@tokensrc/codex 1.13.4 → 1.14.0

package/dist/protocol.js

@@ -5,6 +5,25 @@ export const CODEX_ACCOUNTS_LIST_PATH = CODEX_ACCOUNTS_PATH;
 export const CODEX_ACCOUNTS_IMPORT_PATH = "/v1/admin/codex/accounts/import";
 export const CODEX_ADMIN_ACCOUNTS_PATH = "/v1/admin/codex/accounts";
 export const CODEX_ADMIN_ASSIGNMENTS_PATH = "/v1/admin/codex/assignments";
+export const CODEX_ENROLLMENT_SCHEMA_VERSION = 2;
+export const CODEX_ADMIN_ENROLLMENT_INTENTS_PATH = "/v2/admin/codex/enrollment-intents";
+export const CODEX_CREDENTIAL_ASSIGNMENTS_PATH = "/v2/codex/credential-assignments";
+export const CODEX_SHORT_LIVED_DELIVERIES_PATH = "/v2/codex/short-lived-credential-deliveries";
+export const CODEX_ASSIGNMENT_RETIREMENTS_PATH = "/v2/codex/assignment-retirements";
+export const CODEX_ADMIN_MIGRATION_PLANS_PATH = "/v2/admin/codex/migration-plans";
+export const CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION = 3;
+// The configured service URL already includes the public `/api` prefix.
+export const CODEX_MANAGED_CREDENTIALS_V3_PATH = "/v3/codex";
+export const CODEX_V3_ENROLLMENT_CONFIGURATION_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/enrollment-configuration`;
+export const CODEX_V3_ENROLLMENTS_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/enrollments`;
+export const CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/credential-assignments`;
+export const CODEX_V3_FULL_CREDENTIAL_DELIVERIES_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/full-credential-deliveries`;
+export const CODEX_V3_CREDENTIAL_LINEAGES_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/credential-lineages`;
+export const CODEX_MIGRATION_CAPACITY = {
+    verifiedMinimum: 2,
+    verifiedLimit: null,
+    sequentialRequired: true
+};
 const CodexCompatibilityLabelSchema = z.string().max(256)
     .transform((label) => label.trim() ? label : undefined)
     .optional();
@@ -43,6 +62,19 @@ export const CodexAccountSummarySchema = z.object({
     isDefault: z.boolean(),
     accessExpiresAt: z.number().int().positive().optional(),
     credentialStatus: z.enum(["AVAILABLE", "NEEDS_REAUTH", "TEMPORARILY_UNAVAILABLE"]).optional(),
+    lineageStatus: z.enum([
+        "ENROLLING",
+        "READY",
+        "DELIVERY_UNKNOWN",
+        "ACTIVE",
+        "SYNC_LAGGING",
+        "DIVERGED",
+        "LOST",
+        "NEEDS_REAUTH",
+        "RETIREMENT_PENDING",
+        "RETIRED",
+        "COMPROMISED"
+    ]).optional(),
     quota: CodexQuotaSnapshotViewSchema.nullable().optional()
 });
 export const CodexAccountListResponseSchema = z.object({
@@ -220,6 +252,491 @@ export const CodexAdminAssignmentDeleteResponseSchema = z.strictObject({
     schemaVersion: z.literal(CODEX_DISTRIBUTION_SCHEMA_VERSION),
     assignmentId: z.string().min(1).max(128)
 });
+export const CodexEnrollmentIntentReasonSchema = z.enum([
+    "NEW",
+    "REPLACE_LOST",
+    "REPLACE_REJECTED",
+    "REPLACE_DIVERGED",
+    "REPLACE_ADMIN"
+]);
+export const CodexEnrollmentIntentStatusSchema = z.enum([
+    "AWAITING_CLI",
+    "CLAIMED",
+    "LOGIN_IN_PROGRESS",
+    "UPLOADING",
+    "VALIDATING",
+    "READY",
+    "ACCOUNT_MISMATCH",
+    "IDENTITY_UNVERIFIABLE",
+    "TEMPORARILY_UNAVAILABLE",
+    "OUTCOME_AMBIGUOUS",
+    "EXPIRED",
+    "CANCELLED"
+]);
+const EnrollmentInstantSchema = z.string().datetime({ offset: true });
+export const CodexEnrollmentIntentSchema = z.strictObject({
+    id: z.string().min(1).max(128),
+    type: z.enum(["ACCOUNT_DISCOVERY", "ASSIGNMENT_ENROLLMENT"]),
+    status: CodexEnrollmentIntentStatusSchema,
+    revision: z.number().int().nonnegative(),
+    reason: CodexEnrollmentIntentReasonSchema,
+    assignmentId: z.string().min(1).max(128).nullable(),
+    managedAccountId: z.string().min(1).max(128).nullable(),
+    userSubject: z.string().min(1).max(255).nullable(),
+    createdAt: EnrollmentInstantSchema,
+    expiresAt: EnrollmentInstantSchema,
+    claimedAt: EnrollmentInstantSchema.nullable(),
+    lastHeartbeatAt: EnrollmentInstantSchema.nullable(),
+    cancelledAt: EnrollmentInstantSchema.nullable(),
+    updatedAt: EnrollmentInstantSchema,
+    safeErrorCode: z.string().min(1).max(128).regex(/^[a-z][a-z0-9_.-]*$/i).nullable(),
+    resultManagedAccountId: z.string().min(1).max(128).nullable(),
+    resultLineageId: z.string().min(1).max(128).nullable(),
+    currentGenerationVersion: z.number().int().positive().nullable(),
+    allowedActions: z.array(z.string().min(1).max(64).regex(/^[A-Z][A-Z0-9_]*$/)).max(32)
+});
+export const CodexEnrollmentCandidateIngressSchema = z.strictObject({
+    envelopeVersion: z.literal(1),
+    algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
+    keyId: z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/),
+    publicKey: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/),
+    maxRequestBytes: z.number().int().min(1_024).max(196_608),
+    maxCiphertextBytes: z.number().int().min(256).max(131_072)
+});
+export const CodexEnrollmentCapabilitiesSchema = z.strictObject({
+    enrollmentIntents: z.boolean(),
+    candidateUpload: z.boolean(),
+    delivery: z.boolean(),
+    rotationSync: z.boolean(),
+    candidateIngress: CodexEnrollmentCandidateIngressSchema.optional()
+}).superRefine((capabilities, context) => {
+    if (capabilities.candidateUpload && !capabilities.candidateIngress) {
+        context.addIssue({
+            code: "custom",
+            path: ["candidateIngress"],
+            message: "candidateIngress is required when candidateUpload is enabled."
+        });
+    }
+});
+export const CodexEnrollmentIntentResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    intent: CodexEnrollmentIntentSchema,
+    capabilities: CodexEnrollmentCapabilitiesSchema
+});
+export const CodexEnrollmentMutationInputSchema = z.strictObject({
+    idempotencyKey: z.string().min(8).max(255),
+    revision: z.number().int().nonnegative()
+});
+export const CodexEnrollmentHeartbeatInputSchema = CodexEnrollmentMutationInputSchema.extend({
+    phase: z.enum(["LOGIN_IN_PROGRESS", "UPLOADING"])
+});
+export const CodexEnrollmentCandidateEnvelopeSchema = z.strictObject({
+    version: z.literal(1),
+    algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
+    keyId: z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/),
+    ephemeralPublicKey: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/),
+    salt: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/),
+    nonce: z.string().length(16).regex(/^[A-Za-z0-9_-]+$/),
+    ciphertext: z.string().min(1).max(174_764).regex(/^[A-Za-z0-9_-]+$/),
+    authenticationTag: z.string().length(22).regex(/^[A-Za-z0-9_-]+$/)
+});
+export const CodexEnrollmentCandidateInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    revision: z.number().int().nonnegative(),
+    envelope: CodexEnrollmentCandidateEnvelopeSchema
+});
+export const CodexEnrollmentCandidateResultSchema = z.strictObject({
+    outcome: z.enum([
+        "READY",
+        "ACCOUNT_MISMATCH",
+        "IDENTITY_UNVERIFIABLE",
+        "TEMPORARILY_UNAVAILABLE",
+        "OUTCOME_AMBIGUOUS"
+    ]),
+    managedAccountId: z.string().min(1).max(128).nullable(),
+    lineageId: z.string().min(1).max(128).nullable(),
+    generationVersion: z.number().int().positive().nullable(),
+    replayed: z.boolean()
+});
+export const CodexEnrollmentCandidateResponseSchema = CodexEnrollmentIntentResponseSchema.extend({
+    result: CodexEnrollmentCandidateResultSchema
+});
+export const CodexMigrationPlanStatusSchema = z.enum([
+    "ACTIVE",
+    "PAUSED",
+    "CANCELLED",
+    "COMPLETED"
+]);
+export const CodexMigrationTargetSchema = z.strictObject({
+    id: z.string().min(1).max(255),
+    assignmentId: z.string().min(1).max(255),
+    userSubject: z.string().min(1).max(255),
+    distributionMode: z.enum(["LEGACY", "MIGRATING", "USER_BOUND"]),
+    projectedStatus: z.enum([
+        "UNENROLLED",
+        "AWAITING_CLI",
+        "ENROLLING",
+        "VALIDATING",
+        "READY",
+        "DELIVERY_UNKNOWN",
+        "ACTIVE",
+        "SYNC_LAGGING",
+        "DIVERGED",
+        "LOST",
+        "NEEDS_REAUTH",
+        "RETIREMENT_PENDING",
+        "RETIRED",
+        "COMPROMISED",
+        "LEGACY_V1"
+    ]),
+    enrollmentAttachment: z.enum(["CREATED", "REUSED", "NONE"]),
+    enrollmentIntent: z.strictObject({
+        id: z.string().min(1).max(255),
+        status: CodexEnrollmentIntentStatusSchema,
+        revision: z.number().int().nonnegative(),
+        expiresAt: EnrollmentInstantSchema,
+        updatedAt: EnrollmentInstantSchema,
+        safeErrorCode: z.string().min(1).max(128).regex(/^[a-z][a-z0-9_.-]*$/i).nullable()
+    }).nullable(),
+    allowedAction: z.enum(["LOGIN", "VIEW_ENROLLMENT", "NONE"])
+});
+export const CodexMigrationLoginQueueResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    plan: z.strictObject({
+        id: z.string().min(1).max(255),
+        status: CodexMigrationPlanStatusSchema,
+        revision: z.number().int().nonnegative(),
+        accountId: z.string().min(1).max(255),
+        sequentialRequired: z.literal(true)
+    }),
+    items: z.array(CodexMigrationTargetSchema).max(100),
+    total: z.number().int().nonnegative(),
+    page: z.number().int().min(1).max(1_000_000),
+    pageSize: z.number().int().min(1).max(100)
+}).superRefine((value, context) => {
+    if (value.items.length > value.pageSize || value.items.length > value.total) {
+        context.addIssue({
+            code: "custom",
+            path: ["items"],
+            message: "Migration login queue pagination is inconsistent."
+        });
+    }
+});
+export const CodexUserCredentialAssignmentSchema = z.strictObject({
+    assignmentId: z.string().min(1).max(128),
+    managedAccountId: z.string().min(1).max(128),
+    label: z.string().min(1).max(256),
+    distributionMode: z.literal("SERVER_MANAGED_SHORT_LIVED"),
+    lineageStatus: z.enum([
+        "ENROLLING",
+        "READY",
+        "DELIVERY_UNKNOWN",
+        "ACTIVE",
+        "SYNC_LAGGING",
+        "DIVERGED",
+        "LOST",
+        "NEEDS_REAUTH",
+        "RETIREMENT_PENDING",
+        "RETIRED",
+        "COMPROMISED"
+    ]).nullable(),
+    generationVersion: z.number().int().positive().nullable(),
+    credentialExpiresAt: EnrollmentInstantSchema.nullable(),
+    deliveryEligible: z.boolean()
+});
+export const CodexUserCredentialAssignmentListResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    items: z.array(CodexUserCredentialAssignmentSchema),
+    total: z.number().int().nonnegative()
+}).superRefine((value, context) => {
+    if (value.total !== value.items.length) {
+        context.addIssue({
+            code: "custom",
+            path: ["total"],
+            message: "Credential assignment total must match the unpaged item count."
+        });
+    }
+});
+export const CodexShortLivedDeliveryClientKeySchema = z.strictObject({
+    version: z.literal(1),
+    algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
+    publicKey: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/)
+});
+export const CodexShortLivedDeliveryRequestSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    clientKey: CodexShortLivedDeliveryClientKeySchema
+});
+export const CodexShortLivedDeliveryEnvelopeSchema = z.strictObject({
+    version: z.literal(1),
+    algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
+    ephemeralPublicKey: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/),
+    salt: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/),
+    nonce: z.string().length(16).regex(/^[A-Za-z0-9_-]+$/),
+    ciphertext: z.string().min(1).max(174_764).regex(/^[A-Za-z0-9_-]+$/),
+    authenticationTag: z.string().length(22).regex(/^[A-Za-z0-9_-]+$/)
+});
+const CodexShortLivedDeliveryMetadataSchema = z.strictObject({
+    id: z.string().min(1).max(128),
+    credentialKind: z.literal("SHORT_LIVED"),
+    assignmentId: z.string().min(1).max(128),
+    managedAccountId: z.string().min(1).max(128),
+    lineageId: z.string().min(1).max(128),
+    generationVersion: z.number().int().positive(),
+    status: z.enum(["AWAITING_ACK", "ACKED", "EXPIRED"]),
+    issuedAt: EnrollmentInstantSchema,
+    credentialExpiresAt: EnrollmentInstantSchema,
+    ackExpiresAt: EnrollmentInstantSchema,
+    ackedAt: EnrollmentInstantSchema.nullable()
+});
+export const CodexShortLivedDeliveryResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    delivery: CodexShortLivedDeliveryMetadataSchema.extend({
+        providerAccountId: z.string().min(1).max(512),
+        subject: z.string().min(1).max(255),
+        envelope: CodexShortLivedDeliveryEnvelopeSchema
+    }),
+    replayed: z.boolean()
+});
+export const CodexShortLivedDeliveryAckInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    lineageId: z.string().min(1).max(128),
+    generationVersion: z.number().int().positive()
+});
+export const CodexShortLivedDeliveryAckResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    delivery: CodexShortLivedDeliveryMetadataSchema.extend({
+        status: z.literal("ACKED"),
+        ackedAt: EnrollmentInstantSchema
+    }),
+    replayed: z.boolean()
+});
+export const CodexShortLivedCredentialBundleSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    deliveryId: z.string().min(1).max(128),
+    managedAccountId: z.string().min(1).max(128),
+    providerAccountId: z.string().min(1).max(512),
+    lineageId: z.string().min(1).max(128),
+    generationVersion: z.number().int().positive(),
+    accessToken: z.string().min(1).max(65_536),
+    idToken: z.string().min(1).max(65_536),
+    expiresAt: EnrollmentInstantSchema
+});
+export const CodexAssignmentRetirementSchema = z.strictObject({
+    id: z.string().min(1).max(200),
+    assignmentId: z.string().min(1).max(200),
+    revision: z.number().int().positive(),
+    reason: z.enum(["UNASSIGN", "COMPROMISED", "REPLACED"]),
+    status: z.enum(["RETIREMENT_PENDING", "COMPROMISED", "READY_TO_FINALIZE", "FINALIZED"]),
+    requestedAt: EnrollmentInstantSchema,
+    serverRefreshStoppedAt: EnrollmentInstantSchema,
+    shortLivedCredentialsExpireAt: EnrollmentInstantSchema,
+    localDeleteStatus: z.enum(["NOT_REQUIRED", "PENDING", "ACKNOWLEDGED", "EXPIRED"]),
+    localDeleteAcknowledgedAt: EnrollmentInstantSchema.nullable(),
+    serverSecretsShreddedAt: EnrollmentInstantSchema.nullable(),
+    upstreamRevocationStatus: z.literal("UNKNOWN"),
+    safeToFinalizeAt: EnrollmentInstantSchema
+});
+export const CodexAssignmentRetirementLocalDeleteAckInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    expectedRevision: z.number().int().positive(),
+    targets: z.array(z.strictObject({
+        lineageId: z.string().min(1).max(200),
+        generationVersion: z.number().int().positive()
+    })).min(1).max(1_000)
+});
+const CodexAssignmentRetirementLocalDeleteTargetSchema = z.strictObject({
+    lineageId: z.string().min(1).max(200),
+    generationVersion: z.number().int().positive()
+});
+export const CodexAssignmentRetirementPreflightResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    retirement: CodexAssignmentRetirementSchema,
+    allowedLocalDeleteTargets: z.array(CodexAssignmentRetirementLocalDeleteTargetSchema).max(1_000),
+    allowedActions: z.array(z.literal("ACKNOWLEDGE_LOCAL_DELETE")).max(1)
+});
+export const CodexAssignmentRetirementLocalDeleteAckResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
+    retirement: CodexAssignmentRetirementSchema,
+    replayed: z.boolean()
+});
+const CodexV3InstantSchema = z.string().datetime({ offset: true });
+const CodexV3IdSchema = z.string().min(1).max(255);
+const CodexV3ClientRequestIdSchema = z.string().min(8).max(255)
+    .regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/);
+export const CodexV3CredentialIngressSchema = z.strictObject({
+    envelopeVersion: z.literal(1),
+    algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
+    keyId: z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/),
+    publicKey: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/),
+    maxRequestBytes: z.number().int().min(1_024).max(196_608),
+    maxCiphertextBytes: z.number().int().min(256).max(131_072)
+});
+export const CodexV3CredentialEnvelopeSchema = CodexEnrollmentCandidateEnvelopeSchema;
+export const CodexV3EnrollmentConfigurationSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    ingress: CodexV3CredentialIngressSchema
+});
+export const CodexV3EnrollmentInputSchema = z.strictObject({
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    envelope: CodexV3CredentialEnvelopeSchema
+});
+export const CodexV3EnrollmentSchema = z.strictObject({
+    id: CodexV3IdSchema,
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    status: z.enum([
+        "VALIDATING",
+        "READY",
+        "TEMPORARILY_UNAVAILABLE",
+        "NEEDS_REAUTH",
+        "OUTCOME_AMBIGUOUS"
+    ]),
+    assignmentId: CodexV3IdSchema.nullable(),
+    managedAccountId: CodexV3IdSchema.nullable(),
+    providerAccountId: z.string().min(1).max(512).nullable(),
+    lineageId: CodexV3IdSchema.nullable(),
+    generationVersion: z.number().int().positive().nullable(),
+    authorityMode: z.literal("SERVER_VALIDATING"),
+    createdAt: CodexV3InstantSchema,
+    completedAt: CodexV3InstantSchema.nullable(),
+    safeErrorCode: z.string().min(1).max(128).regex(/^[A-Za-z][A-Za-z0-9_.-]*$/).nullable()
+}).superRefine((value, context) => {
+    const target = [
+        value.assignmentId,
+        value.managedAccountId,
+        value.providerAccountId,
+        value.lineageId,
+        value.generationVersion
+    ];
+    if (value.status === "READY") {
+        if (target.some((item) => item == null) || value.completedAt == null || value.safeErrorCode != null) {
+            context.addIssue({ code: "custom", message: "READY enrollment evidence is incomplete." });
+        }
+    }
+    else if (target.some((item) => item != null)) {
+        context.addIssue({ code: "custom", message: "Non-READY enrollment cannot expose a target tuple." });
+    }
+});
+export const CodexV3EnrollmentResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    enrollment: CodexV3EnrollmentSchema,
+    replayed: z.boolean()
+});
+export const CodexV3AccessTokenHealthSchema = z.enum(["HEALTHY", "EXPIRED", "REJECTED", "UNKNOWN"]);
+export const CodexV3RefreshTokenHealthSchema = z.enum(["HEALTHY", "REJECTED", "UNKNOWN"]);
+export const CodexV3CredentialAssignmentSchema = z.strictObject({
+    assignmentId: CodexV3IdSchema,
+    managedAccountId: CodexV3IdSchema,
+    label: z.string().min(1).max(256),
+    providerAccountId: z.string().min(1).max(512),
+    lineageId: CodexV3IdSchema,
+    lineageStatus: z.enum(["READY", "ACTIVE", "STALE", "NEEDS_REAUTH"]),
+    authorityMode: z.enum(["SERVER_VALIDATING", "DELIVERY_PENDING", "CLIENT_MANAGED"]),
+    authorityEpoch: z.number().int().nonnegative(),
+    currentGenerationVersion: z.number().int().positive(),
+    accessTokenHealth: CodexV3AccessTokenHealthSchema,
+    refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+    credentialExpiresAt: CodexV3InstantSchema,
+    lastObservedAt: CodexV3InstantSchema,
+    deliveryEligible: z.boolean()
+});
+export const CodexV3CredentialAssignmentListResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    items: z.array(CodexV3CredentialAssignmentSchema).max(1),
+    total: z.number().int().min(0).max(1)
+}).superRefine((value, context) => {
+    if (value.total !== value.items.length) {
+        context.addIssue({ code: "custom", path: ["total"], message: "Assignment total is inconsistent." });
+    }
+});
+export const CodexV3FullCredentialDeliveryRequestSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    clientKey: CodexShortLivedDeliveryClientKeySchema
+});
+const CodexV3FullCredentialDeliveryMetadataSchema = z.strictObject({
+    id: CodexV3IdSchema,
+    credentialKind: z.literal("FULL"),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    assignmentId: CodexV3IdSchema,
+    managedAccountId: CodexV3IdSchema,
+    providerAccountId: z.string().min(1).max(512),
+    subject: z.string().min(1).max(255),
+    lineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive(),
+    status: z.enum(["AWAITING_ACK", "ACKED", "EXPIRED"]),
+    authorityMode: z.enum(["DELIVERY_PENDING", "CLIENT_MANAGED"]),
+    issuedAt: CodexV3InstantSchema,
+    credentialExpiresAt: CodexV3InstantSchema,
+    ackExpiresAt: CodexV3InstantSchema,
+    ackedAt: CodexV3InstantSchema.nullable()
+});
+export const CodexV3FullCredentialDeliveryResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    delivery: CodexV3FullCredentialDeliveryMetadataSchema.extend({
+        status: z.literal("AWAITING_ACK"),
+        authorityMode: z.literal("DELIVERY_PENDING"),
+        envelope: CodexShortLivedDeliveryEnvelopeSchema
+    }),
+    replayed: z.boolean()
+});
+export const CodexV3FullCredentialDeliveryAckInputSchema = z.strictObject({
+    generationVersion: z.number().int().positive(),
+    installed: z.literal(true)
+});
+export const CodexV3FullCredentialDeliveryAckResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    delivery: CodexV3FullCredentialDeliveryMetadataSchema.extend({
+        status: z.literal("ACKED"),
+        authorityMode: z.literal("CLIENT_MANAGED"),
+        authorityEpoch: z.number().int().positive(),
+        ackedAt: CodexV3InstantSchema
+    }),
+    replayed: z.boolean()
+});
+export const CodexV3FullCredentialBundleSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    deliveryId: CodexV3IdSchema,
+    managedAccountId: CodexV3IdSchema,
+    providerAccountId: z.string().min(1).max(512),
+    lineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive(),
+    refreshToken: z.string().min(1).max(65_536),
+    accessToken: z.string().min(1).max(65_536),
+    idToken: z.string().min(1).max(65_536),
+    expiresAt: CodexV3InstantSchema
+});
+export const CodexV3GenerationReportInputSchema = z.strictObject({
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    expectedGenerationVersion: z.number().int().positive(),
+    rotationMode: z.enum(["ROTATED", "RETAINED"]),
+    envelope: CodexV3CredentialEnvelopeSchema,
+    accessTokenHealth: CodexV3AccessTokenHealthSchema,
+    refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+    observedAt: CodexV3InstantSchema
+});
+export const CodexV3GenerationReportResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    report: z.strictObject({
+        id: CodexV3IdSchema,
+        clientRequestId: CodexV3ClientRequestIdSchema,
+        lineageId: CodexV3IdSchema,
+        previousGenerationVersion: z.number().int().positive(),
+        generationVersion: z.number().int().positive(),
+        rotationMode: z.enum(["ROTATED", "RETAINED"]),
+        accessTokenHealth: CodexV3AccessTokenHealthSchema,
+        refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+        credentialExpiresAt: CodexV3InstantSchema,
+        observedAt: CodexV3InstantSchema,
+        status: z.literal("APPLIED"),
+        authorityMode: z.literal("CLIENT_MANAGED"),
+        authorityEpoch: z.number().int().positive()
+    }),
+    replayed: z.boolean()
+}).superRefine((value, context) => {
+    if (value.report.generationVersion !== value.report.previousGenerationVersion + 1) {
+        context.addIssue({ code: "custom", path: ["report", "generationVersion"], message: "Generation did not advance exactly once." });
+    }
+});
 export function codexAccountLoginCredentialsPath(accountId) {
     return `${CODEX_ACCOUNTS_PATH}/${encodeURIComponent(accountId)}/login-credentials`;
 }
@@ -232,4 +749,47 @@ export function codexAdminRefreshPath(accountId) {
 export function codexAdminAssignmentPath(assignmentId) {
     return `${CODEX_ADMIN_ASSIGNMENTS_PATH}/${encodeURIComponent(assignmentId)}`;
 }
+export function codexAdminEnrollmentIntentPath(intentId) {
+    return `${CODEX_ADMIN_ENROLLMENT_INTENTS_PATH}/${encodeURIComponent(intentId)}`;
+}
+export function codexAdminEnrollmentIntentActionPath(intentId, action) {
+    return `${codexAdminEnrollmentIntentPath(intentId)}/${action}`;
+}
+export function codexAdminMigrationLoginQueuePath(planId, query) {
+    return `${CODEX_ADMIN_MIGRATION_PLANS_PATH}/${encodeURIComponent(planId)}`
+        + `/login-queue?page=${query.page}&pageSize=${query.pageSize}`;
+}
+export function codexAssignmentShortLivedDeliveriesPath(assignmentId) {
+    return `${CODEX_CREDENTIAL_ASSIGNMENTS_PATH}/${encodeURIComponent(assignmentId)}/short-lived-credential-deliveries`;
+}
+export function codexShortLivedDeliveryAckPath(deliveryId) {
+    return `${CODEX_SHORT_LIVED_DELIVERIES_PATH}/${encodeURIComponent(deliveryId)}/ack`;
+}
+export function codexAssignmentRetirementLocalDeleteAckPath(retirementId) {
+    return `${CODEX_ASSIGNMENT_RETIREMENTS_PATH}/${encodeURIComponent(retirementId)}/local-delete-ack`;
+}
+export function codexAssignmentRetirementPath(retirementId) {
+    return `${CODEX_ASSIGNMENT_RETIREMENTS_PATH}/${encodeURIComponent(retirementId)}`;
+}
+export function codexV3EnrollmentResolvePath(clientRequestId) {
+    return `${CODEX_V3_ENROLLMENTS_PATH}/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
+}
+export function codexV3AssignmentFullCredentialDeliveriesPath(assignmentId) {
+    return `${CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH}/${encodeURIComponent(assignmentId)}`
+        + "/full-credential-deliveries";
+}
+export function codexV3AssignmentFullCredentialDeliveryResolvePath(assignmentId, clientRequestId) {
+    return `${codexV3AssignmentFullCredentialDeliveriesPath(assignmentId)}`
+        + `/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
+}
+export function codexV3FullCredentialDeliveryAckPath(deliveryId) {
+    return `${CODEX_V3_FULL_CREDENTIAL_DELIVERIES_PATH}/${encodeURIComponent(deliveryId)}/ack`;
+}
+export function codexV3LineageGenerationReportsPath(lineageId) {
+    return `${CODEX_V3_CREDENTIAL_LINEAGES_PATH}/${encodeURIComponent(lineageId)}/generations/report`;
+}
+export function codexV3LineageGenerationReportResolvePath(lineageId, clientRequestId) {
+    return `${CODEX_V3_CREDENTIAL_LINEAGES_PATH}/${encodeURIComponent(lineageId)}`
+        + `/generations/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
+}
 //# sourceMappingURL=protocol.js.map