumber>;
+    credentialExpiresAt: z.ZodNullable<z.ZodString>;
+    deliveryEligible: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexUserCredentialAssignmentListResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    items: z.ZodArray<z.ZodObject<{
+        assignmentId: z.ZodString;
+        managedAccountId: z.ZodString;
+        label: z.ZodString;
+        distributionMode: z.ZodLiteral<"SERVER_MANAGED_SHORT_LIVED">;
+        lineageStatus: z.ZodNullable<z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            COMPROMISED: "COMPROMISED";
+            DELIVERY_UNKNOWN: "DELIVERY_UNKNOWN";
+            DIVERGED: "DIVERGED";
+            ENROLLING: "ENROLLING";
+            LOST: "LOST";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            READY: "READY";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+            SYNC_LAGGING: "SYNC_LAGGING";
+        }>>;
+        generationVersion: z.ZodNullable<z.ZodNumber>;
+        credentialExpiresAt: z.ZodNullable<z.ZodString>;
+        deliveryEligible: z.ZodBoolean;
+    }, z.core.$strict>>;
+    total: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexShortLivedDeliveryClientKeySchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+    publicKey: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexShortLivedDeliveryRequestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    clientKey: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        publicKey: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexShortLivedDeliveryEnvelopeSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+    ephemeralPublicKey: z.ZodString;
+    salt: z.ZodString;
+    nonce: z.ZodString;
+    ciphertext: z.ZodString;
+    authenticationTag: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexShortLivedDeliveryResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    delivery: z.ZodObject<{
+        id: z.ZodString;
+        credentialKind: z.ZodLiteral<"SHORT_LIVED">;
+        assignmentId: z.ZodString;
+        managedAccountId: z.ZodString;
+        lineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+        status: z.ZodEnum<{
+            ACKED: "ACKED";
+            AWAITING_ACK: "AWAITING_ACK";
+            EXPIRED: "EXPIRED";
+        }>;
+        issuedAt: z.ZodString;
+        credentialExpiresAt: z.ZodString;
+        ackExpiresAt: z.ZodString;
+        ackedAt: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodString;
+        subject: z.ZodString;
+        envelope: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+            ephemeralPublicKey: z.ZodString;
+            salt: z.ZodString;
+            nonce: z.ZodString;
+            ciphertext: z.ZodString;
+            authenticationTag: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexShortLivedDeliveryAckInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    lineageId: z.ZodString;
+    generationVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexShortLivedDeliveryAckResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    delivery: z.ZodObject<{
+        id: z.ZodString;
+        credentialKind: z.ZodLiteral<"SHORT_LIVED">;
+        assignmentId: z.ZodString;
+        managedAccountId: z.ZodString;
+        lineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+        issuedAt: z.ZodString;
+        credentialExpiresAt: z.ZodString;
+        ackExpiresAt: z.ZodString;
+        status: z.ZodLiteral<"ACKED">;
+        ackedAt: z.ZodString;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexShortLivedCredentialBundleSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    deliveryId: z.ZodString;
+    managedAccountId: z.ZodString;
+    providerAccountId: z.ZodString;
+    lineageId: z.ZodString;
+    generationVersion: z.ZodNumber;
+    accessToken: z.ZodString;
+    idToken: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexAssignmentRetirementSchema: z.ZodObject<{
+    id: z.ZodString;
+    assignmentId: z.ZodString;
+    revision: z.ZodNumber;
+    reason: z.ZodEnum<{
+        COMPROMISED: "COMPROMISED";
+        REPLACED: "REPLACED";
+        UNASSIGN: "UNASSIGN";
+    }>;
+    status: z.ZodEnum<{
+        COMPROMISED: "COMPROMISED";
+        FINALIZED: "FINALIZED";
+        READY_TO_FINALIZE: "READY_TO_FINALIZE";
+        RETIREMENT_PENDING: "RETIREMENT_PENDING";
+    }>;
+    requestedAt: z.ZodString;
+    serverRefreshStoppedAt: z.ZodString;
+    shortLivedCredentialsExpireAt: z.ZodString;
+    localDeleteStatus: z.ZodEnum<{
+        ACKNOWLEDGED: "ACKNOWLEDGED";
+        EXPIRED: "EXPIRED";
+        NOT_REQUIRED: "NOT_REQUIRED";
+        PENDING: "PENDING";
+    }>;
+    localDeleteAcknowledgedAt: z.ZodNullable<z.ZodString>;
+    serverSecretsShreddedAt: z.ZodNullable<z.ZodString>;
+    upstreamRevocationStatus: z.ZodLiteral<"UNKNOWN">;
+    safeToFinalizeAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexAssignmentRetirementLocalDeleteAckInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    expectedRevision: z.ZodNumber;
+    targets: z.ZodArray<z.ZodObject<{
+        lineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const CodexAssignmentRetirementPreflightResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    retirement: z.ZodObject<{
+        id: z.ZodString;
+        assignmentId: z.ZodString;
+        revision: z.ZodNumber;
+        reason: z.ZodEnum<{
+            COMPROMISED: "COMPROMISED";
+            REPLACED: "REPLACED";
+            UNASSIGN: "UNASSIGN";
+        }>;
+        status: z.ZodEnum<{
+            COMPROMISED: "COMPROMISED";
+            FINALIZED: "FINALIZED";
+            READY_TO_FINALIZE: "READY_TO_FINALIZE";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        }>;
+        requestedAt: z.ZodString;
+        serverRefreshStoppedAt: z.ZodString;
+        shortLivedCredentialsExpireAt: z.ZodString;
+        localDeleteStatus: z.ZodEnum<{
+            ACKNOWLEDGED: "ACKNOWLEDGED";
+            EXPIRED: "EXPIRED";
+            NOT_REQUIRED: "NOT_REQUIRED";
+            PENDING: "PENDING";
+        }>;
+        localDeleteAcknowledgedAt: z.ZodNullable<z.ZodString>;
+        serverSecretsShreddedAt: z.ZodNullable<z.ZodString>;
+        upstreamRevocationStatus: z.ZodLiteral<"UNKNOWN">;
+        safeToFinalizeAt: z.ZodString;
+    }, z.core.$strict>;
+    allowedLocalDeleteTargets: z.ZodArray<z.ZodObject<{
+        lineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+    }, z.core.$strict>>;
+    allowedActions: z.ZodArray<z.ZodLiteral<"ACKNOWLEDGE_LOCAL_DELETE">>;
+}, z.core.$strict>;
+export declare const CodexAssignmentRetirementLocalDeleteAckResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    retirement: z.ZodObject<{
+        id: z.ZodString;
+        assignmentId: z.ZodString;
+        revision: z.ZodNumber;
+        reason: z.ZodEnum<{
+            COMPROMISED: "COMPROMISED";
+            REPLACED: "REPLACED";
+            UNASSIGN: "UNASSIGN";
+        }>;
+        status: z.ZodEnum<{
+            COMPROMISED: "COMPROMISED";
+            FINALIZED: "FINALIZED";
+            READY_TO_FINALIZE: "READY_TO_FINALIZE";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        }>;
+        requestedAt: z.ZodString;
+        serverRefreshStoppedAt: z.ZodString;
+        shortLivedCredentialsExpireAt: z.ZodString;
+        localDeleteStatus: z.ZodEnum<{
+            ACKNOWLEDGED: "ACKNOWLEDGED";
+            EXPIRED: "EXPIRED";
+            NOT_REQUIRED: "NOT_REQUIRED";
+            PENDING: "PENDING";
+        }>;
+        localDeleteAcknowledgedAt: z.ZodNullable<z.ZodString>;
+        serverSecretsShreddedAt: z.ZodNullable<z.ZodString>;
+        upstreamRevocationStatus: z.ZodLiteral<"UNKNOWN">;
+        safeToFinalizeAt: z.ZodString;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV3CredentialIngressSchema: z.ZodObject<{
+    envelopeVersion: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+    keyId: z.ZodString;
+    publicKey: z.ZodString;
+    maxRequestBytes: z.ZodNumber;
+    maxCiphertextBytes: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexV3CredentialEnvelopeSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+    keyId: z.ZodString;
+    ephemeralPublicKey: z.ZodString;
+    salt: z.ZodString;
+    nonce: z.ZodString;
+    ciphertext: z.ZodString;
+    authenticationTag: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV3EnrollmentConfigurationSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    ingress: z.ZodObject<{
+        envelopeVersion: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        publicKey: z.ZodString;
+        maxRequestBytes: z.ZodNumber;
+        maxCiphertextBytes: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexV3EnrollmentInputSchema: z.ZodObject<{
+    clientRequestId: z.ZodString;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexV3EnrollmentSchema: z.ZodObject<{
+    id: z.ZodString;
+    clientRequestId: z.ZodString;
+    status: z.ZodEnum<{
+        NEEDS_REAUTH: "NEEDS_REAUTH";
+        OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+        READY: "READY";
+        TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+        VALIDATING: "VALIDATING";
+    }>;
+    assignmentId: z.ZodNullable<z.ZodString>;
+    managedAccountId: z.ZodNullable<z.ZodString>;
+    providerAccountId: z.ZodNullable<z.ZodString>;
+    lineageId: z.ZodNullable<z.ZodString>;
+    generationVersion: z.ZodNullable<z.ZodNumber>;
+    authorityMode: z.ZodLiteral<"SERVER_VALIDATING">;
+    createdAt: z.ZodString;
+    completedAt: z.ZodNullable<z.ZodString>;
+    safeErrorCode: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const CodexV3EnrollmentResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    enrollment: z.ZodObject<{
+        id: z.ZodString;
+        clientRequestId: z.ZodString;
+        status: z.ZodEnum<{
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+            READY: "READY";
+            TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+            VALIDATING: "VALIDATING";
+        }>;
+        assignmentId: z.ZodNullable<z.ZodString>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        lineageId: z.ZodNullable<z.ZodString>;
+        generationVersion: z.ZodNullable<z.ZodNumber>;
+        authorityMode: z.ZodLiteral<"SERVER_VALIDATING">;
+        createdAt: z.ZodString;
+        completedAt: z.ZodNullable<z.ZodString>;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV3AccessTokenHealthSchema: z.ZodEnum<{
+    EXPIRED: "EXPIRED";
+    HEALTHY: "HEALTHY";
+    REJECTED: "REJECTED";
+    UNKNOWN: "UNKNOWN";
+}>;
+export declare const CodexV3RefreshTokenHealthSchema: z.ZodEnum<{
+    HEALTHY: "HEALTHY";
+    REJECTED: "REJECTED";
+    UNKNOWN: "UNKNOWN";
+}>;
+export declare const CodexV3CredentialAssignmentSchema: z.ZodObject<{
+    assignmentId: z.ZodString;
+    managedAccountId: z.ZodString;
+    label: z.ZodString;
+    providerAccountId: z.ZodString;
+    lineageId: z.ZodString;
+    lineageStatus: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        NEEDS_REAUTH: "NEEDS_REAUTH";
+        READY: "READY";
+        STALE: "STALE";
+    }>;
+    authorityMode: z.ZodEnum<{
+        CLIENT_MANAGED: "CLIENT_MANAGED";
+        DELIVERY_PENDING: "DELIVERY_PENDING";
+        SERVER_VALIDATING: "SERVER_VALIDATING";
+    }>;
+    authorityEpoch: z.ZodNumber;
+    currentGenerationVersion: z.ZodNumber;
+    accessTokenHealth: z.ZodEnum<{
+        EXPIRED: "EXPIRED";
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    refreshTokenHealth: z.ZodEnum<{
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    credentialExpiresAt: z.ZodString;
+    lastObservedAt: z.ZodString;
+    deliveryEligible: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV3CredentialAssignmentListResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    items: z.ZodArray<z.ZodObject<{
+        assignmentId: z.ZodString;
+        managedAccountId: z.ZodString;
+        label: z.ZodString;
+        providerAccountId: z.ZodString;
+        lineageId: z.ZodString;
+        lineageStatus: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            READY: "READY";
+            STALE: "STALE";
+        }>;
+        authorityMode: z.ZodEnum<{
+            CLIENT_MANAGED: "CLIENT_MANAGED";
+            DELIVERY_PENDING: "DELIVERY_PENDING";
+            SERVER_VALIDATING: "SERVER_VALIDATING";
+        }>;
+        authorityEpoch: z.ZodNumber;
+        currentGenerationVersion: z.ZodNumber;
+        accessTokenHealth: z.ZodEnum<{
+            EXPIRED: "EXPIRED";
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        refreshTokenHealth: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        credentialExpiresAt: z.ZodString;
+        lastObservedAt: z.ZodString;
+        deliveryEligible: z.ZodBoolean;
+    }, z.core.$strict>>;
+    total: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexV3FullCredentialDeliveryRequestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    clientRequestId: z.ZodString;
+    clientKey: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        publicKey: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexV3FullCredentialDeliveryResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    delivery: z.ZodObject<{
+        id: z.ZodString;
+        credentialKind: z.ZodLiteral<"FULL">;
+        clientRequestId: z.ZodString;
+        assignmentId: z.ZodString;
+        managedAccountId: z.ZodString;
+        providerAccountId: z.ZodString;
+        subject: z.ZodString;
+        lineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+        issuedAt: z.ZodString;
+        credentialExpiresAt: z.ZodString;
+        ackExpiresAt: z.ZodString;
+        ackedAt: z.ZodNullable<z.ZodString>;
+        status: z.ZodLiteral<"AWAITING_ACK">;
+        authorityMode: z.ZodLiteral<"DELIVERY_PENDING">;
+        envelope: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+            ephemeralPublicKey: z.ZodString;
+            salt: z.ZodString;
+            nonce: z.ZodString;
+            ciphertext: z.ZodString;
+            authenticationTag: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV3FullCredentialDeliveryAckInputSchema: z.ZodObject<{
+    generationVersion: z.ZodNumber;
+    installed: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare const CodexV3FullCredentialDeliveryAckResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    delivery: z.ZodObject<{
+        id: z.ZodString;
+        credentialKind: z.ZodLiteral<"FULL">;
+        clientRequestId: z.ZodString;
+        assignmentId: z.ZodString;
+        managedAccountId: z.ZodString;
+        providerAccountId: z.ZodString;
+        subject: z.ZodString;
+        lineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+        issuedAt: z.ZodString;
+        credentialExpiresAt: z.ZodString;
+        ackExpiresAt: z.ZodString;
+        status: z.ZodLiteral<"ACKED">;
+        authorityMode: z.ZodLiteral<"CLIENT_MANAGED">;
+        authorityEpoch: z.ZodNumber;
+        ackedAt: z.ZodString;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV3FullCredentialBundleSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    deliveryId: z.ZodString;
+    managedAccountId: z.ZodString;
+    providerAccountId: z.ZodString;
+    lineageId: z.ZodString;
+    generationVersion: z.ZodNumber;
+    refreshToken: z.ZodString;
+    accessToken: z.ZodString;
+    idToken: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV3GenerationReportInputSchema: z.ZodObject<{
+    clientRequestId: z.ZodString;
+    expectedGenerationVersion: z.ZodNumber;
+    rotationMode: z.ZodEnum<{
+        RETAINED: "RETAINED";
+        ROTATED: "ROTATED";
+    }>;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+    accessTokenHealth: z.ZodEnum<{
+        EXPIRED: "EXPIRED";
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    refreshTokenHealth: z.ZodEnum<{
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    observedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV3GenerationReportResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    report: z.ZodObject<{
+        id: z.ZodString;
+        clientRequestId: z.ZodString;
+        lineageId: z.ZodString;
+        previousGenerationVersion: z.ZodNumber;
+        generationVersion: z.ZodNumber;
+        rotationMode: z.ZodEnum<{
+            RETAINED: "RETAINED";
+            ROTATED: "ROTATED";
+        }>;
+        accessTokenHealth: z.ZodEnum<{
+            EXPIRED: "EXPIRED";
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        refreshTokenHealth: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        credentialExpiresAt: z.ZodString;
+        observedAt: z.ZodString;
+        status: z.ZodLiteral<"APPLIED">;
+        authorityMode: z.ZodLiteral<"CLIENT_MANAGED">;
+        authorityEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
 export type CodexAccountSummary = z.infer<typeof CodexAccountSummarySchema>;
 export type CodexQuotaSnapshotView = z.infer<typeof CodexQuotaSnapshotViewSchema>;
 export type CodexAccountListResponse = z.infer<typeof CodexAccountListResponseSchema>;
@@ -746,7 +1760,63 @@ export type CodexAdminAssignment = z.infer<typeof CodexAdminAssignmentSchema>;
 export type CodexAdminAssignmentListResponse = z.infer<typeof CodexAdminAssignmentListResponseSchema>;
 export type CodexAdminAssignmentMutationResponse = z.infer<typeof CodexAdminAssignmentMutationResponseSchema>;
 export type CodexAdminAssignmentDeleteResponse = z.infer<typeof CodexAdminAssignmentDeleteResponseSchema>;
+export type CodexEnrollmentIntentReason = z.infer<typeof CodexEnrollmentIntentReasonSchema>;
+export type CodexEnrollmentIntentStatus = z.infer<typeof CodexEnrollmentIntentStatusSchema>;
+export type CodexEnrollmentIntent = z.infer<typeof CodexEnrollmentIntentSchema>;
+export type CodexEnrollmentCandidateIngress = z.infer<typeof CodexEnrollmentCandidateIngressSchema>;
+export type CodexEnrollmentCapabilities = z.infer<typeof CodexEnrollmentCapabilitiesSchema>;
+export type CodexEnrollmentIntentResponse = z.infer<typeof CodexEnrollmentIntentResponseSchema>;
+export type CodexEnrollmentMutationInput = z.infer<typeof CodexEnrollmentMutationInputSchema>;
+export type CodexEnrollmentHeartbeatInput = z.infer<typeof CodexEnrollmentHeartbeatInputSchema>;
+export type CodexEnrollmentCandidateEnvelope = z.infer<typeof CodexEnrollmentCandidateEnvelopeSchema>;
+export type CodexEnrollmentCandidateInput = z.infer<typeof CodexEnrollmentCandidateInputSchema>;
+export type CodexEnrollmentCandidateResponse = z.infer<typeof CodexEnrollmentCandidateResponseSchema>;
+export type CodexMigrationPlanStatus = z.infer<typeof CodexMigrationPlanStatusSchema>;
+export type CodexMigrationTarget = z.infer<typeof CodexMigrationTargetSchema>;
+export type CodexMigrationLoginQueueResponse = z.infer<typeof CodexMigrationLoginQueueResponseSchema>;
+export type CodexUserCredentialAssignment = z.infer<typeof CodexUserCredentialAssignmentSchema>;
+export type CodexUserCredentialAssignmentListResponse = z.infer<typeof CodexUserCredentialAssignmentListResponseSchema>;
+export type CodexShortLivedDeliveryClientKey = z.infer<typeof CodexShortLivedDeliveryClientKeySchema>;
+export type CodexShortLivedDeliveryRequest = z.infer<typeof CodexShortLivedDeliveryRequestSchema>;
+export type CodexShortLivedDeliveryResponse = z.infer<typeof CodexShortLivedDeliveryResponseSchema>;
+export type CodexShortLivedDeliveryAckInput = z.infer<typeof CodexShortLivedDeliveryAckInputSchema>;
+export type CodexShortLivedDeliveryAckResponse = z.infer<typeof CodexShortLivedDeliveryAckResponseSchema>;
+export type CodexShortLivedCredentialBundle = z.infer<typeof CodexShortLivedCredentialBundleSchema>;
+export type CodexAssignmentRetirement = z.infer<typeof CodexAssignmentRetirementSchema>;
+export type CodexAssignmentRetirementLocalDeleteAckInput = z.infer<typeof CodexAssignmentRetirementLocalDeleteAckInputSchema>;
+export type CodexAssignmentRetirementPreflightResponse = z.infer<typeof CodexAssignmentRetirementPreflightResponseSchema>;
+export type CodexAssignmentRetirementLocalDeleteAckResponse = z.infer<typeof CodexAssignmentRetirementLocalDeleteAckResponseSchema>;
+export type CodexV3CredentialIngress = z.infer<typeof CodexV3CredentialIngressSchema>;
+export type CodexV3CredentialEnvelope = z.infer<typeof CodexV3CredentialEnvelopeSchema>;
+export type CodexV3EnrollmentConfiguration = z.infer<typeof CodexV3EnrollmentConfigurationSchema>;
+export type CodexV3EnrollmentInput = z.infer<typeof CodexV3EnrollmentInputSchema>;
+export type CodexV3EnrollmentResponse = z.infer<typeof CodexV3EnrollmentResponseSchema>;
+export type CodexV3CredentialAssignment = z.infer<typeof CodexV3CredentialAssignmentSchema>;
+export type CodexV3CredentialAssignmentListResponse = z.infer<typeof CodexV3CredentialAssignmentListResponseSchema>;
+export type CodexV3FullCredentialDeliveryRequest = z.infer<typeof CodexV3FullCredentialDeliveryRequestSchema>;
+export type CodexV3FullCredentialDeliveryResponse = z.infer<typeof CodexV3FullCredentialDeliveryResponseSchema>;
+export type CodexV3FullCredentialDeliveryAckInput = z.infer<typeof CodexV3FullCredentialDeliveryAckInputSchema>;
+export type CodexV3FullCredentialDeliveryAckResponse = z.infer<typeof CodexV3FullCredentialDeliveryAckResponseSchema>;
+export type CodexV3FullCredentialBundle = z.infer<typeof CodexV3FullCredentialBundleSchema>;
+export type CodexV3GenerationReportInput = z.infer<typeof CodexV3GenerationReportInputSchema>;
+export type CodexV3GenerationReportResponse = z.infer<typeof CodexV3GenerationReportResponseSchema>;
 export declare function codexAccountLoginCredentialsPath(accountId: string): string;
 export declare function codexAdminCredentialVersionsPath(accountId: string): string;
 export declare function codexAdminRefreshPath(accountId: string): string;
 export declare function codexAdminAssignmentPath(assignmentId: string): string;
+export declare function codexAdminEnrollmentIntentPath(intentId: string): string;
+export declare function codexAdminEnrollmentIntentActionPath(intentId: string, action: "claim" | "heartbeat" | "cancel" | "candidate"): string;
+export declare function codexAdminMigrationLoginQueuePath(planId: string, query: {
+    page: number;
+    pageSize: number;
+}): string;
+export declare function codexAssignmentShortLivedDeliveriesPath(assignmentId: string): string;
+export declare function codexShortLivedDeliveryAckPath(deliveryId: string): string;
+export declare function codexAssignmentRetirementLocalDeleteAckPath(retirementId: string): string;
+export declare function codexAssignmentRetirementPath(retirementId: string): string;
+export declare function codexV3EnrollmentResolvePath(clientRequestId: string): string;
+export declare function codexV3AssignmentFullCredentialDeliveriesPath(assignmentId: string): string;
+export declare function codexV3AssignmentFullCredentialDeliveryResolvePath(assignmentId: string, clientRequestId: string): string;
+export declare function codexV3FullCredentialDeliveryAckPath(deliveryId: string): string;
+export declare function codexV3LineageGenerationReportsPath(lineageId: string): string;
+export declare function codexV3LineageGenerationReportResolvePath(lineageId: string, clientRequestId: string): string;