@opengeni/contracts 3.1.0-canary.1 → 3.1.2

package/src/modal-native-proof-v2.ts

@@ -0,0 +1,429 @@
+import { defineSchema } from "./define-schema";
+import { z } from "zod";
+import { ModalRouterProviderCommand } from "./sandbox-provider-command";
+
+/** Secret-free descriptions for the NEW native proof protocol. Parsing any
+ * value below establishes correlation ONLY. It does not authenticate a host,
+ * native response, grant, election, capture, Start, or semantic continuation.
+ * Frozen reservation/journal v1 values are never adopted into this protocol. */
+export const MODAL_NATIVE_PROOF_PROTOCOL_VERSION = 2 as const;
+export const MODAL_NATIVE_FRESH_COMPILER_FINGERPRINT =
+  "db6d33c8a1142e5ffe3d1a130d8b9f9d819e46832ad0417d41d5606b7fe25ab1" as const;
+
+const uuid = /* @__PURE__ */ defineSchema(() =>
+  z.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u),
+);
+// Fresh readiness must round-trip through the retained original-command schema.
+// Reuse its exact UUID domain; do not widen it or change the frozen compiler.
+const commandExecId = /* @__PURE__ */ defineSchema(() =>
+  uuid.pipe(ModalRouterProviderCommand.shape.execId),
+);
+const positive = /* @__PURE__ */ defineSchema(() => z.number().int().positive().safe());
+const nonnegative = /* @__PURE__ */ defineSchema(() => z.number().int().nonnegative().safe());
+const digest = /* @__PURE__ */ defineSchema(() => z.string().regex(/^[a-f0-9]{64}$/u));
+const empty = /* @__PURE__ */ defineSchema(() => z.object({}).strict());
+const noItems = /* @__PURE__ */ defineSchema(() => z.tuple([]));
+const entrypoint = /* @__PURE__ */ defineSchema(() =>
+  z.tuple([z.literal("sleep"), z.literal("infinity")]),
+);
+const sourceSha = "bb830ded1925e1d927d1fc221b2329d961f9a57eafdd9a85bf13fb7cfc982599";
+
+/** This entire profile is declared BEFORE even namespace lookup. It is a
+ * reviewed literal, not caller-selected defaults or an arbitrary self-hash. */
+export const ModalNativeFreshNormalizationV1 = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      recipeId: z.literal("modal-native-fresh-v1"),
+      recipeRevision: z.literal(1),
+      schema: z.literal("modal.client.ModalClient/SandboxCreate"),
+      encoding: z.literal("modal-create-json-v1"),
+      sdkVersion: z.literal("0.9.0"),
+      sdkSourceSha256: z.literal(sourceSha),
+      entrypoint,
+      createWorkdir: z.literal("/tmp"),
+      env: empty,
+      mounts: noItems,
+      restore: z.null(),
+      idleTimeout: z.literal("unset"),
+      gpu: z.literal("unset"),
+      gpuProto: z
+        .object({ type: z.literal(0), count: z.literal(0), gpuType: z.literal("") })
+        .strict(),
+      cpuLimit: z.literal("unset"),
+      memoryLimit: z.literal("unset"),
+      pty: z.literal("unset"),
+      regions: z.literal("unset"),
+      proxy: z.literal("unset"),
+      readinessProbe: z.literal("unset"),
+      environmentVariables: z.literal("unset"),
+      network: z
+        .object({
+          access: z.literal("OPEN"),
+          outboundCidrs: noItems,
+          outboundDomains: noItems,
+          inboundCidrs: noItems,
+          i6pn: z.literal(false),
+        })
+        .strict(),
+      volumes: noItems,
+      cloudBucketMounts: noItems,
+      secrets: noItems,
+      ports: noItems,
+      cloud: z.literal(""),
+      verbose: z.literal(false),
+      includeOidcIdentityToken: z.literal(false),
+      experimentalOptions: empty,
+      experimentalOptionsV2: empty,
+      customDomain: z.literal(""),
+    })
+    .strict(),
+);
+export type ModalNativeFreshNormalizationV1 = z.infer<typeof ModalNativeFreshNormalizationV1>;
+
+function freezeLiteral<T>(value: T): T {
+  if (value !== null && typeof value === "object") {
+    for (const child of Object.values(value)) freezeLiteral(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+
+/** Public, credential-free recipe data. The host must normatively select this
+ * literal before I/O; possessing a copy supplies no issuance provenance. */
+export const MODAL_NATIVE_FRESH_NORMALIZATION_V1 = freezeLiteral(
+  ModalNativeFreshNormalizationV1.parse({
+    recipeId: "modal-native-fresh-v1",
+    recipeRevision: 1,
+    schema: "modal.client.ModalClient/SandboxCreate",
+    encoding: "modal-create-json-v1",
+    sdkVersion: "0.9.0",
+    sdkSourceSha256: sourceSha,
+    entrypoint: ["sleep", "infinity"],
+    createWorkdir: "/tmp",
+    env: {},
+    mounts: [],
+    restore: null,
+    idleTimeout: "unset",
+    gpu: "unset",
+    gpuProto: { type: 0, count: 0, gpuType: "" },
+    cpuLimit: "unset",
+    memoryLimit: "unset",
+    pty: "unset",
+    regions: "unset",
+    proxy: "unset",
+    readinessProbe: "unset",
+    environmentVariables: "unset",
+    network: {
+      access: "OPEN",
+      outboundCidrs: [],
+      outboundDomains: [],
+      inboundCidrs: [],
+      i6pn: false,
+    },
+    volumes: [],
+    cloudBucketMounts: [],
+    secrets: [],
+    ports: [],
+    cloud: "",
+    verbose: false,
+    includeOidcIdentityToken: false,
+    experimentalOptions: {},
+    experimentalOptionsV2: {},
+    customDomain: "",
+  }),
+);
+
+export const ModalNativePreparationRecipeV2 = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      version: z.literal(1),
+      recipeId: z.literal("modal-native-fresh-v1"),
+      recipeRevision: z.literal(1),
+      createWorkdir: z.literal("/tmp"),
+      entrypoint,
+      normalization: ModalNativeFreshNormalizationV1,
+      compilerFingerprint: z.literal(MODAL_NATIVE_FRESH_COMPILER_FINGERPRINT),
+    })
+    .strict(),
+);
+export type ModalNativePreparationRecipeV2 = z.infer<typeof ModalNativePreparationRecipeV2>;
+
+export const MODAL_NATIVE_PREPARATION_RECIPE_V2 = freezeLiteral(
+  ModalNativePreparationRecipeV2.parse({
+    version: 1,
+    recipeId: "modal-native-fresh-v1",
+    recipeRevision: 1,
+    createWorkdir: "/tmp",
+    entrypoint: ["sleep", "infinity"],
+    normalization: MODAL_NATIVE_FRESH_NORMALIZATION_V1,
+    compilerFingerprint: MODAL_NATIVE_FRESH_COMPILER_FINGERPRINT,
+  }),
+);
+
+/** Exactly the old reservation vocabulary, NOT an extension to its keys. */
+export const ModalNativeFreshBlueprintV1 = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      version: z.literal(1),
+      adapterId: z.literal("modal-native-fresh-creator-reservation-v1"),
+      create: z
+        .object({
+          operationId: uuid,
+          appId: z.string().regex(/^ap-[A-Za-z0-9_-]{1,200}$/u),
+          imageId: z.string().regex(/^im-[A-Za-z0-9_-]{1,200}$/u),
+          cpu: z
+            .number()
+            .positive()
+            .max(128)
+            .refine(
+              (v) =>
+                Number.isSafeInteger(Math.trunc(v * 1000)) &&
+                Math.trunc(v * 1000) >= 1 &&
+                Math.trunc(v * 1000) / 1000 === v,
+            ),
+          memoryMiB: z.number().int().min(128).max(1048576).safe(),
+          timeoutSeconds: z.number().int().min(1).max(86400).safe(),
+          env: empty,
+          mounts: noItems,
+        })
+        .strict(),
+      restore: z.null(),
+      readiness: z
+        .object({
+          operationId: uuid,
+          execId: commandExecId,
+          commandArgs: z.tuple([z.literal("/bin/true")]),
+          workdir: z.literal("/tmp"),
+          env: empty,
+        })
+        .strict(),
+      publishOperationId: uuid,
+      cleanup: z
+        .object({ operationId: uuid, requires: z.literal("physical-terminal-proof") })
+        .strict(),
+    })
+    .strict(),
+);
+export type ModalNativeFreshBlueprintV1 = z.infer<typeof ModalNativeFreshBlueprintV1>;
+
+/** Full pre-election identity. routeEpoch is NOT the physical lease epoch;
+ * creatorId is NOT an elected owner or a replacement accepted attempt. */
+export const ModalNativeOriginalScopeV2 = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      version: z.literal(2),
+      declarationId: uuid,
+      planId: uuid,
+      creatorId: uuid,
+      accountId: uuid,
+      workspaceId: uuid,
+      sessionId: uuid,
+      turnId: uuid,
+      attemptId: uuid,
+      executionGeneration: positive,
+      triggerEventId: uuid,
+      sandboxGroupId: uuid,
+      routeKind: z.literal("home"),
+      routeTargetId: z.null(),
+      routeEpoch: nonnegative,
+    })
+    .strict()
+    .refine((v) => v.creatorId !== v.attemptId && v.creatorId !== v.planId, {
+      message: "A declared creator is distinct from the accepted attempt and plan",
+    }),
+);
+export type ModalNativeOriginalScopeV2 = z.infer<typeof ModalNativeOriginalScopeV2>;
+
+/** References must resolve through the complete protected scope/config join.
+ * They are neither credentials nor canonical/native authentication receipts. */
+export const ModalNativeConfigurationCaptureRefV2 = /* @__PURE__ */ defineSchema(() =>
+  z.object({ id: uuid, revision: positive }).strict(),
+);
+export type ModalNativeConfigurationCaptureRefV2 = z.infer<
+  typeof ModalNativeConfigurationCaptureRefV2
+>;
+export const ModalNativeProofGrantRefV2 = /* @__PURE__ */ defineSchema(() =>
+  z.object({ id: uuid, epoch: positive }).strict(),
+);
+export type ModalNativeProofGrantRefV2 = z.infer<typeof ModalNativeProofGrantRefV2>;
+export const ModalNativeReservedLeaseRefV2 = /* @__PURE__ */ defineSchema(() =>
+  z.object({ id: uuid, epoch: nonnegative }).strict(),
+);
+export type ModalNativeReservedLeaseRefV2 = z.infer<typeof ModalNativeReservedLeaseRefV2>;
+
+export const ModalNativePreparationDeclarationV2 = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      version: z.literal(2),
+      scope: ModalNativeOriginalScopeV2,
+      blueprint: ModalNativeFreshBlueprintV1,
+      preparationRecipe: ModalNativePreparationRecipeV2,
+      configurationCaptureRef: ModalNativeConfigurationCaptureRefV2,
+      proofGrantRef: ModalNativeProofGrantRefV2,
+      providerRecoveryCount: z.union([
+        z.literal(0),
+        z.literal(1),
+        z.literal(2),
+        z.literal(3),
+        z.literal(4),
+        z.literal(5),
+      ]),
+      namespaceState: z.literal("unbound"),
+    })
+    .strict()
+    .superRefine((v, ctx) => {
+      const ids = [
+        v.scope.planId,
+        v.scope.creatorId,
+        v.blueprint.create.operationId,
+        v.blueprint.readiness.operationId,
+        v.blueprint.readiness.execId,
+        v.blueprint.publishOperationId,
+        v.blueprint.cleanup.operationId,
+      ];
+      if (new Set(ids).size !== 7)
+        ctx.addIssue({
+          code: "custom",
+          message: "All seven supplied operation identities must be distinct",
+        });
+    }),
+);
+export type ModalNativePreparationDeclarationV2 = z.infer<
+  typeof ModalNativePreparationDeclarationV2
+>;
+
+const safeEndpoint = /* @__PURE__ */ defineSchema(() =>
+  z
+    .string()
+    .url()
+    .max(1024)
+    .refine(
+      (v) => {
+        try {
+          const url = new URL(v);
+          return (
+            url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash
+          );
+        } catch {
+          return false;
+        }
+      },
+      { message: "Only a credential-free captured HTTPS endpoint is supported" },
+    ),
+);
+
+/** Separate bind-once append, linked to the SAME captured configuration and
+ * claim. This deliberately has no invented immutable provider-principal ID.
+ * Only a trusted native issuer + authenticated host ingress can attest it. */
+export const ModalNativeNamespaceEvidenceV2 = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      version: z.literal(2),
+      scope: ModalNativeOriginalScopeV2,
+      configurationCaptureRef: ModalNativeConfigurationCaptureRefV2,
+      proofGrantRef: ModalNativeProofGrantRefV2,
+      claimId: uuid,
+      nonce: uuid,
+      claimRevision: positive,
+      recordRevision: positive,
+      captureId: uuid,
+      purpose: z.literal("original-namespace-read"),
+      reservation: ModalNativeReservedLeaseRefV2,
+      source: z.literal("modal-client-workspace-name-lookup-v1"),
+      responseField: z.enum(["workspaceName", "username"]),
+      binding: z
+        .object({
+          version: z.literal(1),
+          serverUrl: safeEndpoint,
+          workspaceName: z.string().min(1).max(200),
+          environment: z.string().max(200),
+        })
+        .strict(),
+    })
+    .strict(),
+);
+export type ModalNativeNamespaceEvidenceV2 = z.infer<typeof ModalNativeNamespaceEvidenceV2>;
+
+const claimFields = {
+  version: z.literal(2),
+  scope: ModalNativeOriginalScopeV2,
+  configurationCaptureRef: ModalNativeConfigurationCaptureRefV2,
+  proofGrantRef: ModalNativeProofGrantRefV2,
+  claimId: uuid,
+  nonce: uuid,
+  claimRevision: positive,
+  recordRevision: positive,
+  captureId: uuid,
+  expiresAt: z.string().datetime(),
+};
+
+/** Scheduling custody ONLY. No lease/task grant is fabricated to authorize
+ * this prerequisite lookup. A reserved lease supplies exclusion, not effects. */
+export const ModalNativeNamespaceReadClaimV2 = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      ...claimFields,
+      purpose: z.literal("original-namespace-read"),
+      reservation: ModalNativeReservedLeaseRefV2,
+    })
+    .strict(),
+);
+export type ModalNativeNamespaceReadClaimV2 = z.infer<typeof ModalNativeNamespaceReadClaimV2>;
+
+/** Exact original router command and authoritative prior cursors; no retarget,
+ * new TaskGet adoption, legacy locator, PTY, Start, stdin or process-cancel API. */
+export const ModalNativeOriginalCommandReadClaimV2 = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      ...claimFields,
+      purpose: z.literal("original-readiness-read"),
+      reservation: ModalNativeReservedLeaseRefV2,
+      physicalOwnerGeneration: positive,
+      operationId: uuid,
+      providerBindingKey: z.string().min(1).max(1024),
+      command: ModalRouterProviderCommand.refine((v) => v.pty !== true),
+    })
+    .strict(),
+);
+export type ModalNativeOriginalCommandReadClaimV2 = z.infer<
+  typeof ModalNativeOriginalCommandReadClaimV2
+>;
+
+/** Preserve the actual runtime descriptor's encoding/fingerprint domain. This
+ * is passive protobuf PREFLIGHT, not the RPC's transmitted bytes or permission. */
+export const ModalNativePreparedStartDescriptionV1 = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      taskId: z.string().min(1).max(200),
+      execId: commandExecId,
+      descriptorProtocol: z.literal("modal-prepared-start-descriptor"),
+      descriptorVersion: z.literal(1),
+      readinessRecipe: z.literal("modal-exec-readiness-bin-true-v1"),
+      readinessRecipeVersion: z.literal(1),
+      startMessage: z.literal("Start"),
+      rpcMethod: z.literal("/modal.task_command_router.TaskCommandRouter/TaskExecStart"),
+      encoderVersion: z.literal("protobufjs@7.6.5"),
+      preflight: z
+        .object({
+          encoding: z.literal("modal-start-protobuf-preflight-v1"),
+          sha256: digest,
+          byteLength: positive.max(1024 * 1024),
+          encoderFingerprint: z.string().regex(/^sha256:[a-f0-9]{64}$/u),
+        })
+        .strict(),
+    })
+    .strict(),
+);
+export type ModalNativePreparedStartDescriptionV1 = z.infer<
+  typeof ModalNativePreparedStartDescriptionV1
+>;
+
+/** Host/native acquisition objects are intentionally NOT constructed here.
+ * Raw DTOs, copied refs and any schema-success result cannot mint those objects.
+ * Capture needs issuer-authenticated OWN bytes, the exact original claim and a
+ * durable capture key; unknown ACK reconciles that same key/acquisition. */
+export type ModalNativeProofCaptureStatusV2 =
+  | { status: "committed"; captureId: string; receiptId: string; recordRevision: number }
+  | { status: "absent_fenced"; captureId: string }
+  | { status: "conflict"; captureId: string }
+  | { status: "unresolved"; captureId: string };

package/src/model-account-choice.ts

@@ -0,0 +1,177 @@
+import { defineSchema } from "./define-schema";
+import { z } from "zod";
+import { LatencyMode, ReasoningEffort } from "./index";
+
+/**
+ * A person's explicit model-account choice for a session and their own
+ * personal preferences (contract SUB-SEL-02, SUB-SEL-04, SUB-ELIG-05,
+ * SUB-OWN-05, D-24, D-27 and D-28), for every provider on the shared
+ * subscription core.
+ *
+ * The picker lists the shared accounts of the workspace's pool and the
+ * caller's own personal accounts (never another person's). A personal
+ * account can be chosen only by its owner, in their private session or
+ * Personal workspace, or for their own newly accepted sends in a shared
+ * session, while personal accounts are allowed there. Choosing never widens
+ * already accepted work; the database enforces the same authority boundary.
+ */
+const ProviderId = /* @__PURE__ */ defineSchema(() => z.string().regex(/^[a-z][a-z0-9_]{1,31}$/));
+
+/** Why a listed account cannot be chosen for this session. */
+export const ModelAccountChoiceRefusal = /* @__PURE__ */ defineSchema(() =>
+  z.enum([
+    "inactive",
+    "personal_not_allowed",
+    "personal_not_owner_work",
+    /** The session has no owner (for example a scheduled run started with an API key). */
+    "session_has_no_owner",
+  ]),
+);
+export type ModelAccountChoiceRefusal = z.infer<typeof ModelAccountChoiceRefusal>;
+
+/**
+ * Stored observation only, not a live check or a promise of available capacity.
+ * Source/time describe the snapshot, not each retained window. Windows can be
+ * partial, unknown or stale; a past reset does not prove replenishment.
+ */
+export const ModelAccountUsageSnapshot = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    observedAt: z.string().datetime().nullable(),
+    source: z.enum(["usage_endpoint", "response_headers", "refusal"]).nullable(),
+    windows: z.array(
+      z.object({
+        id: z.string(),
+        /** Null means unknown; values over 100 can represent overage. */
+        usedPercent: z.number().finite().nonnegative().nullable(),
+        resetsAt: z.string().datetime().nullable(),
+        status: z.enum(["ok", "warning", "exhausted", "unknown"]),
+      }),
+    ),
+    exhaustedUntil: z.string().datetime().nullable(),
+    exhaustedKind: z.enum(["quota", "rate_limit"]).nullable(),
+  }),
+);
+export type ModelAccountUsageSnapshot = z.infer<typeof ModelAccountUsageSnapshot>;
+
+export const ModelAccountChoiceOption = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    provider: ProviderId,
+    connectionId: z.string().uuid(),
+    label: z.string().nullable(),
+    accountEmail: z.string().nullable(),
+    planType: z.string().nullable(),
+    status: z.string(),
+    /** The caller's own personal account. */
+    personal: z.boolean(),
+    /** The workspace pool a shared account belongs to, or `personal`. */
+    source: z.enum(["workspace", "organization", "personal"]),
+    /** Models the account may serve (null: every model the provider offers). */
+    allowedModelIds: z.array(z.string()).nullable(),
+    choosable: z.boolean(),
+    refusal: ModelAccountChoiceRefusal.nullable(),
+    /** Omitted on older servers; null when this visible account has no decodable snapshot. */
+    usage: ModelAccountUsageSnapshot.nullable().optional(),
+  }),
+);
+export type ModelAccountChoiceOption = z.infer<typeof ModelAccountChoiceOption>;
+
+/** A session's binding for one provider: its explicit choice or its automatic placement. */
+const SessionModelAccountBinding = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    provider: ProviderId,
+    connectionId: z.string().uuid().nullable(),
+    choice: z.enum(["explicit", "automatic"]),
+  }),
+);
+
+/** Last lease-backed selection, not a queued choice or an unplaced proposal. */
+export const SessionModelAccountServing = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    turnId: z.string().uuid(),
+    provider: ProviderId,
+    connectionId: z.string().uuid().nullable(),
+    modelId: z.string().min(1),
+    preferredModelId: z.string().min(1),
+    reasoningEffort: z.lazy(() => ReasoningEffort),
+    latencyMode: z.lazy(() => LatencyMode),
+  }),
+);
+export type SessionModelAccountServing = z.infer<typeof SessionModelAccountServing>;
+
+export const SessionModelAccountChoiceResponse = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    /**
+     * The session's current account when it has bindings for one provider
+     * only: `explicit` after a person's choice, else the account automatic
+     * placement last used. Null when it has none, or bindings for several
+     * providers (see `bindings`). `connectionId` is null when the caller may
+     * not see that account.
+     */
+    binding: SessionModelAccountBinding.nullable(),
+    /** One binding per provider: a session keeps each provider's choice separately. */
+    bindings: z.array(SessionModelAccountBinding),
+    /** Omitted by older servers. Account identity is withheld under the same visibility rule. */
+    serving: SessionModelAccountServing.nullable().optional(),
+    accounts: z.array(ModelAccountChoiceOption),
+    personal: z.object({
+      /** Personal accounts are allowed in this workspace (effective setting). */
+      connectionsAllowed: z.boolean(),
+      /** Personal fallback is allowed in this workspace (effective setting). */
+      fallbackAllowed: z.boolean(),
+      /** The caller's own personal-fallback opt-in. */
+      fallbackOptIn: z.boolean(),
+    }),
+  }),
+);
+export type SessionModelAccountChoiceResponse = z.infer<typeof SessionModelAccountChoiceResponse>;
+
+/**
+ * A connection makes it the session's choice for that connection's provider;
+ * other providers' choices stay. `connectionId: null` returns the session to
+ * automatic account selection: only `provider`'s choice when given, else
+ * every provider's.
+ */
+export const SetSessionModelAccountChoiceRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({ connectionId: z.string().uuid().nullable(), provider: ProviderId.optional() })
+    .strict(),
+);
+export type SetSessionModelAccountChoiceRequest = z.infer<
+  typeof SetSessionModelAccountChoiceRequest
+>;
+
+export const SetSessionModelAccountChoiceResponse = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    changed: z.boolean(),
+    /** A waiting turn re-places now; otherwise the choice applies from the next turn. */
+    appliedTo: z.enum(["waiting_turn", "next_turn"]),
+    provider: ProviderId.nullable(),
+    connectionId: z.string().uuid().nullable(),
+    choice: z.enum(["explicit", "automatic"]),
+  }),
+);
+export type SetSessionModelAccountChoiceResponse = z.infer<
+  typeof SetSessionModelAccountChoiceResponse
+>;
+
+export const ModelAccountPreferences = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    /** Use my personal accounts when every shared account is exhausted, where allowed. */
+    personalFallbackOptIn: z.boolean(),
+    /** 0 before any preference was saved; pass it back as `expectedVersion`. */
+    version: z.number().int().nonnegative(),
+  }),
+);
+export type ModelAccountPreferences = z.infer<typeof ModelAccountPreferences>;
+
+export const UpdateModelAccountPreferencesRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      personalFallbackOptIn: z.boolean(),
+      expectedVersion: z.number().int().nonnegative().optional(),
+    })
+    .strict(),
+);
+export type UpdateModelAccountPreferencesRequest = z.infer<
+  typeof UpdateModelAccountPreferencesRequest
+>;