@tokensrc/codex 1.14.3 → 1.14.5

package/dist/protocol.d.ts

@@ -13,11 +13,20 @@ export declare const CODEX_ASSIGNMENT_RETIREMENTS_PATH = "/v2/codex/assignment-r
 export declare const CODEX_ADMIN_MIGRATION_PLANS_PATH = "/v2/admin/codex/migration-plans";
 export declare const CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION: 3;
 export declare const CODEX_MANAGED_CREDENTIALS_V3_PATH = "/v3/codex";
-export declare const CODEX_V3_ENROLLMENT_CONFIGURATION_PATH = "/v3/codex/enrollment-configuration";
+export declare const CODEX_V3_ENROLLMENT_CONFIGURATION_PATH = "/v4/codex/enrollment-configuration";
 export declare const CODEX_V3_ENROLLMENTS_PATH = "/v3/codex/enrollments";
-export declare const CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH = "/v3/codex/credential-assignments";
-export declare const CODEX_V3_FULL_CREDENTIAL_DELIVERIES_PATH = "/v3/codex/full-credential-deliveries";
-export declare const CODEX_V3_CREDENTIAL_LINEAGES_PATH = "/v3/codex/credential-lineages";
+export declare const CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH = "/v4/codex/credential-assignments";
+export declare const CODEX_V3_FULL_CREDENTIAL_DELIVERIES_PATH = "/v4/codex/full-credential-deliveries";
+export declare const CODEX_V3_CREDENTIAL_LINEAGES_PATH = "/v4/codex/credential-lineages";
+export declare const CODEX_TOKEN_POOL_V4_SCHEMA_VERSION: 4;
+export declare const CODEX_TOKEN_POOL_V4_PATH = "/v4/admin/codex";
+export declare const CODEX_TOKEN_POOL_V4_ENROLLMENT_CONFIGURATION_PATH = "/v4/admin/codex/enrollment-configuration";
+export declare const CODEX_TOKEN_POOL_V4_DIRECTORY_RESOLVE_PATH = "/v4/admin/codex/directory-users/resolve";
+export declare const CODEX_TOKEN_POOL_V4_UPLOADS_PATH = "/v4/admin/codex/token-pool/uploads";
+export declare const CODEX_TOKEN_POOL_V4_RUNTIME_PATH = "/v4/codex";
+export declare const CODEX_TOKEN_POOL_V4_CREDENTIAL_ASSIGNMENTS_PATH = "/v4/codex/credential-assignments";
+export declare const CODEX_TOKEN_POOL_V4_FULL_CREDENTIAL_DELIVERIES_PATH = "/v4/codex/full-credential-deliveries";
+export declare const CODEX_TOKEN_POOL_V4_CREDENTIAL_LINEAGES_PATH = "/v4/codex/credential-lineages";
 export declare const CODEX_MIGRATION_CAPACITY: {
     readonly verifiedMinimum: 2;
     readonly verifiedLimit: null;
@@ -1456,7 +1465,7 @@ export declare const CodexV3CredentialEnvelopeSchema: z.ZodObject<{
     authenticationTag: z.ZodString;
 }, z.core.$strict>;
 export declare const CodexV3EnrollmentConfigurationSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     ingress: z.ZodObject<{
         envelopeVersion: z.ZodLiteral<1>;
         algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
@@ -1570,7 +1579,7 @@ export declare const CodexV3CredentialAssignmentSchema: z.ZodObject<{
     deliveryEligible: z.ZodBoolean;
 }, z.core.$strict>;
 export declare const CodexV3CredentialAssignmentListResponseSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     items: z.ZodArray<z.ZodObject<{
         assignmentId: z.ZodString;
         managedAccountId: z.ZodString;
@@ -1608,7 +1617,7 @@ export declare const CodexV3CredentialAssignmentListResponseSchema: z.ZodObject<
     total: z.ZodNumber;
 }, z.core.$strict>;
 export declare const CodexV3FullCredentialDeliveryRequestSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     clientRequestId: z.ZodString;
     clientKey: z.ZodObject<{
         version: z.ZodLiteral<1>;
@@ -1617,7 +1626,7 @@ export declare const CodexV3FullCredentialDeliveryRequestSchema: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 export declare const CodexV3FullCredentialDeliveryResponseSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     delivery: z.ZodObject<{
         id: z.ZodString;
         credentialKind: z.ZodLiteral<"FULL">;
@@ -1648,13 +1657,13 @@ export declare const CodexV3FullCredentialDeliveryResponseSchema: z.ZodObject<{
     replayed: z.ZodBoolean;
 }, z.core.$strict>;
 export declare const CodexV3FullCredentialDeliveryAckInputSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     lineageId: z.ZodString;
     generationVersion: z.ZodNumber;
     installed: z.ZodLiteral<true>;
 }, z.core.$strict>;
 export declare const CodexV3FullCredentialDeliveryAckResponseSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     delivery: z.ZodObject<{
         id: z.ZodString;
         credentialKind: z.ZodLiteral<"FULL">;
@@ -1676,7 +1685,7 @@ export declare const CodexV3FullCredentialDeliveryAckResponseSchema: z.ZodObject
     replayed: z.ZodBoolean;
 }, z.core.$strict>;
 export declare const CodexV3FullCredentialBundleSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     deliveryId: z.ZodString;
     managedAccountId: z.ZodString;
     providerAccountId: z.ZodString;
@@ -1688,7 +1697,7 @@ export declare const CodexV3FullCredentialBundleSchema: z.ZodObject<{
     expiresAt: z.ZodString;
 }, z.core.$strict>;
 export declare const CodexV3GenerationReportInputSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     clientRequestId: z.ZodString;
     expectedGenerationVersion: z.ZodNumber;
     rotationMode: z.ZodEnum<{
@@ -1719,7 +1728,7 @@ export declare const CodexV3GenerationReportInputSchema: z.ZodObject<{
     observedAt: z.ZodString;
 }, z.core.$strict>;
 export declare const CodexV3GenerationReportResponseSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<3>;
+    schemaVersion: z.ZodLiteral<4>;
     report: z.ZodObject<{
         id: z.ZodString;
         clientRequestId: z.ZodString;
@@ -1749,6 +1758,142 @@ export declare const CodexV3GenerationReportResponseSchema: z.ZodObject<{
     }, z.core.$strict>;
     replayed: z.ZodBoolean;
 }, z.core.$strict>;
+export declare const CodexTokenPoolV4IdempotencyKeySchema: z.ZodString;
+export declare const CodexTokenPoolV4AssignmentTargetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"UNBOUND_POOL">;
+}, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"DIRECTORY_PRINCIPAL">;
+    principal: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"SUBJECT">;
+    userSubject: z.ZodString;
+}, z.core.$strict>], "mode">;
+export declare const CodexTokenPoolV4EnrollmentConfigurationSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<4>;
+    ingress: z.ZodObject<{
+        envelopeVersion: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        publicKey: z.ZodString;
+        maxRequestBytes: z.ZodNumber;
+        maxCiphertextBytes: z.ZodNumber;
+    }, z.core.$strict>;
+    assignmentModes: z.ZodTuple<[z.ZodLiteral<"UNBOUND_POOL">, z.ZodLiteral<"DIRECTORY_PRINCIPAL">, z.ZodLiteral<"SUBJECT">], null>;
+}, z.core.$strict>;
+export declare const CodexTokenPoolV4DirectoryResolveResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<4>;
+    user: z.ZodObject<{
+        userSubject: z.ZodString;
+        username: z.ZodString;
+        email: z.ZodNullable<z.ZodEmail>;
+        enabled: z.ZodLiteral<true>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexTokenPoolV4UploadInputSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<4>;
+    clientRequestId: z.ZodString;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"UNBOUND_POOL">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"DIRECTORY_PRINCIPAL">;
+        principal: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"SUBJECT">;
+        userSubject: z.ZodString;
+    }, z.core.$strict>], "mode">;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const CodexTokenPoolV4UploadResponseTargetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"UNBOUND_POOL">;
+}, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"SUBJECT">;
+    userSubject: z.ZodString;
+    username: z.ZodString;
+    userEmail: z.ZodNullable<z.ZodEmail>;
+}, z.core.$strict>], "mode">;
+export declare const CodexTokenPoolV4UploadSchema: z.ZodObject<{
+    id: z.ZodString;
+    clientRequestId: z.ZodString;
+    status: z.ZodEnum<{
+        NEEDS_REAUTH: "NEEDS_REAUTH";
+        OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+        POOLED: "POOLED";
+        RESERVED: "RESERVED";
+        TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+        VALIDATING: "VALIDATING";
+    }>;
+    placement: z.ZodEnum<{
+        FAILED: "FAILED";
+        PENDING: "PENDING";
+        RESERVED: "RESERVED";
+        UNBOUND_POOL: "UNBOUND_POOL";
+    }>;
+    managedAccountId: z.ZodNullable<z.ZodString>;
+    providerAccountId: z.ZodNullable<z.ZodString>;
+    poolEntryId: z.ZodNullable<z.ZodString>;
+    assignmentId: z.ZodNullable<z.ZodString>;
+    assignedUserSubject: z.ZodNullable<z.ZodString>;
+    reservedLineageId: z.ZodNullable<z.ZodString>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"UNBOUND_POOL">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"SUBJECT">;
+        userSubject: z.ZodString;
+        username: z.ZodString;
+        userEmail: z.ZodNullable<z.ZodEmail>;
+    }, z.core.$strict>], "mode">;
+    createdAt: z.ZodString;
+    completedAt: z.ZodNullable<z.ZodString>;
+    safeErrorCode: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const CodexTokenPoolV4UploadResponseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<4>;
+    upload: z.ZodObject<{
+        id: z.ZodString;
+        clientRequestId: z.ZodString;
+        status: z.ZodEnum<{
+            NEEDS_REAUTH: "NEEDS_REAUTH";
+            OUTCOME_AMBIGUOUS: "OUTCOME_AMBIGUOUS";
+            POOLED: "POOLED";
+            RESERVED: "RESERVED";
+            TEMPORARILY_UNAVAILABLE: "TEMPORARILY_UNAVAILABLE";
+            VALIDATING: "VALIDATING";
+        }>;
+        placement: z.ZodEnum<{
+            FAILED: "FAILED";
+            PENDING: "PENDING";
+            RESERVED: "RESERVED";
+            UNBOUND_POOL: "UNBOUND_POOL";
+        }>;
+        managedAccountId: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        poolEntryId: z.ZodNullable<z.ZodString>;
+        assignmentId: z.ZodNullable<z.ZodString>;
+        assignedUserSubject: z.ZodNullable<z.ZodString>;
+        reservedLineageId: z.ZodNullable<z.ZodString>;
+        target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            mode: z.ZodLiteral<"UNBOUND_POOL">;
+        }, z.core.$strict>, z.ZodObject<{
+            mode: z.ZodLiteral<"SUBJECT">;
+            userSubject: z.ZodString;
+            username: z.ZodString;
+            userEmail: z.ZodNullable<z.ZodEmail>;
+        }, z.core.$strict>], "mode">;
+        createdAt: z.ZodString;
+        completedAt: z.ZodNullable<z.ZodString>;
+        safeErrorCode: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    replayed: z.ZodBoolean;
+}, z.core.$strict>;
 export type CodexAccountSummary = z.infer<typeof CodexAccountSummarySchema>;
 export type CodexQuotaSnapshotView = z.infer<typeof CodexQuotaSnapshotViewSchema>;
 export type CodexAccountListResponse = z.infer<typeof CodexAccountListResponseSchema>;
@@ -1805,6 +1950,11 @@ export type CodexV3FullCredentialDeliveryAckResponse = z.infer<typeof CodexV3Ful
 export type CodexV3FullCredentialBundle = z.infer<typeof CodexV3FullCredentialBundleSchema>;
 export type CodexV3GenerationReportInput = z.infer<typeof CodexV3GenerationReportInputSchema>;
 export type CodexV3GenerationReportResponse = z.infer<typeof CodexV3GenerationReportResponseSchema>;
+export type CodexTokenPoolV4AssignmentTarget = z.infer<typeof CodexTokenPoolV4AssignmentTargetSchema>;
+export type CodexTokenPoolV4EnrollmentConfiguration = z.infer<typeof CodexTokenPoolV4EnrollmentConfigurationSchema>;
+export type CodexTokenPoolV4DirectoryResolveResponse = z.infer<typeof CodexTokenPoolV4DirectoryResolveResponseSchema>;
+export type CodexTokenPoolV4UploadInput = z.infer<typeof CodexTokenPoolV4UploadInputSchema>;
+export type CodexTokenPoolV4UploadResponse = z.infer<typeof CodexTokenPoolV4UploadResponseSchema>;
 export declare function codexAccountLoginCredentialsPath(accountId: string): string;
 export declare function codexAdminCredentialVersionsPath(accountId: string): string;
 export declare function codexAdminRefreshPath(accountId: string): string;
@@ -1825,3 +1975,5 @@ export declare function codexV3AssignmentFullCredentialDeliveryResolvePath(assig
 export declare function codexV3FullCredentialDeliveryAckPath(deliveryId: string): string;
 export declare function codexV3LineageGenerationReportsPath(lineageId: string): string;
 export declare function codexV3LineageGenerationReportResolvePath(lineageId: string, clientRequestId: string): string;
+export declare function codexTokenPoolV4DirectoryResolvePath(principal: string): string;
+export declare function codexTokenPoolV4UploadResolvePath(clientRequestId: string): string;

package/dist/protocol.js

@@ -14,11 +14,20 @@ export const CODEX_ADMIN_MIGRATION_PLANS_PATH = "/v2/admin/codex/migration-plans
 export const CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION = 3;
 // The configured service URL already includes the public `/api` prefix.
 export const CODEX_MANAGED_CREDENTIALS_V3_PATH = "/v3/codex";
-export const CODEX_V3_ENROLLMENT_CONFIGURATION_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/enrollment-configuration`;
+export const CODEX_V3_ENROLLMENT_CONFIGURATION_PATH = "/v4/codex/enrollment-configuration";
 export const CODEX_V3_ENROLLMENTS_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/enrollments`;
-export const CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/credential-assignments`;
-export const CODEX_V3_FULL_CREDENTIAL_DELIVERIES_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/full-credential-deliveries`;
-export const CODEX_V3_CREDENTIAL_LINEAGES_PATH = `${CODEX_MANAGED_CREDENTIALS_V3_PATH}/credential-lineages`;
+export const CODEX_V3_CREDENTIAL_ASSIGNMENTS_PATH = "/v4/codex/credential-assignments";
+export const CODEX_V3_FULL_CREDENTIAL_DELIVERIES_PATH = "/v4/codex/full-credential-deliveries";
+export const CODEX_V3_CREDENTIAL_LINEAGES_PATH = "/v4/codex/credential-lineages";
+export const CODEX_TOKEN_POOL_V4_SCHEMA_VERSION = 4;
+export const CODEX_TOKEN_POOL_V4_PATH = "/v4/admin/codex";
+export const CODEX_TOKEN_POOL_V4_ENROLLMENT_CONFIGURATION_PATH = `${CODEX_TOKEN_POOL_V4_PATH}/enrollment-configuration`;
+export const CODEX_TOKEN_POOL_V4_DIRECTORY_RESOLVE_PATH = `${CODEX_TOKEN_POOL_V4_PATH}/directory-users/resolve`;
+export const CODEX_TOKEN_POOL_V4_UPLOADS_PATH = `${CODEX_TOKEN_POOL_V4_PATH}/token-pool/uploads`;
+export const CODEX_TOKEN_POOL_V4_RUNTIME_PATH = "/v4/codex";
+export const CODEX_TOKEN_POOL_V4_CREDENTIAL_ASSIGNMENTS_PATH = `${CODEX_TOKEN_POOL_V4_RUNTIME_PATH}/credential-assignments`;
+export const CODEX_TOKEN_POOL_V4_FULL_CREDENTIAL_DELIVERIES_PATH = `${CODEX_TOKEN_POOL_V4_RUNTIME_PATH}/full-credential-deliveries`;
+export const CODEX_TOKEN_POOL_V4_CREDENTIAL_LINEAGES_PATH = `${CODEX_TOKEN_POOL_V4_RUNTIME_PATH}/credential-lineages`;
 export const CODEX_MIGRATION_CAPACITY = {
     verifiedMinimum: 2,
     verifiedLimit: null,
@@ -573,7 +582,7 @@ export const CodexV3CredentialIngressSchema = z.strictObject({
 });
 export const CodexV3CredentialEnvelopeSchema = CodexEnrollmentCandidateEnvelopeSchema;
 export const CodexV3EnrollmentConfigurationSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
     ingress: CodexV3CredentialIngressSchema
 });
 export const CodexV3EnrollmentInputSchema = z.strictObject({
@@ -641,7 +650,7 @@ export const CodexV3CredentialAssignmentSchema = z.strictObject({
     deliveryEligible: z.boolean()
 });
 export const CodexV3CredentialAssignmentListResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
     items: z.array(CodexV3CredentialAssignmentSchema).max(256),
     total: z.number().int().min(0).max(256)
 }).superRefine((value, context) => {
@@ -650,7 +659,7 @@ export const CodexV3CredentialAssignmentListResponseSchema = z.strictObject({
     }
 });
 export const CodexV3FullCredentialDeliveryRequestSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
     clientRequestId: CodexV3ClientRequestIdSchema,
     clientKey: CodexShortLivedDeliveryClientKeySchema
 });
@@ -673,7 +682,7 @@ const CodexV3FullCredentialDeliveryMetadataSchema = z.strictObject({
     ackedAt: CodexV3InstantSchema.nullable()
 });
 export const CodexV3FullCredentialDeliveryResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
     delivery: CodexV3FullCredentialDeliveryMetadataSchema.extend({
         status: z.literal("AWAITING_ACK"),
         authorityMode: z.literal("DELIVERY_PENDING"),
@@ -682,13 +691,13 @@ export const CodexV3FullCredentialDeliveryResponseSchema = z.strictObject({
     replayed: z.boolean()
 });
 export const CodexV3FullCredentialDeliveryAckInputSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
     lineageId: CodexV3IdSchema,
     generationVersion: z.number().int().positive(),
     installed: z.literal(true)
 });
 export const CodexV3FullCredentialDeliveryAckResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
     delivery: CodexV3FullCredentialDeliveryMetadataSchema.extend({
         status: z.literal("ACKED"),
         authorityMode: z.literal("CLIENT_MANAGED"),
@@ -698,7 +707,7 @@ export const CodexV3FullCredentialDeliveryAckResponseSchema = z.strictObject({
     replayed: z.boolean()
 });
 export const CodexV3FullCredentialBundleSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
     deliveryId: CodexV3IdSchema,
     managedAccountId: CodexV3IdSchema,
     providerAccountId: z.string().min(1).max(512),
@@ -710,7 +719,7 @@ export const CodexV3FullCredentialBundleSchema = z.strictObject({
     expiresAt: CodexV3InstantSchema
 });
 export const CodexV3GenerationReportInputSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
     clientRequestId: CodexV3ClientRequestIdSchema,
     expectedGenerationVersion: z.number().int().positive(),
     rotationMode: z.enum(["ROTATED", "RETAINED"]),
@@ -720,7 +729,7 @@ export const CodexV3GenerationReportInputSchema = z.strictObject({
     observedAt: CodexV3InstantSchema
 });
 export const CodexV3GenerationReportResponseSchema = z.strictObject({
-    schemaVersion: z.literal(CODEX_MANAGED_CREDENTIALS_V3_SCHEMA_VERSION),
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
     report: z.strictObject({
         id: CodexV3IdSchema,
         clientRequestId: CodexV3ClientRequestIdSchema,
@@ -742,6 +751,95 @@ export const CodexV3GenerationReportResponseSchema = z.strictObject({
         context.addIssue({ code: "custom", path: ["report", "generationVersion"], message: "Generation did not advance exactly once." });
     }
 });
+const CodexTokenPoolV4PrincipalSchema = z.string().min(1).max(255)
+    .refine((value) => value === value.trim(), "Principal must be canonical.")
+    .refine((value) => !/[\s\u0000-\u001f\u007f]/u.test(value), "Principal contains unsafe characters.");
+export const CodexTokenPoolV4IdempotencyKeySchema = z.string().min(8).max(255)
+    .refine((value) => value === value.trim(), "Idempotency key must be canonical.");
+export const CodexTokenPoolV4AssignmentTargetSchema = z.discriminatedUnion("mode", [
+    z.strictObject({ mode: z.literal("UNBOUND_POOL") }),
+    z.strictObject({ mode: z.literal("DIRECTORY_PRINCIPAL"), principal: CodexTokenPoolV4PrincipalSchema }),
+    z.strictObject({ mode: z.literal("SUBJECT"), userSubject: CodexV3IdSchema })
+]);
+export const CodexTokenPoolV4EnrollmentConfigurationSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
+    ingress: CodexV3CredentialIngressSchema,
+    assignmentModes: z.tuple([
+        z.literal("UNBOUND_POOL"),
+        z.literal("DIRECTORY_PRINCIPAL"),
+        z.literal("SUBJECT")
+    ])
+});
+export const CodexTokenPoolV4DirectoryResolveResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
+    user: z.strictObject({
+        userSubject: CodexV3IdSchema,
+        username: z.string().min(1).max(255).refine((value) => value === value.trim()),
+        email: z.email().nullable(),
+        enabled: z.literal(true)
+    })
+});
+export const CodexTokenPoolV4UploadInputSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    target: CodexTokenPoolV4AssignmentTargetSchema,
+    envelope: CodexV3CredentialEnvelopeSchema
+});
+export const CodexTokenPoolV4UploadResponseTargetSchema = z.discriminatedUnion("mode", [
+    z.strictObject({ mode: z.literal("UNBOUND_POOL") }),
+    z.strictObject({
+        mode: z.literal("SUBJECT"),
+        userSubject: CodexV3IdSchema,
+        username: z.string().min(1).max(255).refine((value) => value === value.trim()),
+        userEmail: z.email().nullable()
+    })
+]);
+export const CodexTokenPoolV4UploadSchema = z.strictObject({
+    id: CodexV3IdSchema,
+    clientRequestId: CodexV3ClientRequestIdSchema,
+    status: z.enum([
+        "VALIDATING",
+        "POOLED",
+        "RESERVED",
+        "TEMPORARILY_UNAVAILABLE",
+        "NEEDS_REAUTH",
+        "OUTCOME_AMBIGUOUS"
+    ]),
+    placement: z.enum(["PENDING", "UNBOUND_POOL", "RESERVED", "FAILED"]),
+    managedAccountId: CodexV3IdSchema.nullable(),
+    providerAccountId: CodexV3IdSchema.nullable(),
+    poolEntryId: CodexV3IdSchema.nullable(),
+    assignmentId: CodexV3IdSchema.nullable(),
+    assignedUserSubject: CodexV3IdSchema.nullable(),
+    reservedLineageId: CodexV3IdSchema.nullable(),
+    target: CodexTokenPoolV4UploadResponseTargetSchema,
+    createdAt: CodexV3InstantSchema,
+    completedAt: CodexV3InstantSchema.nullable(),
+    safeErrorCode: CodexV3IdSchema.nullable()
+}).superRefine((value, context) => {
+    const outcome = [value.managedAccountId, value.providerAccountId, value.poolEntryId];
+    const reservation = [value.assignmentId, value.assignedUserSubject, value.reservedLineageId];
+    const failure = ["TEMPORARILY_UNAVAILABLE", "NEEDS_REAUTH", "OUTCOME_AMBIGUOUS"].includes(value.status);
+    const invalid = value.status === "VALIDATING"
+        ? value.placement !== "PENDING" || [...outcome, ...reservation].some((item) => item != null)
+            || value.completedAt != null || value.safeErrorCode != null
+        : value.status === "POOLED"
+            ? value.placement !== "UNBOUND_POOL" || outcome.some((item) => item == null)
+                || reservation.some((item) => item != null) || value.completedAt == null
+                || value.safeErrorCode != null || value.target.mode !== "UNBOUND_POOL"
+            : value.status === "RESERVED"
+                ? value.placement !== "RESERVED" || [...outcome, ...reservation].some((item) => item == null)
+                    || value.completedAt == null || value.safeErrorCode != null || value.target.mode !== "SUBJECT"
+                : !failure || value.placement !== "FAILED" || [...outcome, ...reservation].some((item) => item != null)
+                    || value.completedAt == null || value.safeErrorCode == null;
+    if (invalid)
+        context.addIssue({ code: "custom", message: "Token pool upload evidence is inconsistent." });
+});
+export const CodexTokenPoolV4UploadResponseSchema = z.strictObject({
+    schemaVersion: z.literal(CODEX_TOKEN_POOL_V4_SCHEMA_VERSION),
+    upload: CodexTokenPoolV4UploadSchema,
+    replayed: z.boolean()
+});
 export function codexAccountLoginCredentialsPath(accountId) {
     return `${CODEX_ACCOUNTS_PATH}/${encodeURIComponent(accountId)}/login-credentials`;
 }
@@ -797,4 +895,10 @@ export function codexV3LineageGenerationReportResolvePath(lineageId, clientReque
     return `${CODEX_V3_CREDENTIAL_LINEAGES_PATH}/${encodeURIComponent(lineageId)}`
         + `/generations/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
 }
+export function codexTokenPoolV4DirectoryResolvePath(principal) {
+    return `${CODEX_TOKEN_POOL_V4_DIRECTORY_RESOLVE_PATH}?principal=${encodeURIComponent(principal)}`;
+}
+export function codexTokenPoolV4UploadResolvePath(clientRequestId) {
+    return `${CODEX_TOKEN_POOL_V4_UPLOADS_PATH}/resolve?clientRequestId=${encodeURIComponent(clientRequestId)}`;
+}
 //# sourceMappingURL=protocol.js.map