@tokensrc/codex 1.14.15 → 1.14.17

package/dist/protocol.d.ts

@@ -32,6 +32,14 @@ export declare const CODEX_MULTI_DEVICE_V5_RUNTIME_PATH = "/v5/codex";
 export declare const CODEX_MULTI_DEVICE_V5_CREDENTIAL_ASSIGNMENTS_PATH = "/v5/codex/credential-assignments";
 export declare const CODEX_MULTI_DEVICE_V5_DEVICE_SESSIONS_PATH = "/v5/codex/device-sessions";
 export declare const CODEX_MULTI_DEVICE_V5_CREDENTIAL_LINEAGES_PATH = "/v5/codex/credential-lineages";
+export declare const CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION: 6;
+export declare const CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH = "/v6/codex";
+export declare const CODEX_V6_ACCOUNT_REQUESTS_PATH = "/v6/codex/account-requests";
+export declare const CODEX_V6_DEVICE_ACCESS_RECONCILIATIONS_PATH = "/v6/codex/device-access/reconciliations";
+export declare const CODEX_V6_DEVICE_BINDINGS_PATH = "/v6/codex/device-bindings";
+export declare const CODEX_REQUEST_BOUND_DEVICE_V6_ADMIN_PATH = "/v6/admin/codex";
+export declare const CODEX_V6_ADMIN_ACCOUNT_REQUESTS_PATH = "/v6/admin/codex/account-requests";
+export declare const CODEX_V6_ADMIN_DEVICE_BINDINGS_PATH = "/v6/admin/codex/device-bindings";
 export declare const CODEX_MIGRATION_CAPACITY: {
     readonly verifiedMinimum: 2;
     readonly verifiedLimit: null;
@@ -95,8 +103,11 @@ export declare const CodexAccountSummarySchema: z.ZodObject<{
     label: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string | undefined, string>>>;
     isDefault: z.ZodBoolean;
     accessExpiresAt: z.ZodOptional<z.ZodNumber>;
+    subscriptionStatus: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    subscriptionExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     credentialStatus: z.ZodOptional<z.ZodEnum<{
         AVAILABLE: "AVAILABLE";
+        EXPIRED: "EXPIRED";
         NEEDS_REAUTH: "NEEDS_REAUTH";
         TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
     }>>;
@@ -155,8 +166,11 @@ export declare const CodexAccountListResponseSchema: z.ZodObject<{
         label: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string | undefined, string>>>;
         isDefault: z.ZodBoolean;
         accessExpiresAt: z.ZodOptional<z.ZodNumber>;
+        subscriptionStatus: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        subscriptionExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         credentialStatus: z.ZodOptional<z.ZodEnum<{
             AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
             NEEDS_REAUTH: "NEEDS_REAUTH";
             TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
         }>>;
@@ -217,8 +231,11 @@ export declare const CodexLoginCredentialsResponseSchema: z.ZodObject<{
         label: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string | undefined, string>>>;
         isDefault: z.ZodBoolean;
         accessExpiresAt: z.ZodOptional<z.ZodNumber>;
+        subscriptionStatus: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        subscriptionExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         credentialStatus: z.ZodOptional<z.ZodEnum<{
             AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
             NEEDS_REAUTH: "NEEDS_REAUTH";
             TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
         }>>;
@@ -442,6 +459,7 @@ export declare const CodexAdminAccountSchema: z.ZodObject<{
     lastRefreshErrorCode: z.ZodNullable<z.ZodString>;
     credentialStatus: z.ZodEnum<{
         AVAILABLE: "AVAILABLE";
+        EXPIRED: "EXPIRED";
         NEEDS_REAUTH: "NEEDS_REAUTH";
         TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
     }>;
@@ -531,6 +549,7 @@ export declare const CodexAdminAccountListResponseSchema: z.ZodObject<{
         lastRefreshErrorCode: z.ZodNullable<z.ZodString>;
         credentialStatus: z.ZodEnum<{
             AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
             NEEDS_REAUTH: "NEEDS_REAUTH";
             TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
         }>;
@@ -621,6 +640,7 @@ export declare const CodexCredentialVersionListResponseSchema: z.ZodObject<{
         lastRefreshErrorCode: z.ZodNullable<z.ZodString>;
         credentialStatus: z.ZodEnum<{
             AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
             NEEDS_REAUTH: "NEEDS_REAUTH";
             TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
         }>;
@@ -752,6 +772,104 @@ export declare const CodexManualRefreshResponseSchema: z.ZodObject<{
     errorCode: z.ZodNullable<z.ZodString>;
     expiresAt: z.ZodNullable<z.ZodNumber>;
 }, z.core.$strict>;
+export declare const CodexAdminAccountRenewalInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    expectedSubscriptionExpiresAt: z.ZodNullable<z.ZodNumber>;
+    subscriptionExpiresAt: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexAdminAccountRenewalResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    account: z.ZodObject<{
+        id: z.ZodString;
+        sourceKey: z.ZodString;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        label: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string | undefined, string>>>;
+        email: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            DISABLED: "DISABLED";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+        }>;
+        refreshStatus: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        subscriptionStatus: z.ZodNullable<z.ZodString>;
+        subscriptionExpiresAt: z.ZodNullable<z.ZodNumber>;
+        credentialExpiresAt: z.ZodNullable<z.ZodNumber>;
+        lastRefreshAt: z.ZodNullable<z.ZodNumber>;
+        lastRefreshErrorCode: z.ZodNullable<z.ZodString>;
+        credentialStatus: z.ZodEnum<{
+            AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+        }>;
+        activeCredential: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            accountId: z.ZodString;
+            version: z.ZodNumber;
+            status: z.ZodEnum<{
+                ACTIVE: "ACTIVE";
+                CANDIDATE: "CANDIDATE";
+                REJECTED: "REJECTED";
+                RETIRED: "RETIRED";
+                REVOKED: "REVOKED";
+                SUPERSEDED: "SUPERSEDED";
+                UNKNOWN: "UNKNOWN";
+            }>;
+            expiresAt: z.ZodNullable<z.ZodNumber>;
+            observedSource: z.ZodNullable<z.ZodString>;
+            lastVerifiedAt: z.ZodNullable<z.ZodNumber>;
+            lastRefreshAttemptAt: z.ZodNullable<z.ZodNumber>;
+            lastRefreshAttemptReason: z.ZodNullable<z.ZodEnum<{
+                ACCESS_TOKEN_EXPIRED: "ACCESS_TOKEN_EXPIRED";
+                ACCESS_TOKEN_EXPIRING_SOON: "ACCESS_TOKEN_EXPIRING_SOON";
+                CONTROLLED_RECOVERY: "CONTROLLED_RECOVERY";
+                MANUAL_ADMIN_REQUEST: "MANUAL_ADMIN_REQUEST";
+                MISSING_ACCESS_TOKEN: "MISSING_ACCESS_TOKEN";
+                MISSING_EXPIRY: "MISSING_EXPIRY";
+                MISSING_ID_TOKEN: "MISSING_ID_TOKEN";
+                ON_DEMAND_RETRIEVAL: "ON_DEMAND_RETRIEVAL";
+                SCHEDULED_REFRESH: "SCHEDULED_REFRESH";
+                UPLOAD_REPLACEMENT_VALIDATION: "UPLOAD_REPLACEMENT_VALIDATION";
+            }>>;
+            lastRefreshAttemptOutcome: z.ZodNullable<z.ZodEnum<{
+                IN_PROGRESS: "IN_PROGRESS";
+                PERMANENT_FAILURE: "PERMANENT_FAILURE";
+                SUCCESS: "SUCCESS";
+                TEMPORARY_FAILURE: "TEMPORARY_FAILURE";
+            }>>;
+            lastRefreshAttemptErrorCode: z.ZodNullable<z.ZodString>;
+            lastRefreshObservedExpiresAt: z.ZodNullable<z.ZodNumber>;
+            firstObservedAt: z.ZodNumber;
+            lastObservedAt: z.ZodNumber;
+            serverIssuedAt: z.ZodNullable<z.ZodNumber>;
+            providerIssuedAt: z.ZodNullable<z.ZodNumber>;
+            parentCredentialId: z.ZodNullable<z.ZodString>;
+            supersededByCredentialId: z.ZodNullable<z.ZodString>;
+            supersededAt: z.ZodNullable<z.ZodNumber>;
+            supersededReason: z.ZodNullable<z.ZodString>;
+            lastRefreshTokenResponseMode: z.ZodEnum<{
+                NEW: "NEW";
+                NOT_APPLICABLE: "NOT_APPLICABLE";
+                OMITTED: "OMITTED";
+                SAME: "SAME";
+            }>;
+            retiredAt: z.ZodNullable<z.ZodNumber>;
+            rejectedAt: z.ZodNullable<z.ZodNumber>;
+            createdAt: z.ZodNumber;
+            updatedAt: z.ZodNumber;
+        }, z.core.$strict>>;
+        createdAt: z.ZodNumber;
+        updatedAt: z.ZodNumber;
+        activeAssignmentCount: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>;
+    previousSubscriptionExpiresAt: z.ZodNullable<z.ZodNumber>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
 export declare const CodexAdminAssignmentSchema: z.ZodObject<{
     id: z.ZodString;
     accountId: z.ZodString;
@@ -1229,6 +1347,8 @@ export declare const CodexUserCredentialAssignmentSchema: z.ZodObject<{
     }>>;
     generationVersion: z.ZodNullable<z.ZodNumber>;
     credentialExpiresAt: z.ZodNullable<z.ZodString>;
+    subscriptionStatus: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    subscriptionExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     deliveryEligible: z.ZodBoolean;
 }, z.core.$strict>;
 export declare const CodexUserCredentialAssignmentListResponseSchema: z.ZodObject<{
@@ -1253,6 +1373,8 @@ export declare const CodexUserCredentialAssignmentListResponseSchema: z.ZodObjec
         }>>;
         generationVersion: z.ZodNullable<z.ZodNumber>;
         credentialExpiresAt: z.ZodNullable<z.ZodString>;
+        subscriptionStatus: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        subscriptionExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         deliveryEligible: z.ZodBoolean;
     }, z.core.$strict>>;
     total: z.ZodNumber;
@@ -1580,6 +1702,8 @@ export declare const CodexV3CredentialAssignmentSchema: z.ZodObject<{
         UNKNOWN: "UNKNOWN";
     }>;
     credentialExpiresAt: z.ZodString;
+    subscriptionStatus: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    subscriptionExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     lastObservedAt: z.ZodString;
     deliveryEligible: z.ZodBoolean;
     quota: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -1649,6 +1773,8 @@ export declare const CodexV3CredentialAssignmentListResponseSchema: z.ZodObject<
             UNKNOWN: "UNKNOWN";
         }>;
         credentialExpiresAt: z.ZodString;
+        subscriptionStatus: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        subscriptionExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         lastObservedAt: z.ZodString;
         deliveryEligible: z.ZodBoolean;
         quota: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -2015,6 +2141,1066 @@ export declare const CodexV5GenerationReportResponseSchema: z.ZodObject<{
     }, z.core.$strict>;
     replayed: z.ZodBoolean;
 }, z.core.$strict>;
+/**
+ * v6 makes one complete upstream token set the property of exactly one
+ * request/device binding. A request may own several bindings for the same
+ * user, but lineages and installation ids may never be shared by bindings.
+ */
+export declare const CodexV6DeviceDescriptorSchema: z.ZodObject<{
+    installationId: z.ZodString;
+    label: z.ZodString;
+    platform: z.ZodEnum<{
+        darwin: "darwin";
+        linux: "linux";
+        unknown: "unknown";
+        win32: "win32";
+    }>;
+}, z.core.$strict>;
+export declare const CodexV6AccountRequestStatusSchema: z.ZodEnum<{
+    APPROVED: "APPROVED";
+    CANCELLED: "CANCELLED";
+    EXPIRED: "EXPIRED";
+    REJECTED: "REJECTED";
+    SUBMITTED: "SUBMITTED";
+}>;
+export declare const CodexV6AccountRequestAvailabilitySchema: z.ZodEnum<{
+    AVAILABLE: "AVAILABLE";
+    EXPIRED: "EXPIRED";
+    PARTIALLY_AVAILABLE: "PARTIALLY_AVAILABLE";
+    PENDING_APPROVAL: "PENDING_APPROVAL";
+    UNAVAILABLE: "UNAVAILABLE";
+    WAITING_FOR_BINDING: "WAITING_FOR_BINDING";
+}>;
+export declare const CodexV6AccountRequestSchema: z.ZodObject<{
+    id: z.ZodString;
+    userSubject: z.ZodString;
+    username: z.ZodString;
+    userEmail: z.ZodNullable<z.ZodEmail>;
+    status: z.ZodEnum<{
+        APPROVED: "APPROVED";
+        CANCELLED: "CANCELLED";
+        EXPIRED: "EXPIRED";
+        REJECTED: "REJECTED";
+        SUBMITTED: "SUBMITTED";
+    }>;
+    availability: z.ZodEnum<{
+        AVAILABLE: "AVAILABLE";
+        EXPIRED: "EXPIRED";
+        PARTIALLY_AVAILABLE: "PARTIALLY_AVAILABLE";
+        PENDING_APPROVAL: "PENDING_APPROVAL";
+        UNAVAILABLE: "UNAVAILABLE";
+        WAITING_FOR_BINDING: "WAITING_FOR_BINDING";
+    }>;
+    reason: z.ZodString;
+    requestedDeviceCount: z.ZodNumber;
+    approvedDeviceLimit: z.ZodNullable<z.ZodNumber>;
+    activeBindingCount: z.ZodNumber;
+    pendingBindingCount: z.ZodNumber;
+    requestedValidUntil: z.ZodString;
+    validFrom: z.ZodNullable<z.ZodString>;
+    validUntil: z.ZodNullable<z.ZodString>;
+    version: z.ZodNumber;
+    createdAt: z.ZodString;
+    submittedAt: z.ZodString;
+    reviewedAt: z.ZodNullable<z.ZodString>;
+    safeErrorCode: z.ZodNullable<z.ZodString>;
+    allowedActions: z.ZodArray<z.ZodEnum<{
+        CANCEL: "CANCEL";
+        CLAIM_DEVICE: "CLAIM_DEVICE";
+        VIEW_BINDINGS: "VIEW_BINDINGS";
+    }>>;
+}, z.core.$strict>;
+export declare const CodexV6CreateAccountRequestInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    clientRequestId: z.ZodString;
+    reason: z.ZodString;
+    requestedDeviceCount: z.ZodNumber;
+    requestedValidUntil: z.ZodString;
+    initialDevice: z.ZodObject<{
+        installationId: z.ZodString;
+        label: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            unknown: "unknown";
+            win32: "win32";
+        }>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexV6AccountRequestResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    request: z.ZodObject<{
+        id: z.ZodString;
+        userSubject: z.ZodString;
+        username: z.ZodString;
+        userEmail: z.ZodNullable<z.ZodEmail>;
+        status: z.ZodEnum<{
+            APPROVED: "APPROVED";
+            CANCELLED: "CANCELLED";
+            EXPIRED: "EXPIRED";
+            REJECTED: "REJECTED";
+            SUBMITTED: "SUBMITTED";
+        }>;
+        availability: z.ZodEnum<{
+            AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
+            PARTIALLY_AVAILABLE: "PARTIALLY_AVAILABLE";
+            PENDING_APPROVAL: "PENDING_APPROVAL";
+            UNAVAILABLE: "UNAVAILABLE";
+            WAITING_FOR_BINDING: "WAITING_FOR_BINDING";
+        }>;
+        reason: z.ZodString;
+        requestedDeviceCount: z.ZodNumber;
+        approvedDeviceLimit: z.ZodNullable<z.ZodNumber>;
+        activeBindingCount: z.ZodNumber;
+        pendingBindingCount: z.ZodNumber;
+        requestedValidUntil: z.ZodString;
+        validFrom: z.ZodNullable<z.ZodString>;
+        validUntil: z.ZodNullable<z.ZodString>;
+        version: z.ZodNumber;
+        createdAt: z.ZodString;
+        submittedAt: z.ZodString;
+        reviewedAt: z.ZodNullable<z.ZodString>;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+        allowedActions: z.ZodArray<z.ZodEnum<{
+            CANCEL: "CANCEL";
+            CLAIM_DEVICE: "CLAIM_DEVICE";
+            VIEW_BINDINGS: "VIEW_BINDINGS";
+        }>>;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV6AccountRequestListResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        userSubject: z.ZodString;
+        username: z.ZodString;
+        userEmail: z.ZodNullable<z.ZodEmail>;
+        status: z.ZodEnum<{
+            APPROVED: "APPROVED";
+            CANCELLED: "CANCELLED";
+            EXPIRED: "EXPIRED";
+            REJECTED: "REJECTED";
+            SUBMITTED: "SUBMITTED";
+        }>;
+        availability: z.ZodEnum<{
+            AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
+            PARTIALLY_AVAILABLE: "PARTIALLY_AVAILABLE";
+            PENDING_APPROVAL: "PENDING_APPROVAL";
+            UNAVAILABLE: "UNAVAILABLE";
+            WAITING_FOR_BINDING: "WAITING_FOR_BINDING";
+        }>;
+        reason: z.ZodString;
+        requestedDeviceCount: z.ZodNumber;
+        approvedDeviceLimit: z.ZodNullable<z.ZodNumber>;
+        activeBindingCount: z.ZodNumber;
+        pendingBindingCount: z.ZodNumber;
+        requestedValidUntil: z.ZodString;
+        validFrom: z.ZodNullable<z.ZodString>;
+        validUntil: z.ZodNullable<z.ZodString>;
+        version: z.ZodNumber;
+        createdAt: z.ZodString;
+        submittedAt: z.ZodString;
+        reviewedAt: z.ZodNullable<z.ZodString>;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+        allowedActions: z.ZodArray<z.ZodEnum<{
+            CANCEL: "CANCEL";
+            CLAIM_DEVICE: "CLAIM_DEVICE";
+            VIEW_BINDINGS: "VIEW_BINDINGS";
+        }>>;
+    }, z.core.$strict>>;
+    total: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexV6AdminAccountRequestListQuerySchema: z.ZodObject<{
+    expiresBefore: z.ZodOptional<z.ZodString>;
+    includeTerminal: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const CodexV6AdminReplacementCandidateQuerySchema: z.ZodObject<{
+    replaceBefore: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV6CancelAccountRequestInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    expectedRequestVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexV6AdminReviewAccountRequestInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    expectedRequestVersion: z.ZodNumber;
+    decision: z.ZodEnum<{
+        APPROVE: "APPROVE";
+        REJECT: "REJECT";
+    }>;
+    reason: z.ZodString;
+    approvedDeviceLimit: z.ZodNullable<z.ZodNumber>;
+    validFrom: z.ZodNullable<z.ZodString>;
+    validUntil: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const CodexV6DeviceBindingStatusSchema: z.ZodEnum<{
+    ACTIVE: "ACTIVE";
+    NEEDS_REAUTH: "NEEDS_REAUTH";
+    PENDING_TOKEN: "PENDING_TOKEN";
+    READY: "READY";
+    REPLACEMENT_PENDING: "REPLACEMENT_PENDING";
+    RETIRED: "RETIRED";
+    RETIREMENT_PENDING: "RETIREMENT_PENDING";
+}>;
+export declare const CodexV6DeviceBindingSchema: z.ZodObject<{
+    id: z.ZodString;
+    requestId: z.ZodString;
+    userSubject: z.ZodString;
+    installationId: z.ZodString;
+    deviceLabel: z.ZodString;
+    platform: z.ZodEnum<{
+        darwin: "darwin";
+        linux: "linux";
+        unknown: "unknown";
+        win32: "win32";
+    }>;
+    source: z.ZodEnum<{
+        ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
+        ADMIN_ADDED: "ADMIN_ADDED";
+        LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
+        REQUEST_INITIAL: "REQUEST_INITIAL";
+    }>;
+    status: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        NEEDS_REAUTH: "NEEDS_REAUTH";
+        PENDING_TOKEN: "PENDING_TOKEN";
+        READY: "READY";
+        REPLACEMENT_PENDING: "REPLACEMENT_PENDING";
+        RETIRED: "RETIRED";
+        RETIREMENT_PENDING: "RETIREMENT_PENDING";
+    }>;
+    predecessorBindingId: z.ZodNullable<z.ZodString>;
+    managedAccountId: z.ZodNullable<z.ZodString>;
+    providerAccountId: z.ZodNullable<z.ZodString>;
+    poolEntryId: z.ZodNullable<z.ZodString>;
+    credentialLineageId: z.ZodNullable<z.ZodString>;
+    generationVersion: z.ZodNullable<z.ZodNumber>;
+    credentialExpiresAt: z.ZodNullable<z.ZodString>;
+    accountExpiresAt: z.ZodNullable<z.ZodString>;
+    replacementDueAt: z.ZodNullable<z.ZodString>;
+    replacementReason: z.ZodNullable<z.ZodEnum<{
+        ADMIN_REQUESTED: "ADMIN_REQUESTED";
+        CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+        SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+    }>>;
+    accessTokenHealth: z.ZodEnum<{
+        EXPIRED: "EXPIRED";
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    refreshTokenHealth: z.ZodEnum<{
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    legacyAssignmentId: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    activatedAt: z.ZodNullable<z.ZodString>;
+    retiredAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const CodexV6DeviceBindingListResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        requestId: z.ZodString;
+        userSubject: z.ZodString;
+        installationId: z.ZodString;
+        deviceLabel: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            unknown: "unknown";
+            win32: "win32";
+        }>;
+        source: z.ZodEnum<{
+            ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
+            ADMIN_ADDED: "ADMIN_ADDED";
+            LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
+            REQUEST_INITIAL: "REQUEST_INITIAL";
+        }>;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            PENDING_TOKEN: "PENDING_TOKEN";
+            READY: "READY";
+            REPLACEMENT_PENDING: "REPLACEMENT_PENDING";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        }>;
+        predecessorBindingId: z.ZodNullable<z.ZodString>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        poolEntryId: z.ZodNullable<z.ZodString>;
+        credentialLineageId: z.ZodNullable<z.ZodString>;
+        generationVersion: z.ZodNullable<z.ZodNumber>;
+        credentialExpiresAt: z.ZodNullable<z.ZodString>;
+        accountExpiresAt: z.ZodNullable<z.ZodString>;
+        replacementDueAt: z.ZodNullable<z.ZodString>;
+        replacementReason: z.ZodNullable<z.ZodEnum<{
+            ADMIN_REQUESTED: "ADMIN_REQUESTED";
+            CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+            SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+        }>>;
+        accessTokenHealth: z.ZodEnum<{
+            EXPIRED: "EXPIRED";
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        refreshTokenHealth: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        legacyAssignmentId: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        activatedAt: z.ZodNullable<z.ZodString>;
+        retiredAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    total: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexV6AdminReplacementCandidateListResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    items: z.ZodArray<z.ZodObject<{
+        request: z.ZodObject<{
+            id: z.ZodString;
+            userSubject: z.ZodString;
+            username: z.ZodString;
+            userEmail: z.ZodNullable<z.ZodEmail>;
+            status: z.ZodEnum<{
+                APPROVED: "APPROVED";
+                CANCELLED: "CANCELLED";
+                EXPIRED: "EXPIRED";
+                REJECTED: "REJECTED";
+                SUBMITTED: "SUBMITTED";
+            }>;
+            availability: z.ZodEnum<{
+                AVAILABLE: "AVAILABLE";
+                EXPIRED: "EXPIRED";
+                PARTIALLY_AVAILABLE: "PARTIALLY_AVAILABLE";
+                PENDING_APPROVAL: "PENDING_APPROVAL";
+                UNAVAILABLE: "UNAVAILABLE";
+                WAITING_FOR_BINDING: "WAITING_FOR_BINDING";
+            }>;
+            reason: z.ZodString;
+            requestedDeviceCount: z.ZodNumber;
+            approvedDeviceLimit: z.ZodNullable<z.ZodNumber>;
+            activeBindingCount: z.ZodNumber;
+            pendingBindingCount: z.ZodNumber;
+            requestedValidUntil: z.ZodString;
+            validFrom: z.ZodNullable<z.ZodString>;
+            validUntil: z.ZodNullable<z.ZodString>;
+            version: z.ZodNumber;
+            createdAt: z.ZodString;
+            submittedAt: z.ZodString;
+            reviewedAt: z.ZodNullable<z.ZodString>;
+            safeErrorCode: z.ZodNullable<z.ZodString>;
+            allowedActions: z.ZodArray<z.ZodEnum<{
+                CANCEL: "CANCEL";
+                CLAIM_DEVICE: "CLAIM_DEVICE";
+                VIEW_BINDINGS: "VIEW_BINDINGS";
+            }>>;
+        }, z.core.$strict>;
+        binding: z.ZodObject<{
+            id: z.ZodString;
+            requestId: z.ZodString;
+            userSubject: z.ZodString;
+            installationId: z.ZodString;
+            deviceLabel: z.ZodString;
+            platform: z.ZodEnum<{
+                darwin: "darwin";
+                linux: "linux";
+                unknown: "unknown";
+                win32: "win32";
+            }>;
+            source: z.ZodEnum<{
+                ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
+                ADMIN_ADDED: "ADMIN_ADDED";
+                LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
+                REQUEST_INITIAL: "REQUEST_INITIAL";
+            }>;
+            status: z.ZodEnum<{
+                ACTIVE: "ACTIVE";
+                NEEDS_REAUTH: "NEEDS_REAUTH";
+                PENDING_TOKEN: "PENDING_TOKEN";
+                READY: "READY";
+                REPLACEMENT_PENDING: "REPLACEMENT_PENDING";
+                RETIRED: "RETIRED";
+                RETIREMENT_PENDING: "RETIREMENT_PENDING";
+            }>;
+            predecessorBindingId: z.ZodNullable<z.ZodString>;
+            managedAccountId: z.ZodNullable<z.ZodString>;
+            providerAccountId: z.ZodNullable<z.ZodString>;
+            poolEntryId: z.ZodNullable<z.ZodString>;
+            credentialLineageId: z.ZodNullable<z.ZodString>;
+            generationVersion: z.ZodNullable<z.ZodNumber>;
+            credentialExpiresAt: z.ZodNullable<z.ZodString>;
+            accountExpiresAt: z.ZodNullable<z.ZodString>;
+            replacementDueAt: z.ZodNullable<z.ZodString>;
+            replacementReason: z.ZodNullable<z.ZodEnum<{
+                ADMIN_REQUESTED: "ADMIN_REQUESTED";
+                CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+                SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+            }>>;
+            accessTokenHealth: z.ZodEnum<{
+                EXPIRED: "EXPIRED";
+                HEALTHY: "HEALTHY";
+                REJECTED: "REJECTED";
+                UNKNOWN: "UNKNOWN";
+            }>;
+            refreshTokenHealth: z.ZodEnum<{
+                HEALTHY: "HEALTHY";
+                REJECTED: "REJECTED";
+                UNKNOWN: "UNKNOWN";
+            }>;
+            legacyAssignmentId: z.ZodNullable<z.ZodString>;
+            createdAt: z.ZodString;
+            activatedAt: z.ZodNullable<z.ZodString>;
+            retiredAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>;
+        recommendedReason: z.ZodEnum<{
+            ADMIN_REQUESTED: "ADMIN_REQUESTED";
+            CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+            SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+        }>;
+        replaceBefore: z.ZodString;
+    }, z.core.$strict>>;
+    total: z.ZodNumber;
+}, z.core.$strict>;
+export declare const CodexV6ReconcileDeviceAccessInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    clientRequestId: z.ZodString;
+    device: z.ZodObject<{
+        installationId: z.ZodString;
+        label: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            unknown: "unknown";
+            win32: "win32";
+        }>;
+    }, z.core.$strict>;
+    legacy: z.ZodNullable<z.ZodObject<{
+        assignmentId: z.ZodString;
+        managedAccountId: z.ZodString;
+        providerAccountId: z.ZodString;
+        lineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const CodexV6ReconcileDeviceAccessResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    accessStatus: z.ZodEnum<{
+        AVAILABLE: "AVAILABLE";
+        DEVICE_BINDING_REQUIRED: "DEVICE_BINDING_REQUIRED";
+        REQUEST_EXPIRED: "REQUEST_EXPIRED";
+        REQUEST_PENDING: "REQUEST_PENDING";
+        REQUEST_REQUIRED: "REQUEST_REQUIRED";
+        TOKEN_PENDING: "TOKEN_PENDING";
+        UNAVAILABLE: "UNAVAILABLE";
+    }>;
+    request: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        userSubject: z.ZodString;
+        username: z.ZodString;
+        userEmail: z.ZodNullable<z.ZodEmail>;
+        status: z.ZodEnum<{
+            APPROVED: "APPROVED";
+            CANCELLED: "CANCELLED";
+            EXPIRED: "EXPIRED";
+            REJECTED: "REJECTED";
+            SUBMITTED: "SUBMITTED";
+        }>;
+        availability: z.ZodEnum<{
+            AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
+            PARTIALLY_AVAILABLE: "PARTIALLY_AVAILABLE";
+            PENDING_APPROVAL: "PENDING_APPROVAL";
+            UNAVAILABLE: "UNAVAILABLE";
+            WAITING_FOR_BINDING: "WAITING_FOR_BINDING";
+        }>;
+        reason: z.ZodString;
+        requestedDeviceCount: z.ZodNumber;
+        approvedDeviceLimit: z.ZodNullable<z.ZodNumber>;
+        activeBindingCount: z.ZodNumber;
+        pendingBindingCount: z.ZodNumber;
+        requestedValidUntil: z.ZodString;
+        validFrom: z.ZodNullable<z.ZodString>;
+        validUntil: z.ZodNullable<z.ZodString>;
+        version: z.ZodNumber;
+        createdAt: z.ZodString;
+        submittedAt: z.ZodString;
+        reviewedAt: z.ZodNullable<z.ZodString>;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+        allowedActions: z.ZodArray<z.ZodEnum<{
+            CANCEL: "CANCEL";
+            CLAIM_DEVICE: "CLAIM_DEVICE";
+            VIEW_BINDINGS: "VIEW_BINDINGS";
+        }>>;
+    }, z.core.$strict>>;
+    binding: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        requestId: z.ZodString;
+        userSubject: z.ZodString;
+        installationId: z.ZodString;
+        deviceLabel: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            unknown: "unknown";
+            win32: "win32";
+        }>;
+        source: z.ZodEnum<{
+            ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
+            ADMIN_ADDED: "ADMIN_ADDED";
+            LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
+            REQUEST_INITIAL: "REQUEST_INITIAL";
+        }>;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            PENDING_TOKEN: "PENDING_TOKEN";
+            READY: "READY";
+            REPLACEMENT_PENDING: "REPLACEMENT_PENDING";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        }>;
+        predecessorBindingId: z.ZodNullable<z.ZodString>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        poolEntryId: z.ZodNullable<z.ZodString>;
+        credentialLineageId: z.ZodNullable<z.ZodString>;
+        generationVersion: z.ZodNullable<z.ZodNumber>;
+        credentialExpiresAt: z.ZodNullable<z.ZodString>;
+        accountExpiresAt: z.ZodNullable<z.ZodString>;
+        replacementDueAt: z.ZodNullable<z.ZodString>;
+        replacementReason: z.ZodNullable<z.ZodEnum<{
+            ADMIN_REQUESTED: "ADMIN_REQUESTED";
+            CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+            SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+        }>>;
+        accessTokenHealth: z.ZodEnum<{
+            EXPIRED: "EXPIRED";
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        refreshTokenHealth: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        legacyAssignmentId: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        activatedAt: z.ZodNullable<z.ZodString>;
+        retiredAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    replacementBinding: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        requestId: z.ZodString;
+        userSubject: z.ZodString;
+        installationId: z.ZodString;
+        deviceLabel: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            unknown: "unknown";
+            win32: "win32";
+        }>;
+        source: z.ZodEnum<{
+            ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
+            ADMIN_ADDED: "ADMIN_ADDED";
+            LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
+            REQUEST_INITIAL: "REQUEST_INITIAL";
+        }>;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            PENDING_TOKEN: "PENDING_TOKEN";
+            READY: "READY";
+            REPLACEMENT_PENDING: "REPLACEMENT_PENDING";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        }>;
+        predecessorBindingId: z.ZodNullable<z.ZodString>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        poolEntryId: z.ZodNullable<z.ZodString>;
+        credentialLineageId: z.ZodNullable<z.ZodString>;
+        generationVersion: z.ZodNullable<z.ZodNumber>;
+        credentialExpiresAt: z.ZodNullable<z.ZodString>;
+        accountExpiresAt: z.ZodNullable<z.ZodString>;
+        replacementDueAt: z.ZodNullable<z.ZodString>;
+        replacementReason: z.ZodNullable<z.ZodEnum<{
+            ADMIN_REQUESTED: "ADMIN_REQUESTED";
+            CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+            SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+        }>>;
+        accessTokenHealth: z.ZodEnum<{
+            EXPIRED: "EXPIRED";
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        refreshTokenHealth: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        legacyAssignmentId: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        activatedAt: z.ZodNullable<z.ZodString>;
+        retiredAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    migration: z.ZodEnum<{
+        ADDITIONAL_DEVICE_DETECTED: "ADDITIONAL_DEVICE_DETECTED";
+        ALREADY_MIGRATED: "ALREADY_MIGRATED";
+        AUTO_MIGRATED: "AUTO_MIGRATED";
+        NONE: "NONE";
+    }>;
+    guidanceCode: z.ZodNullable<z.ZodEnum<{
+        account_request_expired: "account_request_expired";
+        account_request_pending: "account_request_pending";
+        account_request_required: "account_request_required";
+        account_unavailable: "account_unavailable";
+        device_binding_admin_required: "device_binding_admin_required";
+        device_token_pending: "device_token_pending";
+    }>>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV6AdminCreateDeviceBindingInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    expectedRequestVersion: z.ZodNumber;
+    device: z.ZodObject<{
+        installationId: z.ZodString;
+        label: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            unknown: "unknown";
+            win32: "win32";
+        }>;
+    }, z.core.$strict>;
+    poolEntryId: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const CodexV6AdminCreateDeviceBindingResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    request: z.ZodObject<{
+        id: z.ZodString;
+        userSubject: z.ZodString;
+        username: z.ZodString;
+        userEmail: z.ZodNullable<z.ZodEmail>;
+        status: z.ZodEnum<{
+            APPROVED: "APPROVED";
+            CANCELLED: "CANCELLED";
+            EXPIRED: "EXPIRED";
+            REJECTED: "REJECTED";
+            SUBMITTED: "SUBMITTED";
+        }>;
+        availability: z.ZodEnum<{
+            AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
+            PARTIALLY_AVAILABLE: "PARTIALLY_AVAILABLE";
+            PENDING_APPROVAL: "PENDING_APPROVAL";
+            UNAVAILABLE: "UNAVAILABLE";
+            WAITING_FOR_BINDING: "WAITING_FOR_BINDING";
+        }>;
+        reason: z.ZodString;
+        requestedDeviceCount: z.ZodNumber;
+        approvedDeviceLimit: z.ZodNullable<z.ZodNumber>;
+        activeBindingCount: z.ZodNumber;
+        pendingBindingCount: z.ZodNumber;
+        requestedValidUntil: z.ZodString;
+        validFrom: z.ZodNullable<z.ZodString>;
+        validUntil: z.ZodNullable<z.ZodString>;
+        version: z.ZodNumber;
+        createdAt: z.ZodString;
+        submittedAt: z.ZodString;
+        reviewedAt: z.ZodNullable<z.ZodString>;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+        allowedActions: z.ZodArray<z.ZodEnum<{
+            CANCEL: "CANCEL";
+            CLAIM_DEVICE: "CLAIM_DEVICE";
+            VIEW_BINDINGS: "VIEW_BINDINGS";
+        }>>;
+    }, z.core.$strict>;
+    binding: z.ZodObject<{
+        id: z.ZodString;
+        requestId: z.ZodString;
+        userSubject: z.ZodString;
+        installationId: z.ZodString;
+        deviceLabel: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            unknown: "unknown";
+            win32: "win32";
+        }>;
+        source: z.ZodEnum<{
+            ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
+            ADMIN_ADDED: "ADMIN_ADDED";
+            LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
+            REQUEST_INITIAL: "REQUEST_INITIAL";
+        }>;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            PENDING_TOKEN: "PENDING_TOKEN";
+            READY: "READY";
+            REPLACEMENT_PENDING: "REPLACEMENT_PENDING";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        }>;
+        predecessorBindingId: z.ZodNullable<z.ZodString>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        poolEntryId: z.ZodNullable<z.ZodString>;
+        credentialLineageId: z.ZodNullable<z.ZodString>;
+        generationVersion: z.ZodNullable<z.ZodNumber>;
+        credentialExpiresAt: z.ZodNullable<z.ZodString>;
+        accountExpiresAt: z.ZodNullable<z.ZodString>;
+        replacementDueAt: z.ZodNullable<z.ZodString>;
+        replacementReason: z.ZodNullable<z.ZodEnum<{
+            ADMIN_REQUESTED: "ADMIN_REQUESTED";
+            CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+            SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+        }>>;
+        accessTokenHealth: z.ZodEnum<{
+            EXPIRED: "EXPIRED";
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        refreshTokenHealth: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        legacyAssignmentId: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        activatedAt: z.ZodNullable<z.ZodString>;
+        retiredAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV6AdminReplaceDeviceTokenInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    expectedRequestVersion: z.ZodNumber;
+    reason: z.ZodEnum<{
+        ADMIN_REQUESTED: "ADMIN_REQUESTED";
+        CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+        SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+    }>;
+    replaceBefore: z.ZodString;
+    poolEntryId: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const CodexV6AdminReplaceDeviceTokenResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    request: z.ZodObject<{
+        id: z.ZodString;
+        userSubject: z.ZodString;
+        username: z.ZodString;
+        userEmail: z.ZodNullable<z.ZodEmail>;
+        status: z.ZodEnum<{
+            APPROVED: "APPROVED";
+            CANCELLED: "CANCELLED";
+            EXPIRED: "EXPIRED";
+            REJECTED: "REJECTED";
+            SUBMITTED: "SUBMITTED";
+        }>;
+        availability: z.ZodEnum<{
+            AVAILABLE: "AVAILABLE";
+            EXPIRED: "EXPIRED";
+            PARTIALLY_AVAILABLE: "PARTIALLY_AVAILABLE";
+            PENDING_APPROVAL: "PENDING_APPROVAL";
+            UNAVAILABLE: "UNAVAILABLE";
+            WAITING_FOR_BINDING: "WAITING_FOR_BINDING";
+        }>;
+        reason: z.ZodString;
+        requestedDeviceCount: z.ZodNumber;
+        approvedDeviceLimit: z.ZodNullable<z.ZodNumber>;
+        activeBindingCount: z.ZodNumber;
+        pendingBindingCount: z.ZodNumber;
+        requestedValidUntil: z.ZodString;
+        validFrom: z.ZodNullable<z.ZodString>;
+        validUntil: z.ZodNullable<z.ZodString>;
+        version: z.ZodNumber;
+        createdAt: z.ZodString;
+        submittedAt: z.ZodString;
+        reviewedAt: z.ZodNullable<z.ZodString>;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+        allowedActions: z.ZodArray<z.ZodEnum<{
+            CANCEL: "CANCEL";
+            CLAIM_DEVICE: "CLAIM_DEVICE";
+            VIEW_BINDINGS: "VIEW_BINDINGS";
+        }>>;
+    }, z.core.$strict>;
+    currentBinding: z.ZodObject<{
+        id: z.ZodString;
+        requestId: z.ZodString;
+        userSubject: z.ZodString;
+        installationId: z.ZodString;
+        deviceLabel: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            unknown: "unknown";
+            win32: "win32";
+        }>;
+        source: z.ZodEnum<{
+            ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
+            ADMIN_ADDED: "ADMIN_ADDED";
+            LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
+            REQUEST_INITIAL: "REQUEST_INITIAL";
+        }>;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            PENDING_TOKEN: "PENDING_TOKEN";
+            READY: "READY";
+            REPLACEMENT_PENDING: "REPLACEMENT_PENDING";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        }>;
+        predecessorBindingId: z.ZodNullable<z.ZodString>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        poolEntryId: z.ZodNullable<z.ZodString>;
+        credentialLineageId: z.ZodNullable<z.ZodString>;
+        generationVersion: z.ZodNullable<z.ZodNumber>;
+        credentialExpiresAt: z.ZodNullable<z.ZodString>;
+        accountExpiresAt: z.ZodNullable<z.ZodString>;
+        replacementDueAt: z.ZodNullable<z.ZodString>;
+        replacementReason: z.ZodNullable<z.ZodEnum<{
+            ADMIN_REQUESTED: "ADMIN_REQUESTED";
+            CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+            SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+        }>>;
+        accessTokenHealth: z.ZodEnum<{
+            EXPIRED: "EXPIRED";
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        refreshTokenHealth: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        legacyAssignmentId: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        activatedAt: z.ZodNullable<z.ZodString>;
+        retiredAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    replacementBinding: z.ZodObject<{
+        id: z.ZodString;
+        requestId: z.ZodString;
+        userSubject: z.ZodString;
+        installationId: z.ZodString;
+        deviceLabel: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            unknown: "unknown";
+            win32: "win32";
+        }>;
+        source: z.ZodEnum<{
+            ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
+            ADMIN_ADDED: "ADMIN_ADDED";
+            LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
+            REQUEST_INITIAL: "REQUEST_INITIAL";
+        }>;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            PENDING_TOKEN: "PENDING_TOKEN";
+            READY: "READY";
+            REPLACEMENT_PENDING: "REPLACEMENT_PENDING";
+            RETIRED: "RETIRED";
+            RETIREMENT_PENDING: "RETIREMENT_PENDING";
+        }>;
+        predecessorBindingId: z.ZodNullable<z.ZodString>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        poolEntryId: z.ZodNullable<z.ZodString>;
+        credentialLineageId: z.ZodNullable<z.ZodString>;
+        generationVersion: z.ZodNullable<z.ZodNumber>;
+        credentialExpiresAt: z.ZodNullable<z.ZodString>;
+        accountExpiresAt: z.ZodNullable<z.ZodString>;
+        replacementDueAt: z.ZodNullable<z.ZodString>;
+        replacementReason: z.ZodNullable<z.ZodEnum<{
+            ADMIN_REQUESTED: "ADMIN_REQUESTED";
+            CREDENTIAL_UNHEALTHY: "CREDENTIAL_UNHEALTHY";
+            SUBSCRIPTION_EXPIRING: "SUBSCRIPTION_EXPIRING";
+        }>>;
+        accessTokenHealth: z.ZodEnum<{
+            EXPIRED: "EXPIRED";
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        refreshTokenHealth: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        legacyAssignmentId: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        activatedAt: z.ZodNullable<z.ZodString>;
+        retiredAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV6FullCredentialDeliveryInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    clientRequestId: z.ZodString;
+    installationId: z.ZodString;
+    clientKey: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        publicKey: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexV6FullCredentialDeliveryResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    delivery: z.ZodObject<{
+        id: z.ZodString;
+        clientRequestId: z.ZodString;
+        requestId: z.ZodString;
+        bindingId: z.ZodString;
+        installationId: z.ZodString;
+        managedAccountId: z.ZodString;
+        providerAccountId: z.ZodString;
+        credentialLineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+        issuedAt: z.ZodString;
+        credentialExpiresAt: z.ZodString;
+        ackExpiresAt: z.ZodString;
+        ackedAt: z.ZodNullable<z.ZodString>;
+        status: z.ZodLiteral<"AWAITING_ACK">;
+        envelope: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+            ephemeralPublicKey: z.ZodString;
+            salt: z.ZodString;
+            nonce: z.ZodString;
+            ciphertext: z.ZodString;
+            authenticationTag: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV6FullCredentialBundleSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    deliveryId: z.ZodString;
+    requestId: z.ZodString;
+    bindingId: z.ZodString;
+    installationId: z.ZodString;
+    managedAccountId: z.ZodString;
+    providerAccountId: z.ZodString;
+    credentialLineageId: z.ZodString;
+    generationVersion: z.ZodNumber;
+    refreshToken: z.ZodString;
+    accessToken: z.ZodString;
+    idToken: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV6AcknowledgeFullCredentialDeliveryInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    installationId: z.ZodString;
+    credentialLineageId: z.ZodString;
+    generationVersion: z.ZodNumber;
+    installed: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare const CodexV6AcknowledgeFullCredentialDeliveryResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    delivery: z.ZodObject<{
+        id: z.ZodString;
+        clientRequestId: z.ZodString;
+        requestId: z.ZodString;
+        bindingId: z.ZodString;
+        installationId: z.ZodString;
+        managedAccountId: z.ZodString;
+        providerAccountId: z.ZodString;
+        credentialLineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+        issuedAt: z.ZodString;
+        credentialExpiresAt: z.ZodString;
+        ackExpiresAt: z.ZodString;
+        status: z.ZodLiteral<"ACKED">;
+        ackedAt: z.ZodString;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const CodexV6GenerationReportInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    clientRequestId: z.ZodString;
+    bindingId: z.ZodString;
+    installationId: z.ZodString;
+    expectedGenerationVersion: z.ZodNumber;
+    rotationMode: z.ZodEnum<{
+        RETAINED: "RETAINED";
+        ROTATED: "ROTATED";
+    }>;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+    accessTokenHealth: z.ZodEnum<{
+        EXPIRED: "EXPIRED";
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    refreshTokenHealth: z.ZodEnum<{
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    observedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV6GenerationReportResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<6>;
+    report: z.ZodObject<{
+        id: z.ZodString;
+        clientRequestId: z.ZodString;
+        requestId: z.ZodString;
+        bindingId: z.ZodString;
+        installationId: z.ZodString;
+        credentialLineageId: z.ZodString;
+        previousGenerationVersion: z.ZodNumber;
+        generationVersion: z.ZodNumber;
+        rotationMode: z.ZodEnum<{
+            RETAINED: "RETAINED";
+            ROTATED: "ROTATED";
+        }>;
+        accessTokenHealth: z.ZodEnum<{
+            EXPIRED: "EXPIRED";
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        refreshTokenHealth: z.ZodEnum<{
+            HEALTHY: "HEALTHY";
+            REJECTED: "REJECTED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        credentialExpiresAt: z.ZodString;
+        observedAt: z.ZodString;
+        status: z.ZodLiteral<"APPLIED">;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
 export declare const CodexV4AccessObservationStateSchema: z.ZodEnum<{
     EXPIRED: "EXPIRED";
     EXPIRING: "EXPIRING";
@@ -2198,6 +3384,8 @@ export type CodexAdminAccount = z.infer<typeof CodexAdminAccountSchema>;
 export type CodexAdminAccountListResponse = z.infer<typeof CodexAdminAccountListResponseSchema>;
 export type CodexCredentialVersionListResponse = z.infer<typeof CodexCredentialVersionListResponseSchema>;
 export type CodexManualRefreshResponse = z.infer<typeof CodexManualRefreshResponseSchema>;
+export type CodexAdminAccountRenewalInput = z.infer<typeof CodexAdminAccountRenewalInputSchema>;
+export type CodexAdminAccountRenewalResponse = z.infer<typeof CodexAdminAccountRenewalResponseSchema>;
 export type CodexAdminAssignment = z.infer<typeof CodexAdminAssignmentSchema>;
 export type CodexAdminAssignmentListResponse = z.infer<typeof CodexAdminAssignmentListResponseSchema>;
 export type CodexAdminAssignmentMutationResponse = z.infer<typeof CodexAdminAssignmentMutationResponseSchema>;
@@ -2255,6 +3443,31 @@ export type CodexV5ReleaseDeviceSessionInput = z.infer<typeof CodexV5ReleaseDevi
 export type CodexV5ReleaseDeviceSessionResponse = z.infer<typeof CodexV5ReleaseDeviceSessionResponseSchema>;
 export type CodexV5GenerationReportInput = z.infer<typeof CodexV5GenerationReportInputSchema>;
 export type CodexV5GenerationReportResponse = z.infer<typeof CodexV5GenerationReportResponseSchema>;
+export type CodexV6DeviceDescriptor = z.infer<typeof CodexV6DeviceDescriptorSchema>;
+export type CodexV6AccountRequest = z.infer<typeof CodexV6AccountRequestSchema>;
+export type CodexV6CreateAccountRequestInput = z.infer<typeof CodexV6CreateAccountRequestInputSchema>;
+export type CodexV6AccountRequestResponse = z.infer<typeof CodexV6AccountRequestResponseSchema>;
+export type CodexV6AccountRequestListResponse = z.infer<typeof CodexV6AccountRequestListResponseSchema>;
+export type CodexV6AdminAccountRequestListQuery = z.infer<typeof CodexV6AdminAccountRequestListQuerySchema>;
+export type CodexV6AdminReplacementCandidateQuery = z.infer<typeof CodexV6AdminReplacementCandidateQuerySchema>;
+export type CodexV6CancelAccountRequestInput = z.infer<typeof CodexV6CancelAccountRequestInputSchema>;
+export type CodexV6AdminReviewAccountRequestInput = z.infer<typeof CodexV6AdminReviewAccountRequestInputSchema>;
+export type CodexV6DeviceBinding = z.infer<typeof CodexV6DeviceBindingSchema>;
+export type CodexV6DeviceBindingListResponse = z.infer<typeof CodexV6DeviceBindingListResponseSchema>;
+export type CodexV6AdminReplacementCandidateListResponse = z.infer<typeof CodexV6AdminReplacementCandidateListResponseSchema>;
+export type CodexV6ReconcileDeviceAccessInput = z.infer<typeof CodexV6ReconcileDeviceAccessInputSchema>;
+export type CodexV6ReconcileDeviceAccessResponse = z.infer<typeof CodexV6ReconcileDeviceAccessResponseSchema>;
+export type CodexV6AdminCreateDeviceBindingInput = z.infer<typeof CodexV6AdminCreateDeviceBindingInputSchema>;
+export type CodexV6AdminCreateDeviceBindingResponse = z.infer<typeof CodexV6AdminCreateDeviceBindingResponseSchema>;
+export type CodexV6AdminReplaceDeviceTokenInput = z.infer<typeof CodexV6AdminReplaceDeviceTokenInputSchema>;
+export type CodexV6AdminReplaceDeviceTokenResponse = z.infer<typeof CodexV6AdminReplaceDeviceTokenResponseSchema>;
+export type CodexV6FullCredentialDeliveryInput = z.infer<typeof CodexV6FullCredentialDeliveryInputSchema>;
+export type CodexV6FullCredentialDeliveryResponse = z.infer<typeof CodexV6FullCredentialDeliveryResponseSchema>;
+export type CodexV6FullCredentialBundle = z.infer<typeof CodexV6FullCredentialBundleSchema>;
+export type CodexV6AcknowledgeFullCredentialDeliveryInput = z.infer<typeof CodexV6AcknowledgeFullCredentialDeliveryInputSchema>;
+export type CodexV6AcknowledgeFullCredentialDeliveryResponse = z.infer<typeof CodexV6AcknowledgeFullCredentialDeliveryResponseSchema>;
+export type CodexV6GenerationReportInput = z.infer<typeof CodexV6GenerationReportInputSchema>;
+export type CodexV6GenerationReportResponse = z.infer<typeof CodexV6GenerationReportResponseSchema>;
 export type CodexTokenPoolV4AssignmentTarget = z.infer<typeof CodexTokenPoolV4AssignmentTargetSchema>;
 export type CodexTokenPoolV4EnrollmentConfiguration = z.infer<typeof CodexTokenPoolV4EnrollmentConfigurationSchema>;
 export type CodexTokenPoolV4DirectoryResolveResponse = z.infer<typeof CodexTokenPoolV4DirectoryResolveResponseSchema>;
@@ -2263,6 +3476,7 @@ export type CodexTokenPoolV4UploadResponse = z.infer<typeof CodexTokenPoolV4Uplo
 export declare function codexAccountLoginCredentialsPath(accountId: string): string;
 export declare function codexAdminCredentialVersionsPath(accountId: string): string;
 export declare function codexAdminRefreshPath(accountId: string): string;
+export declare function codexAdminRenewPath(accountId: string): string;
 export declare function codexAdminAssignmentPath(assignmentId: string): string;
 export declare function codexAdminEnrollmentIntentPath(intentId: string): string;
 export declare function codexAdminEnrollmentIntentActionPath(intentId: string, action: "claim" | "heartbeat" | "cancel" | "candidate"): string;
@@ -2285,5 +3499,19 @@ export declare function codexV5AssignmentDeviceSessionsPath(assignmentId: string
 export declare function codexV5AssignmentDeviceSessionResolvePath(assignmentId: string, clientRequestId: string): string;
 export declare function codexV5DeviceSessionActionPath(sessionId: string, action: "ack" | "heartbeat" | "release"): string;
 export declare function codexV5LineageGenerationReportsPath(lineageId: string): string;
+export declare function codexV6AccountRequestPath(requestId: string): string;
+export declare function codexV6AccountRequestActionPath(requestId: string, action: "cancel"): string;
+export declare function codexV6AccountRequestDeviceBindingsPath(requestId: string): string;
+export declare function codexV6AdminAccountRequestDeviceBindingsPath(requestId: string): string;
+export declare function codexV6AdminDeviceBindingReplacementPath(requestId: string, bindingId: string): string;
+export declare function codexV6AdminAccountRequestPath(requestId: string): string;
+export declare function codexV6AdminAccountRequestsPath(query?: CodexV6AdminAccountRequestListQuery): string;
+export declare function codexV6AdminReplacementCandidatesPath(query: CodexV6AdminReplacementCandidateQuery): string;
+export declare function codexV6AdminAccountRequestReviewPath(requestId: string): string;
+export declare function codexV6DeviceBindingFullCredentialDeliveriesPath(bindingId: string): string;
+export declare function codexV6DeviceBindingFullCredentialDeliveryResolvePath(bindingId: string, clientRequestId: string): string;
+export declare function codexV6FullCredentialDeliveryAckPath(deliveryId: string): string;
+export declare function codexV6BindingGenerationReportsPath(bindingId: string): string;
+export declare function codexV6BindingGenerationReportResolvePath(bindingId: string, clientRequestId: string): string;
 export declare function codexTokenPoolV4DirectoryResolvePath(principal: string): string;
 export declare function codexTokenPoolV4UploadResolvePath(clientRequestId: string): string;