@tokensrc/codex 1.14.16 → 1.14.18

package/dist/protocol.js

@@ -6,11 +6,6 @@ export const CODEX_ACCOUNTS_IMPORT_PATH = "/v1/admin/codex/accounts/import";
 export const CODEX_ADMIN_ACCOUNTS_PATH = "/v1/admin/codex/accounts";
 export const CODEX_ADMIN_ASSIGNMENTS_PATH = "/v1/admin/codex/assignments";
 export const CODEX_ENROLLMENT_SCHEMA_VERSION = 2;
-export const CODEX_ADMIN_ENROLLMENT_INTENTS_PATH = "/v2/admin/codex/enrollment-intents";
-export const CODEX_CREDENTIAL_ASSIGNMENTS_PATH = "/v2/codex/credential-assignments";
-export const CODEX_SHORT_LIVED_DELIVERIES_PATH = "/v2/codex/short-lived-credential-deliveries";
-export const CODEX_ASSIGNMENT_RETIREMENTS_PATH = "/v2/codex/assignment-retirements";
-export const CODEX_ADMIN_MIGRATION_PLANS_PATH = "/v2/admin/codex/migration-plans";
 export const CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION = 3;
 // The configured service URL already includes the public `/api` prefix.
 export const CODEX_MANAGED_CREDENTIALS_V3_PATH = "/v3/codex";
@@ -25,19 +20,20 @@ export const CODEX_TOKEN_POOL_V4_ENROLLMENT_CONFIGURATION_PATH = `${CODEX_TOKEN_
 export const CODEX_TOKEN_POOL_V4_DIRECTORY_RESOLVE_PATH = `${CODEX_TOKEN_POOL_V4_PATH}/directory-users/resolve`;
 export const CODEX_TOKEN_POOL_V4_UPLOADS_PATH = `${CODEX_TOKEN_POOL_V4_PATH}/token-pool/uploads`;
 export const CODEX_TOKEN_POOL_V4_RUNTIME_PATH = "/v4/codex";
-export const CODEX_TOKEN_POOL_V4_CREDENTIAL_ASSIGNMENTS_PATH = `${CODEX_TOKEN_POOL_V4_RUNTIME_PATH}/credential-assignments`;
-export const CODEX_TOKEN_POOL_V4_FULL_CREDENTIAL_DELIVERIES_PATH = `${CODEX_TOKEN_POOL_V4_RUNTIME_PATH}/full-credential-deliveries`;
 export const CODEX_TOKEN_POOL_V4_CREDENTIAL_LINEAGES_PATH = `${CODEX_TOKEN_POOL_V4_RUNTIME_PATH}/credential-lineages`;
 export const CODEX_MULTI_DEVICE_V5_SCHEMA_VERSION = 5;
 export const CODEX_MULTI_DEVICE_V5_RUNTIME_PATH = "/v5/codex";
 export const CODEX_MULTI_DEVICE_V5_CREDENTIAL_ASSIGNMENTS_PATH = `${CODEX_MULTI_DEVICE_V5_RUNTIME_PATH}/credential-assignments`;
 export const CODEX_MULTI_DEVICE_V5_DEVICE_SESSIONS_PATH = `${CODEX_MULTI_DEVICE_V5_RUNTIME_PATH}/device-sessions`;
 export const CODEX_MULTI_DEVICE_V5_CREDENTIAL_LINEAGES_PATH = `${CODEX_MULTI_DEVICE_V5_RUNTIME_PATH}/credential-lineages`;
-export const CODEX_MIGRATION_CAPACITY = {
-    verifiedMinimum: 2,
-    verifiedLimit: null,
-    sequentialRequired: true
-};
+export const CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION = 6;
+export const CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH = "/v6/codex";
+export const CODEX_V6_ACCOUNT_REQUESTS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH}/account-requests`;
+export const CODEX_V6_DEVICE_ACCESS_RECONCILIATIONS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH}/device-access/reconciliations`;
+export const CODEX_V6_DEVICE_BINDINGS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH}/device-bindings`;
+export const CODEX_REQUEST_BOUND_DEVICE_V6_ADMIN_PATH = "/v6/admin/codex";
+export const CODEX_V6_ADMIN_ACCOUNT_REQUESTS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_ADMIN_PATH}/account-requests`;
+export const CODEX_V6_ADMIN_DEVICE_BINDINGS_PATH = `${CODEX_REQUEST_BOUND_DEVICE_V6_ADMIN_PATH}/device-bindings`;
 const CodexCompatibilityLabelSchema = z.string().max(256)
     .transform((label) => label.trim() ? label : undefined)
     .optional();
@@ -279,84 +275,11 @@ export const CodexAdminAssignmentDeleteResponseSchema = z.strictObject({
     schemaVersion: z.literal(CODEX_DISTRIBUTION_SCHEMA_VERSION),
     assignmentId: z.string().min(1).max(128)
 });
-export const CodexEnrollmentIntentReasonSchema = z.enum([
-    "NEW",
-    "REPLACE_LOST",
-    "REPLACE_REJECTED",
-    "REPLACE_DIVERGED",
-    "REPLACE_ADMIN"
-]);
-export const CodexEnrollmentIntentStatusSchema = z.enum([
-    "AWAITING_CLI",
-    "CLAIMED",
-    "LOGIN_IN_PROGRESS",
-    "UPLOADING",
-    "VALIDATING",
-    "READY",
-    "ACCOUNT_MISMATCH",
-    "IDENTITY_UNVERIFIABLE",
-    "TEMPORARILY_UNAVAILABLE",
-    "OUTCOME_AMBIGUOUS",
-    "EXPIRED",
-    "CANCELLED"
-]);
 const EnrollmentInstantSchema = z.string().datetime({ offset: true });
-export const CodexEnrollmentIntentSchema = z.strictObject({
-    id: z.string().min(1).max(128),
-    type: z.enum(["ACCOUNT_DISCOVERY", "ASSIGNMENT_ENROLLMENT"]),
-    status: CodexEnrollmentIntentStatusSchema,
-    revision: z.number().int().nonnegative(),
-    reason: CodexEnrollmentIntentReasonSchema,
-    assignmentId: z.string().min(1).max(128).nullable(),
-    managedAccountId: z.string().min(1).max(128).nullable(),
-    userSubject: z.string().min(1).max(255).nullable(),
-    createdAt: EnrollmentInstantSchema,
-    expiresAt: EnrollmentInstantSchema,
-    claimedAt: EnrollmentInstantSchema.nullable(),
-    lastHeartbeatAt: EnrollmentInstantSchema.nullable(),
-    cancelledAt: EnrollmentInstantSchema.nullable(),
-    updatedAt: EnrollmentInstantSchema,
-    safeErrorCode: z.string().min(1).max(128).regex(/^[a-z][a-z0-9_.-]*$/i).nullable(),
-    resultManagedAccountId: z.string().min(1).max(128).nullable(),
-    resultLineageId: z.string().min(1).max(128).nullable(),
-    currentGenerationVersion: z.number().int().positive().nullable(),
-    allowedActions: z.array(z.string().min(1).max(64).regex(/^[A-Z][A-Z0-9_]*$/)).max(32)
-});
-export const CodexEnrollmentCandidateIngressSchema = z.strictObject({
-    envelopeVersion: z.literal(1),
-    algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
-    keyId: z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/),
-    publicKey: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/),
-    maxRequestBytes: z.number().int().min(1_024).max(196_608),
-    maxCiphertextBytes: z.number().int().min(256).max(131_072)
-});
-export const CodexEnrollmentCapabilitiesSchema = z.strictObject({
-    enrollmentIntents: z.boolean(),
-    candidateUpload: z.boolean(),
-    delivery: z.boolean(),
-    rotationSync: z.boolean(),
-    candidateIngress: CodexEnrollmentCandidateIngressSchema.optional()
-}).superRefine((capabilities, context) => {
-    if (capabilities.candidateUpload && !capabilities.candidateIngress) {
-        context.addIssue({
-            code: "custom",
-            path: ["candidateIngress"],
-            message: "candidateIngress is required when candidateUpload is enabled."
-        });
-    }
-});
-export const CodexEnrollmentIntentResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    intent: CodexEnrollmentIntentSchema,
-    capabilities: CodexEnrollmentCapabilitiesSchema
-});
 export const CodexEnrollmentMutationInputSchema = z.strictObject({
     idempotencyKey: z.string().min(8).max(255),
     revision: z.number().int().nonnegative()
 });
-export const CodexEnrollmentHeartbeatInputSchema = CodexEnrollmentMutationInputSchema.extend({
-    phase: z.enum(["LOGIN_IN_PROGRESS", "UPLOADING"])
-});
 export const CodexEnrollmentCandidateEnvelopeSchema = z.strictObject({
     version: z.literal(1),
     algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
@@ -367,88 +290,6 @@ export const CodexEnrollmentCandidateEnvelopeSchema = z.strictObject({
     ciphertext: z.string().min(1).max(174_764).regex(/^[A-Za-z0-9_-]+$/),
     authenticationTag: z.string().length(22).regex(/^[A-Za-z0-9_-]+$/)
 });
-export const CodexEnrollmentCandidateInputSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    revision: z.number().int().nonnegative(),
-    envelope: CodexEnrollmentCandidateEnvelopeSchema
-});
-export const CodexEnrollmentCandidateResultSchema = z.strictObject({
-    outcome: z.enum([
-        "READY",
-        "ACCOUNT_MISMATCH",
-        "IDENTITY_UNVERIFIABLE",
-        "TEMPORARILY_UNAVAILABLE",
-        "OUTCOME_AMBIGUOUS"
-    ]),
-    managedAccountId: z.string().min(1).max(128).nullable(),
-    lineageId: z.string().min(1).max(128).nullable(),
-    generationVersion: z.number().int().positive().nullable(),
-    replayed: z.boolean()
-});
-export const CodexEnrollmentCandidateResponseSchema = CodexEnrollmentIntentResponseSchema.extend({
-    result: CodexEnrollmentCandidateResultSchema
-});
-export const CodexMigrationPlanStatusSchema = z.enum([
-    "ACTIVE",
-    "PAUSED",
-    "CANCELLED",
-    "COMPLETED"
-]);
-export const CodexMigrationTargetSchema = z.strictObject({
-    id: z.string().min(1).max(255),
-    assignmentId: z.string().min(1).max(255),
-    userSubject: z.string().min(1).max(255),
-    distributionMode: z.enum(["LEGACY", "MIGRATING", "USER_BOUND"]),
-    projectedStatus: z.enum([
-        "UNENROLLED",
-        "AWAITING_CLI",
-        "ENROLLING",
-        "VALIDATING",
-        "READY",
-        "DELIVERY_UNKNOWN",
-        "ACTIVE",
-        "SYNC_LAGGING",
-        "DIVERGED",
-        "LOST",
-        "NEEDS_REAUTH",
-        "RETIREMENT_PENDING",
-        "RETIRED",
-        "COMPROMISED",
-        "LEGACY_V1"
-    ]),
-    enrollmentAttachment: z.enum(["CREATED", "REUSED", "NONE"]),
-    enrollmentIntent: z.strictObject({
-        id: z.string().min(1).max(255),
-        status: CodexEnrollmentIntentStatusSchema,
-        revision: z.number().int().nonnegative(),
-        expiresAt: EnrollmentInstantSchema,
-        updatedAt: EnrollmentInstantSchema,
-        safeErrorCode: z.string().min(1).max(128).regex(/^[a-z][a-z0-9_.-]*$/i).nullable()
-    }).nullable(),
-    allowedAction: z.enum(["LOGIN", "VIEW_ENROLLMENT", "NONE"])
-});
-export const CodexMigrationLoginQueueResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    plan: z.strictObject({
-        id: z.string().min(1).max(255),
-        status: CodexMigrationPlanStatusSchema,
-        revision: z.number().int().nonnegative(),
-        accountId: z.string().min(1).max(255),
-        sequentialRequired: z.literal(true)
-    }),
-    items: z.array(CodexMigrationTargetSchema).max(100),
-    total: z.number().int().nonnegative(),
-    page: z.number().int().min(1).max(1_000_000),
-    pageSize: z.number().int().min(1).max(100)
-}).superRefine((value, context) => {
-    if (value.items.length > value.pageSize || value.items.length > value.total) {
-        context.addIssue({
-            code: "custom",
-            path: ["items"],
-            message: "Migration login queue pagination is inconsistent."
-        });
-    }
-});
 export const CodexUserCredentialAssignmentSchema = z.strictObject({
     assignmentId: z.string().min(1).max(128),
     managedAccountId: z.string().min(1).max(128),
@@ -491,10 +332,6 @@ export const CodexShortLivedDeliveryClientKeySchema = z.strictObject({
     algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
     publicKey: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/)
 });
-export const CodexShortLivedDeliveryRequestSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    clientKey: CodexShortLivedDeliveryClientKeySchema
-});
 export const CodexShortLivedDeliveryEnvelopeSchema = z.strictObject({
     version: z.literal(1),
     algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
@@ -504,90 +341,6 @@ export const CodexShortLivedDeliveryEnvelopeSchema = z.strictObject({
     ciphertext: z.string().min(1).max(174_764).regex(/^[A-Za-z0-9_-]+$/),
     authenticationTag: z.string().length(22).regex(/^[A-Za-z0-9_-]+$/)
 });
-const CodexShortLivedDeliveryMetadataSchema = z.strictObject({
-    id: z.string().min(1).max(128),
-    credentialKind: z.literal("SHORT_LIVED"),
-    assignmentId: z.string().min(1).max(128),
-    managedAccountId: z.string().min(1).max(128),
-    lineageId: z.string().min(1).max(128),
-    generationVersion: z.number().int().positive(),
-    status: z.enum(["AWAITING_ACK", "ACKED", "EXPIRED"]),
-    issuedAt: EnrollmentInstantSchema,
-    credentialExpiresAt: EnrollmentInstantSchema,
-    ackExpiresAt: EnrollmentInstantSchema,
-    ackedAt: EnrollmentInstantSchema.nullable()
-});
-export const CodexShortLivedDeliveryResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    delivery: CodexShortLivedDeliveryMetadataSchema.extend({
-        providerAccountId: z.string().min(1).max(512),
-        subject: z.string().min(1).max(255),
-        envelope: CodexShortLivedDeliveryEnvelopeSchema
-    }),
-    replayed: z.boolean()
-});
-export const CodexShortLivedDeliveryAckInputSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    lineageId: z.string().min(1).max(128),
-    generationVersion: z.number().int().positive()
-});
-export const CodexShortLivedDeliveryAckResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    delivery: CodexShortLivedDeliveryMetadataSchema.extend({
-        status: z.literal("ACKED"),
-        ackedAt: EnrollmentInstantSchema
-    }),
-    replayed: z.boolean()
-});
-export const CodexShortLivedCredentialBundleSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    deliveryId: z.string().min(1).max(128),
-    managedAccountId: z.string().min(1).max(128),
-    providerAccountId: z.string().min(1).max(512),
-    lineageId: z.string().min(1).max(128),
-    generationVersion: z.number().int().positive(),
-    accessToken: z.string().min(1).max(65_536),
-    idToken: z.string().min(1).max(65_536),
-    expiresAt: EnrollmentInstantSchema
-});
-export const CodexAssignmentRetirementSchema = z.strictObject({
-    id: z.string().min(1).max(200),
-    assignmentId: z.string().min(1).max(200),
-    revision: z.number().int().positive(),
-    reason: z.enum(["UNASSIGN", "COMPROMISED", "REPLACED"]),
-    status: z.enum(["RETIREMENT_PENDING", "COMPROMISED", "READY_TO_FINALIZE", "FINALIZED"]),
-    requestedAt: EnrollmentInstantSchema,
-    serverRefreshStoppedAt: EnrollmentInstantSchema,
-    shortLivedCredentialsExpireAt: EnrollmentInstantSchema,
-    localDeleteStatus: z.enum(["NOT_REQUIRED", "PENDING", "ACKNOWLEDGED", "EXPIRED"]),
-    localDeleteAcknowledgedAt: EnrollmentInstantSchema.nullable(),
-    serverSecretsShreddedAt: EnrollmentInstantSchema.nullable(),
-    upstreamRevocationStatus: z.literal("UNKNOWN"),
-    safeToFinalizeAt: EnrollmentInstantSchema
-});
-export const CodexAssignmentRetirementLocalDeleteAckInputSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    expectedRevision: z.number().int().positive(),
-    targets: z.array(z.strictObject({
-        lineageId: z.string().min(1).max(200),
-        generationVersion: z.number().int().positive()
-    })).min(1).max(1_000)
-});
-const CodexAssignmentRetirementLocalDeleteTargetSchema = z.strictObject({
-    lineageId: z.string().min(1).max(200),
-    generationVersion: z.number().int().positive()
-});
-export const CodexAssignmentRetirementPreflightResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    retirement: CodexAssignmentRetirementSchema,
-    allowedLocalDeleteTargets: z.array(CodexAssignmentRetirementLocalDeleteTargetSchema).max(1_000),
-    allowedActions: z.array(z.literal("ACKNOWLEDGE_LOCAL_DELETE")).max(1)
-});
-export const CodexAssignmentRetirementLocalDeleteAckResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_ENROLLMENT_SCHEMA_VERSION),
-    retirement: CodexAssignmentRetirementSchema,
-    replayed: z.boolean()
-});
 const CodexV3InstantSchema = z.string().datetime({ offset: true });
 const CodexV3IdSchema = z.string().min(1).max(255);
 const CodexV3ClientRequestIdSchema = z.string().min(8).max(255)
@@ -895,6 +648,436 @@ export const CodexV5GenerationReportResponseSchema = z.strictObject({
             message: "Generation did not advance exactly once." });
     }
 });
+/**
+ * v6 makes one complete upstream token set the property of exactly one
+ * request/device binding. A request may own several bindings for the same
+ * user, but lineages and installation ids may never be shared by bindings.
+ */
+export const CodexV6DeviceDescriptorSchema = z.strictObject({
+    installationId: CodexV5InstallationIdSchema,
+    label: z.string().trim().min(1).max(128),
+    platform: z.enum(["darwin", "linux", "win32", "unknown"])
+});
+export const CodexV6AccountRequestStatusSchema = z.enum([
+    "SUBMITTED",
+    "APPROVED",
+    "REJECTED",
+    "CANCELLED",
+    "EXPIRED"
+]);
+export const CodexV6AccountRequestAvailabilitySchema = z.enum([
+    "PENDING_APPROVAL",
+    "WAITING_FOR_BINDING",
+    "PARTIALLY_AVAILABLE",
+    "AVAILABLE",
+    "UNAVAILABLE",
+    "EXPIRED"
+]);
+export const CodexV6AccountRequestSchema = z.strictObject({
+    id: CodexV3IdSchema,
+    userSubject: CodexV3IdSchema,
+    username: z.string().trim().min(1).max(255),
+    userEmail: z.email().nullable(),
+    status: CodexV6AccountRequestStatusSchema,
+    availability: CodexV6AccountRequestAvailabilitySchema,
+    reason: z.string().trim().min(5).max(1_000),
+    requestedDeviceCount: z.number().int().min(1).max(32),
+    approvedDeviceLimit: z.number().int().min(1).max(32).nullable(),
+    activeBindingCount: z.number().int().min(0).max(32),
+    pendingBindingCount: z.number().int().min(0).max(32),
+    requestedValidUntil: CodexV3InstantSchema,
+    validFrom: CodexV3InstantSchema.nullable(),
+    validUntil: CodexV3InstantSchema.nullable(),
+    version: z.number().int().nonnegative(),
+    createdAt: CodexV3InstantSchema,
+    submittedAt: CodexV3InstantSchema,
+    reviewedAt: CodexV3InstantSchema.nullable(),
+    safeErrorCode: z.string().min(1).max(128).regex(/^[a-z][a-z0-9_.-]*$/u).nullable(),
+    allowedActions: z.array(z.enum(["CANCEL", "CLAIM_DEVICE", "VIEW_BINDINGS"])).max(3)
+}).superRefine((value, context) => {
+    const approved = ["APPROVED", "EXPIRED"].includes(value.status);
+    if (approved !== (value.approvedDeviceLimit !== null && value.validFrom !== null
+        && value.validUntil !== null)) {
+        context.addIssue({ code: "custom", message: "Request approval evidence is inconsistent." });
+    }
+    if (value.approvedDeviceLimit !== null
+        && value.activeBindingCount + value.pendingBindingCount > value.approvedDeviceLimit) {
+        context.addIssue({ code: "custom", message: "Request binding counts exceed the approved limit." });
+    }
+});
+export const CodexV6CreateAccountRequestInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    reason: z.string().trim().min(5).max(1_000),
+    requestedDeviceCount: z.number().int().min(1).max(32),
+    requestedValidUntil: CodexV3InstantSchema,
+    initialDevice: CodexV6DeviceDescriptorSchema
+});
+export const CodexV6AccountRequestResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    request: CodexV6AccountRequestSchema,
+    replayed: z.boolean()
+});
+export const CodexV6AccountRequestListResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    items: z.array(CodexV6AccountRequestSchema).max(256),
+    total: z.number().int().min(0).max(256)
+}).superRefine((value, context) => {
+    if (value.items.length !== value.total) {
+        context.addIssue({ code: "custom", path: ["total"], message: "Request total is inconsistent." });
+    }
+});
+export const CodexV6AdminAccountRequestListQuerySchema = z.strictObject({
+    expiresBefore: CodexV3InstantSchema.optional(),
+    includeTerminal: z.boolean().optional()
+});
+export const CodexV6AdminReplacementCandidateQuerySchema = z.strictObject({
+    replaceBefore: CodexV3InstantSchema
+});
+export const CodexV6CancelAccountRequestInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    expectedRequestVersion: z.number().int().nonnegative()
+});
+export const CodexV6AdminReviewAccountRequestInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    expectedRequestVersion: z.number().int().nonnegative(),
+    decision: z.enum(["APPROVE", "REJECT"]),
+    reason: z.string().trim().min(5).max(1_000),
+    approvedDeviceLimit: z.number().int().min(1).max(32).nullable(),
+    validFrom: CodexV3InstantSchema.nullable(),
+    validUntil: CodexV3InstantSchema.nullable()
+}).superRefine((value, context) => {
+    const approval = value.approvedDeviceLimit !== null && value.validFrom !== null
+        && value.validUntil !== null;
+    if ((value.decision === "APPROVE") !== approval) {
+        context.addIssue({ code: "custom", message: "Approval decision fields are inconsistent." });
+    }
+});
+export const CodexV6DeviceBindingStatusSchema = z.enum([
+    "PENDING_TOKEN",
+    "READY",
+    "ACTIVE",
+    "REPLACEMENT_PENDING",
+    "NEEDS_REAUTH",
+    "RETIREMENT_PENDING",
+    "RETIRED"
+]);
+export const CodexV6DeviceBindingSchema = z.strictObject({
+    id: CodexV3IdSchema,
+    requestId: CodexV3IdSchema,
+    userSubject: CodexV3IdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    deviceLabel: z.string().trim().min(1).max(128),
+    platform: z.enum(["darwin", "linux", "win32", "unknown"]),
+    source: z.enum([
+        "REQUEST_INITIAL",
+        "ADMIN_ADDED",
+        "LEGACY_AUTO_MIGRATED",
+        "ACCOUNT_REPLACEMENT"
+    ]),
+    status: CodexV6DeviceBindingStatusSchema,
+    predecessorBindingId: CodexV3IdSchema.nullable(),
+    managedAccountId: CodexV3IdSchema.nullable(),
+    providerAccountId: z.string().min(1).max(512).nullable(),
+    poolEntryId: CodexV3IdSchema.nullable(),
+    credentialLineageId: CodexV3IdSchema.nullable(),
+    generationVersion: z.number().int().positive().nullable(),
+    credentialExpiresAt: CodexV3InstantSchema.nullable(),
+    accountExpiresAt: CodexV3InstantSchema.nullable(),
+    replacementDueAt: CodexV3InstantSchema.nullable(),
+    replacementReason: z.enum([
+        "SUBSCRIPTION_EXPIRING",
+        "CREDENTIAL_UNHEALTHY",
+        "ADMIN_REQUESTED"
+    ]).nullable(),
+    accessTokenHealth: CodexV3AccessTokenHealthSchema,
+    refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+    legacyAssignmentId: CodexV3IdSchema.nullable(),
+    createdAt: CodexV3InstantSchema,
+    activatedAt: CodexV3InstantSchema.nullable(),
+    retiredAt: CodexV3InstantSchema.nullable()
+}).superRefine((value, context) => {
+    const complete = [value.managedAccountId, value.providerAccountId, value.poolEntryId,
+        value.credentialLineageId, value.generationVersion, value.credentialExpiresAt]
+        .every((item) => item !== null);
+    if ((value.status === "PENDING_TOKEN") === complete) {
+        context.addIssue({ code: "custom", message: "Device binding credential evidence is inconsistent." });
+    }
+    if ((value.source === "LEGACY_AUTO_MIGRATED") !== (value.legacyAssignmentId !== null)) {
+        context.addIssue({ code: "custom", message: "Legacy migration evidence is inconsistent." });
+    }
+    if ((value.source === "ACCOUNT_REPLACEMENT") !== (value.predecessorBindingId !== null)) {
+        context.addIssue({ code: "custom", message: "Replacement predecessor evidence is inconsistent." });
+    }
+    const replacementEvidence = value.replacementDueAt !== null && value.replacementReason !== null;
+    if ((value.replacementDueAt !== null) !== (value.replacementReason !== null)
+        || (value.status === "REPLACEMENT_PENDING" || value.source === "ACCOUNT_REPLACEMENT")
+            !== replacementEvidence) {
+        context.addIssue({ code: "custom", message: "Replacement timing evidence is inconsistent." });
+    }
+});
+export const CodexV6DeviceBindingListResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    items: z.array(CodexV6DeviceBindingSchema).max(32),
+    total: z.number().int().min(0).max(32)
+}).superRefine((value, context) => {
+    if (value.items.length !== value.total
+        || new Set(value.items.map(({ id }) => id)).size !== value.items.length
+        || new Set(value.items.filter(({ credentialLineageId }) => credentialLineageId !== null)
+            .map(({ credentialLineageId }) => credentialLineageId)).size
+            !== value.items.filter(({ credentialLineageId }) => credentialLineageId !== null).length) {
+        context.addIssue({ code: "custom", message: "Device bindings are duplicated or incomplete." });
+    }
+    const byId = new Map(value.items.map((item) => [item.id, item]));
+    const successors = new Set();
+    for (const item of value.items) {
+        if (item.predecessorBindingId === null)
+            continue;
+        const predecessor = byId.get(item.predecessorBindingId);
+        if (!predecessor || predecessor.installationId !== item.installationId
+            || predecessor.requestId !== item.requestId || predecessor.userSubject !== item.userSubject
+            || successors.has(predecessor.id)) {
+            context.addIssue({ code: "custom", message: "Replacement binding chain is inconsistent." });
+            break;
+        }
+        successors.add(predecessor.id);
+    }
+    const activeByInstallation = new Map();
+    for (const item of value.items.filter(({ status }) => status !== "RETIRED")) {
+        activeByInstallation.set(item.installationId, [...(activeByInstallation.get(item.installationId) ?? []), item]);
+    }
+    for (const items of activeByInstallation.values()) {
+        if (items.length > 2 || items.length === 2 && !items.some(({ status }) => status === "REPLACEMENT_PENDING") || items.length === 2 && !items.some(({ source }) => source === "ACCOUNT_REPLACEMENT")) {
+            context.addIssue({ code: "custom", message: "Installation has conflicting active bindings." });
+            break;
+        }
+    }
+});
+export const CodexV6AdminReplacementCandidateListResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    items: z.array(z.strictObject({
+        request: CodexV6AccountRequestSchema,
+        binding: CodexV6DeviceBindingSchema,
+        recommendedReason: z.enum([
+            "SUBSCRIPTION_EXPIRING",
+            "CREDENTIAL_UNHEALTHY",
+            "ADMIN_REQUESTED"
+        ]),
+        replaceBefore: CodexV3InstantSchema
+    })).max(256),
+    total: z.number().int().min(0).max(256)
+}).superRefine((value, context) => {
+    if (value.items.length !== value.total || value.items.some(({ request, binding }) => binding.requestId !== request.id || binding.userSubject !== request.userSubject
+        || !["ACTIVE", "NEEDS_REAUTH"].includes(binding.status))) {
+        context.addIssue({ code: "custom", message: "Replacement candidates are inconsistent." });
+    }
+});
+const CodexV6LegacyDeviceEvidenceSchema = z.strictObject({
+    assignmentId: CodexV3IdSchema,
+    managedAccountId: CodexV3IdSchema,
+    providerAccountId: z.string().min(1).max(512),
+    lineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive()
+});
+export const CodexV6ReconcileDeviceAccessInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    device: CodexV6DeviceDescriptorSchema,
+    legacy: CodexV6LegacyDeviceEvidenceSchema.nullable()
+});
+export const CodexV6ReconcileDeviceAccessResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    accessStatus: z.enum([
+        "AVAILABLE",
+        "REQUEST_REQUIRED",
+        "REQUEST_PENDING",
+        "DEVICE_BINDING_REQUIRED",
+        "TOKEN_PENDING",
+        "REQUEST_EXPIRED",
+        "UNAVAILABLE"
+    ]),
+    request: CodexV6AccountRequestSchema.nullable(),
+    binding: CodexV6DeviceBindingSchema.nullable(),
+    replacementBinding: CodexV6DeviceBindingSchema.nullable(),
+    migration: z.enum([
+        "NONE",
+        "AUTO_MIGRATED",
+        "ALREADY_MIGRATED",
+        "ADDITIONAL_DEVICE_DETECTED"
+    ]),
+    guidanceCode: z.enum([
+        "account_request_required",
+        "account_request_pending",
+        "device_binding_admin_required",
+        "device_token_pending",
+        "account_request_expired",
+        "account_unavailable"
+    ]).nullable(),
+    replayed: z.boolean()
+}).superRefine((value, context) => {
+    if (value.accessStatus === "AVAILABLE" && (value.request === null || value.binding === null
+        || !["READY", "ACTIVE", "REPLACEMENT_PENDING"].includes(value.binding.status))) {
+        context.addIssue({ code: "custom", message: "Available device access lacks an active binding." });
+    }
+    if (value.accessStatus === "DEVICE_BINDING_REQUIRED"
+        && value.guidanceCode !== "device_binding_admin_required") {
+        context.addIssue({ code: "custom", message: "Unbound devices must receive administrator guidance." });
+    }
+    if (value.replacementBinding !== null && (value.request === null || value.binding === null
+        || value.binding.status !== "REPLACEMENT_PENDING"
+        || value.replacementBinding.status !== "READY"
+        || value.replacementBinding.source !== "ACCOUNT_REPLACEMENT"
+        || value.replacementBinding.predecessorBindingId !== value.binding.id
+        || value.replacementBinding.requestId !== value.binding.requestId
+        || value.replacementBinding.userSubject !== value.binding.userSubject
+        || value.replacementBinding.installationId !== value.binding.installationId
+        || value.replacementBinding.credentialLineageId === value.binding.credentialLineageId
+        || value.replacementBinding.poolEntryId === value.binding.poolEntryId)) {
+        context.addIssue({ code: "custom", message: "Ready replacement binding is inconsistent." });
+    }
+});
+export const CodexV6AdminCreateDeviceBindingInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    expectedRequestVersion: z.number().int().nonnegative(),
+    device: CodexV6DeviceDescriptorSchema,
+    poolEntryId: CodexV3IdSchema.nullable()
+});
+export const CodexV6AdminCreateDeviceBindingResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    request: CodexV6AccountRequestSchema,
+    binding: CodexV6DeviceBindingSchema,
+    replayed: z.boolean()
+});
+export const CodexV6AdminReplaceDeviceTokenInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    expectedRequestVersion: z.number().int().nonnegative(),
+    reason: z.enum([
+        "SUBSCRIPTION_EXPIRING",
+        "CREDENTIAL_UNHEALTHY",
+        "ADMIN_REQUESTED"
+    ]),
+    replaceBefore: CodexV3InstantSchema,
+    poolEntryId: CodexV3IdSchema.nullable()
+});
+export const CodexV6AdminReplaceDeviceTokenResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    request: CodexV6AccountRequestSchema,
+    currentBinding: CodexV6DeviceBindingSchema,
+    replacementBinding: CodexV6DeviceBindingSchema,
+    replayed: z.boolean()
+}).superRefine((value, context) => {
+    if (value.currentBinding.requestId !== value.request.id
+        || value.currentBinding.userSubject !== value.request.userSubject
+        || value.currentBinding.status !== "REPLACEMENT_PENDING"
+        || value.replacementBinding.requestId !== value.request.id
+        || value.replacementBinding.userSubject !== value.request.userSubject
+        || value.replacementBinding.source !== "ACCOUNT_REPLACEMENT"
+        || value.replacementBinding.predecessorBindingId !== value.currentBinding.id
+        || value.replacementBinding.installationId !== value.currentBinding.installationId
+        || value.replacementBinding.poolEntryId !== null
+            && value.replacementBinding.poolEntryId === value.currentBinding.poolEntryId
+        || value.replacementBinding.credentialLineageId !== null
+            && value.replacementBinding.credentialLineageId === value.currentBinding.credentialLineageId) {
+        context.addIssue({ code: "custom", message: "Replacement response identities are inconsistent." });
+    }
+});
+export const CodexV6FullCredentialDeliveryInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    clientKey: CodexShortLivedDeliveryClientKeySchema
+});
+const CodexV6FullCredentialDeliveryMetadataSchema = z.strictObject({
+    id: CodexV3IdSchema,
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    requestId: CodexV3IdSchema,
+    bindingId: CodexV3IdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    managedAccountId: CodexV3IdSchema,
+    providerAccountId: z.string().min(1).max(512),
+    credentialLineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive(),
+    status: z.enum(["AWAITING_ACK", "ACKED", "EXPIRED"]),
+    issuedAt: CodexV3InstantSchema,
+    credentialExpiresAt: CodexV3InstantSchema,
+    ackExpiresAt: CodexV3InstantSchema,
+    ackedAt: CodexV3InstantSchema.nullable()
+});
+export const CodexV6FullCredentialDeliveryResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    delivery: CodexV6FullCredentialDeliveryMetadataSchema.extend({
+        status: z.literal("AWAITING_ACK"),
+        envelope: CodexShortLivedDeliveryEnvelopeSchema
+    }),
+    replayed: z.boolean()
+});
+export const CodexV6FullCredentialBundleSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    deliveryId: CodexV3IdSchema,
+    requestId: CodexV3IdSchema,
+    bindingId: CodexV3IdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    managedAccountId: CodexV3IdSchema,
+    providerAccountId: z.string().min(1).max(512),
+    credentialLineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive(),
+    refreshToken: z.string().min(1).max(65_536),
+    accessToken: z.string().min(1).max(65_536),
+    idToken: z.string().min(1).max(65_536),
+    expiresAt: CodexV3InstantSchema
+});
+export const CodexV6AcknowledgeFullCredentialDeliveryInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    installationId: CodexV5InstallationIdSchema,
+    credentialLineageId: CodexV3IdSchema,
+    generationVersion: z.number().int().positive(),
+    installed: z.literal(true)
+});
+export const CodexV6AcknowledgeFullCredentialDeliveryResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    delivery: CodexV6FullCredentialDeliveryMetadataSchema.extend({
+        status: z.literal("ACKED"),
+        ackedAt: CodexV3InstantSchema
+    }),
+    replayed: z.boolean()
+});
+export const CodexV6GenerationReportInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    bindingId: CodexV3IdSchema,
+    installationId: CodexV5InstallationIdSchema,
+    expectedGenerationVersion: z.number().int().positive(),
+    rotationMode: z.enum(["ROTATED", "RETAINED"]),
+    envelope: CodexV3CredentialEnvelopeSchema,
+    accessTokenHealth: CodexV3AccessTokenHealthSchema,
+    refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+    observedAt: CodexV3InstantSchema
+});
+export const CodexV6GenerationReportResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_REQUEST_BOUND_DEVICE_V6_SCHEMA_VERSION),
+    report: z.strictObject({
+        id: CodexV3IdSchema,
+        clientRequestId: CodexV3ClientRequestIdSchema,
+        requestId: CodexV3IdSchema,
+        bindingId: CodexV3IdSchema,
+        installationId: CodexV5InstallationIdSchema,
+        credentialLineageId: CodexV3IdSchema,
+        previousGenerationVersion: z.number().int().positive(),
+        generationVersion: z.number().int().positive(),
+        rotationMode: z.enum(["ROTATED", "RETAINED"]),
+        accessTokenHealth: CodexV3AccessTokenHealthSchema,
+        refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+        credentialExpiresAt: CodexV3InstantSchema,
+        observedAt: CodexV3InstantSchema,
+        status: z.literal("APPLIED")
+    }),
+    replayed: z.boolean()
+}).superRefine((value, context) => {
+    if (value.report.generationVersion !== value.report.previousGenerationVersion + 1) {
+        context.addIssue({ code: "custom", path: ["report", "generationVersion"],
+            message: "Generation did not advance exactly once." });
+    }
+});
 export const CodexV4AccessObservationStateSchema = z.enum([
     "VALID", "EXPIRING", "EXPIRED", "INVALID"
 ]);
@@ -1026,28 +1209,6 @@ export function codexAdminRenewPath(accountId) {
 export function codexAdminAssignmentPath(assignmentId) {
     return `${CODEX_ADMIN_ASSIGNMENTS_PATH}/${encodeURIComponent(assignmentId)}`;
 }
-export function codexAdminEnrollmentIntentPath(intentId) {
-    return `${CODEX_ADMIN_ENROLLMENT_INTENTS_PATH}/${encodeURIComponent(intentId)}`;
-}
-export function codexAdminEnrollmentIntentActionPath(intentId, action) {
-    return `${codexAdminEnrollmentIntentPath(intentId)}/${action}`;
-}
-export function codexAdminMigrationLoginQueuePath(planId, query) {
-    return `${CODEX_ADMIN_MIGRATION_PLANS_PATH}/${encodeURIComponent(planId)}`
-        + `/login-queue?page=${query.page}&pageSize=${query.pageSize}`;
-}
-export function codexAssignmentShortLivedDeliveriesPath(assignmentId) {
-    return `${CODEX_CREDENTIAL_ASSIGNMENTS_PATH}/${encodeURIComponent(assignmentId)}/short-lived-credential-deliveries`;
-}
-export function codexShortLivedDeliveryAckPath(deliveryId) {
-    return `${CODEX_SHORT_LIVED_DELIVERIES_PATH}/${encodeURIComponent(deliveryId)}/ack`;
-}
-export function codexAssignmentRetirementLocalDeleteAckPath(retirementId) {
-    return `${CODEX_ASSIGNMENT_RETIREMENTS_PATH}/${encodeURIComponent(retirementId)}/local-delete-ack`;
-}
-export function codexAssignmentRetirementPath(retirementId) {
-    return `${CODEX_ASSIGNMENT_RETIREMENTS_PATH}/${encodeURIComponent(retirementId)}`;
-}
 export function codexV3EnrollmentResolvePath(clientRequestId) {
     return `${CODEX_V3_ENROLLMENTS_PATH}/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
 }
@@ -1085,6 +1246,62 @@ export function codexV5DeviceSessionActionPath(sessionId, action) {
 export function codexV5LineageGenerationReportsPath(lineageId) {
     return `${CODEX_MULTI_DEVICE_V5_CREDENTIAL_LINEAGES_PATH}/${encodeURIComponent(lineageId)}/generations/report`;
 }
+export function codexV6AccountRequestPath(requestId) {
+    return `${CODEX_V6_ACCOUNT_REQUESTS_PATH}/${encodeURIComponent(requestId)}`;
+}
+export function codexV6AccountRequestActionPath(requestId, action) {
+    return `${codexV6AccountRequestPath(requestId)}/${action}`;
+}
+export function codexV6AccountRequestDeviceBindingsPath(requestId) {
+    return `${codexV6AccountRequestPath(requestId)}/device-bindings`;
+}
+export function codexV6AdminAccountRequestDeviceBindingsPath(requestId) {
+    return `${CODEX_V6_ADMIN_ACCOUNT_REQUESTS_PATH}/${encodeURIComponent(requestId)}/device-bindings`;
+}
+export function codexV6AdminDeviceBindingReplacementPath(requestId, bindingId) {
+    return `${codexV6AdminAccountRequestDeviceBindingsPath(requestId)}/`
+        + `${encodeURIComponent(bindingId)}/replacement`;
+}
+export function codexV6AdminAccountRequestPath(requestId) {
+    return `${CODEX_V6_ADMIN_ACCOUNT_REQUESTS_PATH}/${encodeURIComponent(requestId)}`;
+}
+export function codexV6AdminAccountRequestsPath(query = {}) {
+    const parsed = CodexV6AdminAccountRequestListQuerySchema.parse(query);
+    const parameters = new URLSearchParams();
+    if (parsed.expiresBefore)
+        parameters.set("expiresBefore", parsed.expiresBefore);
+    if (parsed.includeTerminal !== undefined) {
+        parameters.set("includeTerminal", String(parsed.includeTerminal));
+    }
+    const suffix = parameters.toString();
+    return `${CODEX_V6_ADMIN_ACCOUNT_REQUESTS_PATH}${suffix ? `?${suffix}` : ""}`;
+}
+export function codexV6AdminReplacementCandidatesPath(query) {
+    const parsed = CodexV6AdminReplacementCandidateQuerySchema.parse(query);
+    return `${CODEX_V6_ADMIN_DEVICE_BINDINGS_PATH}/replacement-candidates`
+        + `?replaceBefore=${encodeURIComponent(parsed.replaceBefore)}`;
+}
+export function codexV6AdminAccountRequestReviewPath(requestId) {
+    return `${codexV6AdminAccountRequestPath(requestId)}/review`;
+}
+export function codexV6DeviceBindingFullCredentialDeliveriesPath(bindingId) {
+    return `${CODEX_V6_DEVICE_BINDINGS_PATH}/${encodeURIComponent(bindingId)}/full-credential-deliveries`;
+}
+export function codexV6DeviceBindingFullCredentialDeliveryResolvePath(bindingId, clientRequestId) {
+    return `${codexV6DeviceBindingFullCredentialDeliveriesPath(bindingId)}`
+        + `/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
+}
+export function codexV6FullCredentialDeliveryAckPath(deliveryId) {
+    return `${CODEX_REQUEST_BOUND_DEVICE_V6_RUNTIME_PATH}/full-credential-deliveries/`
+        + `${encodeURIComponent(deliveryId)}/ack`;
+}
+export function codexV6BindingGenerationReportsPath(bindingId) {
+    return `${CODEX_V6_DEVICE_BINDINGS_PATH}/${encodeURIComponent(bindingId)}/generations/report`;
+}
+export function codexV6BindingGenerationReportResolvePath(bindingId, clientRequestId) {
+    return `${CODEX_V6_DEVICE_BINDINGS_PATH}/${encodeURIComponent(bindingId)}`
+        + `/generations/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
+}
 export function codexTokenPoolV4DirectoryResolvePath(principal) {
     return `${CODEX_TOKEN_POOL_V4_DIRECTORY_RESOLVE_PATH}?principal=${encodeURIComponent(principal)}`;
 }