@tokensrc/codex 1.14.11 → 1.14.13

package/dist/multi-device-v5-state.d.ts

@@ -0,0 +1,373 @@
+import { type KeyObject } from "node:crypto";
+import { z } from "zod";
+import { CodexV5CreateDeviceSessionResponseSchema } from "./protocol.js";
+export declare const CodexV5SessionStateSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    assignmentId: z.ZodString;
+    managedAccountId: z.ZodString;
+    providerAccountId: z.ZodString;
+    lineageId: z.ZodString;
+    installationId: z.ZodString;
+    sessionId: z.ZodString;
+    authorityEpoch: z.ZodNumber;
+    generationVersion: z.ZodNumber;
+    leaseExpiresAt: z.ZodString;
+    releaseIdempotencyKey: z.ZodString;
+    status: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        RECOVERY_REQUIRED: "RECOVERY_REQUIRED";
+    }>;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV5AcquireJournalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    assignmentId: z.ZodString;
+    expectedManagedAccountId: z.ZodString;
+    expectedProviderAccountId: z.ZodString;
+    expectedLineageId: z.ZodString;
+    installationId: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    ackIdempotencyKey: z.ZodString;
+    releaseIdempotencyKey: z.ZodString;
+    clientKey: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        publicKey: z.ZodString;
+    }, z.core.$strict>;
+    privateKeyPkcs8: z.ZodString;
+    response: z.ZodNullable<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<5>;
+        session: z.ZodObject<{
+            id: z.ZodString;
+            clientRequestId: z.ZodString;
+            installationId: z.ZodString;
+            assignmentId: z.ZodString;
+            managedAccountId: z.ZodString;
+            providerAccountId: z.ZodString;
+            lineageId: z.ZodString;
+            generationVersion: z.ZodNumber;
+            issuedAt: z.ZodString;
+            leaseExpiresAt: z.ZodString;
+            status: z.ZodEnum<{
+                ACTIVE: "ACTIVE";
+                AWAITING_ACK: "AWAITING_ACK";
+            }>;
+            authorityEpoch: z.ZodNumber;
+            envelope: z.ZodObject<{
+                version: z.ZodLiteral<1>;
+                algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+                ephemeralPublicKey: z.ZodString;
+                salt: z.ZodString;
+                nonce: z.ZodString;
+                ciphertext: z.ZodString;
+                authenticationTag: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        replayed: z.ZodBoolean;
+    }, z.core.$strict>>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV5ReportJournalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    lineageId: z.ZodString;
+    installationId: z.ZodString;
+    sessionId: z.ZodString;
+    authorityEpoch: z.ZodNumber;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    expectedGenerationVersion: z.ZodNumber;
+    rotationMode: z.ZodEnum<{
+        RETAINED: "RETAINED";
+        ROTATED: "ROTATED";
+    }>;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+    accessTokenHealth: z.ZodEnum<{
+        EXPIRED: "EXPIRED";
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    refreshTokenHealth: z.ZodEnum<{
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    observedAt: z.ZodString;
+    credentialExpiresAt: z.ZodString;
+    accessTokenDigest: z.ZodString;
+    refreshTokenDigest: z.ZodString;
+    idTokenDigest: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export type CodexV5SessionState = z.infer<typeof CodexV5SessionStateSchema>;
+export type CodexV5AcquireJournal = z.infer<typeof CodexV5AcquireJournalSchema>;
+export type CodexV5ReportJournal = z.infer<typeof CodexV5ReportJournalSchema>;
+export declare function getOrCreateCodexInstallationId(env?: NodeJS.ProcessEnv, now?: number, newId?: () => string): Promise<string>;
+export declare function readCodexV5SessionState(env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    assignmentId: string;
+    managedAccountId: string;
+    providerAccountId: string;
+    lineageId: string;
+    installationId: string;
+    sessionId: string;
+    authorityEpoch: number;
+    generationVersion: number;
+    leaseExpiresAt: string;
+    releaseIdempotencyKey: string;
+    status: "ACTIVE" | "RECOVERY_REQUIRED";
+    updatedAt: string;
+} | undefined>;
+export declare function writeCodexV5SessionState(value: CodexV5SessionState, env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    assignmentId: string;
+    managedAccountId: string;
+    providerAccountId: string;
+    lineageId: string;
+    installationId: string;
+    sessionId: string;
+    authorityEpoch: number;
+    generationVersion: number;
+    leaseExpiresAt: string;
+    releaseIdempotencyKey: string;
+    status: "ACTIVE" | "RECOVERY_REQUIRED";
+    updatedAt: string;
+}>;
+export declare function clearCodexV5SessionState(expectedSessionId: string, env?: NodeJS.ProcessEnv): Promise<void>;
+export declare function readCodexV5AcquireJournal(env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    assignmentId: string;
+    expectedManagedAccountId: string;
+    expectedProviderAccountId: string;
+    expectedLineageId: string;
+    installationId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    ackIdempotencyKey: string;
+    releaseIdempotencyKey: string;
+    clientKey: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        publicKey: string;
+    };
+    privateKeyPkcs8: string;
+    response: {
+        schemaVersion: 5;
+        session: {
+            id: string;
+            clientRequestId: string;
+            installationId: string;
+            assignmentId: string;
+            managedAccountId: string;
+            providerAccountId: string;
+            lineageId: string;
+            generationVersion: number;
+            issuedAt: string;
+            leaseExpiresAt: string;
+            status: "ACTIVE" | "AWAITING_ACK";
+            authorityEpoch: number;
+            envelope: {
+                version: 1;
+                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+                ephemeralPublicKey: string;
+                salt: string;
+                nonce: string;
+                ciphertext: string;
+                authenticationTag: string;
+            };
+        };
+        replayed: boolean;
+    } | null;
+    createdAt: string;
+    updatedAt: string;
+} | undefined>;
+export declare function writeCodexV5AcquireJournal(value: CodexV5AcquireJournal, env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    assignmentId: string;
+    expectedManagedAccountId: string;
+    expectedProviderAccountId: string;
+    expectedLineageId: string;
+    installationId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    ackIdempotencyKey: string;
+    releaseIdempotencyKey: string;
+    clientKey: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        publicKey: string;
+    };
+    privateKeyPkcs8: string;
+    response: {
+        schemaVersion: 5;
+        session: {
+            id: string;
+            clientRequestId: string;
+            installationId: string;
+            assignmentId: string;
+            managedAccountId: string;
+            providerAccountId: string;
+            lineageId: string;
+            generationVersion: number;
+            issuedAt: string;
+            leaseExpiresAt: string;
+            status: "ACTIVE" | "AWAITING_ACK";
+            authorityEpoch: number;
+            envelope: {
+                version: 1;
+                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+                ephemeralPublicKey: string;
+                salt: string;
+                nonce: string;
+                ciphertext: string;
+                authenticationTag: string;
+            };
+        };
+        replayed: boolean;
+    } | null;
+    createdAt: string;
+    updatedAt: string;
+}>;
+export declare function updateCodexV5AcquireJournalResponse(expected: CodexV5AcquireJournal, response: z.infer<typeof CodexV5CreateDeviceSessionResponseSchema>, now: number, env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    assignmentId: string;
+    expectedManagedAccountId: string;
+    expectedProviderAccountId: string;
+    expectedLineageId: string;
+    installationId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    ackIdempotencyKey: string;
+    releaseIdempotencyKey: string;
+    clientKey: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        publicKey: string;
+    };
+    privateKeyPkcs8: string;
+    response: {
+        schemaVersion: 5;
+        session: {
+            id: string;
+            clientRequestId: string;
+            installationId: string;
+            assignmentId: string;
+            managedAccountId: string;
+            providerAccountId: string;
+            lineageId: string;
+            generationVersion: number;
+            issuedAt: string;
+            leaseExpiresAt: string;
+            status: "ACTIVE" | "AWAITING_ACK";
+            authorityEpoch: number;
+            envelope: {
+                version: 1;
+                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+                ephemeralPublicKey: string;
+                salt: string;
+                nonce: string;
+                ciphertext: string;
+                authenticationTag: string;
+            };
+        };
+        replayed: boolean;
+    } | null;
+    createdAt: string;
+    updatedAt: string;
+}>;
+export declare function clearCodexV5AcquireJournal(expected: Pick<CodexV5AcquireJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;
+export declare function openCodexV5AcquireJournalKey(journal: CodexV5AcquireJournal): KeyObject;
+export declare function readCodexV5ReportJournal(env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    lineageId: string;
+    installationId: string;
+    sessionId: string;
+    authorityEpoch: number;
+    clientRequestId: string;
+    idempotencyKey: string;
+    expectedGenerationVersion: number;
+    rotationMode: "RETAINED" | "ROTATED";
+    envelope: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        keyId: string;
+        ephemeralPublicKey: string;
+        salt: string;
+        nonce: string;
+        ciphertext: string;
+        authenticationTag: string;
+    };
+    accessTokenHealth: "EXPIRED" | "HEALTHY" | "REJECTED" | "UNKNOWN";
+    refreshTokenHealth: "HEALTHY" | "REJECTED" | "UNKNOWN";
+    observedAt: string;
+    credentialExpiresAt: string;
+    accessTokenDigest: string;
+    refreshTokenDigest: string;
+    idTokenDigest: string;
+    createdAt: string;
+    updatedAt: string;
+} | undefined>;
+export declare function writeCodexV5ReportJournal(value: CodexV5ReportJournal, env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    lineageId: string;
+    installationId: string;
+    sessionId: string;
+    authorityEpoch: number;
+    clientRequestId: string;
+    idempotencyKey: string;
+    expectedGenerationVersion: number;
+    rotationMode: "RETAINED" | "ROTATED";
+    envelope: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        keyId: string;
+        ephemeralPublicKey: string;
+        salt: string;
+        nonce: string;
+        ciphertext: string;
+        authenticationTag: string;
+    };
+    accessTokenHealth: "EXPIRED" | "HEALTHY" | "REJECTED" | "UNKNOWN";
+    refreshTokenHealth: "HEALTHY" | "REJECTED" | "UNKNOWN";
+    observedAt: string;
+    credentialExpiresAt: string;
+    accessTokenDigest: string;
+    refreshTokenDigest: string;
+    idTokenDigest: string;
+    createdAt: string;
+    updatedAt: string;
+}>;
+export declare function clearCodexV5ReportJournal(expected: Pick<CodexV5ReportJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;
+export declare function exportCodexV5PrivateKey(privateKey: KeyObject): string;

package/dist/multi-device-v5-state.js

@@ -0,0 +1,218 @@
+import { createPrivateKey, randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { z } from "zod";
+import { CodexShortLivedDeliveryClientKeySchema, CodexV3AccessTokenHealthSchema, CodexV3CredentialEnvelopeSchema, CodexV3RefreshTokenHealthSchema, CodexV5CreateDeviceSessionResponseSchema } from "./protocol.js";
+import { readJsonIfExists, removePrivateFileDurably, withPrivateFileLock, writePrivateJson } from "./private-file.js";
+const Instant = z.string().datetime({ offset: true });
+const Id = z.string().min(1).max(512);
+const Stable = z.string().min(8).max(255);
+const Digest = z.string().length(64).regex(/^[0-9a-f]{64}$/);
+const InstallationId = z.string().min(16).max(200).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]+$/);
+const InstallationSchema = z.strictObject({
+    schemaVersion: z.literal(1), installationId: InstallationId, createdAt: Instant
+});
+export const CodexV5SessionStateSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    tenantId: Id,
+    subject: Id,
+    assignmentId: Id,
+    managedAccountId: Id,
+    providerAccountId: Id,
+    lineageId: Id,
+    installationId: InstallationId,
+    sessionId: Id,
+    authorityEpoch: z.number().int().positive(),
+    generationVersion: z.number().int().positive(),
+    leaseExpiresAt: Instant,
+    releaseIdempotencyKey: Stable,
+    status: z.enum(["ACTIVE", "RECOVERY_REQUIRED"]),
+    updatedAt: Instant
+});
+export const CodexV5AcquireJournalSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    tenantId: Id,
+    subject: Id,
+    assignmentId: Id,
+    expectedManagedAccountId: Id,
+    expectedProviderAccountId: Id,
+    expectedLineageId: Id,
+    installationId: InstallationId,
+    clientRequestId: Stable,
+    idempotencyKey: Stable,
+    ackIdempotencyKey: Stable,
+    releaseIdempotencyKey: Stable,
+    clientKey: CodexShortLivedDeliveryClientKeySchema,
+    privateKeyPkcs8: z.string().min(1).max(512).regex(/^[A-Za-z0-9_-]+$/),
+    response: CodexV5CreateDeviceSessionResponseSchema.nullable(),
+    createdAt: Instant,
+    updatedAt: Instant
+});
+export const CodexV5ReportJournalSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    tenantId: Id,
+    subject: Id,
+    lineageId: Id,
+    installationId: InstallationId,
+    sessionId: Id,
+    authorityEpoch: z.number().int().positive(),
+    clientRequestId: Stable,
+    idempotencyKey: Stable,
+    expectedGenerationVersion: z.number().int().positive(),
+    rotationMode: z.enum(["ROTATED", "RETAINED"]),
+    envelope: CodexV3CredentialEnvelopeSchema,
+    accessTokenHealth: CodexV3AccessTokenHealthSchema,
+    refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+    observedAt: Instant,
+    credentialExpiresAt: Instant,
+    accessTokenDigest: Digest,
+    refreshTokenDigest: Digest,
+    idTokenDigest: Digest,
+    createdAt: Instant,
+    updatedAt: Instant
+});
+function root(env) {
+    return env.CODEX_HOME?.trim() || join(homedir(), ".codex");
+}
+function installationPath(env) { return join(root(env), ".numa-installation.json"); }
+function sessionPath(env) { return join(root(env), ".numa-device-session-v5.json"); }
+function acquirePath(env) { return join(root(env), ".numa-device-acquire-v5.json"); }
+function reportPath(env) { return join(root(env), ".numa-device-report-v5.json"); }
+export async function getOrCreateCodexInstallationId(env = process.env, now = Date.now(), newId = randomUUID) {
+    const target = installationPath(env);
+    return withPrivateFileLock(target, async () => {
+        const current = await readJsonIfExists(target);
+        if (current !== undefined)
+            return InstallationSchema.parse(current).installationId;
+        const value = InstallationSchema.parse({ schemaVersion: 1,
+            installationId: `install-${newId()}`, createdAt: new Date(now).toISOString() });
+        await writePrivateJson(target, value);
+        return value.installationId;
+    });
+}
+async function readParsed(path, schema) {
+    const raw = await readJsonIfExists(path);
+    return raw === undefined ? undefined : schema.parse(raw);
+}
+export function readCodexV5SessionState(env = process.env) {
+    return readParsed(sessionPath(env), CodexV5SessionStateSchema);
+}
+export async function writeCodexV5SessionState(value, env = process.env) {
+    const target = sessionPath(env);
+    return withPrivateFileLock(target, async () => {
+        const parsed = CodexV5SessionStateSchema.parse(value);
+        await writePrivateJson(target, parsed);
+        return parsed;
+    });
+}
+export async function clearCodexV5SessionState(expectedSessionId, env = process.env) {
+    const target = sessionPath(env);
+    await withPrivateFileLock(target, async () => {
+        const current = await readParsed(target, CodexV5SessionStateSchema);
+        if (!current)
+            return;
+        if (current.sessionId !== expectedSessionId)
+            throw stateConflict();
+        await removePrivateFileDurably(target);
+    });
+}
+export function readCodexV5AcquireJournal(env = process.env) {
+    return readParsed(acquirePath(env), CodexV5AcquireJournalSchema);
+}
+export async function writeCodexV5AcquireJournal(value, env = process.env) {
+    const target = acquirePath(env);
+    return withPrivateFileLock(target, async () => {
+        const parsed = CodexV5AcquireJournalSchema.parse(value);
+        const current = await readParsed(target, CodexV5AcquireJournalSchema);
+        if (current && JSON.stringify(current) !== JSON.stringify(parsed))
+            throw stateConflict();
+        if (!current)
+            await writePrivateJson(target, parsed);
+        return current ?? parsed;
+    });
+}
+export async function updateCodexV5AcquireJournalResponse(expected, response, now, env = process.env) {
+    const target = acquirePath(env);
+    return withPrivateFileLock(target, async () => {
+        const current = await readParsed(target, CodexV5AcquireJournalSchema);
+        if (!current || current.clientRequestId !== expected.clientRequestId
+            || current.idempotencyKey !== expected.idempotencyKey)
+            throw stateConflict();
+        const updated = CodexV5AcquireJournalSchema.parse({ ...current, response,
+            updatedAt: new Date(now).toISOString() });
+        await writePrivateJson(target, updated);
+        return updated;
+    });
+}
+export async function clearCodexV5AcquireJournal(expected, env = process.env) {
+    const target = acquirePath(env);
+    await withPrivateFileLock(target, async () => {
+        const current = await readParsed(target, CodexV5AcquireJournalSchema);
+        if (!current)
+            return;
+        if (current.clientRequestId !== expected.clientRequestId
+            || current.idempotencyKey !== expected.idempotencyKey)
+            throw stateConflict();
+        await removePrivateFileDurably(target);
+    });
+}
+export function openCodexV5AcquireJournalKey(journal) {
+    const encoded = Buffer.from(journal.privateKeyPkcs8, "base64url");
+    try {
+        if (encoded.toString("base64url") !== journal.privateKeyPkcs8)
+            throw stateConflict();
+        const key = createPrivateKey({ key: encoded, format: "der", type: "pkcs8" });
+        if (key.asymmetricKeyType !== "x25519")
+            throw stateConflict();
+        return key;
+    }
+    finally {
+        encoded.fill(0);
+    }
+}
+export function readCodexV5ReportJournal(env = process.env) {
+    return readParsed(reportPath(env), CodexV5ReportJournalSchema);
+}
+export async function writeCodexV5ReportJournal(value, env = process.env) {
+    const target = reportPath(env);
+    return withPrivateFileLock(target, async () => {
+        const parsed = CodexV5ReportJournalSchema.parse(value);
+        const current = await readParsed(target, CodexV5ReportJournalSchema);
+        if (current && JSON.stringify(current) !== JSON.stringify(parsed))
+            throw stateConflict();
+        if (!current)
+            await writePrivateJson(target, parsed);
+        return current ?? parsed;
+    });
+}
+export async function clearCodexV5ReportJournal(expected, env = process.env) {
+    const target = reportPath(env);
+    await withPrivateFileLock(target, async () => {
+        const current = await readParsed(target, CodexV5ReportJournalSchema);
+        if (!current)
+            return;
+        if (current.clientRequestId !== expected.clientRequestId
+            || current.idempotencyKey !== expected.idempotencyKey)
+            throw stateConflict();
+        await removePrivateFileDurably(target);
+    });
+}
+export function exportCodexV5PrivateKey(privateKey) {
+    if (privateKey.asymmetricKeyType !== "x25519")
+        throw stateConflict();
+    const encoded = privateKey.export({ format: "der", type: "pkcs8" });
+    if (!Buffer.isBuffer(encoded))
+        throw stateConflict();
+    try {
+        return encoded.toString("base64url");
+    }
+    finally {
+        encoded.fill(0);
+    }
+}
+function stateConflict() {
+    return Object.assign(new Error("The Codex v5 device state changed unexpectedly."), {
+        code: "managed_codex_v5_state_conflict"
+    });
+}
+//# sourceMappingURL=multi-device-v5-state.js.map

package/dist/multi-device-v5-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-device-v5-state.js","sourceRoot":"","sources":["../src/multi-device-v5-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sCAAsC,EACtC,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,wCAAwC,EACzC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC7D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAE1F,MAAM,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC;IACxC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO;CAChF,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,EAAE;IAChB,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;IACrB,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,cAAc;IAC9B,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,cAAc,EAAE,OAAO;IACvB,qBAAqB,EAAE,MAAM;IAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/C,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,YAAY,EAAE,EAAE;IAChB,wBAAwB,EAAE,EAAE;IAC5B,yBAAyB,EAAE,EAAE;IAC7B,iBAAiB,EAAE,EAAE;IACrB,cAAc,EAAE,cAAc;IAC9B,eAAe,EAAE,MAAM;IACvB,cAAc,EAAE,MAAM;IACtB,iBAAiB,EAAE,MAAM;IACzB,qBAAqB,EAAE,MAAM;IAC7B,SAAS,EAAE,sCAAsC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACrE,QAAQ,EAAE,wCAAwC,CAAC,QAAQ,EAAE;IAC7D,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,cAAc;IAC9B,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,eAAe,EAAE,MAAM;IACvB,cAAc,EAAE,MAAM;IACtB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC7C,QAAQ,EAAE,+BAA+B;IACzC,iBAAiB,EAAE,8BAA8B;IACjD,kBAAkB,EAAE,+BAA+B;IACnD,UAAU,EAAE,OAAO;IACnB,mBAAmB,EAAE,OAAO;IAC5B,iBAAiB,EAAE,MAAM;IACzB,kBAAkB,EAAE,MAAM;IAC1B,aAAa,EAAE,MAAM;IACrB,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAMH,SAAS,IAAI,CAAC,GAAsB;IAClC,OAAO,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AACD,SAAS,gBAAgB,CAAC,GAAsB,IAAY,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC;AAChH,SAAS,WAAW,CAAC,GAAsB,IAAY,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC;AAChH,SAAS,WAAW,CAAC,GAAsB,IAAY,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC;AAChH,SAAS,UAAU,CAAC,GAAsB,IAAY,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;AAE9G,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,KAAK,GAAiB,UAAU;IAEhC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC;QACnF,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;YACvD,cAAc,EAAE,WAAW,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,cAAc,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,MAAoB;IAC7D,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC1E,OAAO,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACjE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAA0B,EAC1B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,iBAAyB,EACzB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB;YAAE,MAAM,aAAa,EAAE,CAAC;QACnE,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC5E,OAAO,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,2BAA2B,CAAC,CAAC;AACnE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA4B,EAC5B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,MAAM,aAAa,EAAE,CAAC;QACzF,IAAI,CAAC,OAAO;YAAE,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,OAAO,IAAI,MAAM,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,QAA+B,EAC/B,QAAkE,EAClE,GAAW,EACX,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;eAC/D,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/E,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ;YACtE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAA2E,EAC3E,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;eACnD,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/E,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,OAA8B;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,eAAe;YAAE,MAAM,aAAa,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAAE,MAAM,aAAa,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC3E,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,0BAA0B,CAAC,CAAC;AACjE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA2B,EAC3B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACrE,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,MAAM,aAAa,EAAE,CAAC;QACzF,IAAI,CAAC,OAAO;YAAE,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,OAAO,IAAI,MAAM,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAA0E,EAC1E,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;eACnD,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/E,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAqB;IAC3D,IAAI,UAAU,CAAC,iBAAiB,KAAK,QAAQ;QAAE,MAAM,aAAa,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,aAAa,EAAE,CAAC;IACrD,IAAI,CAAC;QAAC,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAAE;QACjF,IAAI,EAAE,iCAAiC;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/profile.d.ts

@@ -24,6 +24,7 @@ export interface ResolvedCodexProfile {
         rotationSync: boolean;
         managedCredentialsV3?: boolean;
         accountTokenPoolV4?: boolean;
+        multiDeviceCredentialSync?: boolean;
     };
     stale: boolean;
 }
@@ -39,3 +40,4 @@ export interface ResolveCodexProfileOptions {
 export declare function resolveCodexProfile(options: ResolveCodexProfileOptions): Promise<ResolvedCodexProfile>;
 export declare function profileManagedCredentialsV3Enabled(value: unknown): boolean;
 export declare function profileAccountTokenPoolV4Enabled(value: unknown): boolean;
+export declare function profileMultiDeviceCredentialSyncEnabled(value: unknown): boolean;

package/dist/profile.js

@@ -27,7 +27,8 @@ const ServiceSchema = z.object({
             migrationPlans: z.boolean().optional(),
             rotationSync: z.boolean(),
             managedCredentialsV3: z.boolean().optional(),
-            accountTokenPoolV4: z.boolean().optional()
+            accountTokenPoolV4: z.boolean().optional(),
+            multiDeviceCredentialSync: z.boolean().optional()
         }).passthrough().optional()
     }).passthrough().optional()
 });
@@ -108,6 +109,8 @@ export async function resolveCodexProfile(options) {
         || cachedProfile?.success === true && profileManagedCredentialsV3Enabled(cachedProfile.data);
     const accountTokenPoolV4Required = cached?.observedAccountTokenPoolV4 === true
         || cachedProfile?.success === true && profileAccountTokenPoolV4Enabled(cachedProfile.data);
+    const multiDeviceCredentialSyncRequired = cached?.observedMultiDeviceCredentialSync === true
+        || cachedProfile?.success === true && profileMultiDeviceCredentialSyncEnabled(cachedProfile.data);
     const cacheMaxAgeMs = cachedProfile?.success
         ? (cachedProfile.data.cache?.maxAgeSeconds ?? 300) * 1_000
         : 0;
@@ -156,6 +159,9 @@ export async function resolveCodexProfile(options) {
                     if (accountTokenPoolV4Required && !profileAccountTokenPoolV4Enabled(next.data)) {
                         throw new CodexError("Client configuration attempted to disable the previously observed v4 account token pool.", "profile_capability_downgrade");
                     }
+                    if (multiDeviceCredentialSyncRequired && !profileMultiDeviceCredentialSyncEnabled(next.data)) {
+                        throw new CodexError("Client configuration attempted to disable previously observed multi-device credential fencing.", "profile_capability_downgrade");
+                    }
                     const previous = cached ? ProfileSchema.safeParse(cached.profile) : undefined;
                     if (previous?.success && next.data.profileId === previous.data.profileId
                         && next.data.revision < previous.data.revision) {
@@ -174,6 +180,9 @@ export async function resolveCodexProfile(options) {
                     ...((accountTokenPoolV4Required || profileAccountTokenPoolV4Enabled(raw))
                         ? { observedAccountTokenPoolV4: true }
                         : {}),
+                    ...((multiDeviceCredentialSyncRequired || profileMultiDeviceCredentialSyncEnabled(raw))
+                        ? { observedMultiDeviceCredentialSync: true }
+                        : {}),
                     profile: raw
                 };
             }
@@ -202,6 +211,9 @@ export async function resolveCodexProfile(options) {
     if (accountTokenPoolV4Required && !profileAccountTokenPoolV4Enabled(profile.data)) {
         throw new CodexError("A cached profile cannot disable the previously observed v4 account token pool.", "profile_capability_downgrade");
     }
+    if (multiDeviceCredentialSyncRequired && !profileMultiDeviceCredentialSyncEnabled(profile.data)) {
+        throw new CodexError("A cached profile cannot disable previously observed multi-device credential fencing.", "profile_capability_downgrade");
+    }
     const minimumVersion = profile.data.minimumClientVersions?.tokensrcCodex;
     if (minimumVersion && compareVersions(PACKAGE_VERSION, minimumVersion) < 0) {
         throw new CodexError(`@tokensrc/codex ${minimumVersion} or newer is required by this profile.`, "client_upgrade_required");
@@ -277,6 +289,17 @@ export function profileAccountTokenPoolV4Enabled(value) {
     return parsed.success
         && parsed.data.services.codex?.capabilities?.userBoundRefreshTokens?.accountTokenPoolV4 === true;
 }
+export function profileMultiDeviceCredentialSyncEnabled(value) {
+    if (value && typeof value === "object"
+        && value
+            .userBoundRefreshTokens?.multiDeviceCredentialSync === true) {
+        return true;
+    }
+    const parsed = ProfileSchema.safeParse(value);
+    return parsed.success
+        && parsed.data.services.codex?.capabilities?.userBoundRefreshTokens
+            ?.multiDeviceCredentialSync === true;
+}
 function defaultProfileDirectory() {
     const configured = process.env.TOKENSRC_CODEX_CONFIG_DIR?.trim();
     if (configured)