@tokensrc/codex 1.14.16 → 1.14.18

package/README.md

@@ -10,7 +10,7 @@ npx @tokensrc/codex use
 npx @tokensrc/codex run
 ```
 
-The standalone command tree includes `login`, `logout`, `list`, `upload`, `use`,
+The standalone command tree includes `login`, `logout`, `request`, `list`, `upload`, `use`,
 `run`, `app`, `auth-agent`, `enrollment`, `admin`, `shortcut`, `status`, and `reset`. The
 `admin accounts` subtree lists tenant accounts, shows redacted credential-version
 diagnostics, records explicit subscription renewals, and requests one server-side refresh; it never receives refresh
@@ -28,6 +28,50 @@ numa codex admin assignments bind acct_xxx keycloak-subject --default
 numa codex admin assignments unbind assignment_xxx
 ```
 
+When discovery advertises `requestBoundDeviceCredentials: true`, v6 replaces
+direct user/account assignments with a request and per-device binding model. A
+request belongs to one Keycloak subject and may contain several bindings for
+that same user. Every binding owns a distinct complete ChatGPT token set and
+credential lineage; Numa never copies a refresh token between installations.
+
+```sh
+numa codex request create --reason "项目开发" --until 2026-10-01T00:00:00+08:00 --devices 2
+numa codex request list
+numa codex request reconcile
+numa codex request bindings request_xxx
+
+numa codex admin requests list --expiring-within 30
+numa codex admin requests review request_xxx --decision APPROVE --reason "审批通过" \
+  --version 0 --device-limit 2 --valid-from 2026-09-01T00:00:00+08:00 \
+  --valid-until 2026-10-01T00:00:00+08:00
+numa codex admin requests bind-device request_xxx --installation install_xxx \
+  --device-label "Work Mac" --platform darwin --version 1 --pool-entry pool_xxx
+numa codex admin requests replacement-candidates --within 30
+numa codex admin requests replace-device-token request_xxx binding_xxx \
+  --version 2 --reason SUBSCRIPTION_EXPIRING \
+  --replace-before 2026-09-25T00:00:00+08:00 --pool-entry pool_new
+```
+
+The first v6 reconciliation reads only the safe identifiers of an already
+distributed local credential. The Server atomically converts it into one
+approved migration request and one `LEGACY_AUTO_MIGRATED` binding; the existing
+token set changes ownership but is not duplicated. A different installation for
+the same user receives `codex_device_binding_required`, its installation ID, and
+administrator-contact guidance. An administrator must bind a new PoolEntry with
+an independent token set before that device becomes available.
+
+Administrator request lists are ordered by nearest expiry. `--expiring-within`
+uses the Server's `expiresBefore` filter and excludes terminal requests. Under
+`replacement-candidates` identifies bindings whose `accountExpiresAt` or health
+requires a successor. The old binding stays active while the successor receives
+an independent PoolEntry/lineage; only the device's successful install ACK makes
+the successor active and retires the old token set. A temporary delivery failure
+therefore keeps a healthy old token set usable and retryable. Under
+v6, managed `numa codex login` can only add a complete token set to the unbound
+pool; direct `--assign-to`/`--assign-to-subject` flags and legacy assignment
+mutations are disabled. The full Server transaction and migration invariants are
+documented in `docs/superpowers/specs/2026-08-31-request-bound-device-token-sets-design.md`.
+
 An account whose `subscriptionStatus` is `EXPIRED`, or whose
 `subscriptionExpiresAt` has passed, is unavailable even when a cached OpenAI
 access token has a later JWT expiry. Renewal requires a strictly later,
@@ -48,80 +92,38 @@ delivery-eligible and credential/device-session endpoints reject it with
 `codex_account_expired`; after renewal it becomes eligible only when its
 credential lineage is otherwise healthy.
 
-Tenant administrators complete a server-created account discovery or assignment
-enrollment with one isolated official Codex login:
+Credential expiry is independent from subscription expiry. The legacy Server
+error `client_credential_expired` is normalized to
+`codex_account_needs_reauth`, never `codex_account_expired`. On an explicit 409
+reauthentication decision, the client removes only the exact rejected delivery
+recovery journal. Network failures, 5xx responses, and unknown mutation
+outcomes retain that journal for idempotent recovery.
+
+For an active subscription with `credentialStatus=NEEDS_REAUTH`, an
+administrator replaces the credential with a fresh isolated official login,
+targeted to the affected Numa username or exact directory email:
 
 ```sh
-numa codex enrollment status intent_xxx
-numa codex enrollment login intent_xxx
-numa codex enrollment login intent_xxx --device-auth
-numa codex enrollment login-batch migration_plan_xxx --dry-run
-numa codex enrollment login-batch migration_plan_xxx
-numa codex enrollment cancel intent_xxx
-numa codex retirement acknowledge retirement_xxx
+numa codex admin accounts credential-versions acct_xxx --json
+numa codex admin assignments list --json
+numa codex login --assign-to affected-user
 ```
 
-`enrollment login` refuses to start until the service advertises encrypted
-candidate ingress. It claims the intent, maintains its heartbeat, runs the
-official login in a temporary `CODEX_HOME`, and uploads only an authenticated
-X25519/AES-GCM refresh-token envelope bound to the tenant, intent, revision, and
-idempotency key. Provider account identity and access/ID tokens are not accepted
-by the upload contract, and the temporary login directory is removed afterward.
-Transport failures and HTTP 5xx responses replay the exact same encrypted body,
-intent revision, and idempotency key a bounded number of times. A Server-confirmed
-`TEMPORARILY_UNAVAILABLE` result is different: while the same isolated login still
-holds the credential, Numa may follow the returned revision and create the next
-idempotent candidate attempt. If the final upload result remains uncertain, Numa
-reads only intent metadata and refuses a new login or upload key until the Server
-reports a terminal result.
-
-`enrollment login-batch` is available only when discovery advertises
-`migrationPlans: true` and the Bearer principal has the tenant-admin role. It
-pages the Server-owned queue, executes `LOGIN`/`AWAITING_CLI` targets one at a
-time, and reloads the plan after every target. A response-lost `CLAIMED` or
-`LOGIN_IN_PROGRESS` target is resumed only after the Server proves that the
-current Bearer is the same claimant; another claimant is never taken over.
-Other `VIEW_ENROLLMENT`, completed, paused, and cancelled work is reported
-without starting another official login.
-`--dry-run` emits the same redacted ordering without generating credentials. The
-advertised verified minimum of two parallel lineages is evidence, not a maximum;
-the CLI still obeys `sequentialRequired: true` and never creates a local RT pool.
-
-When the discovered profile advertises `delivery: true`, `use`, `run`, `app`,
-and `auth-agent` resolve the caller's schema-v2 credential Assignment; they fail
-closed instead of falling back to the schema-v1 account list. The Server remains
-the only owner and refresh executor for the real OpenAI refresh token. Before an
-issue request, Numa writes a mode-`0600` private recovery journal containing the
-client delivery key and issue idempotency key. A lost response or crash in the
-`INSTALLING` phase therefore replays the same request instead of creating another
-delivery. Numa decrypts only access/ID tokens, installs them under a local file
-lock with an atomic `fsync` + rename, and writes a random, upstream-unusable
-placeholder in the `auth.json` refresh-token field. It then ACKs the installed
-lineage generation and securely removes the private issue journal. The remaining
-lineage and ACK recovery metadata contains no credential material.
-Schema-v2 install, reset, and retirement also delete any old full
-`auth.json.numa-backup` instead of retaining or restoring a legacy real refresh
-token. Once delivery has been observed, profile caching treats it as sticky and
-will not downgrade to schema v1 during a discovery failure.
-
-When either `delivery` or `migrationPlans` is enabled, the legacy RT-pool
-mutations (`upload`, administrator refresh, assignment bind/unbind, and
-`auth-agent --restore`) fail with
-`schema_v2_legacy_management_disabled`; they never silently call schema-v1.
-
-`run` and `app` automatically supervise delivery while their official Codex child
-process remains alive. They request renewal only inside the Server's final
-60-second safety window, stop supervision on child exit, and terminate the child
-with a visible error if renewal fails. `auth-agent` remains available as an
-explicit foreground diagnostic. Schema-v1 short-lived delivery remains available
-only for tenants whose discovered profile has not enabled the v2 capability.
-
-`retirement acknowledge` only removes the exact locally managed
-Assignment/lineage/generation recorded by Numa. It writes a Secret-free local
-tombstone before deleting `auth.json`. Before deletion it reads the Server
-retirement, verifies the Assignment and exact disclosed lineage/version target,
-then uses the current revision to append evidence. The ACK is not device identity and
-does not bypass the natural expiry of any other disclosed short-lived token.
+The affected user then runs `numa codex list --json` and `numa codex run` to
+verify a new lineage. Do not renew the subscription unless its own status or
+timestamp has expired. Do not copy or share `auth.json`; official Codex login
+credentials are collected only inside the isolated login flow.
+
+If the official login succeeds but upload returns
+`codex_token_pool_healthy_lineage_exists`, do not repeat the login. The Server
+must first reconcile the stale lineage to `NEEDS_REAUTH`; a lineage that just
+failed delivery with `client_credential_expired` cannot validly block its own
+replacement as healthy.
+
+When the discovered profile advertises `requestBoundDeviceCredentials: true`,
+the legacy direct-assignment mutations (`upload`, administrator refresh,
+assignment bind/unbind, and `auth-agent --restore`) fail with
+`schema_v2_legacy_management_disabled`; they never silently fall back.
 
 The client connects to
 `X-Tenant-Id: numa-realm`. With `--server` and `--tenant-id` it resolves RFC 9728

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import type { CodexAuthController } from "./oidc.js";
-import { type CodexAdminAccountListResponse, type CodexAdminAccountRenewalInput, type CodexAdminAccountRenewalResponse, type CodexAdminAssignmentDeleteResponse, type CodexAdminAssignmentListResponse, type CodexAdminAssignmentMutationResponse, type CodexAccountListResponse, type CodexAssignmentRetirementLocalDeleteAckInput, type CodexAssignmentRetirementLocalDeleteAckResponse, type CodexAssignmentRetirementPreflightResponse, type CodexCredentialVersionListResponse, type CodexEnrollmentHeartbeatInput, type CodexEnrollmentCandidateInput, type CodexEnrollmentCandidateResponse, type CodexEnrollmentIntentResponse, type CodexEnrollmentMutationInput, type CodexImportResult, type CodexLoginCredentialsResponse, type CodexManualRefreshResponse, type CodexMigrationLoginQueueResponse, type CodexShortLivedDeliveryAckInput, type CodexShortLivedDeliveryAckResponse, type CodexShortLivedDeliveryRequest, type CodexShortLivedDeliveryResponse, type CodexUserCredentialAssignmentListResponse, type CodexUploadBatch, type CodexV3CredentialAssignmentListResponse, type CodexV3EnrollmentConfiguration, type CodexV3EnrollmentInput, type CodexV3EnrollmentResponse, type CodexV3FullCredentialDeliveryAckInput, type CodexV3FullCredentialDeliveryAckResponse, type CodexV3FullCredentialDeliveryRequest, type CodexV3FullCredentialDeliveryResponse, type CodexV3GenerationReportInput, type CodexV3GenerationReportResponse, type CodexV4AccessObservationInput, type CodexV4AccessObservationResponse, type CodexV5AcknowledgeDeviceSessionInput, type CodexV5AcknowledgeDeviceSessionResponse, type CodexV5CreateDeviceSessionInput, type CodexV5CreateDeviceSessionResponse, type CodexV5GenerationReportInput, type CodexV5GenerationReportResponse, type CodexV5HeartbeatDeviceSessionInput, type CodexV5HeartbeatDeviceSessionResponse, type CodexV5ReleaseDeviceSessionInput, type CodexV5ReleaseDeviceSessionResponse, type CodexTokenPoolV4AssignmentTarget, type CodexTokenPoolV4DirectoryResolveResponse, type CodexTokenPoolV4EnrollmentConfiguration, type CodexTokenPoolV4UploadInput, type CodexTokenPoolV4UploadResponse } from "./protocol.js";
+import { type CodexAdminAccountListResponse, type CodexAdminAccountRenewalInput, type CodexAdminAccountRenewalResponse, type CodexAdminAssignmentDeleteResponse, type CodexAdminAssignmentListResponse, type CodexAdminAssignmentMutationResponse, type CodexAccountListResponse, type CodexCredentialVersionListResponse, type CodexImportResult, type CodexLoginCredentialsResponse, type CodexManualRefreshResponse, type CodexUploadBatch, type CodexV3CredentialAssignmentListResponse, type CodexV3EnrollmentConfiguration, type CodexV3EnrollmentInput, type CodexV3EnrollmentResponse, type CodexV3FullCredentialDeliveryAckInput, type CodexV3FullCredentialDeliveryAckResponse, type CodexV3FullCredentialDeliveryRequest, type CodexV3FullCredentialDeliveryResponse, type CodexV3GenerationReportInput, type CodexV3GenerationReportResponse, type CodexV4AccessObservationInput, type CodexV4AccessObservationResponse, type CodexV5AcknowledgeDeviceSessionInput, type CodexV5AcknowledgeDeviceSessionResponse, type CodexV5CreateDeviceSessionInput, type CodexV5CreateDeviceSessionResponse, type CodexV5GenerationReportInput, type CodexV5GenerationReportResponse, type CodexV5HeartbeatDeviceSessionInput, type CodexV5HeartbeatDeviceSessionResponse, type CodexV5ReleaseDeviceSessionInput, type CodexV5ReleaseDeviceSessionResponse, type CodexV6AccountRequestListResponse, type CodexV6AdminAccountRequestListQuery, type CodexV6AccountRequestResponse, type CodexV6CancelAccountRequestInput, type CodexV6AdminReviewAccountRequestInput, type CodexV6AdminReplacementCandidateListResponse, type CodexV6AdminReplacementCandidateQuery, type CodexV6AcknowledgeFullCredentialDeliveryInput, type CodexV6AcknowledgeFullCredentialDeliveryResponse, type CodexV6AdminCreateDeviceBindingInput, type CodexV6AdminCreateDeviceBindingResponse, type CodexV6AdminReplaceDeviceTokenInput, type CodexV6AdminReplaceDeviceTokenResponse, type CodexV6CreateAccountRequestInput, type CodexV6DeviceBindingListResponse, type CodexV6FullCredentialDeliveryInput, type CodexV6FullCredentialDeliveryResponse, type CodexV6GenerationReportInput, type CodexV6GenerationReportResponse, type CodexV6ReconcileDeviceAccessInput, type CodexV6ReconcileDeviceAccessResponse, type CodexTokenPoolV4AssignmentTarget, type CodexTokenPoolV4DirectoryResolveResponse, type CodexTokenPoolV4EnrollmentConfiguration, type CodexTokenPoolV4UploadInput, type CodexTokenPoolV4UploadResponse } from "./protocol.js";
 import type { ResolvedCodexConfig } from "./types.js";
 export declare function normalizeCodexServiceUrl(rawUrl: string, allowInsecureHttp?: boolean): string;
 export declare class CodexServiceClient {
@@ -12,7 +12,6 @@ export declare class CodexServiceClient {
     getCurrentActorSubject(): Promise<string>;
     private request;
     listAccounts(): Promise<CodexAccountListResponse>;
-    listCredentialAssignments(): Promise<CodexUserCredentialAssignmentListResponse>;
     getV3EnrollmentConfiguration(): Promise<CodexV3EnrollmentConfiguration>;
     getTokenPoolV4EnrollmentConfiguration(): Promise<CodexTokenPoolV4EnrollmentConfiguration>;
     resolveTokenPoolV4DirectoryUser(principal: string): Promise<CodexTokenPoolV4DirectoryResolveResponse>;
@@ -36,12 +35,28 @@ export declare class CodexServiceClient {
     heartbeatV5DeviceSession(sessionId: string, input: CodexV5HeartbeatDeviceSessionInput): Promise<CodexV5HeartbeatDeviceSessionResponse>;
     releaseV5DeviceSession(sessionId: string, input: CodexV5ReleaseDeviceSessionInput, idempotencyKey: string): Promise<CodexV5ReleaseDeviceSessionResponse>;
     reportV5Generation(lineageId: string, input: CodexV5GenerationReportInput, idempotencyKey: string): Promise<CodexV5GenerationReportResponse>;
+    listV6AccountRequests(): Promise<CodexV6AccountRequestListResponse>;
+    getV6AccountRequest(requestId: string): Promise<CodexV6AccountRequestResponse>;
+    createV6AccountRequest(input: CodexV6CreateAccountRequestInput, idempotencyKey: string): Promise<CodexV6AccountRequestResponse>;
+    cancelV6AccountRequest(requestId: string, input: CodexV6CancelAccountRequestInput, idempotencyKey: string): Promise<CodexV6AccountRequestResponse>;
+    listV6AdminAccountRequests(query?: CodexV6AdminAccountRequestListQuery): Promise<CodexV6AccountRequestListResponse>;
+    getV6AdminAccountRequest(requestId: string): Promise<CodexV6AccountRequestResponse>;
+    listV6AdminReplacementCandidates(query: CodexV6AdminReplacementCandidateQuery): Promise<CodexV6AdminReplacementCandidateListResponse>;
+    reviewV6AdminAccountRequest(requestId: string, input: CodexV6AdminReviewAccountRequestInput, idempotencyKey: string): Promise<CodexV6AccountRequestResponse>;
+    listV6DeviceBindings(requestId: string): Promise<CodexV6DeviceBindingListResponse>;
+    reconcileV6DeviceAccess(input: CodexV6ReconcileDeviceAccessInput, idempotencyKey: string): Promise<CodexV6ReconcileDeviceAccessResponse>;
+    createV6AdminDeviceBinding(requestId: string, input: CodexV6AdminCreateDeviceBindingInput, idempotencyKey: string): Promise<CodexV6AdminCreateDeviceBindingResponse>;
+    replaceV6AdminDeviceToken(requestId: string, bindingId: string, input: CodexV6AdminReplaceDeviceTokenInput, idempotencyKey: string): Promise<CodexV6AdminReplaceDeviceTokenResponse>;
+    listV6AdminDeviceBindings(requestId: string): Promise<CodexV6DeviceBindingListResponse>;
+    createV6FullCredentialDelivery(bindingId: string, input: CodexV6FullCredentialDeliveryInput, idempotencyKey: string): Promise<CodexV6FullCredentialDeliveryResponse>;
+    resolveV6FullCredentialDelivery(bindingId: string, clientRequestId: string, installationId: string): Promise<CodexV6FullCredentialDeliveryResponse>;
+    private requireV6FullDelivery;
+    acknowledgeV6FullCredentialDelivery(deliveryId: string, input: CodexV6AcknowledgeFullCredentialDeliveryInput, idempotencyKey: string): Promise<CodexV6AcknowledgeFullCredentialDeliveryResponse>;
+    reportV6Generation(bindingId: string, input: CodexV6GenerationReportInput, idempotencyKey: string): Promise<CodexV6GenerationReportResponse>;
+    resolveV6GenerationReport(bindingId: string, expected: Pick<CodexV6GenerationReportInput, "clientRequestId" | "bindingId" | "installationId" | "expectedGenerationVersion" | "rotationMode" | "accessTokenHealth" | "refreshTokenHealth" | "observedAt">): Promise<CodexV6GenerationReportResponse>;
+    private requireV6Report;
     observeV4AccessToken(lineageId: string, input: CodexV4AccessObservationInput): Promise<CodexV4AccessObservationResponse>;
     private requireV3Report;
-    createShortLivedCredentialDelivery(assignmentId: string, input: CodexShortLivedDeliveryRequest, idempotencyKey: string): Promise<CodexShortLivedDeliveryResponse>;
-    acknowledgeShortLivedCredentialDelivery(deliveryId: string, input: CodexShortLivedDeliveryAckInput, idempotencyKey: string): Promise<CodexShortLivedDeliveryAckResponse>;
-    acknowledgeAssignmentRetirementLocalDelete(retirementId: string, input: CodexAssignmentRetirementLocalDeleteAckInput, idempotencyKey: string): Promise<CodexAssignmentRetirementLocalDeleteAckResponse>;
-    getAssignmentRetirement(retirementId: string): Promise<CodexAssignmentRetirementPreflightResponse>;
     getLoginCredentials(accountId: string): Promise<CodexLoginCredentialsResponse>;
     uploadAccounts(payload: CodexUploadBatch): Promise<CodexImportResult>;
     listAdminAccounts(): Promise<CodexAdminAccountListResponse>;
@@ -55,15 +70,5 @@ export declare class CodexServiceClient {
         isDefault: boolean;
     }): Promise<CodexAdminAssignmentMutationResponse>;
     unbindAdminAssignment(assignmentId: string): Promise<CodexAdminAssignmentDeleteResponse>;
-    getEnrollmentIntent(intentId: string): Promise<CodexEnrollmentIntentResponse>;
-    listMigrationLoginQueue(planId: string, query?: {
-        page?: number;
-        pageSize?: number;
-    }): Promise<CodexMigrationLoginQueueResponse>;
-    claimEnrollmentIntent(intentId: string, input: CodexEnrollmentMutationInput): Promise<CodexEnrollmentIntentResponse>;
-    heartbeatEnrollmentIntent(intentId: string, input: CodexEnrollmentHeartbeatInput): Promise<CodexEnrollmentIntentResponse>;
-    cancelEnrollmentIntent(intentId: string, input: CodexEnrollmentMutationInput): Promise<CodexEnrollmentIntentResponse>;
-    uploadEnrollmentCandidate(intentId: string, input: CodexEnrollmentCandidateInput, idempotencyKey: string): Promise<CodexEnrollmentCandidateResponse>;
-    private mutateEnrollmentIntent;
 }
 export declare function codexImportRequestTimeoutMs(baseTimeoutMs: number, accountCount: number): number;

package/dist/client.js

@@ -1,5 +1,5 @@
 import { CodexAuthError, CodexLoginRequiredError, CodexServiceError } from "./errors.js";
-import { CODEX_ACCOUNTS_IMPORT_PATH, CODEX_ACCOUNTS_LIST_PATH, CodexAssignmentRetirementLocalDeleteAckInputSchema, CodexAssignmentRetirementLocalDeleteAckResponseSchema, CodexAssignmentRetirementPreflightResponseSchema, CODEX_ADMIN_ACCOUNTS_PATH, CODEX_ADMIN_ASSIGNMENTS_PATH, CODEX_CREDENTIAL_ASSIGNMENTS_PATH, CodexAdminAssignmentDeleteResponseSchema, CodexAdminAssignmentListResponseSchema, CodexAdminAssignmentMutationResponseSchema, CodexAdminAccountListResponseSchema, CodexAdminAccountRenewalInputSchema, CodexAdminAccountRenewalResponseSchema, CodexAccountListResponseSchema, CodexCredentialVersionListResponseSchema, CodexEnrollmentHeartbeatInputSchema, CodexEnrollmentCandidateInputSchema, CodexEnrollmentCandidateResponseSchema, CodexEnrollmentIntentResponseSchema, CodexEnrollmentMutationInputSchema, CodexImportResultSchema, CodexLoginCredentialsResponseSchema, CodexManualRefreshResponseSchema, CodexMigrationLoginQueueResponseSchema, CodexShortLivedDeliveryAckInputSchema, CodexShortLivedDeliveryAckResponseSchema, CodexShortLivedDeliveryRequestSchema, CodexShortLivedDeliveryResponseSchema, CodexUserCredentialAssignmentListResponseSchema, CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH, CODEX_V3_ENROLLMENT_CONFIGURATION_PATH, CODEX_V3_ENROLLMENTS_PATH, CodexV3CredentialAssignmentListResponseSchema, CodexV3EnrollmentConfigurationSchema, CodexV3EnrollmentInputSchema, CodexV3EnrollmentResponseSchema, CodexV3FullCredentialDeliveryAckInputSchema, CodexV3FullCredentialDeliveryAckResponseSchema, CodexV3FullCredentialDeliveryRequestSchema, CodexV3FullCredentialDeliveryResponseSchema, CodexV3GenerationReportInputSchema, CodexV3GenerationReportResponseSchema, CodexV4AccessObservationInputSchema, CodexV4AccessObservationResponseSchema, CodexV5AcknowledgeDeviceSessionInputSchema, CodexV5AcknowledgeDeviceSessionResponseSchema, CodexV5CreateDeviceSessionInputSchema, CodexV5CreateDeviceSessionResponseSchema, CodexV5GenerationReportInputSchema, CodexV5GenerationReportResponseSchema, CodexV5HeartbeatDeviceSessionInputSchema, CodexV5HeartbeatDeviceSessionResponseSchema, CodexV5ReleaseDeviceSessionInputSchema, CodexV5ReleaseDeviceSessionResponseSchema, CODEX_TOKEN_POOL_V4_ENROLLMENT_CONFIGURATION_PATH, CODEX_TOKEN_POOL_V4_UPLOADS_PATH, CodexTokenPoolV4DirectoryResolveResponseSchema, CodexTokenPoolV4EnrollmentConfigurationSchema, CodexTokenPoolV4IdempotencyKeySchema, CodexTokenPoolV4UploadInputSchema, CodexTokenPoolV4UploadResponseSchema, codexAccountLoginCredentialsPath, codexAssignmentRetirementLocalDeleteAckPath, codexAssignmentRetirementPath, codexAdminAssignmentPath, codexAdminCredentialVersionsPath, codexAdminEnrollmentIntentActionPath, codexAdminEnrollmentIntentPath, codexAdminMigrationLoginQueuePath, codexAdminRenewPath, codexAdminRefreshPath, codexAssignmentShortLivedDeliveriesPath, codexShortLivedDeliveryAckPath, codexV3AssignmentFullCredentialDeliveriesPath, codexV3AssignmentFullCredentialDeliveryResolvePath, codexV3EnrollmentResolvePath, codexV3FullCredentialDeliveryAckPath, codexV3LineageGenerationReportResolvePath, codexV3LineageGenerationReportsPath, codexV4LineageAccessObservationPath, codexV5AssignmentDeviceSessionResolvePath, codexV5AssignmentDeviceSessionsPath, codexV5DeviceSessionActionPath, codexV5LineageGenerationReportsPath, codexTokenPoolV4DirectoryResolvePath, codexTokenPoolV4UploadResolvePath } from "./protocol.js";
+import { CODEX_ACCOUNTS_IMPORT_PATH, CODEX_ACCOUNTS_LIST_PATH, CODEX_ADMIN_ACCOUNTS_PATH, CODEX_ADMIN_ASSIGNMENTS_PATH, CodexAdminAssignmentDeleteResponseSchema, CodexAdminAssignmentListResponseSchema, CodexAdminAssignmentMutationResponseSchema, CodexAdminAccountListResponseSchema, CodexAdminAccountRenewalInputSchema, CodexAdminAccountRenewalResponseSchema, CodexAccountListResponseSchema, CodexCredentialVersionListResponseSchema, CodexEnrollmentMutationInputSchema, CodexImportResultSchema, CodexLoginCredentialsResponseSchema, CodexManualRefreshResponseSchema, CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH, CODEX_V3_ENROLLMENT_CONFIGURATION_PATH, CODEX_V3_ENROLLMENTS_PATH, CodexV3CredentialAssignmentListResponseSchema, CodexV3EnrollmentConfigurationSchema, CodexV3EnrollmentInputSchema, CodexV3EnrollmentResponseSchema, CodexV3FullCredentialDeliveryAckInputSchema, CodexV3FullCredentialDeliveryAckResponseSchema, CodexV3FullCredentialDeliveryRequestSchema, CodexV3FullCredentialDeliveryResponseSchema, CodexV3GenerationReportInputSchema, CodexV3GenerationReportResponseSchema, CodexV4AccessObservationInputSchema, CodexV4AccessObservationResponseSchema, CodexV5AcknowledgeDeviceSessionInputSchema, CodexV5AcknowledgeDeviceSessionResponseSchema, CodexV5CreateDeviceSessionInputSchema, CodexV5CreateDeviceSessionResponseSchema, CodexV5GenerationReportInputSchema, CodexV5GenerationReportResponseSchema, CodexV5HeartbeatDeviceSessionInputSchema, CodexV5HeartbeatDeviceSessionResponseSchema, CodexV5ReleaseDeviceSessionInputSchema, CodexV5ReleaseDeviceSessionResponseSchema, CODEX_V6_ACCOUNT_REQUESTS_PATH, CODEX_V6_DEVICE_ACCESS_RECONCILIATIONS_PATH, CodexV6AccountRequestListResponseSchema, CodexV6AccountRequestResponseSchema, CodexV6CancelAccountRequestInputSchema, CodexV6AdminReviewAccountRequestInputSchema, CodexV6AdminReplacementCandidateListResponseSchema, CodexV6AcknowledgeFullCredentialDeliveryInputSchema, CodexV6AcknowledgeFullCredentialDeliveryResponseSchema, CodexV6AdminCreateDeviceBindingInputSchema, CodexV6AdminCreateDeviceBindingResponseSchema, CodexV6AdminReplaceDeviceTokenInputSchema, CodexV6AdminReplaceDeviceTokenResponseSchema, CodexV6CreateAccountRequestInputSchema, CodexV6DeviceBindingListResponseSchema, CodexV6FullCredentialDeliveryInputSchema, CodexV6FullCredentialDeliveryResponseSchema, CodexV6GenerationReportInputSchema, CodexV6GenerationReportResponseSchema, CodexV6ReconcileDeviceAccessInputSchema, CodexV6ReconcileDeviceAccessResponseSchema, CODEX_TOKEN_POOL_V4_ENROLLMENT_CONFIGURATION_PATH, CODEX_TOKEN_POOL_V4_UPLOADS_PATH, CodexTokenPoolV4DirectoryResolveResponseSchema, CodexTokenPoolV4EnrollmentConfigurationSchema, CodexTokenPoolV4IdempotencyKeySchema, CodexTokenPoolV4UploadInputSchema, CodexTokenPoolV4UploadResponseSchema, codexAccountLoginCredentialsPath, codexAdminAssignmentPath, codexAdminCredentialVersionsPath, codexAdminRenewPath, codexAdminRefreshPath, codexV3AssignmentFullCredentialDeliveriesPath, codexV3AssignmentFullCredentialDeliveryResolvePath, codexV3EnrollmentResolvePath, codexV3FullCredentialDeliveryAckPath, codexV3LineageGenerationReportResolvePath, codexV3LineageGenerationReportsPath, codexV4LineageAccessObservationPath, codexV5AssignmentDeviceSessionResolvePath, codexV5AssignmentDeviceSessionsPath, codexV5DeviceSessionActionPath, codexV5LineageGenerationReportsPath, codexV6AccountRequestDeviceBindingsPath, codexV6AccountRequestActionPath, codexV6AccountRequestPath, codexV6AdminAccountRequestDeviceBindingsPath, codexV6AdminAccountRequestPath, codexV6AdminAccountRequestsPath, codexV6AdminAccountRequestReviewPath, codexV6AdminDeviceBindingReplacementPath, codexV6AdminReplacementCandidatesPath, codexV6BindingGenerationReportResolvePath, codexV6BindingGenerationReportsPath, codexV6DeviceBindingFullCredentialDeliveriesPath, codexV6DeviceBindingFullCredentialDeliveryResolvePath, codexV6FullCredentialDeliveryAckPath, codexTokenPoolV4DirectoryResolvePath, codexTokenPoolV4UploadResolvePath } from "./protocol.js";
 export function normalizeCodexServiceUrl(rawUrl, allowInsecureHttp = false) {
     const url = new URL(rawUrl);
     const loopback = ["127.0.0.1", "localhost", "::1", "[::1]"].includes(url.hostname);
@@ -104,7 +104,7 @@ export class CodexServiceClient {
                 ? serviceCode
                 : undefined;
             const normalizedServiceCode = safeServiceCode === "client_credential_expired"
-                ? "codex_account_expired"
+                ? "codex_account_needs_reauth"
                 : safeServiceCode;
             const code = normalizedServiceCode
                 ?? (response.status === 401 || response.status === 403
@@ -113,7 +113,7 @@ export class CodexServiceClient {
             throw new CodexServiceError(normalizedServiceCode === "codex_account_expired"
                 ? "ChatGPT account subscription has expired and must be renewed by an administrator."
                 : normalizedServiceCode === "codex_account_needs_reauth"
-                    ? "ChatGPT account credentials are invalid and must be re-imported by an administrator."
+                    ? "ChatGPT account credentials are invalid and must be replaced through a fresh managed Codex login."
                     : `Codex account service request failed (HTTP ${response.status}): ${detail}`, code, response.status);
         }
         return body;
@@ -125,13 +125,6 @@ export class CodexServiceClient {
         }
         return parsed.data;
     }
-    async listCredentialAssignments() {
-        const parsed = CodexUserCredentialAssignmentListResponseSchema.safeParse(await this.request(CODEX_CREDENTIAL_ASSIGNMENTS_PATH));
-        if (!parsed.success) {
-            throw new CodexServiceError("Invalid Codex credential assignment list response.", "invalid_codex_service_response");
-        }
-        return parsed.data;
-    }
     async getV3EnrollmentConfiguration() {
         const parsed = CodexV3EnrollmentConfigurationSchema.safeParse(await this.request(CODEX_V3_ENROLLMENT_CONFIGURATION_PATH));
         if (!parsed.success) {
@@ -316,6 +309,201 @@ export class CodexServiceClient {
         }
         return parsed.data;
     }
+    async listV6AccountRequests() {
+        const subject = await this.getCurrentActorSubject();
+        const parsed = CodexV6AccountRequestListResponseSchema.safeParse(await this.request(CODEX_V6_ACCOUNT_REQUESTS_PATH));
+        if (!parsed.success || parsed.data.items.some((item) => item.userSubject !== subject)) {
+            throw new CodexServiceError("Invalid Codex v6 account-request list response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async getV6AccountRequest(requestId) {
+        const subject = await this.getCurrentActorSubject();
+        const parsed = CodexV6AccountRequestResponseSchema.safeParse(await this.request(codexV6AccountRequestPath(requestId)));
+        if (!parsed.success || parsed.data.request.id !== requestId
+            || parsed.data.request.userSubject !== subject) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 account-request response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async createV6AccountRequest(input, idempotencyKey) {
+        const subject = await this.getCurrentActorSubject();
+        const body = CodexV6CreateAccountRequestInputSchema.parse(input);
+        const key = CodexTokenPoolV4IdempotencyKeySchema.parse(idempotencyKey);
+        const parsed = CodexV6AccountRequestResponseSchema.safeParse(await this.request(CODEX_V6_ACCOUNT_REQUESTS_PATH, { method: "POST", body, headers: { "Idempotency-Key": key } }));
+        if (!parsed.success || parsed.data.request.userSubject !== subject) {
+            throw new CodexServiceError("Invalid Codex v6 account-request response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async cancelV6AccountRequest(requestId, input, idempotencyKey) {
+        const subject = await this.getCurrentActorSubject();
+        const body = CodexV6CancelAccountRequestInputSchema.parse(input);
+        const key = CodexTokenPoolV4IdempotencyKeySchema.parse(idempotencyKey);
+        const parsed = CodexV6AccountRequestResponseSchema.safeParse(await this.request(codexV6AccountRequestActionPath(requestId, "cancel"), { method: "POST", body, headers: { "Idempotency-Key": key } }));
+        if (!parsed.success || parsed.data.request.id !== requestId
+            || parsed.data.request.status !== "CANCELLED"
+            || parsed.data.request.userSubject !== subject) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 request-cancellation response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async listV6AdminAccountRequests(query = {}) {
+        const parsed = CodexV6AccountRequestListResponseSchema.safeParse(await this.request(codexV6AdminAccountRequestsPath(query)));
+        if (!parsed.success) {
+            throw new CodexServiceError("Invalid Codex v6 administrator request-list response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async getV6AdminAccountRequest(requestId) {
+        const parsed = CodexV6AccountRequestResponseSchema.safeParse(await this.request(codexV6AdminAccountRequestPath(requestId)));
+        if (!parsed.success || parsed.data.request.id !== requestId) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 administrator request response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async listV6AdminReplacementCandidates(query) {
+        const parsed = CodexV6AdminReplacementCandidateListResponseSchema.safeParse(await this.request(codexV6AdminReplacementCandidatesPath(query)));
+        if (!parsed.success) {
+            throw new CodexServiceError("Invalid Codex v6 replacement-candidate list response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async reviewV6AdminAccountRequest(requestId, input, idempotencyKey) {
+        const body = CodexV6AdminReviewAccountRequestInputSchema.parse(input);
+        const key = CodexTokenPoolV4IdempotencyKeySchema.parse(idempotencyKey);
+        const parsed = CodexV6AccountRequestResponseSchema.safeParse(await this.request(codexV6AdminAccountRequestReviewPath(requestId), { method: "POST", body, headers: { "Idempotency-Key": key } }));
+        const expectedStatus = body.decision === "APPROVE" ? "APPROVED" : "REJECTED";
+        if (!parsed.success || parsed.data.request.id !== requestId
+            || parsed.data.request.status !== expectedStatus) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 request-review response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async listV6DeviceBindings(requestId) {
+        const subject = await this.getCurrentActorSubject();
+        const parsed = CodexV6DeviceBindingListResponseSchema.safeParse(await this.request(codexV6AccountRequestDeviceBindingsPath(requestId)));
+        if (!parsed.success || parsed.data.items.some((item) => item.requestId !== requestId
+            || item.userSubject !== subject)) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 device-binding list response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async reconcileV6DeviceAccess(input, idempotencyKey) {
+        const subject = await this.getCurrentActorSubject();
+        const body = CodexV6ReconcileDeviceAccessInputSchema.parse(input);
+        const key = CodexTokenPoolV4IdempotencyKeySchema.parse(idempotencyKey);
+        const parsed = CodexV6ReconcileDeviceAccessResponseSchema.safeParse(await this.request(CODEX_V6_DEVICE_ACCESS_RECONCILIATIONS_PATH, { method: "POST", body, headers: { "Idempotency-Key": key } }));
+        if (!parsed.success
+            || parsed.data.binding?.installationId !== undefined
+                && parsed.data.binding.installationId !== body.device.installationId
+            || parsed.data.replacementBinding?.installationId !== undefined
+                && parsed.data.replacementBinding.installationId !== body.device.installationId
+            || parsed.data.request !== null && parsed.data.binding !== null
+                && parsed.data.binding.requestId !== parsed.data.request.id
+            || parsed.data.request !== null && parsed.data.request.userSubject !== subject
+            || parsed.data.binding !== null && parsed.data.binding.userSubject !== subject
+            || parsed.data.replacementBinding !== null
+                && parsed.data.replacementBinding.userSubject !== subject) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 device-access reconciliation.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async createV6AdminDeviceBinding(requestId, input, idempotencyKey) {
+        const body = CodexV6AdminCreateDeviceBindingInputSchema.parse(input);
+        const key = CodexTokenPoolV4IdempotencyKeySchema.parse(idempotencyKey);
+        const parsed = CodexV6AdminCreateDeviceBindingResponseSchema.safeParse(await this.request(codexV6AdminAccountRequestDeviceBindingsPath(requestId), { method: "POST", body, headers: { "Idempotency-Key": key } }));
+        if (!parsed.success || parsed.data.request.id !== requestId
+            || parsed.data.binding.requestId !== requestId
+            || parsed.data.binding.installationId !== body.device.installationId) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 device-binding response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async replaceV6AdminDeviceToken(requestId, bindingId, input, idempotencyKey) {
+        const body = CodexV6AdminReplaceDeviceTokenInputSchema.parse(input);
+        const key = CodexTokenPoolV4IdempotencyKeySchema.parse(idempotencyKey);
+        const parsed = CodexV6AdminReplaceDeviceTokenResponseSchema.safeParse(await this.request(codexV6AdminDeviceBindingReplacementPath(requestId, bindingId), { method: "POST", body, headers: { "Idempotency-Key": key } }));
+        if (!parsed.success || parsed.data.request.id !== requestId
+            || parsed.data.currentBinding.id !== bindingId
+            || parsed.data.currentBinding.requestId !== requestId
+            || parsed.data.replacementBinding.requestId !== requestId) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 replacement response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async listV6AdminDeviceBindings(requestId) {
+        const parsed = CodexV6DeviceBindingListResponseSchema.safeParse(await this.request(codexV6AdminAccountRequestDeviceBindingsPath(requestId)));
+        if (!parsed.success || parsed.data.items.some((item) => item.requestId !== requestId)) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 administrator device-binding list response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async createV6FullCredentialDelivery(bindingId, input, idempotencyKey) {
+        const body = CodexV6FullCredentialDeliveryInputSchema.parse(input);
+        const key = CodexTokenPoolV4IdempotencyKeySchema.parse(idempotencyKey);
+        const parsed = CodexV6FullCredentialDeliveryResponseSchema.safeParse(await this.request(codexV6DeviceBindingFullCredentialDeliveriesPath(bindingId), { method: "POST", body, headers: { "Idempotency-Key": key }, timeoutMs: 45_000 }));
+        return this.requireV6FullDelivery(parsed, bindingId, body.clientRequestId, body.installationId);
+    }
+    async resolveV6FullCredentialDelivery(bindingId, clientRequestId, installationId) {
+        const requestId = CodexV6FullCredentialDeliveryInputSchema.shape.clientRequestId
+            .parse(clientRequestId);
+        const installation = CodexV6FullCredentialDeliveryInputSchema.shape.installationId
+            .parse(installationId);
+        const parsed = CodexV6FullCredentialDeliveryResponseSchema.safeParse(await this.request(codexV6DeviceBindingFullCredentialDeliveryResolvePath(bindingId, requestId)));
+        return this.requireV6FullDelivery(parsed, bindingId, requestId, installation);
+    }
+    requireV6FullDelivery(parsed, bindingId, clientRequestId, installationId) {
+        if (!parsed.success || parsed.data.delivery.bindingId !== bindingId
+            || parsed.data.delivery.clientRequestId !== clientRequestId
+            || parsed.data.delivery.installationId !== installationId) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 full-delivery response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async acknowledgeV6FullCredentialDelivery(deliveryId, input, idempotencyKey) {
+        const body = CodexV6AcknowledgeFullCredentialDeliveryInputSchema.parse(input);
+        const key = CodexTokenPoolV4IdempotencyKeySchema.parse(idempotencyKey);
+        const parsed = CodexV6AcknowledgeFullCredentialDeliveryResponseSchema.safeParse(await this.request(codexV6FullCredentialDeliveryAckPath(deliveryId), { method: "POST", body, headers: { "Idempotency-Key": key } }));
+        if (!parsed.success || parsed.data.delivery.id !== deliveryId
+            || parsed.data.delivery.installationId !== body.installationId
+            || parsed.data.delivery.credentialLineageId !== body.credentialLineageId
+            || parsed.data.delivery.generationVersion !== body.generationVersion) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 delivery ACK response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async reportV6Generation(bindingId, input, idempotencyKey) {
+        const body = CodexV6GenerationReportInputSchema.parse(input);
+        if (body.bindingId !== bindingId) {
+            throw new CodexServiceError("Codex v6 generation report targets another binding.", "invalid_codex_request", 400);
+        }
+        const key = CodexTokenPoolV4IdempotencyKeySchema.parse(idempotencyKey);
+        const parsed = CodexV6GenerationReportResponseSchema.safeParse(await this.request(codexV6BindingGenerationReportsPath(bindingId), { method: "POST", body, headers: { "Idempotency-Key": key }, timeoutMs: 45_000 }));
+        return this.requireV6Report(parsed, bindingId, body);
+    }
+    async resolveV6GenerationReport(bindingId, expected) {
+        if (expected.bindingId !== bindingId) {
+            throw new CodexServiceError("Codex v6 generation report targets another binding.", "invalid_codex_request", 400);
+        }
+        const clientRequestId = CodexV6GenerationReportInputSchema.shape.clientRequestId
+            .parse(expected.clientRequestId);
+        const parsed = CodexV6GenerationReportResponseSchema.safeParse(await this.request(codexV6BindingGenerationReportResolvePath(bindingId, clientRequestId)));
+        return this.requireV6Report(parsed, bindingId, { ...expected, clientRequestId });
+    }
+    requireV6Report(parsed, bindingId, expected) {
+        if (!parsed.success || parsed.data.report.bindingId !== bindingId
+            || parsed.data.report.clientRequestId !== expected.clientRequestId
+            || parsed.data.report.installationId !== expected.installationId
+            || parsed.data.report.previousGenerationVersion !== expected.expectedGenerationVersion
+            || parsed.data.report.rotationMode !== expected.rotationMode
+            || parsed.data.report.accessTokenHealth !== expected.accessTokenHealth
+            || parsed.data.report.refreshTokenHealth !== expected.refreshTokenHealth
+            || parsed.data.report.observedAt !== expected.observedAt) {
+            throw new CodexServiceError("Invalid or mismatched Codex v6 generation report response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
     async observeV4AccessToken(lineageId, input) {
         const body = CodexV4AccessObservationInputSchema.parse(input);
         const parsed = CodexV4AccessObservationResponseSchema.safeParse(await this.request(codexV4LineageAccessObservationPath(lineageId), { method: "PUT", body, timeoutMs: Math.min(this.config.connection.requestTimeoutMs, 2_000) }));
@@ -340,55 +528,6 @@ export class CodexServiceClient {
         }
         return parsed.data;
     }
-    async createShortLivedCredentialDelivery(assignmentId, input, idempotencyKey) {
-        const body = CodexShortLivedDeliveryRequestSchema.parse(input);
-        const idempotency = CodexEnrollmentMutationInputSchema.shape.idempotencyKey.parse(idempotencyKey);
-        const parsed = CodexShortLivedDeliveryResponseSchema.safeParse(await this.request(codexAssignmentShortLivedDeliveriesPath(assignmentId), {
-            method: "POST",
-            body,
-            headers: { "Idempotency-Key": idempotency },
-            timeoutMs: Math.max(this.config.connection.requestTimeoutMs, 45_000)
-        }));
-        if (!parsed.success || parsed.data.delivery.assignmentId !== assignmentId) {
-            throw new CodexServiceError("Invalid or mismatched Codex short-lived credential delivery response.", "invalid_codex_service_response");
-        }
-        return parsed.data;
-    }
-    async acknowledgeShortLivedCredentialDelivery(deliveryId, input, idempotencyKey) {
-        const body = CodexShortLivedDeliveryAckInputSchema.parse(input);
-        const idempotency = CodexEnrollmentMutationInputSchema.shape.idempotencyKey.parse(idempotencyKey);
-        const parsed = CodexShortLivedDeliveryAckResponseSchema.safeParse(await this.request(codexShortLivedDeliveryAckPath(deliveryId), {
-            method: "POST",
-            body,
-            headers: { "Idempotency-Key": idempotency }
-        }));
-        if (!parsed.success || parsed.data.delivery.id !== deliveryId
-            || parsed.data.delivery.lineageId !== input.lineageId
-            || parsed.data.delivery.generationVersion !== input.generationVersion) {
-            throw new CodexServiceError("Invalid or mismatched Codex short-lived credential ACK response.", "invalid_codex_service_response");
-        }
-        return parsed.data;
-    }
-    async acknowledgeAssignmentRetirementLocalDelete(retirementId, input, idempotencyKey) {
-        const body = CodexAssignmentRetirementLocalDeleteAckInputSchema.parse(input);
-        const idempotency = CodexEnrollmentMutationInputSchema.shape.idempotencyKey.parse(idempotencyKey);
-        const parsed = CodexAssignmentRetirementLocalDeleteAckResponseSchema.safeParse(await this.request(codexAssignmentRetirementLocalDeleteAckPath(retirementId), {
-            method: "POST",
-            body,
-            headers: { "Idempotency-Key": idempotency }
-        }));
-        if (!parsed.success || parsed.data.retirement.id !== retirementId) {
-            throw new CodexServiceError("Invalid or mismatched Codex assignment retirement response.", "invalid_codex_service_response");
-        }
-        return parsed.data;
-    }
-    async getAssignmentRetirement(retirementId) {
-        const parsed = CodexAssignmentRetirementPreflightResponseSchema.safeParse(await this.request(codexAssignmentRetirementPath(retirementId)));
-        if (!parsed.success || parsed.data.retirement.id !== retirementId) {
-            throw new CodexServiceError("Invalid or mismatched Codex assignment retirement preflight response.", "invalid_codex_service_response");
-        }
-        return parsed.data;
-    }
     async getLoginCredentials(accountId) {
         const parsed = CodexLoginCredentialsResponseSchema.safeParse(await this.request(codexAccountLoginCredentialsPath(accountId)));
         if (!parsed.success || parsed.data.account.id !== accountId) {
@@ -480,63 +619,6 @@ export class CodexServiceClient {
         }
         return parsed.data;
     }
-    async getEnrollmentIntent(intentId) {
-        const parsed = CodexEnrollmentIntentResponseSchema.safeParse(await this.request(codexAdminEnrollmentIntentPath(intentId)));
-        if (!parsed.success || parsed.data.intent.id !== intentId) {
-            throw new CodexServiceError("Invalid or mismatched Codex enrollment intent response.", "invalid_codex_service_response");
-        }
-        return parsed.data;
-    }
-    async listMigrationLoginQueue(planId, query = {}) {
-        const page = query.page ?? 1;
-        const pageSize = query.pageSize ?? 100;
-        if (!Number.isInteger(page) || page < 1 || page > 1_000_000
-            || !Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100) {
-            throw new CodexServiceError("Invalid migration login queue page.", "invalid_configuration");
-        }
-        const parsed = CodexMigrationLoginQueueResponseSchema.safeParse(await this.request(codexAdminMigrationLoginQueuePath(planId, { page, pageSize })));
-        if (!parsed.success || parsed.data.plan.id !== planId
-            || parsed.data.page !== page || parsed.data.pageSize !== pageSize) {
-            throw new CodexServiceError("Invalid or mismatched Codex migration login queue response.", "invalid_codex_service_response");
-        }
-        return parsed.data;
-    }
-    async claimEnrollmentIntent(intentId, input) {
-        const body = CodexEnrollmentMutationInputSchema.parse(input);
-        return this.mutateEnrollmentIntent(intentId, "claim", body);
-    }
-    async heartbeatEnrollmentIntent(intentId, input) {
-        const body = CodexEnrollmentHeartbeatInputSchema.parse(input);
-        return this.mutateEnrollmentIntent(intentId, "heartbeat", body);
-    }
-    async cancelEnrollmentIntent(intentId, input) {
-        const body = CodexEnrollmentMutationInputSchema.parse(input);
-        return this.mutateEnrollmentIntent(intentId, "cancel", body);
-    }
-    async uploadEnrollmentCandidate(intentId, input, idempotencyKey) {
-        const body = CodexEnrollmentCandidateInputSchema.parse(input);
-        const idempotency = CodexEnrollmentMutationInputSchema.shape.idempotencyKey.parse(idempotencyKey);
-        const parsed = CodexEnrollmentCandidateResponseSchema.safeParse(await this.request(codexAdminEnrollmentIntentActionPath(intentId, "candidate"), {
-            method: "POST",
-            body,
-            headers: { "Idempotency-Key": idempotency },
-            timeoutMs: Math.max(this.config.connection.requestTimeoutMs, 45_000)
-        }));
-        if (!parsed.success || parsed.data.intent.id !== intentId) {
-            throw new CodexServiceError("Invalid or mismatched Codex enrollment candidate response.", "invalid_codex_service_response");
-        }
-        return parsed.data;
-    }
-    async mutateEnrollmentIntent(intentId, action, body) {
-        const parsed = CodexEnrollmentIntentResponseSchema.safeParse(await this.request(codexAdminEnrollmentIntentActionPath(intentId, action), {
-            method: "POST",
-            body
-        }));
-        if (!parsed.success || parsed.data.intent.id !== intentId) {
-            throw new CodexServiceError("Invalid or mismatched Codex enrollment intent response.", "invalid_codex_service_response");
-        }
-        return parsed.data;
-    }
 }
 export function codexImportRequestTimeoutMs(baseTimeoutMs, accountCount) {
     const validationWaves = Math.max(1, Math.ceil(accountCount / 8));