@tokensrc/codex 1.14.16 → 1.14.17

package/dist/protocol.js

@@ -33,6 +33,14 @@ export const CODEX_MULTI_DEVICE_V5_RUNTIME_PATH = "/v5/codex";
 export const CODEX_MULTI_DEVICE_V5_CREDENTIAL_ASSIGNMENTS_PATH = `${CODEX_MULTI_DEVICE_V5_RUNTIME_PATH}/credential-assignments`;
 export const CODEX_MULTI_DEVICE_V5_DEVICE_SESSIONS_PATH = `${CODEX_MULTI_DEVICE_V5_RUNTIME_PATH}/device-sessions`;
 export const CODEX_MULTI_DEVICE_V5_CREDENTIAL_LINEAGES_PATH = `${CODEX_MULTI_DEVICE_V5_RUNTIME_PATH}/credential-lineages`;
+export const CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION = 6;
+export const CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH = "/v6/codex";
+export const CODEX_V6_ACCOUNT_REQUESTS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH}/account-requests`;
+export const CODEX_V6_DEVICE_ACCESS_RECONCILIATIONS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH}/device-access/reconciliations`;
+export const CODEX_V6_DEVICE_BINDINGS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH}/device-bindings`;
+export const CODEX_REQUEST_BOUND_DEVICE_V6_ADMIN_PATH = "/v6/admin/codex";
+export const CODEX_V6_ADMIN_ACCOUNT_REQUESTS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_ADMIN_PATH}/account-requests`;
+export const CODEX_V6_ADMIN_DEVICE_BINDINGS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_ADMIN_PATH}/device-bindings`;
 export const CODEX_MIGRATION_CAPACITY = {
     verifiedMinimum: 2,
     verifiedLimit: null,
@@ -895,6 +903,436 @@ export const CodexV5GenerationReportResponseSchema = z.strictObject({
             message: "Generation did not advance exactly once." });
     }
 });
+/**
+ * v6 makes one complete upstream token set the property of exactly one
+ * request/device binding. A request may own several bindings for the same
+ * user, but lineages and installation ids may never be shared by bindings.
+ */
+export const CodexV6DeviceDescriptorSchema = z.strictObject({
+    installationId: CodexV5InstallationIdSchema,
+    label: z.string().trim().min(1).max(128),
+    platform: z.enum(["darwin", "linux", "win32", "unknown"])
+});
+export const CodexV6AccountRequestStatusSchema = z.enum([
+    "SUBMITTED",
+    "APPROVED",
+    "REJECTED",
+    "CANCELLED",
+    "EXPIRED"
+]);
+export const CodexV6AccountRequestAvailabilitySchema = z.enum([
+    "PENDING_APPROVAL",
+    "WAITING_FOR_BINDING",
+    "PARTIALLY_AVAILABLE",
+    "AVAILABLE",
+    "UNAVAILABLE",
+    "EXPIRED"
+]);
+export const CodexV6AccountRequestSchema = z.strictObject({
+    id: CodexV3IdSchema,
+    userSubject: CodexV3IdSchema,
+    username: z.string().trim().min(1).max(255),
+    userEmail: z.email().nullable(),
+    status: CodexV6AccountRequestStatusSchema,
+    availability: CodexV6AccountRequestAvailabilitySchema,
+    reason: z.string().trim().min(5).max(1_000),
+    requestedDeviceCount: z.number().int().min(1).max(32),
+    approvedDeviceLimit: z.number().int().min(1).max(32).nullable(),
+    activeBindingCount: z.number().int().min(0).max(32),
+    pendingBindingCount: z.number().int().min(0).max(32),
+    requestedValidUntil: CodexV3InstantSchema,
+    validFrom: CodexV3InstantSchema.nullable(),
+    validUntil: CodexV3InstantSchema.nullable(),
+    version: z.number().int().nonnegative(),
+    createdAt: CodexV3InstantSchema,
+    submittedAt: CodexV3InstantSchema,
+    reviewedAt: CodexV3InstantSchema.nullable(),
+    safeErrorCode: z.string().min(1).max(128).regex(/^[a-z][a-z0-9_.-]*$/u).nullable(),
+    allowedActions: z.array(z.enum(["CANCEL", "CLAIM_DEVICE", "VIEW_BINDINGS"])).max(3)
+}).superRefine((value, context) => {
+    const approved = ["APPROVED", "EXPIRED"].includes(value.status);
+    if (approved !== (value.approvedDeviceLimit !== null && value.validFrom !== null
+        && value.validUntil !== null)) {
+        context.addIssue({ code: "custom", message: "Request approval evidence is inconsistent." });
+    }
+    if (value.approvedDeviceLimit !== null
+        && value.activeBindingCount + value.pendingBindingCount > value.approvedDeviceLimit) {
+        context.addIssue({ code: "custom", message: "Request binding counts exceed the approved limit." });
+    }
+});
+export const CodexV6CreateAccountRequestInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    reason: z.string().trim().min(5).max(1_000),
+    requestedDeviceCount: z.number().int().min(1).max(32),
+    requestedValidUntil: CodexV3InstantSchema,
+    initialDevice: CodexV6DeviceDescriptorSchema
+});
+export const CodexV6AccountRequestResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    request: CodexV6AccountRequestSchema,
+    replayed: z.boolean()
+});
+export const CodexV6AccountRequestListResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    items: z.array(CodexV6AccountRequestSchema).max(256),
+    total: z.number().int().min(0).max(256)
+}).superRefine((value, context) => {
+    if (value.items.length !== value.total) {
+        context.addIssue({ code: "custom", path: ["total"], message: "Request total is inconsistent." });
+    }
+});
+export const CodexV6AdminAccountRequestListQuerySchema = z.strictObject({
+    expiresBefore: CodexV3InstantSchema.optional(),
+    includeTerminal: z.boolean().optional()
+});
+export const CodexV6AdminReplacementCandidateQuerySchema = z.strictObject({
+    replaceBefore: CodexV3InstantSchema
+});
+export const CodexV6CancelAccountRequestInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    expectedRequestVersion: z.number().int().nonnegative()
+});
+export const CodexV6AdminReviewAccountRequestInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    expectedRequestVersion: z.number().int().nonnegative(),
+    decision: z.enum(["APPROVE", "REJECT"]),
+    reason: z.string().trim().min(5).max(1_000),
+    approvedDeviceLimit: z.number().int().min(1).max(32).nullable(),
+    validFrom: CodexV3InstantSchema.nullable(),
+    validUntil: CodexV3InstantSchema.nullable()
+}).superRefine((value, context) => {
+    const approval = value.approvedDeviceLimit !== null && value.validFrom !== null
+        && value.validUntil !== null;
+    if ((value.decision === "APPROVE") !== approval) {
+        context.addIssue({ code: "custom", message: "Approval decision fields are inconsistent." });
+    }
+});
+export const CodexV6DeviceBindingStatusSchema = z.enum([
+    "PENDING_TOKEN",
+    "READY",
+    "ACTIVE",
+    "REPLACEMENT_PENDING",
+    "NEEDS_REAUTH",
+    "RETIREMENT_PENDING",
+    "RETIRED"
+]);
+export const CodexV6DeviceBindingSchema = z.strictObject({
+    id: CodexV3IdSchema,
+    requestId: CodexV3IdSchema,
+    userSubject: CodexV3IdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    deviceLabel: z.string().trim().min(1).max(128),
+    platform: z.enum(["darwin", "linux", "win32", "unknown"]),
+    source: z.enum([
+        "REQUEST_INITIAL",
+        "ADMIN_ADDED",
+        "LEGACY_AUTO_MIGRATED",
+        "ACCOUNT_REPLACEMENT"
+    ]),
+    status: CodexV6DeviceBindingStatusSchema,
+    predecessorBindingId: CodexV3IdSchema.nullable(),
+    managedAccountId: CodexV3IdSchema.nullable(),
+    providerAccountId: z.string().min(1).max(512).nullable(),
+    poolEntryId: CodexV3IdSchema.nullable(),
+    credentialLineageId: CodexV3IdSchema.nullable(),
+    generationVersion: z.number().int().positive().nullable(),
+    credentialExpiresAt: CodexV3InstantSchema.nullable(),
+    accountExpiresAt: CodexV3InstantSchema.nullable(),
+    replacementDueAt: CodexV3InstantSchema.nullable(),
+    replacementReason: z.enum([
+        "SUBSCRIPTION_EXPIRING",
+        "CREDENTIAL_UNHEALTHY",
+        "ADMIN_REQUESTED"
+    ]).nullable(),
+    accessTokenHealth: CodexV3AccessTokenHealthSchema,
+    refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+    legacyAssignmentId: CodexV3IdSchema.nullable(),
+    createdAt: CodexV3InstantSchema,
+    activatedAt: CodexV3InstantSchema.nullable(),
+    retiredAt: CodexV3InstantSchema.nullable()
+}).superRefine((value, context) => {
+    const complete = [value.managedAccountId, value.providerAccountId, value.poolEntryId,
+        value.credentialLineageId, value.generationVersion, value.credentialExpiresAt]
+        .every((item) => item !== null);
+    if ((value.status === "PENDING_TOKEN") === complete) {
+        context.addIssue({ code: "custom", message: "Device binding credential evidence is inconsistent." });
+    }
+    if ((value.source === "LEGACY_AUTO_MIGRATED") !== (value.legacyAssignmentId !== null)) {
+        context.addIssue({ code: "custom", message: "Legacy migration evidence is inconsistent." });
+    }
+    if ((value.source === "ACCOUNT_REPLACEMENT") !== (value.predecessorBindingId !== null)) {
+        context.addIssue({ code: "custom", message: "Replacement predecessor evidence is inconsistent." });
+    }
+    const replacementEvidence = value.replacementDueAt !== null && value.replacementReason !== null;
+    if ((value.replacementDueAt !== null) !== (value.replacementReason !== null)
+        || (value.status === "REPLACEMENT_PENDING" || value.source === "ACCOUNT_REPLACEMENT")
+            !== replacementEvidence) {
+        context.addIssue({ code: "custom", message: "Replacement timing evidence is inconsistent." });
+    }
+});
+export const CodexV6DeviceBindingListResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    items: z.array(CodexV6DeviceBindingSchema).max(32),
+    total: z.number().int().min(0).max(32)
+}).superRefine((value, context) => {
+    if (value.items.length !== value.total
+        || new Set(value.items.map(({ id }) => id)).size !== value.items.length
+        || new Set(value.items.filter(({ credentialLineageId }) => credentialLineageId !== null)
+            .map(({ credentialLineageId }) => credentialLineageId)).size
+            !== value.items.filter(({ credentialLineageId }) => credentialLineageId !== null).length) {
+        context.addIssue({ code: "custom", message: "Device bindings are duplicated or incomplete." });
+    }
+    const byId = new Map(value.items.map((item) => [item.id, item]));
+    const successors = new Set();
+    for (const item of value.items) {
+        if (item.predecessorBindingId === null)
+            continue;
+        const predecessor = byId.get(item.predecessorBindingId);
+        if (!predecessor || predecessor.installationId !== item.installationId
+            || predecessor.requestId !== item.requestId || predecessor.userSubject !== item.userSubject
+            || successors.has(predecessor.id)) {
+            context.addIssue({ code: "custom", message: "Replacement binding chain is inconsistent." });
+            break;
+        }
+        successors.add(predecessor.id);
+    }
+    const activeByInstallation = new Map();
+    for (const item of value.items.filter(({ status }) => status !== "RETIRED")) {
+        activeByInstallation.set(item.installationId, [...(activeByInstallation.get(item.installationId) ?? []), item]);
+    }
+    for (const items of activeByInstallation.values()) {
+        if (items.length > 2 || items.length === 2 && !items.some(({ status }) => status === "REPLACEMENT_PENDING") || items.length === 2 && !items.some(({ source }) => source === "ACCOUNT_REPLACEMENT")) {
+            context.addIssue({ code: "custom", message: "Installation has conflicting active bindings." });
+            break;
+        }
+    }
+});
+export const CodexV6AdminReplacementCandidateListResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    items: z.array(z.strictObject({
+        request: CodexV6AccountRequestSchema,
+        binding: CodexV6DeviceBindingSchema,
+        recommendedReason: z.enum([
+            "SUBSCRIPTION_EXPIRING",
+            "CREDENTIAL_UNHEALTHY",
+            "ADMIN_REQUESTED"
+        ]),
+        replaceBefore: CodexV3InstantSchema
+    })).max(256),
+    total: z.number().int().min(0).max(256)
+}).superRefine((value, context) => {
+    if (value.items.length !== value.total || value.items.some(({ request, binding }) => binding.requestId !== request.id || binding.userSubject !== request.userSubject
+        || !["ACTIVE", "NEEDS_REAUTH"].includes(binding.status))) {
+        context.addIssue({ code: "custom", message: "Replacement candidates are inconsistent." });
+    }
+});
+const CodexV6LegacyDeviceEvidenceSchema = z.strictObject({
+    assignmentId: CodexV3IdSchema,
+    managedAccountId: CodexV3IdSchema,
+    providerAccountId: z.string().min(1).max(512),
+    lineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive()
+});
+export const CodexV6ReconcileDeviceAccessInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    device: CodexV6DeviceDescriptorSchema,
+    legacy: CodexV6LegacyDeviceEvidenceSchema.nullable()
+});
+export const CodexV6ReconcileDeviceAccessResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    accessStatus: z.enum([
+        "AVAILABLE",
+        "REQUEST_REQUIRED",
+        "REQUEST_PENDING",
+        "DEVICE_BINDING_REQUIRED",
+        "TOKEN_PENDING",
+        "REQUEST_EXPIRED",
+        "UNAVAILABLE"
+    ]),
+    request: CodexV6AccountRequestSchema.nullable(),
+    binding: CodexV6DeviceBindingSchema.nullable(),
+    replacementBinding: CodexV6DeviceBindingSchema.nullable(),
+    migration: z.enum([
+        "NONE",
+        "AUTO_MIGRATED",
+        "ALREADY_MIGRATED",
+        "ADDITIONAL_DEVICE_DETECTED"
+    ]),
+    guidanceCode: z.enum([
+        "account_request_required",
+        "account_request_pending",
+        "device_binding_admin_required",
+        "device_token_pending",
+        "account_request_expired",
+        "account_unavailable"
+    ]).nullable(),
+    replayed: z.boolean()
+}).superRefine((value, context) => {
+    if (value.accessStatus === "AVAILABLE" && (value.request === null || value.binding === null
+        || !["READY", "ACTIVE", "REPLACEMENT_PENDING"].includes(value.binding.status))) {
+        context.addIssue({ code: "custom", message: "Available device access lacks an active binding." });
+    }
+    if (value.accessStatus === "DEVICE_BINDING_REQUIRED"
+        && value.guidanceCode !== "device_binding_admin_required") {
+        context.addIssue({ code: "custom", message: "Unbound devices must receive administrator guidance." });
+    }
+    if (value.replacementBinding !== null && (value.request === null || value.binding === null
+        || value.binding.status !== "REPLACEMENT_PENDING"
+        || value.replacementBinding.status !== "READY"
+        || value.replacementBinding.source !== "ACCOUNT_REPLACEMENT"
+        || value.replacementBinding.predecessorBindingId !== value.binding.id
+        || value.replacementBinding.requestId !== value.binding.requestId
+        || value.replacementBinding.userSubject !== value.binding.userSubject
+        || value.replacementBinding.installationId !== value.binding.installationId
+        || value.replacementBinding.credentialLineageId === value.binding.credentialLineageId
+        || value.replacementBinding.poolEntryId === value.binding.poolEntryId)) {
+        context.addIssue({ code: "custom", message: "Ready replacement binding is inconsistent." });
+    }
+});
+export const CodexV6AdminCreateDeviceBindingInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    expectedRequestVersion: z.number().int().nonnegative(),
+    device: CodexV6DeviceDescriptorSchema,
+    poolEntryId: CodexV3IdSchema.nullable()
+});
+export const CodexV6AdminCreateDeviceBindingResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    request: CodexV6AccountRequestSchema,
+    binding: CodexV6DeviceBindingSchema,
+    replayed: z.boolean()
+});
+export const CodexV6AdminReplaceDeviceTokenInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    expectedRequestVersion: z.number().int().nonnegative(),
+    reason: z.enum([
+        "SUBSCRIPTION_EXPIRING",
+        "CREDENTIAL_UNHEALTHY",
+        "ADMIN_REQUESTED"
+    ]),
+    replaceBefore: CodexV3InstantSchema,
+    poolEntryId: CodexV3IdSchema.nullable()
+});
+export const CodexV6AdminReplaceDeviceTokenResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    request: CodexV6AccountRequestSchema,
+    currentBinding: CodexV6DeviceBindingSchema,
+    replacementBinding: CodexV6DeviceBindingSchema,
+    replayed: z.boolean()
+}).superRefine((value, context) => {
+    if (value.currentBinding.requestId !== value.request.id
+        || value.currentBinding.userSubject !== value.request.userSubject
+        || value.currentBinding.status !== "REPLACEMENT_PENDING"
+        || value.replacementBinding.requestId !== value.request.id
+        || value.replacementBinding.userSubject !== value.request.userSubject
+        || value.replacementBinding.source !== "ACCOUNT_REPLACEMENT"
+        || value.replacementBinding.predecessorBindingId !== value.currentBinding.id
+        || value.replacementBinding.installationId !== value.currentBinding.installationId
+        || value.replacementBinding.poolEntryId !== null
+            && value.replacementBinding.poolEntryId === value.currentBinding.poolEntryId
+        || value.replacementBinding.credentialLineageId !== null
+            && value.replacementBinding.credentialLineageId === value.currentBinding.credentialLineageId) {
+        context.addIssue({ code: "custom", message: "Replacement response identities are inconsistent." });
+    }
+});
+export const CodexV6FullCredentialDeliveryInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    clientKey: CodexShortLivedDeliveryClientKeySchema
+});
+const CodexV6FullCredentialDeliveryMetadataSchema = z.strictObject({
+    id: CodexV3IdSchema,
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    requestId: CodexV3IdSchema,
+    bindingId: CodexV3IdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    managedAccountId: CodexV3IdSchema,
+    providerAccountId: z.string().min(1).max(512),
+    credentialLineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive(),
+    status: z.enum(["AWAITING_ACK", "ACKED", "EXPIRED"]),
+    issuedAt: CodexV3InstantSchema,
+    credentialExpiresAt: CodexV3InstantSchema,
+    ackExpiresAt: CodexV3InstantSchema,
+    ackedAt: CodexV3InstantSchema.nullable()
+});
+export const CodexV6FullCredentialDeliveryResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    delivery: CodexV6FullCredentialDeliveryMetadataSchema.extend({
+        status: z.literal("AWAITING_ACK"),
+        envelope: CodexShortLivedDeliveryEnvelopeSchema
+    }),
+    replayed: z.boolean()
+});
+export const CodexV6FullCredentialBundleSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    deliveryId: CodexV3IdSchema,
+    requestId: CodexV3IdSchema,
+    bindingId: CodexV3IdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    managedAccountId: CodexV3IdSchema,
+    providerAccountId: z.string().min(1).max(512),
+    credentialLineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive(),
+    refreshToken: z.string().min(1).max(65_536),
+    accessToken: z.string().min(1).max(65_536),
+    idToken: z.string().min(1).max(65_536),
+    expiresAt: CodexV3InstantSchema
+});
+export const CodexV6AcknowledgeFullCredentialDeliveryInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    installationId: CodexV5InstallationIdSchema,
+    credentialLineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive(),
+    installed: z.literal(true)
+});
+export const CodexV6AcknowledgeFullCredentialDeliveryResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    delivery: CodexV6FullCredentialDeliveryMetadataSchema.extend({
+        status: z.literal("ACKED"),
+        ackedAt: CodexV3InstantSchema
+    }),
+    replayed: z.boolean()
+});
+export const CodexV6GenerationReportInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    bindingId: CodexV3IdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    expectedGenerationVersion: z.number().int().positive(),
+    rotationMode: z.enum(["ROTATED", "RETAINED"]),
+    envelope: CodexV3CredentialEnvelopeSchema,
+    accessTokenHealth: CodexV3AccessTokenHealthSchema,
+    refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+    observedAt: CodexV3InstantSchema
+});
+export const CodexV6GenerationReportResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    report: z.strictObject({
+        id: CodexV3IdSchema,
+        clientRequestId: CodexV3ClientRequestIdSchema,
+        requestId: CodexV3IdSchema,
+        bindingId: CodexV3IdSchema,
+        installationId: CodexV5InstallationIdSchema,
+        credentialLineageId: CodexV3IdSchema,
+        previousGenerationVersion: z.number().int().positive(),
+        generationVersion: z.number().int().positive(),
+        rotationMode: z.enum(["ROTATED", "RETAINED"]),
+        accessTokenHealth: CodexV3AccessTokenHealthSchema,
+        refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+        credentialExpiresAt: CodexV3InstantSchema,
+        observedAt: CodexV3InstantSchema,
+        status: z.literal("APPLIED")
+    }),
+    replayed: z.boolean()
+}).superRefine((value, context) => {
+    if (value.report.generationVersion !== value.report.previousGenerationVersion + 1) {
+        context.addIssue({ code: "custom", path: ["report", "generationVersion"],
+            message: "Generation did not advance exactly once." });
+    }
+});
 export const CodexV4AccessObservationStateSchema = z.enum([
     "VALID", "EXPIRING", "EXPIRED", "INVALID"
 ]);
@@ -1085,6 +1523,62 @@ export function codexV5DeviceSessionActionPath(sessionId, action) {
 export function codexV5LineageGenerationReportsPath(lineageId) {
     return `${CODEX_MULTI_DEVICE_V5_CREDENTIAL_LINEAGES_PATH}/${encodeURIComponent(lineageId)}/generations/report`;
 }
+export function codexV6AccountRequestPath(requestId) {
+    return `${CODEX_V6_ACCOUNT_REQUESTS_PATH}/${encodeURIComponent(requestId)}`;
+}
+export function codexV6AccountRequestActionPath(requestId, action) {
+    return `${codexV6AccountRequestPath(requestId)}/${action}`;
+}
+export function codexV6AccountRequestDeviceBindingsPath(requestId) {
+    return `${codexV6AccountRequestPath(requestId)}/device-bindings`;
+}
+export function codexV6AdminAccountRequestDeviceBindingsPath(requestId) {
+    return `${CODEX_V6_ADMIN_ACCOUNT_REQUESTS_PATH}/${encodeURIComponent(requestId)}/device-bindings`;
+}
+export function codexV6AdminDeviceBindingReplacementPath(requestId, bindingId) {
+    return `${codexV6AdminAccountRequestDeviceBindingsPath(requestId)}/`
+        + `${encodeURIComponent(bindingId)}/replacement`;
+}
+export function codexV6AdminAccountRequestPath(requestId) {
+    return `${CODEX_V6_ADMIN_ACCOUNT_REQUESTS_PATH}/${encodeURIComponent(requestId)}`;
+}
+export function codexV6AdminAccountRequestsPath(query = {}) {
+    const parsed = CodexV6AdminAccountRequestListQuerySchema.parse(query);
+    const parameters = new URLSearchParams();
+    if (parsed.expiresBefore)
+        parameters.set("expiresBefore", parsed.expiresBefore);
+    if (parsed.includeTerminal !== undefined) {
+        parameters.set("includeTerminal", String(parsed.includeTerminal));
+    }
+    const suffix = parameters.toString();
+    return `${CODEX_V6_ADMIN_ACCOUNT_REQUESTS_PATH}${suffix ? `?${suffix}` : ""}`;
+}
+export function codexV6AdminReplacementCandidatesPath(query) {
+    const parsed = CodexV6AdminReplacementCandidateQuerySchema.parse(query);
+    return `${CODEX_V6_ADMIN_DEVICE_BINDINGS_PATH}/replacement-candidates`
+        + `?replaceBefore=${encodeURIComponent(parsed.replaceBefore)}`;
+}
+export function codexV6AdminAccountRequestReviewPath(requestId) {
+    return `${codexV6AdminAccountRequestPath(requestId)}/review`;
+}
+export function codexV6DeviceBindingFullCredentialDeliveriesPath(bindingId) {
+    return `${CODEX_V6_DEVICE_BINDINGS_PATH}/${encodeURIComponent(bindingId)}/full-credential-deliveries`;
+}
+export function codexV6DeviceBindingFullCredentialDeliveryResolvePath(bindingId, clientRequestId) {
+    return `${codexV6DeviceBindingFullCredentialDeliveriesPath(bindingId)}`
+        + `/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
+}
+export function codexV6FullCredentialDeliveryAckPath(deliveryId) {
+    return `${CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH}/full-credential-deliveries/`
+        + `${encodeURIComponent(deliveryId)}/ack`;
+}
+export function codexV6BindingGenerationReportsPath(bindingId) {
+    return `${CODEX_V6_DEVICE_BINDINGS_PATH}/${encodeURIComponent(bindingId)}/generations/report`;
+}
+export function codexV6BindingGenerationReportResolvePath(bindingId, clientRequestId) {
+    return `${CODEX_V6_DEVICE_BINDINGS_PATH}/${encodeURIComponent(bindingId)}`
+        + `/generations/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
+}
 export function codexTokenPoolV4DirectoryResolvePath(principal) {
     return `${CODEX_TOKEN_POOL_V4_DIRECTORY_RESOLVE_PATH}?principal=${encodeURIComponent(principal)}`;
 }