@fayegram-ai/decision-bridge 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 Notable user-facing changes by version.
 
+## 0.1.2
+
+- Add opt-in Jev images, typed bounding boxes, native JSON assets, and long context
+  across SDK and CLI, with capability preflight and nullable token usage.
+
 ## 0.1.1
 
 - Add OpenAI `default`/`luna` selectors and requested/resolved model metadata; improve CLI configuration and documentation.

package/README.md

@@ -29,7 +29,7 @@ embedded WAV/MP3 audio and MP4/WebM video, ordered images → audio → videos
 The common API checks provider/model capabilities before dispatch; refusals are
 errors.
 
-**Version 0.1.1 · Node.js 22.16+ or modern browsers (SDK) · ESM · zero runtime dependencies**
+**Version 0.1.2 · Node.js 22.16+ or modern browsers (SDK) · ESM · zero runtime dependencies**
 
 The npm package is
 [@fayegram-ai/decision-bridge](https://www.npmjs.com/package/@fayegram-ai/decision-bridge).
@@ -53,7 +53,7 @@ Use these model selectors with the built-in decision providers:
 | Cloudflare (`cloudflare-decisions`) | `clef-flash`, `@cf/cloudflare/clef-flash` | — |
 | Cloudflare (`cloudflare-decisions`) | `clef-omni`, `@cf/cloudflare/clef-omni` | — |
 
-`jev-latest` is Jev's default alias. Jev also accepts explicit model IDs available through your TypeSafe account;
+`jev-latest` is Jev's default alias. Jev also accepts `jev-preview` and explicit model IDs available through your TypeSafe account;
 use `bridge.listModels()` or the CLI `models` command to inspect that catalog.
 The bridge does not maintain a static list of Jev versions. A moving alias or a
 catalog entry does not guarantee inference access or reproducible model quality.
@@ -80,7 +80,7 @@ All native providers support shared state and the common `choice`, `noul`, and
 
 | Provider | Additional supported features | Guide |
 | --- | --- | --- |
-| Jev | Native decisions through the TypeSafe API | [Provider reference](docs/reference/PROVIDERS.md#native-jev) |
+| Jev | Native decisions, opt-in images, boxes, and long context through TypeSafe | [Jev guide](docs/guides/JEV.md) |
 | OpenAI Decisions | Ordered text/images, typed choices, labelled scores, safety identifiers, native access | [OpenAI Decisions](docs/guides/OPENAI_DECISIONS.md) |
 | Cloudflare Clef / Clef-flash | Embedded images before text, typed choices, labelled scores, native access, Workers AI binding, optional Gateway | [Cloudflare decisions](docs/guides/CLOUDFLARE_DECISIONS.md) |
 | Cloudflare Clef-omni | The same decision and transport features, plus embedded audio/video | [Omni media and limits](docs/guides/CLOUDFLARE_DECISIONS.md#omni-audio-and-video) |

package/docs/README.md

@@ -17,7 +17,7 @@ validated, structured decisions.
 For provider-specific input forms, consult the
 [capability comparison](reference/PROVIDERS.md#common-request-capabilities).
 The common bridge API and dedicated native APIs have separate request shapes;
-the OpenAI and Cloudflare guides cover both.
+the Jev, OpenAI and Cloudflare guides cover both.
 
 ## Use the bridge
 
@@ -27,6 +27,7 @@ the OpenAI and Cloudflare guides cover both.
 | [Browser integration](guides/BROWSER.md) | Direct browser use, CORS requirements, and credential exposure |
 | [Platforms](guides/PLATFORMS.md) | Windows, macOS, and Linux setup |
 | [Switching models](guides/SWITCHING_MODELS.md) | Backend and model selection |
+| [Jev](guides/JEV.md) | Common/native images, boxes, experimental long context, model selection, and CLI opt-ins |
 | [OpenAI Decisions](guides/OPENAI_DECISIONS.md) | Model selectors and upstream targets, selection metadata, common/native access, ordered images, and typed values |
 | [Cloudflare Clef / Clef-flash / Clef-omni](guides/CLOUDFLARE_DECISIONS.md) | Common/native decisions, embedded images and Omni audio/video, REST and Workers AI binding, busy-mode compatibility, and optional Gateway |
 | [Customization](guides/CUSTOMIZATION.md) | Questions, templates, extensions, and policies |

package/docs/development/ARCHITECTURE.md

@@ -38,7 +38,7 @@ Application / CLI
   application policy / storage / downstream action
 ```
 
-Native OpenAI and Cloudflare providers also expose `createDecision` directly.
+Native Jev, OpenAI and Cloudflare providers also expose `createDecision` directly.
 Common and native paths share provider validation, codecs, and bounded transport.
 Direct native calls use provider deadlines; bridge calls additionally enforce the
 shared evaluation deadline and extension lifecycle.
@@ -82,6 +82,7 @@ See [OpenAI model selection](../guides/OPENAI_DECISIONS.md#model-selection).
 | `schemas/decision.config.schema.json` | Shipped CLI configuration structure and editor support |
 | `src/providers/` | API orchestration, model profiles, preflight, codecs, bounded image/audio/video inspection, and transports |
 | `src/providers/openai-profile.mjs`, `src/providers/decisions-preflight.mjs` | Release-owned OpenAI selection, capabilities, and preparation of selected and outgoing requests |
+| `src/providers/jev-profile.mjs`, `src/providers/jev-preflight.mjs`, `src/providers/jev-images.mjs` | Jev experimental policy, common/native assets, and image preflight |
 | `src/embedded.mjs` | Shared embedded data URL and canonical base64 checks |
 | `src/transport.mjs`, `src/response-transport.mjs` | Credential destinations, bounded bodies, safe errors, retries |
 | `src/async.mjs` | Deadlines and cancellation races |
@@ -102,7 +103,8 @@ claiming equivalent statistical semantics across models.
 
 The bridge takes result-validation policy from the provider contract. Cloudflare
 uses an allowance for four-decimal distributions; other built-ins retain the
-baseline. Response metadata cannot relax validation. See the [SDK reference](../reference/SDK.md).
+baseline. Jev additionally permits explicitly unknown token counts while requiring
+native confidence. Response metadata cannot relax validation. See the [SDK reference](../reference/SDK.md).
 Application code passes that precision explicitly when using `decideChoice`; the
 policy helper does not infer it from the answer or its metadata.
 

package/docs/guides/BROWSER.md

@@ -35,6 +35,9 @@ headers used by the SDK. For Jev evaluation those include `POST`, `Authorization
 and `Content-Type`. If the preflight is rejected, the browser sends no evaluation
 request; neither the SDK nor a browser setting can override that server policy.
 Check your intended origin with TypeSafe before relying on direct Jev calls.
+When Jev experimental features are enabled, CORS must also permit the selected
+`TypeSafe-Danger-Zone-Images` and `TypeSafe-Danger-Zone-Long-Context` headers.
+The [Jev guide](JEV.md) covers browser-safe embedded assets and boxes.
 
 Any key delivered to browser JavaScript can be read by the app's users. Only use
 a credential that the provider explicitly permits for browser exposure. If an

package/docs/guides/GETTING_STARTED.md

@@ -25,7 +25,7 @@ You can also install a verified local archive, replacing the path below. See
 a source checkout:
 
 ```bash
-npm install /path/to/fayegram-ai-decision-bridge-0.1.1.tgz
+npm install /path/to/fayegram-ai-decision-bridge-0.1.2.tgz
 ```
 
 The installed package contains the SDK, declarations, command runner, examples,

package/docs/guides/JEV.md

@@ -0,0 +1,174 @@
+# Jev images, boxes, and long context
+
+Jev uses TypeSafe's native `POST /v1/systemone` endpoint. The SDK defaults to
+`jev-latest`; `jev-preview` and explicit version IDs are also accepted. Model
+listing is account-specific and may list aliases without versioned IDs.
+The returned `model` records the service-reported version independently of
+`meta.requestedModel`.
+
+## Experimental opt-ins
+
+Jev images and long context are disabled by default. Enable each independently
+in provider configuration. TypeSafe treats these capabilities as experimental;
+their accuracy, formats, and limits can change.
+
+```javascript
+import { createBridge, JevProvider, box, noul } from '@fayegram-ai/decision-bridge';
+
+const provider = new JevProvider({
+    model: 'jev-1.14.0',
+    dangerZone: { images: true, longContext: true },
+});
+const bridge = createBridge({ provider });
+
+// imageBase64 is a caller-prepared PNG or JPEG, without a data URL prefix.
+const result = await bridge.evaluate({
+    input: [
+        { type: 'text', text: 'A photograph from the kitchen camera.' },
+        { type: 'image', dataUrl: 'data:image/png;base64,' + imageBase64 },
+    ],
+    questions: {
+        present: noul('Is there a coffee mug in the image?'),
+        mug: box('The coffee mug in the image'),
+    },
+});
+console.log(result.answers.present.noul, result.answers.mug.box);
+```
+
+`dangerZone.images` sends `TypeSafe-Danger-Zone-Images: true` and enables common
+image input and boxes. It works with Jev 1.13 and 1.14 for images. Boxes require
+`jev-preview` or a pinned Jev version of 1.14.0 or newer. Local box capability
+lookup remains conservative for moving stable aliases and unknown model names;
+use a supported pinned ID or `jev-preview` for boxes. Account access and hosted
+model availability are still checked by the service.
+
+`dangerZone.longContext` sends `TypeSafe-Danger-Zone-Long-Context: true`. TypeSafe
+documents 262k tokens for both the per-request and per-question contexts with
+this header, compared with default limits of 64k and 32k respectively. This
+option works on Jev 1.13 and 1.14. It does not change the byte budget or estimate
+token counts. Longer contexts are slower and less accurate.
+
+Ordered common input becomes a state array in the same order. Text stays text;
+each image becomes an asset reference. The SDK chooses references that do not
+collide with the input or question text. Jev does not support image detail
+controls: omit `detail`, or use `null` or `auto`. Audio/video, typed choices,
+labelled scores, and safety identifiers remain unsupported by this provider.
+
+## Native assets in instructions and criteria
+
+Use `provider.createDecision()` when images belong inside structured state,
+instructions, or criteria. It accepts the native JSON request shape and returns
+`{ decision, meta }`. Native calls share validation, transport, cancellation,
+and retry policy with common calls, and bypass bridge extensions and observers.
+
+```javascript
+const { decision, meta } = await provider.createDecision({
+    state: { photo: 'photo-unique-reference' },
+    assets: {
+        'photo-unique-reference': {
+            type: 'image', format: 'png', data_base64: imageBase64,
+        },
+        'example-unique-reference': {
+            type: 'image', format: 'jpg', data_base64: exampleBase64,
+        },
+    },
+    questions: {
+        same: noul('Does the object in `photo` match this picture: example-unique-reference?'),
+        target: box('The matching object in `photo`'),
+    },
+});
+console.log(decision.answers.target.box, meta.requestedModel);
+```
+
+References are substituted in string values, including inside sentences and
+nested JSON. Object keys are not substituted. Every asset must be referenced.
+Whole-value references are resolved first. In longer strings, matches are
+consumed from left to right; when keys overlap at the same position, the current
+API uses asset-map order. A reference hidden by another match does not count as
+used. Preflight rejects unused assets before dispatch. Place references in
+separate values when both images are intended.
+Use long unique references (for example, fresh UUIDs) that cannot accidentally
+match ordinary text. Each reference is at most 1024 UTF-8 bytes; all reference
+keys together are at most 65536 bytes. A file is uploaded once, but repeating
+its reference repeats the image in the model's expanded input.
+
+The bridge uses the JSON/base64 transport supported by TypeSafe. It does not
+accept multipart `part` assets, read local image files, fetch URLs, resize,
+rotate, or re-encode images. Base64 overhead counts toward the request limit.
+Native Jev assets are separate from the common request shape; use
+`createDecision` for images embedded in instructions or criteria.
+
+## Boxes and results
+
+`box(instructions)` takes no criteria. Its answer has `type: 'box'`, `box`,
+and native `confidence`. Coordinates are fractions measured from the top-left:
+`left` and `right` scale with width; `top` and `bottom` scale with height.
+All four values must be finite numbers in 0–1, with `left < right` and
+`top < bottom`. Validation rejects malformed boxes rather than repairing them.
+Common results containing box questions use result `meta.schemaVersion: 4`;
+the CLI configuration schema version remains 1.
+
+Each question returns one box. There is no absent-target result: a box is
+returned even when the target is absent. Pair it with a presence `noul` and
+choose your own presence/confidence thresholds using representative images.
+Jev token usage may be `null`; that means unknown, never zero. Native confidence
+and all other result checks remain enforced.
+
+## Image and request limits
+
+- PNG or JPEG (`png`, `jpg`, `jpeg`); still images only. Animated PNG is rejected.
+- At most 16 MiB per decoded image file.
+- Each dimension is 256–1568 pixels, and area is 78,400–2,458,624 pixels.
+  A 256 × 256 image fails the area minimum.
+- Jev requests default to a 32 MiB serialized JSON ceiling. `maxRequestBytes`
+  can lower it, but cannot exceed 32 MiB. Response budgets remain independently
+  configurable, with an 8 MiB default.
+- State, each instruction, and each criterion must fit 64 nested JSON levels.
+  General bridge snapshots also retain their 200,000-node limit.
+
+Preflight checks base64, headers, dimensions, PNG animation, references, original
+image bytes, and serialized request bytes. Full decoding, server re-encoding,
+the 32 MiB processed-image and expanded-input limits, and token limits remain
+service checks. Client header inspection cannot predict processed sizes.
+Prepare upright pixels yourself: TypeSafe removes metadata and does not apply
+EXIF orientation. No separate image-count cap is asserted by the bridge;
+`maxImages: null` means size and context determine capacity.
+
+## CLI
+
+```json
+{
+    "schemaVersion": 1,
+    "provider": "jev",
+    "model": "jev-1.14.0",
+    "apiKeyEnv": "TYPESAFE_API_KEY",
+    "dangerZone": { "images": true, "longContext": true }
+}
+```
+
+```shell
+decision-bridge validate request.json --config decision.config.json
+decision-bridge evaluate request.json --config decision.config.json --env-file .env
+decision-bridge validate native.json --native --model jev-preview --jev-images
+decision-bridge batch native.jsonl --native --config decision.config.json --env-file .env
+```
+
+Common/native validation is offline and uses the same preflight as inference.
+`--native` works with `init`, `validate`, `evaluate`, and `batch`. Jev keeps its
+`models` command. CLI JSON/JSONL input supports requests up to 32 MiB per record;
+the actual serialized request must also fit the configured provider ceiling.
+
+`--jev-images` / `--no-jev-images` and `--jev-long-context` /
+`--no-jev-long-context` override independent fields in `dangerZone`.
+`DECISION_JEV_IMAGES` and `DECISION_JEV_LONG_CONTEXT` accept exactly `true` or
+`false`. Flags override environment, then JSON configuration, then defaults.
+Switching providers discards Jev-specific settings; using these flags with
+another provider is a configuration error.
+
+## Protocol sources
+
+- [TypeSafe release announcement](https://typesafe.ai/blog/jev-1-14)
+- [Images, assets, limits, and experimental header](https://docs.typesafe.ai/images)
+- [Box questions and absence behavior](https://docs.typesafe.ai/primitives/box)
+- [Models, aliases, and context limits](https://docs.typesafe.ai/models)
+- [JavaScript SDK compatibility changes](https://docs.typesafe.ai/sdk/javascript/changelog)

package/docs/guides/PLATFORMS.md

@@ -22,7 +22,7 @@ compatible native Node runtime. See [testing](../development/TESTING.md).
 Open PowerShell at the cloned repository or extracted source directory:
 
 ```powershell
-cd "C:\path\to\decision-bridge-0.1.1"
+cd "C:\path\to\decision-bridge-0.1.2"
 node --version
 node bin/decision.mjs validate examples/request.json
 Copy-Item .env.example .env
@@ -48,7 +48,7 @@ the archive rather than reusing generated `node_modules` or executable shims.
 ## macOS / Linux
 
 ```bash
-cd "/path/to/decision-bridge-0.1.1"
+cd "/path/to/decision-bridge-0.1.2"
 node --version
 node bin/decision.mjs validate examples/request.json
 cp .env.example .env

package/docs/reference/CLI.md

@@ -51,6 +51,12 @@ there is no CLI binding selector. Gateway settings route the selected REST reque
 | `models` | List the configured provider's models; may be paginated |
 | `batch FILE\|-` | Stream JSONL inputs and ordered JSONL result/error records |
 
+Jev supports both common and `--native` requests for evaluation, validation,
+initialization, and ordered batches. Experimental images/boxes require
+`--jev-images`, and longer context requires `--jev-long-context` (or matching
+JSON configuration). Use `--no-jev-images` and `--no-jev-long-context` to
+override enabled settings. See the [Jev guide](../guides/JEV.md).
+
 No input filename on `evaluate`, `validate`, or `schema` selects the bundled sample,
 not stdin. Use `-` explicitly for stdin. Empty invocation prints help. Configuration
 and credential errors do not cause fallback to another backend.
@@ -91,6 +97,8 @@ later configuration changes to control selection.
 | `--provider NAME` | `jev`, `openai-decisions`, `cloudflare-decisions`, `custom-decision`, `custom-generative` |
 | `--preset NAME` | custom-generative preset: `openai-compatible`, `openrouter`, or `anthropic`; exclusive with module |
 | `--native` | Explicit native Decisions input/output; init/evaluate/validate/batch only |
+| `--jev-images`, `--no-jev-images` | Enable/disable experimental Jev images and boxes |
+| `--jev-long-context`, `--no-jev-long-context` | Enable/disable experimental Jev 262k context |
 | `--model SELECTOR` | Model selector or supported upstream ID; overrides input JSON model and configured default |
 | `--base-url URL` | Custom endpoint; requires explicit credential selection |
 | `--api-key-env NAME` | Environment variable name, never the key itself |
@@ -172,7 +180,10 @@ delivery needs separate validation.
 
 ## I/O and resource limits
 
-Single JSON input: **8 MiB**. JSONL: **8 MiB per line, 64 MiB total**. Config:
+Single JSON input normally uses **8 MiB**. JSONL normally uses **8 MiB per line,
+64 MiB total**. Jev permits **32 MiB** for a single JSON input or JSONL record,
+then checks serialized requests against its configured ceiling (32 MiB by default).
+Config:
 **1 MiB**. Environment file: **64 KiB**. Provider request and response default to
 8 MiB each, configurable to at most 64 MiB. Cloudflare reads single JSON inputs
 and individual JSONL records within 64 MiB, then applies model-specific serialized

package/docs/reference/CONFIGURATION.md

@@ -46,10 +46,11 @@ profile. Gateway configuration is optional for either SDK transport and for CLI
 | `noAuth` | Boolean; true only for loopback OpenAI-compatible endpoints |
 | `timeoutMs` | Positive integer up to 2,147,483,647 milliseconds |
 | `maxRetries` | Integer 0–10; OpenAI/Cloudflare default 0; Jev and generative presets default 2 |
-| `maxRequestBytes`, `maxResponseBytes` | Positive integer through 64 MiB; default 8 MiB. Cloudflare requests: Clef/Clef-flash default/cap 13 MiB; Omni default 36 MiB, configurable through 64 MiB |
+| `maxRequestBytes`, `maxResponseBytes` | Positive integer through 64 MiB; default 8 MiB. Jev requests default/cap 32 MiB. Cloudflare requests: Clef/Clef-flash default/cap 13 MiB; Omni default 36 MiB, configurable through 64 MiB |
 | `accountId` | Cloudflare REST account ID; otherwise `CLOUDFLARE_ACCOUNT_ID` |
 | `rejectIfBusy` | Cloudflare boolean; default false, incompatible with retries. Effective true fails REST preflight with `UNSUPPORTED_CAPABILITY`; see the [binding support and REST limitation](../guides/CLOUDFLARE_DECISIONS.md#capacity-rejection-and-ai-gateway) |
 | `gateway` | Cloudflare Gateway object; see the [Cloudflare guide](../guides/CLOUDFLARE_DECISIONS.md) |
+| `dangerZone` | Jev-only `{ images?: boolean, longContext?: boolean }`; both default false; see the [Jev guide](../guides/JEV.md) |
 | `maxTokens` | Generative output budget, 1–1,048,576; default 4096 |
 | `responseFormat` | Compatible generative presets: `json_schema`, `json_object`, `text` |
 | `tokenParameter` | Compatible generative presets: `max_completion_tokens` or `max_tokens` |
@@ -58,6 +59,10 @@ profile. Gateway configuration is optional for either SDK transport and for CLI
 | `options` | Custom factory's JSON options, e.g. its own baseURL |
 
 Upper numeric limits validate client configuration, not vendor model capabilities.
+Jev requests default to and are capped at 32 MiB; a smaller `maxRequestBytes`
+lowers that ceiling. `DECISION_JEV_IMAGES` and `DECISION_JEV_LONG_CONTEXT`
+accept `true` or `false`; their CLI overrides are `--jev-images`,
+`--no-jev-images`, `--jev-long-context`, and `--no-jev-long-context`.
 Cloudflare selects its byte budget from the effective request model, including
 per-call overrides. An explicit smaller `maxRequestBytes` remains the ceiling;
 selecting Omni cannot enlarge it. Omni's default is a bridge policy, not a

package/docs/reference/PROVIDERS.md

@@ -44,7 +44,7 @@ contract. The following additional forms are checked before dispatch:
 
 | Provider | Ordered text / embedded images | Typed string/boolean choices | Labelled score levels | Safety identifier | Model listing |
 | --- | --- | --- | --- | --- | --- |
-| Jev | Unsupported | Unsupported | Unsupported | Unsupported | Supported |
+| Jev | Ordered text; images with explicit opt-in | Unsupported | Unsupported | Unsupported | Supported |
 | OpenAI Decisions | Supported; up to 128 images, preserving order | Supported | Supported | Supported | Unsupported |
 | Cloudflare Clef / Clef-flash | Supported; up to four images before text | Supported | Supported; 2–10 levels | Unsupported | Unsupported |
 | Cloudflare Clef-omni | Supported; up to four images before audio/video/text | Supported | Supported; 2–10 levels | Unsupported | Unsupported |
@@ -62,7 +62,11 @@ capability fields `audio`, `videos`, `maxAudioClips`, and `maxVideos` normalize
 false/zero when omitted, preserving legacy custom profiles. Cloudflare's older
 models and all other shipped providers reject audio/video before inference.
 
-Dedicated `createDecision()` access is available on OpenAI Decisions and
+Jev additionally supports `box` questions on `jev-preview` and pinned 1.14+ models
+when `dangerZone.images` is enabled. Other built-ins reject box questions.
+See the [Jev guide](../guides/JEV.md) for asset placement and experimental opt-ins.
+
+Dedicated `createDecision()` access is available on Jev, OpenAI Decisions and
 Cloudflare providers. It uses each service's native request/response shape and
 bypasses bridge preparation and observation hooks.
 
@@ -74,6 +78,12 @@ intermediate language model, skill, portal prompt, or chat conversion is used.
 `GET /v1/models` lists native models. A listed catalog can differ from valid aliases;
 `jev-latest` is the documented stable alias.
 
+`jev-preview` selects the preview release. Images and longer context require
+explicit `dangerZone` settings. Common image input preserves ordering; native
+`createDecision()` additionally accepts JSON assets referenced in state,
+instructions, and criteria. Box outputs preserve normalized edges and confidence.
+See the [Jev guide](../guides/JEV.md) for limits and absence handling.
+
 Pin a version after evaluating it for your workload rather than assuming a moving
 alias yields reproducible quality. Store the returned `model` along with the
 requested model and your question-template revision.

package/docs/reference/SDK.md

@@ -48,7 +48,7 @@ guides. These are SDK options, not per-evaluation bridge options.
 | --- | --- |
 | `timeoutMs` | 30,000 ms; positive integer through 2,147,483,647; one transport budget for dispatch, retries, backoff, and response reading |
 | `maxRetries` | Additional eligible attempts, 0–10; Jev and generative presets default to 2, native OpenAI and Cloudflare to 0 |
-| `maxRequestBytes` | Complete serialized request ceiling; normally 8 MiB, configurable from 1 byte through 64 MiB; Cloudflare applies its [model-specific budgets](../guides/CLOUDFLARE_DECISIONS.md#embedded-images-and-limits) |
+| `maxRequestBytes` | Complete serialized request ceiling; normally 8 MiB, configurable from 1 byte through 64 MiB; Jev defaults to and caps at 32 MiB; Cloudflare applies its [model-specific budgets](../guides/CLOUDFLARE_DECISIONS.md#embedded-images-and-limits) |
 | `maxResponseBytes` | 8 MiB; configurable from 1 byte through 64 MiB; applies while reading the response body |
 | `fetchImpl` | Optional `(url: string, init?: RequestInit) => Promise<Response>`; defaults to the runtime's `fetch` |
 
@@ -146,6 +146,10 @@ const q3 = score('How far did processing progress?', [
 ]);
 ```
 
+`box(instructions)` returns a box question with no criteria; supported providers
+must declare `boxes: true`. Jev supports it with experimental image opt-in and
+a supported model; see [Jev images and boxes](../guides/JEV.md).
+
 Builders return immutable question objects. `choice(instructions, criteria)` accepts
 a label map containing 1 to 255 options. `noul(instructions, criteria?)` accepts an
 optional criteria object,
@@ -201,7 +205,8 @@ rubric exactly. Generative providers calculate score and legend locally. Native
 values are validated and preserved, not normalized or replaced.
 
 **Usage:** `input_tokens` and `output_tokens` are nonnegative integers or null.
-Jev, OpenAI Decisions, and Cloudflare require reported integer counts. OpenAI and
+Jev accepts explicitly null counts as unknown; OpenAI Decisions and Cloudflare
+require reported integer counts. OpenAI and
 Anthropic cache creation/read counts are preserved separately when provided;
 Cloudflare does not fabricate cache or total-token fields. No total price, inferred cache saving, or
 estimated token count is fabricated.
@@ -231,7 +236,8 @@ unavailable metadata exists. Result objects and nested data returned by the brid
 are immutable. Standalone validation functions return snapshots, not frozen values.
 
 `schemaVersion` remains 1 for legacy requests and 2 for ordered images/text or
-richer question forms. Audio/video requests use 3. This result version is separate
+richer question forms. Audio/video requests use 3; requests with boxes use 4.
+This result version is separate
 from the CLI configuration schema, which remains 1.
 
 ## Extensions
@@ -304,6 +310,8 @@ automatic model fallback. The CLI has a separate streaming JSONL implementation.
 - `createProvider(config)`: factory requiring an explicit `type` equal to `jev`,
   `openai-decisions`, or `cloudflare-decisions`.
 - `JevProvider`, `OpenAIDecisionsProvider`, `CloudflareDecisionsProvider`: native provider classes.
+- `box(instructions)` and `JevProvider.createDecision(request, options?)`:
+  bounding boxes and native JSON assets; see the [Jev guide](../guides/JEV.md).
 - `scoreLevels(instructions, levels)` and the array overload of `choice`:
   labelled rubrics and typed string/boolean options, with provider capability checks.
 - `OpenAIDecisionsProvider.createDecision(request, options?)`: dedicated native
@@ -314,9 +322,9 @@ automatic model fallback. The CLI has a separate streaming JSONL implementation.
   an own `input.model` property or an explicitly supplied default; inherited
   models are ignored, and it never selects a Jev model.
   Question builders and schema generation validate without selecting an inference model.
-- `validateResult(input, questions, { native = false, probabilityDecimalPlaces })`: snapshot supplied
+- `validateResult(input, questions, { native = false, nullableUsage = false, probabilityDecimalPlaces })`: snapshot supplied
   questions and validate the canonical result; native mode requires confidence
-  and reported counts.
+  and reported counts unless the provider explicitly enables nullable usage.
 - `decideChoice(answer, { minProbability, minMargin = 0, abstainOptions = [], probabilityDecimalPlaces })`:
   returns a policy result, never executes an action. `minProbability` is required.
 - `DecisionError`, `publicError(error)`: public structured failure handling.

package/docs/reference/SOURCES.md

@@ -11,6 +11,10 @@ reference does not imply that authenticated inference was run against its servic
 | TypeSafe request/response API | https://docs.typesafe.ai/api |
 | TypeSafe JavaScript examples | https://docs.typesafe.ai/sdk/javascript |
 | Native model listing and aliases | https://docs.typesafe.ai/models |
+| Jev image assets and experimental opt-in | https://docs.typesafe.ai/images |
+| Jev bounding boxes | https://docs.typesafe.ai/primitives/box |
+| Jev 1.14 release | https://typesafe.ai/blog/jev-1-14 |
+| Jev nullable usage compatibility | https://docs.typesafe.ai/sdk/javascript/changelog |
 | Choice decisions | https://docs.typesafe.ai/primitives/choice |
 | Noul probabilities | https://docs.typesafe.ai/primitives/noul |
 | Score rubric and weighted expectation | https://docs.typesafe.ai/primitives/score |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fayegram-ai/decision-bridge",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "JavaScript SDK and CLI for structured decisions across native decision APIs and configurable model providers",
   "repository": {
     "type": "git",

package/schemas/decision.config.schema.json

@@ -29,13 +29,27 @@
                     "$ref": "#/$defs/retries"
                 },
                 "maxRequestBytes": {
-                    "$ref": "#/$defs/bytes"
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 33554432
                 },
                 "maxResponseBytes": {
                     "$ref": "#/$defs/bytes"
                 },
                 "provider": {
                     "const": "jev"
+                },
+                "dangerZone": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "properties": {
+                        "images": {
+                            "type": "boolean"
+                        },
+                        "longContext": {
+                            "type": "boolean"
+                        }
+                    }
                 }
             }
         },

package/src/capabilities.mjs

@@ -2,6 +2,7 @@ import { DecisionError, requireCondition as check } from './errors.mjs';
 import { cloneJson, freezeJson, isRecord } from './validation.mjs';
 import { CLOUDFLARE_MODELS } from './providers/cloudflare-profile.mjs';
 import { openaiModelProfile } from './providers/openai-profile.mjs';
+import { jevFeatures } from './providers/jev-profile.mjs';
 
 /** Conservative defaults preserve the pre-existing custom-provider contract. */
 export const LEGACY_CAPABILITIES = freezeJson({
@@ -9,6 +10,7 @@ export const LEGACY_CAPABILITIES = freezeJson({
     labeledScores: false, safetyIdentifier: false,
     maxImages: 0, maxChoiceOptions: 255, maxScoreLevels: 10,
     audio: false, videos: false, maxAudioClips: 0, maxVideos: 0,
+    boxes: false,
 });
 
 const CLOUDFLARE_CAPABILITIES = freezeJson({
@@ -16,7 +18,9 @@ const CLOUDFLARE_CAPABILITIES = freezeJson({
     labeledScores: true, safetyIdentifier: false, maxImages: 4, maxChoiceOptions: 255, maxScoreLevels: 10,
 });
 
-export function builtInCapabilities(type, model) {
+export function builtInCapabilities(type, model, options = {}) {
+    if (type === 'jev') return freezeJson({ ...LEGACY_CAPABILITIES,
+        ...jevFeatures(model, Object.hasOwn(options, 'dangerZone') ? options.dangerZone : undefined) });
     if (type === 'cloudflare-decisions') {
         const key = typeof model === 'string' ? model.trim().replace(/^@cf\/cloudflare\//, '') : '';
         const profile = Object.hasOwn(CLOUDFLARE_MODELS, key) ? CLOUDFLARE_MODELS[key] : undefined;
@@ -45,7 +49,7 @@ export function providerCapabilities(provider, model) {
     check(isRecord(profile) && Object.keys(profile).every(key => Object.hasOwn(LEGACY_CAPABILITIES, key)),
         'Invalid capability profile.', 'CONFIGURATION_ERROR');
     const result = { ...LEGACY_CAPABILITIES, ...profile };
-    for (const key of ['supported', 'orderedInput', 'images', 'typedChoices', 'labeledScores', 'safetyIdentifier', 'audio', 'videos']) {
+    for (const key of ['supported', 'orderedInput', 'images', 'typedChoices', 'labeledScores', 'safetyIdentifier', 'audio', 'videos', 'boxes']) {
         check(typeof result[key] === 'boolean', 'Capability flags must be boolean.', 'CONFIGURATION_ERROR');
     }
     for (const key of ['maxImages', 'maxChoiceOptions', 'maxScoreLevels', 'maxAudioClips', 'maxVideos']) {
@@ -75,6 +79,7 @@ export function assertCapabilities(request, capabilities) {
     }
     if (Object.hasOwn(request, 'safetyIdentifier')) requireFeature(capabilities.safetyIdentifier, 'safetyIdentifier');
     for (const q of Object.values(request.questions)) {
+        if (q.type === 'box') requireFeature(capabilities.boxes, 'box questions');
         if (q.options) requireFeature(capabilities.typedChoices, 'typed choices');
         if (q.levels) requireFeature(capabilities.labeledScores, 'labelled scores');
         const choices = q.options?.length ?? (q.type === 'choice' ? Object.keys(q.criteria).length : 0);
@@ -86,6 +91,7 @@ export function assertCapabilities(request, capabilities) {
 }
 
 export function commonSchemaVersion(request) {
+    if (Object.values(request.questions).some(q => q.type === 'box')) return 4;
     if (request.input?.some(part => ['audio', 'video'].includes(part.type))) return 3;
     return Object.hasOwn(request, 'input') || Object.hasOwn(request, 'safetyIdentifier') ||
         Object.values(request.questions).some(q => q.options || q.levels) ? 2 : 1;

package/src/cli/config-validation.mjs

@@ -2,13 +2,14 @@ import { requireCondition as check } from '../errors.mjs';
 import { cloneJson, isRecord } from '../validation.mjs';
 import { cloudflareGateway, validateCloudflareLimits } from '../providers/cloudflare-profile.mjs';
 import { generationOptions } from '../custom/generative/shared.mjs';
+import { jevDangerZone, jevRequestLimit } from '../providers/jev-profile.mjs';
 
 export const PROVIDERS = ['jev', 'openai-decisions', 'cloudflare-decisions', 'custom-decision', 'custom-generative'];
 export const PRESETS = ['openai-compatible', 'openrouter', 'anthropic'];
 export const TRANSPORT = ['baseURL', 'maxRetries', 'maxRequestBytes', 'maxResponseBytes'];
 export const GENERATION = ['maxTokens', 'responseFormat', 'tokenParameter', 'parameters', 'noAuth'];
 export const PROVIDER_FIELDS = [...TRANSPORT, ...GENERATION, 'apiKeyEnv', 'model', 'preset', 'module',
-    'options', 'accountId', 'rejectIfBusy', 'gateway'];
+    'options', 'accountId', 'rejectIfBusy', 'gateway', 'dangerZone'];
 const FIELDS = new Set(['$schema', 'schemaVersion', 'provider', 'timeoutMs', ...PROVIDER_FIELDS]);
 export const NUMERIC = new Set(['timeoutMs', 'maxRetries', 'maxRequestBytes', 'maxResponseBytes', 'maxTokens']);
 export const KEY_ENVS = { jev: 'TYPESAFE_API_KEY', 'openai-decisions': 'OPENAI_API_KEY',
@@ -56,7 +57,14 @@ export function validateConfig(input, { complete = false } = {}) {
     check(config.module === undefined || ['custom-decision', 'custom-generative'].includes(config.provider),
         'module requires custom-decision or custom-generative.', 'CONFIGURATION_ERROR');
     check(config.options === undefined || isModule(config), 'options requires a custom provider module.', 'CONFIGURATION_ERROR');
+    // Validate nested shape even when a partial file omits its provider selector.
+    if (Object.hasOwn(config, 'dangerZone')) config.dangerZone = jevDangerZone(config.dangerZone);
     if (config.provider !== undefined) {
+        if (config.provider !== 'jev') check(!Object.hasOwn(config, 'dangerZone'),
+            'dangerZone requires Jev.', 'CONFIGURATION_ERROR');
+        else {
+            jevRequestLimit(config.maxRequestBytes);
+        }
         if (config.provider !== 'cloudflare-decisions') check(['accountId', 'rejectIfBusy', 'gateway'].every(key => config[key] === undefined),
             'Cloudflare settings require cloudflare-decisions.', 'CONFIGURATION_ERROR');
         else {